auto_satellite.yml

---
- name: configure rhel workshop for webservers
  hosts: lab_hosts
  become: true
  gather_facts: false
  tasks:
    - name: configure RHEL webservers
      include_role:
        name: ../../roles/webservers

- name: configure satellite
  hosts: satellite
  become: true
  become_method: sudo
  environment:
    LANG: en_US.UTF-8
    LC_ALL: en_US.UTF-8
    TERM: linux
  gather_facts: false
  tasks:
    - name: configure satellite admin password
      command: "foreman-rake permissions:reset password={{ admin_password }}"
    - name: update hammer admin password in /root/.hammer/cli.modules.d/foreman.yml
      lineinfile:
        path: /root/.hammer/cli.modules.d/foreman.yml
        regexp: 'password'
        line: "  :password: '{{ admin_password }}'"
    - name: configure satellite dns
      become: false
      community.aws.route53:
        state: present
        zone: "{{ workshop_dns_zone }}"
        record: "{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}"
        type: A
        overwrite: true
        value: "{{ ansible_host }}"
        wait: true
      delegate_to: localhost
      when:
        - dns_type is defined
        - dns_type == 'aws'
    - name: create letsencrypt subdirectories
      file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
        mode: 0750
      with_items:
        - /etc/letsencrypt
        - /var/lib/letsencrypt
    - name: make sure httpd is stopped
      service:
        name: httpd.service
        state: stopped
      register: stop_httpd
      until: stop_httpd is not failed
      retries: 5
    # If this fails check out status of certbot: https://letsencrypt.status.io/
    - name: try to issue SSL certificate
      block:
        - name: Issue SSL cert
          shell: >
            podman run -it --rm --name certbot \
                -v "/etc/letsencrypt:/etc/letsencrypt" \
                -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
                -p 80:80 \
                -p 443:443 \
                docker.io/certbot/certbot:latest certonly \
                --key-type rsa \
                --rsa-key-size 4096 \
                --no-bootstrap \
                --standalone \
                -d {{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }} \
                --email ansible-network@redhat.com \
                --noninteractive \
                --agree-tos
          register: issue_sat_cert
          until: issue_sat_cert is not failed
          retries: 5
      rescue:
        - name: error with SSL cert
          debug:
            msg: "Unable to retrieve SSL cert, ERROR, continuing on without cert..."

        - name: append dns_information failure
          set_fact:
            dns_information:
              - "{{ dns_information }}"
              - "The Lets Encrypt certbot failed for the satellite node, please check https://letsencrypt.status.io/ to make sure the service is running"
    - name: download LetsEncrypt R3 cert
      get_url:
        url: https://letsencrypt.org/certs/lets-encrypt-r3.pem
        dest: "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}"
        mode: 0644
        checksum: sha256:177e1b8fc43b722b393f4200ff4d92e32deeffbb76fef5ee68d8f49c88cf9d32
        group: root
        owner: root
    - name: download LetsEncrypt root X1 cert
      get_url:
        url: https://letsencrypt.org/certs/isrgrootx1.pem
        dest: "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}"
        mode: 0644
        checksum: sha256:22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1
        group: root
        owner: root
    - name: retrieve LetsEncrypt R3 cert
      slurp:
        src: "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/lets-encrypt-r3.pem"
      register: intermediate_cert
    - name: retrieve LetsEncrypt root X1 cert
      slurp:
        src: "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/isrgrootx1.pem"
      register: root_cert
    - name: combine R3 and root X1 certs to create LetsEncrypt CA bundle
      template:
        src: cert_bundle.j2
        dest: "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/letsencrypt-ca-bundle.pem"
    - name: start httpd
      service:
        name: httpd.service
        state: started
      register: start_httpd
      until: start_httpd is not failed
      retries: 5
    - name: set original gold image hostname via hostnamectl
      command: >-
        hostnamectl set-hostname satellite.example.com
    - name: change satellite hostname
      shell: >-
        satellite-change-hostname {{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}
        -u admin -p {{ admin_password }} --skip-dns --assumeyes
      register: satellite_change_hostname
      #until: "'Success!' in satellite_change_hostname.stdout"
      failed_when: '"Success!" not in satellite_change_hostname.stdout'
    - name: update satellite with LetsEncrypt cert
      shell: >-
        satellite-installer --scenario satellite
        --certs-server-cert "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/fullchain.pem"
        --certs-server-key "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/privkey.pem"
        --certs-server-ca-cert "/etc/letsencrypt/live/{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}/letsencrypt-ca-bundle.pem"
        --certs-update-server --certs-update-server-ca
      register: satellite_update_cert
      #until: "'Success!' in satellite_update_cert.stdout"
      failed_when: '"Success!" not in satellite_update_cert.stdout'

