Where to Go Next

Ansible for Proxmox VE · Module 07

credativ GmbH

What you built in 3.5 hours

~/ansible-proxmox/
├── ansible.cfg
├── requirements.yml
├── site.yml
├── inventory/
│   ├── hosts.yml              # the three nodes
│   ├── lab.proxmox.yml        # everything else, from the API
│   └── group_vars/
├── playbooks/
│   ├── 20-cluster.yml         # forms the cluster
│   └── 30-operations.yml            # storage, users, guests, backup
└── roles/pve_node/            # the reusable part

Summary

Proxmox VE

1. A cluster is a state you describe: quorum, one join at a time, and an API that answers before the node is a member
2. /etc/pve is cluster-wide. pmxcfs distributes it — root’s authorized_keys included
3. Storage, users and tokens are state too. Least privilege: a scoped token, not the root password
4. The API viewer is where module options come from, and what to reach for when one is missing

Ansible, as far as that needed

5. Describe the target state rather than the steps; changed=0 is a test result
6. A module beats a command — and when there is none, write the guard yourself

What we did not cover

Topic	Where it belongs
Ceph, HA, SDN, QDevice	Proxmox VE Clustering & Shared Storage
Cloud-init images, golden templates	a VM lifecycle workshop
AWX / Ansible Automation Platform, Semaphore	an Ansible operations workshop
Molecule, CI for roles	an Ansible testing workshop
Ansible for the guests inside the VMs	a general Ansible course

The obvious next step

Your playbooks currently run from your laptop. That works exactly as long as it is only you.

• Git first: the repository is the source of truth, not a directory
• CI second: run ansible-lint and --check on every merge request
• AWX / AAP or Semaphore third: scheduled runs, an audit trail, credentials that live somewhere other than a developer’s home directory

In that order.

Still curious?

The bonus exercises go further than the workshop had time for:

• make the backup task idempotent
• scope the API token to a resource pool
• build a scheduled backup job with ansible.builtin.uri
• turn the guest into a template and clone from it
• let Proxmox tags drive a play
• write a read-only health check playbook

Solutions included. They assume the state you have right now.

Where to look things up

• Ansible: https://docs.ansible.com/ansible/latest/
• The collection: https://docs.ansible.com/ansible/latest/collections/community/proxmox/
• Proxmox VE: https://pve.proxmox.com/pve-docs/
• The API of your own cluster: https://<node>:8006/pve-docs/api-viewer/
• Offline, always correct for your version: ansible-doc <module>

Bookmark the third and the fifth. Those are the two you will actually use.

Feedback

• What was too fast, what was too slow?
• What did you expect that did not happen?
• What would you have cut to get more of something else?

Afterwards, and for anything longer: alexander.wirt@credativ.de

Thank you

Questions, discussion, and code:

• All slides, handouts, labs, and reference code in code/ are yours to keep
• credativ GmbH · https://www.credativ.de