Manage your Raspberry Pi fleet with Ansible

The Raspberry Pi is a small, versatile gadget that makes interfacing with the actual world a breeze for mere mortals. The Raspberry Pi Foundation’s concept was to promote the units at such a low price that breaking one could be unhappy—however not a catastrophe. This is one motive it has been an enormous success as an educational tool. But their usefulness has not escaped the enterprise world, the place they’re changing into a invaluable instrument for automating the bodily world.

Whether they’re used for powering data shows, automating testing, controlling equipment, monitoring an atmosphere, or doing different duties, enterprises see Raspberry Pis as severe units for doing severe duties. Each mannequin has an extended product lifecycle—even the older fashions (1B+, 2B, 3A+, 3B, and 3B+) will stay in manufacturing till not less than January 2026. There is little threat that they are going to go out of date, so you may preserve a sufficiently massive inventory and deal with them as modular elements that you simply change reasonably than repair.

Stable hardware vs. altering software program

While you may depend on the hardware to stay fixed, the identical isn’t true for the software program. The Raspberry Pi’s official supported working system is Raspberry Pi OS (beforehand known as Raspbian), and it ought to be up to date repeatedly to get the most recent security and bug fixes.

This presents an issue. Because Raspberry Pis present a bridge between the bodily and digital worlds, they’re usually put in in difficult-to-reach places. They additionally are typically put in by hardware of us, sometimes electricians for vegetation and meeting technicians for merchandise. You don’t wish to waste their time by requiring them to attach a keyboard and monitor, log in to run raspi-config, set up software program with apt-get, after which configure the software program.

Since Raspberry Pi OS boots off an SD card, one method is to at all times preserve an up-to-date model of the software program on the SD card that the installer can simply plug (and sizzling glue) in. high quality assurance (QA) division will hold the SD playing cards below model management, so that you may be assured that every one new installations are on the most recent launch. But this answer is expensive to keep up since each software program replace requires making ready a brand new picture and burning it to all of the SD playing cards. It additionally would not handle repair all of your current units. In some circumstances, you could have to create customized photos for particular Raspberry Pis doing particular jobs, and it could be unavoidable that you simply want an installer to attach a keyboard and monitor to configure one thing.

A greater method is to make use of the identical minimal base working system set up after which use network boot to keep up all of the customizations and updates on the community. This requires sustaining only one base picture, which is simpler to handle, so it’s a good method when you have a dependable community infrastructure. Unfortunately, not all networks help this methodology; because the Raspberry Pi’s community boot documentation says: “Due to the huge range of networking devices available, we can’t guarantee that network booting will work with any device.” Sadly, it’s now not an choice on the Raspberry Pi 4. Furthermore, this isn’t an choice when units are disconnected from the community for an extended time period.

The higher objective, subsequently, is to supply a standard base Raspberry Pi OS picture that does not change usually however, as soon as it is put in, can routinely be custom-made, maintained, and managed remotely.

Create the bottom picture

Your base picture will nearly definitely want small modifications from the default Raspberry Pi OS picture. Fortunately, you solely have to recreate the base picture if the Raspberry Pi OS picture is up to date or it’s essential to change one thing in your configuration. The typical time between main variations of Raspberry Pi OS is about two years, which is an efficient goal upkeep lifecycle. It offers you loads of time to swap out older units for brand spanking new ones whereas conserving issues manageable for the QA division to keep up releases. Older variations will nonetheless be supported for safety and bug fixes for some time after that.

On my Hacker Public Radio episode Safely enabling SSH in the default Raspbian image in 2017, I walked via the steps to automate updating the bottom picture. The script I created:

• Downloads the most recent picture ZIP file
• Verifies it’s legitimate
• Extracts the picture itself
• Enables SSH for safe distant administration
• Changes the default passwords for the foundation and Pi customers
• Secures the SSH server on the Pi

Since then, I’ve augmented the script to:

• Enable connections to a WiFi community (wpa_supplicant.conf)
• Load its configuration from an INI file, conserving delicate data separate from the primary script.
• Use losetup to simplify mounting the picture
• Create a firstboot script

These modifications make sure that the units are locked down earlier than deploying them. You can discover an up to date model of the fix-ssh-on-pi script on GitHub.

Now is an efficient time to switch the script in your atmosphere and particularly so as to add any safety keys or digital certificates essential for authentication. However, it is best to carry off including any customized purposes or configurations at this level, as they are often added later. For probably the most half, the picture will behave like a generic Raspberry Pi OS picture, that means it’ll boot and resize the SD card as normal and set up the standard default software program and firmware.