- name: configure controller for auto_satellite
  hosts: control_nodes
  gather_facts: false
  vars:
    auto_satellite_project_scm_url: 'https://github.com/redhat-partner-tech/automated-satellite.git'
    auto_satellite_project_scm_branch: 'aap2'
    controller_infra_workloads:
      - redhat_cop.controller_configuration.credential_types
      - redhat_cop.controller_configuration.credentials
      - redhat_cop.controller_configuration.execution_environments
      - redhat_cop.controller_configuration.projects
      - redhat_cop.controller_configuration.inventories
      - redhat_cop.controller_configuration.inventory_sources
      - redhat_cop.controller_configuration.job_templates
      - redhat_cop.controller_configuration.workflow_job_templates
    controller_hostname: "https://{{ ansible_host }}"
    controller_username: admin
    controller_password: "{{ admin_password }}"
    controller_validate_certs: false
    controller_credential_types:
      - name: Satellite_Collection
        description: Credential for redhat.satellite collection
        kind: cloud
        inputs:
          fields:
            - type: string
              id: username
              label: Satellite Username
            - type: string
              id: password
              label: Satellite Password
              secret: true
            - type: string
              id: host
              label: Satellite Hostname
          required:
            - username
            - password
            - host
        injectors:
          env:
            SATELLITE_SERVER_URL: !unsafe '{{ host }}'
            SATELLITE_USERNAME: !unsafe '{{ username}}'
            SATELLITE_PASSWORD: !unsafe '{{ password }}'
            SATELLITE_VALIDATE_CERTS: 'false'
      - name: GitHub_Personal_Access_Token
        description: Credential for GitHub repo operations automation
        kind: cloud
        inputs:
          fields:
            - type: string
              id: personal_access_token
              label: Personal Access Token
              secret: true
              help_text: GitHub Personal Access Token
              multiline: true
          required:
            - personal_access_token
        injectors:
          env:
            MY_PA_TOKEN: !unsafe '{{ personal_access_token }}'
    controller_credentials:
      - name: Satellite Credential
        credential_type: Satellite_Collection
        state: present
        organization: Default
        inputs:
          host: "https://{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}"
          username: 'admin'
          password: "{{ admin_password }}"
      - name: Inventory Credential
        credential_type: Red Hat Satellite 6
        state: present
        organization: Default
        inputs:
          host: "https://{{ student }}-sat.{{ ec2_name_prefix|lower }}.{{ workshop_dns_zone }}"
          username: 'admin'
          password: "{{ admin_password }}"
    controller_projects:
      - name: Automated Management
        organization: Default
        scm_update_on_launch: true
        scm_update_cache_timeout: 3600
        scm_type: git
        scm_url: "{{ auto_satellite_project_scm_url }}"
        scm_branch: "{{ auto_satellite_project_scm_branch }}"
        default_environment: auto_satellite workshop execution environment
      - name: Fact Scan
        organization: Default
        scm_type: git
        scm_url: 'https://github.com/ansible/awx-facts-playbooks.git'
    controller_templates:
      - name: SETUP / Satellite
        project: Automated Management
        playbook: setup_satellite.yml
        inventory: Workshop Inventory
        credentials:
          - Satellite Credential
          - Workshop Credential
        extra_vars:
          refresh_satellite_manifest: false
        ask_variables_on_launch: true
      - name: SETUP / Controller
        project: Automated Management
        playbook: setup_controller.yml
        inventory: Workshop Inventory
        credentials:
          - Controller Credential
        execution_environment: auto_satellite controller iac execution environment
    controller_execution_environments:
      - name: auto_satellite controller iac execution environment
        image: quay.io/s4v0/ee-automated-smart-mgmt-aap2-dev:latest

  tasks:
    - name: Deploy controller-infra workloads
      include_role:
        name: "{{ controller_infra_vars }}"
      loop: "{{ controller_infra_workloads }}"
      loop_control:
        loop_var: controller_infra_vars
      when:
        - controller_infra_workloads | d("") | length >0

