Ansible automation for SAP - Issue and Best practices

Pratheek P

unread,

Oct 26, 2020, 2:38:08 AM10/26/20

to Ansible Project

Dear Ansible community,

I want to try out Ansible automation for SAP where we automate SAP start/stop, Oracle DB start/stop processes. I'm able to achieve this by creating playbooks, using become method to change user and establishing open SSH connection from root of Ansible control node to root of SAP managed host. Now I have a new requirement to use a non-root user in control node and managed host. However, I noticed that when I use the non-root user, I'm not able to get the correct environment variables required to start/stop SAP as <sid>adm user. I want to know what is the best way to achieve this and also about the best practices when it comes to automating SAP tasks using Ansible. Looking forward to your replies.

Best Regards,

Pratheek. P

Pratheek P

unread,

Oct 28, 2020, 4:52:51 AM10/28/20

to Ansible Project

Any updates on this please?

Best Regards,

Pratheek. P

Dick Visser

unread,

Oct 28, 2020, 5:43:56 AM10/28/20

to ansible...@googlegroups.com

https://docs.ansible.com/ansible/latest/user_guide/playbooks_environment.html

> --
> You received this message because you are subscribed to the Google Groups "Ansible Project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/3e4b6dc6-da53-499d-aa8c-d4767879e822n%40googlegroups.com.

--
Dick Visser
Trust & Identity Service Operations Manager
GÉANT

Pratheek P

unread,

Nov 4, 2020, 5:44:19 AM11/4/20

to Ansible Project

Thank you. Is there a way we can use non-root user and carry out administrative tasks in Ansible system? Also, what are the best practices for using Ansible in SAP?

Dick Visser

unread,

Nov 4, 2020, 11:25:28 AM11/4/20

to ansible...@googlegroups.com

On Wed, 4 Nov 2020 at 11:44, Pratheek P <prathee...@gmail.com> wrote:
>
> Thank you. Is there a way we can use non-root user and carry out administrative tasks in Ansible system?

Not sure what you mean.
Very generally speaking one should not be able to do administrative
tasks as a non-root user.

What do you mean by "Ansible system"? The controller node? Or the
managed node(s)?
You should not run ansible (playbooks) as root on the controller node,
as this is both not needed and insecure.

As for the managed nodes, it depends on the "administrative tasks" you
want to carry out.
Do they need privilege escalation (i.e. sudo etc)?

> Also, what are the best practices for using Ansible in SAP?

Ansible is "just" an automation tool, so this question basically
translates to "what are the best practices for administrating SAP?".
I don't know the answer to that, but given that SAP is commercial
software, that usually comes with documentation and support.
That would be the place where I would look.

Dick

> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/86debbba-1ecb-433d-9c4a-6b3b134df215n%40googlegroups.com.

Pratheek P

unread,

Nov 5, 2020, 6:32:14 AM11/5/20

to Ansible Project

Thank you for your response. What are the different use cases of Ansible in automating SAP related tasks? For example, I have automated the task of upgrading the SAP kernel using Ansible. The upgrade of SAP kernel involves starting, stopping SAP application from the command line and extracting a few packages, changing ownerships etc. These tasks are easily managed with the help of Ansible now.