The notable addition is help for a firstboot script. This is the glue that makes the Raspberry Pi run your customized configuration after the primary time it configures itself. Again, I encourage you to switch the script in your atmosphere. For instance, you may have the gadget register itself, run via a system check and diagnostic procedures, pull down a consumer software, and so forth.

If you do not wish to customise it, it’ll do the naked minimal wanted to get your Raspberry Pi on the community in order that it may be uniquely recognized by the network-management software program.

Set up computerized administration

If you are managing servers in a DevOps atmosphere, you will not blink an eye fixed on the concept of utilizing configuration management software to manage your Raspberry Pi units. If you utilize a instrument that requires an agent, you may embody the agent software program as a part of the bottom picture. Given the sources on the Raspberry Pi, although, an agentless answer corresponding to Ansible could be the most suitable choice. It simply makes use of SSH and Python, would not require any extra software program on the consumer, the management software program is straightforward to put in, and it’s simple to make use of.

All you want is the Ansible software, an inventory of units you wish to handle saved in an inventory file, and a playbook, which is a set of directions that you really want carried out. For instance, you may update the bottom Raspberry Pi OS picture utilizing the apt replace && apt full-upgrade equal apt module. The playbook could be:

  - title: Run the equal of "apt-get update" as a separate step
    apt:
      update_cache: true
      cache_valid_time: 3600
  - title: Update all packages to the most recent model
    apt:
      improve: dist

You might imagine putting in Ansible for Raspberry Pi is overkill, however I discover it’s worthwhile if it’s essential to handle greater than two or three computer systems. Using Ansible additionally offers you a extra hygienic community—your stock is audited and listed in its host file, software program installations are documented via its playbooks, and information and configurations are evaded their units, so they’re simpler to again up repeatedly.

According to Wikipedia, Ansible’s design targets embody:

• Minimal in nature. Management programs shouldn’t impose extra dependencies on the atmosphere.
• Consistent. With Ansible, one ought to be capable of create constant environments.
• Secure. Ansible doesn’t deploy brokers to nodes. Only OpenSSH and Python are required on the managed nodes.
• Highly dependable. When rigorously written, an Ansible playbook may be idempotent to forestall surprising uncomfortable side effects on the managed programs. It is solely doable to have a poorly written playbook that’s not idempotent.
• Minimal studying required. Playbooks use a straightforward and descriptive language primarily based on YAML and Jinja templates.

Anyone with the proper authorization can configure a tool, however you may restrict authorization utilizing normal Unix permissions. You can apply granular entry to playbooks in order that, for instance, check operators can entry simply the check and diagnostic instruments you put in.

How it really works

Imagine you’ve gotten a widget manufacturing facility that features a Raspberry Pi in its product. Your services staff additionally makes use of them to watch the environmental plant and safety. Likewise, the engineering staff makes use of the units on the manufacturing strains inside the manufacturing monitoring course of. And the IT division makes use of them as disposable dumb terminals to entry the pinnacle workplace enterprise useful resource planning (ERP) system. In all of those circumstances, downtime must be stored to a minimal.

We intention to ship the very same gadget with the very same picture to every of the groups.

Preparing the picture

Common to all levels is making ready the picture itself. After cloning the fix-ssh-on-pi.bash script from github, a one time motion is required to edit and rename the recordsdata fix-ssh-on-pi.ini_example to fix-ssh-on-pi.ini, and wpa_supplicant.conf_example to wpa_supplicant.conf.

You solely have to run the script any time that Raspberry Pi OS(Raspbian) is up to date, or while you modified your configuration recordsdata. I’d advocate together with this as a part of your devops workflow. If you don’t have that in place but then it may be automated utilizing a easy cron job.

I’d advocate having a Raspberry Pi Station devoted to burning the most recent SDCards within the retailer room. This would routinely burn the most recent picture from the community as soon as a brand new card is inserted into the external SD Card Reader. With some creativeness and a 3D printer, a pleasant unit could possibly be manufactured for giving suggestions on progress.

When a Raspberry Pi is requisitioned, the shop keepers can then take away one of many completed SDCards and embody it with the work order.

Inventory/Hosts File

In our fictitious instance, the position of the gadget will likely be decided by the placement of the community that it has linked to. Therefore we want to have the ability to establish Raspberry Pies as soon as they arrive onto the community. How you method this may solely rely on how your community is configured, and what instruments is obtainable to you. I’d advise listening to the episode by operat0r known as hpr3090 :: Locating Computers on a Enterprise Network for some nice tips about how to do that.