- name: Final workshop preparations
  hosts: control_nodes
  become: true
  gather_facts: true

  tasks:

    - when: provision_mode == "workshop"
      block:
        - name: Run SETUP / Satellite job template
          awx.awx.job_launch:
            job_template: "SETUP / Satellite"
            extra_vars:
              refresh_satellite_manifest: true
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: setupsatjob

        - name: "Check API until SETUP / Satellite job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ setupsatjob.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates01
          until: workshop_job_templates01.json.status == "successful"
          delay: 20  # Every 20 seconds
          retries: 45  # 15 minutes 15*60/20

    - when: provision_mode == "demo"
      block:
        - name: Run SETUP / Satellite job template
          awx.awx.job_launch:
            job_template: "SETUP / Satellite"
            extra_vars:
              refresh_satellite_manifest: true
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: setupsatjob

        - name: "Check API until SETUP / Satellite job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ setupsatjob.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates01
          until: workshop_job_templates01.json.status == "successful"
          delay: 20  # Every 20 seconds
          retries: 45  # 15 minutes 15*60/20

        - name: Run SETUP / Controller job template
          awx.awx.job_launch:
            job_template: "SETUP / Controller"
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: setupcontroljob

        - name: "Check API until SETUP / Controller job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ setupcontroljob.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates02
          until: workshop_job_templates02.json.status == "successful"
          delay: 20  # Every 20 seconds
          retries: 15  # 5 minutes 5*60/20

        - name: Run SATELLITE / RHEL - Publish Content View job template
          awx.awx.job_launch:
            job_template: "SATELLITE / RHEL - Publish Content View"
            extra_vars:
              env: Dev
              content_view: RHEL7
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: rhelpubcvjob01

        - name: "Check API until SATELLITE / RHEL - Publish Content View job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ rhelpubcvjob01.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates03
          until: workshop_job_templates03.json.status == "successful"
          delay: 20  # Every 20 seconds
          retries: 10  # 3.33 minutes 3.33*60/20

        - name: Run SATELLITE / RHEL - Promote Content View job template
          awx.awx.job_launch:
            job_template: "SATELLITE / RHEL - Promote Content View"
            extra_vars:
              content_view: RHEL7
              current_lifecycle_environment: RHEL7_Dev
              lifecycle_environment: RHEL7_QA
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: rhelpromotecvjob01

        - name: "Check API until SATELLITE / RHEL - Promote Content View job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ rhelpromotecvjob01.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates04
          until: workshop_job_templates04.json.status == "successful"
          delay: 15  # Every 15 seconds
          retries: 8  # 2 minutes 2*60/15

        - name: Run SATELLITE / RHEL - Publish Content View job template
          awx.awx.job_launch:
            job_template: "SATELLITE / RHEL - Publish Content View"
            extra_vars:
              env: Dev
              content_view: RHEL7
            controller_username: admin
            controller_password: "{{ admin_password }}"
            controller_host: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}"
          register: rhelpubcvjob02

        - name: "Check API until SATELLITE / RHEL - Publish Content View job is successful"
          ansible.builtin.uri:
            url: "https://{{ student }}.{{ ec2_name_prefix }}.{{ workshop_dns_zone }}/api/v2/jobs/{{ rhelpubcvjob02.id }}/?format=json"
            user: admin
            password: "{{ admin_password }}"
            force_basic_auth: true
            method: GET
            return_content: true
            status_code: 200
            validate_certs: false
          register: workshop_job_templates05
          until: workshop_job_templates05.json.status == "successful"
          delay: 20  # Every 20 seconds
          retries: 10  # 3.33 minutes 3.33*60/20