# Ansible Automation for VyOS

> Automated VyOS deployment and configuration management with Ansible - playbooks for provisioning, network setup, CI/CD integration, and bulk operations

Source: https://opennix.org/en/docs/vyos/examples/ansible/


Ansible automation for VyOS configuration management, deployment, and maintenance.

## Scenario

- Infrastructure as Code: version-controlled configuration
- Mass Deployment: automated provisioning of multiple VyOS instances
- Consistency: uniform configuration across the fleet

## Ansible Inventory

```yaml
# inventory.yml
all:
  children:
    vyos_routers:
      hosts:
        vyos-gw-01:
          ansible_host: 10.10.1.1
        vyos-gw-02:
          ansible_host: 10.10.2.1
      vars:
        ansible_network_os: vyos
        ansible_connection: network_cli
        ansible_user: vyos
        ansible_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256...
```

## Ansible Playbook Example

```yaml
---
# vyos-config.yml
- name: Configure VyOS Routers
  hosts: vyos_routers
  gather_facts: false

  tasks:
    - name: Set hostname
      vyos_system:
        host_name: "{{ inventory_hostname }}"
        state: present

    - name: Configure interfaces
      vyos_interfaces:
        config:
          - name: eth0
            description: "WAN Interface"
            enabled: true
          - name: eth1
            description: "LAN Interface"
            enabled: true

    - name: Configure IP addresses
      vyos_l3_interfaces:
        config:
          - name: eth1
            ipv4:
              - address: 10.10.1.1/24

    - name: Configure OSPF
      vyos_ospfv2:
        config:
          router_id: "{{ ansible_host }}"
          areas:
            - area_id: 0.0.0.0
              networks:
                - address: 10.10.1.0/24

    - name: Save configuration
      vyos_config:
        save: yes
```

## Running Playbook

```bash
ansible-playbook -i inventory.yml vyos-config.yml

# Dry-run (check mode)
ansible-playbook -i inventory.yml vyos-config.yml --check

# Limit to specific hosts
ansible-playbook -i inventory.yml vyos-config.yml --limit vyos-gw-01
```

## Yandex/VK Cloud Integration

```yaml
# Deploy VyOS in Yandex Cloud with Terraform, then configure with Ansible
- name: Wait for VyOS boot
  wait_for:
    host: "{{ yandex_cloud_elastic_ip }}"
    port: 22
    timeout: 300

- name: Initial VyOS configuration
  vyos_config:
    src: templates/vyos-cloud-init.conf.j2
```

## Ansible Vault for Secrets

```bash
# Encrypt passwords
ansible-vault encrypt_string 'MySecretPassword' --name 'ansible_password'

# Edit vault file
ansible-vault edit secrets.yml

# Run with vault password
ansible-playbook -i inventory.yml vyos-config.yml --ask-vault-pass
```

## Best Practices

1. **Version Control**: Git repository for playbooks
2. **Templates**: Jinja2 templates for dynamic config
3. **Testing**: validate the configuration in a test environment first
4. **Idempotency**: playbooks must be idempotent
5. **Secrets**: use Ansible Vault for credentials

## References

- [Ansible VyOS Module](https://docs.ansible.com/ansible/latest/collections/vyos/vyos/index.html)
- [VyOS Ansible Example](https://docs.vyos.io/en/latest/automation/index.html)
- [Network Automation with Ansible](https://docs.ansible.com/ansible/latest/network/index.html)