Each division would have their very own provisioning server operating the Ansible Software, which after all could possibly be one other Raspberry Pi. It is the usual unix/ssh permissions that dictate who has entry to what inside your group. In episode hpr3080 :: Ansible ping I walked via absolutely the fundamentals of putting in and troubleshooting Ansible. Since then klaatu added hpr3162 :: Introduction to Ansible which is a superb introduction to the subject basically.

How the provisioning server turns into conscious of the brand new units may be energetic or passive.

You might have the First Boot script actively calling a url to register itself. You would wish to have an internet software listening and utilizing the acquired data to register the brand new host within the Ansible Inventory.

This could be a superb method for departments the place units are changed sometimes and also you need them provisioned as quickly as doable. As an instance when a water high quality monitoring station will get changed, it might be a good suggestion to have it register. The Electrician might then choose the precise Playbook to deploy to the gadget through a sensible telephone app.

On the opposite hand a passive method could also be higher if you will be putting in units continually, like on a manufacturing line. In that case we are able to assume that any new units discovered on the manufacturing line community may have our check and diagnostic software program put in firstly of the road. This may also be eliminated routinely previous to delivery.

One of the modifications that fix-ssh-on-pi.bash does is that it renames the hostname of every Raspberry Pi to a model primarily based on it’s Ethernet MAC address. As an instance a Ethernet MAC address of dc:a6:32:01:23:45 will lead to a hostname of dca632012345.

When the Raspberry Pi finishes it’s first time boot sequence, the third computerized reboot will request a IP Address out of your DHCP server, that hostname will (most likely) change into obtainable within the workplace DNS community.

At this level your Raspberry Pi is accessible utilizing one thing like ssh dca632012345, ssh dca632012345.native, ssh dca632012345.lan, or in our instance ssh dca632012345.manufacturing.instance.com.

I included a small script on github to find Raspberry Pies primarily based on Ethernet MAC address. I mentioned this just lately on my Hacker Public Radio episode Locating computers on a network:

# ./put-pi-in-ansible-host.bash | tee all_pies.ini
[all_pies]
b827eb012345 ansible_host=192.168.1.123
dca632012345 ansible_host=192.168.1.127
b827eb897654 ansible_host=192.168.1.143
dca632897654 ansible_host=192.168.1.223

In my Ansible ping episode on Hacker Public Radio, I used a YAML stock file as an alternative of the INI model above.

Execute a playbook

Regardless of how the provisioning server turns into conscious of the units, you now know they exist. In this instance, you’ll deploy completely different playbooks primarily based on the subnet the gadget is in.

Perhaps the best playbook you may attempt is that this one (from Ansible ping and obtainable on GitHub):

- title: Test Ping
  hosts: all
  duties:
  - motion: ping

You ought to now have all the things it’s essential to talk with the brand new units:

ansible-playbook --inventory-file all_pies.ini ping-example-playbook.yaml

By modifying the playbook, you may replace and configure your units any manner you want. I take advantage of this to create customers, replace the system to the most recent model, add and take away software program, and do different configurations. There are a number of good examples obtainable about updating your programs, such because the Ansible apt update all packages on Ubuntu / Debian Linux tutorial.

At this level, the units stop to be generic. You will know the precise position every Raspberry Pi ought to have, and you’ll provision it as such. How customized it’s will rely on the playbook, however I counsel having a selected Ansible role for every job you want a Pi to do. For instance, even when your widget manufacturing facility has just one water-quality monitoring station, it is best to nonetheless outline a task for it. Not solely will this assist you to rapidly deploy an an identical alternative if essential, however you might be additionally documenting the method, which can be required for certifications corresponding to ISO 9000.

You now have the means to audit that updates to your community are in place and being achieved repeatedly. Hopefully, this may hold your units safe for a few years of service. This methodology additionally applies to merchandise you ship, as they are often up to date through hotspots operated by area service engineers. During common system upkeep, the Raspberry Pi is routinely up to date utilizing credentials equipped within the wpa_supplicant.conf file.

Make administration simpler

I hope this has opened your thoughts about deal with managing many units extra simply. All it’s essential to get began is your PC or laptop computer and a Raspberry Pi. The rules of burning a generic picture, creating a tool stock, and deploying a playbook are the identical whether or not you are engaged on a small scale or scaling as much as a whole lot of units.