forked from redhat-cop/agnosticd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
azure_infrastructure_deployment.yml
366 lines (330 loc) · 11.1 KB
/
azure_infrastructure_deployment.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
---
- name: Step 001 Deploy Infrastructure
hosts: localhost
connection: local
gather_facts: false
become: false
tags:
- step001
- deploy_infrastructure
environment:
AZURE_CLIENT_ID: "{{azure_service_principal}}"
AZURE_TENANT: "{{azure_tenant}}"
AZURE_SECRET: "{{azure_password}}"
AZURE_SUBSCRIPTION_ID: "{{azure_subscription_id}}"
# AZURE_CONFIG_DIR: create a specific config dir for this stack to allow concurrent access
AZURE_CONFIG_DIR: "/tmp/.azure-{{project_tag}}"
tasks:
- name: Ensure az is installed
environment:
PATH: /usr/bin
command: which az
register: az_result
- name: Fail if az not available
fail:
msg: you need azure-cli installed
when: az_result is failed
- set_fact:
t_dest: "{{output_dir}}/{{ env_type }}.{{ guid }}.{{cloud_provider}}_cloud_template"
params_dest: "{{output_dir}}/{{project_tag}}-cloud_template_parameters.json"
tags:
- azure_infrastructure_deployment
- validate_azure_template
- gen_azure_template
- name: Azure Generate Resource manager template
template:
src: "../configs/{{ env_type }}/files/cloud_providers/{{cloud_provider}}_cloud_template.j2"
dest: "{{t_dest}}"
tags:
- azure_infrastructure_deployment
- validate_azure_template
- gen_azure_template
# use command line 'az' to validate template and deploy
- name: Login to Azure
command: >-
az login --service-principal
-u "{{azure_service_principal}}"
-p {{azure_password}}
--tenant {{azure_tenant}}
environment:
PATH: /usr/bin
tags:
- validate_azure_template
- create_inventory
- must
- name: Create the resource group
tags:
- azure_infrastructure_deployment
- validate_azure_template
azure_rm_resourcegroup:
name: "{{ az_resource_group }}"
location: "{{ azure_region }}"
- name: Check for auto-generated SSH Key
stat:
path: "{{output_dir}}/{{env_authorized_key}}"
register: env_authorized_key_status
tags:
- check_for_env_keys
- name: Get SSH public key
set_fact:
ssh_key: "~/.ssh/{{key_name}}.pem"
ssh_key_data: "{{lookup('file', '~/.ssh/{{key_name}}.pub')}}"
tags:
- set_existing_ssh_key
- must
- create_inventory
when: not env_authorized_key_status.stat.exists
- name: Get SSH public key
set_fact:
ssh_key: "{{output_dir}}/{{env_authorized_key}}"
ssh_key_data: "{{lookup('file', '{{output_dir}}/{{env_authorized_key}}.pub')}}"
tags:
- set_generated_ssh_key
- must
- create_inventory
when: env_authorized_key_status.stat.exists
- name: Setting windows_password variable
set_fact:
windows_password: "{{hostvars['localhost'].generated_windows_password}}"
when:
- windows_password is not defined
- generated_windows_password is defined
- name: Check if the parameter file exists
stat:
path: "{{params_dest}}"
register: params_dest_status
- name: Build parameter file
copy:
content: |
{
"adminUsername": { "value": "{{remote_user}}" },
"sshKeyData": { "value": "{{ssh_key_data}}"},
"DNSZone": { "value": "{{HostedZoneId}}"},
"guid": { "value": "{{guid}}"},
}
dest: "{{params_dest}}"
when: not params_dest_status.stat.exists
tags:
- azure_infrastructure_deployment
- validate_azure_template
- name: Validate arm template
environment:
PATH: /usr/bin
command: >-
az group deployment validate
--template-file {{t_dest}}
--resource-group {{az_resource_group}}
--parameters @{{params_dest}}
changed_when: false
tags:
- azure_infrastructure_deployment
- validate_azure_template
- name: ARM Group deployment create
environment:
PATH: /usr/bin
command: >-
az group deployment create
--name {{env_type}}.{{guid}}
--template-file {{t_dest}}
--resource-group {{az_resource_group}}
--parameters @{{params_dest}}
register: az_deploy
tags:
- azure_infrastructure_deployment
- az_rm_deploy
until: az_deploy is succeeded
retries: 0
- debug:
var: az_deploy
verbosity: 2
tags:
- azure_infrastructure_deployment
- name: Fetch DNS zone NS entries
azure_rm_dnsrecordset_facts:
zone_name: "{{guid}}.{{HostedZoneId}}"
resource_group: "{{az_resource_group}}"
record_type: NS
relative_name: '@'
register: subzone_ns
tags:
- azure_infrastructure_deployment
when:
- HostedZoneId != "none"
- debug:
var: subzone_ns
verbosity: 2
tags:
- azure_infrastructure_deployment
- name: Add delegation for NS to the main DNSZone
azure_rm_dnsrecordset:
resource_group: "{{az_dnszone_resource_group|default('dns')}}"
relative_name: "{{guid}}"
zone_name: "{{HostedZoneId}}"
record_type: NS
state: present
records: "{{ subzone_ns | json_query('ansible_facts.azure_dnsrecordset[0].properties.NSRecords[*].{entry: nsdname}') }}"
tags:
- azure_infrastructure_deployment
when:
- HostedZoneId != "none"
- name: Run infra-azure-create-inventory Role
import_role:
name: infra-azure-create-inventory
# Copy env_vars variables from the config to all hosts
- import_playbook: ../include_vars.yml
# TODO: use common infra role instead of this playbook
- name: Configure local ssh config for bastion proxy use
import_playbook: "{{cloud_provider}}_ssh_config_setup.yml"
when: groups["bastions"] is defined and (groups["bastions"]|length>0)
tags:
- must
- create_inventory
- name: wait_for_connection for all non-windows machines and set hostname
hosts:
- all:!windows:!network
gather_facts: false
become: true
tags:
- step001
- wait_ssh
- set_hostname
tasks:
- name: wait for linux host to be available
wait_for_connection:
timeout: 300
register: rwait
ignore_errors: true
- name: restart instance if wait_for_connection failed
become: false
environment:
AZURE_CLIENT_ID: "{{azure_service_principal}}"
AZURE_TENANT: "{{azure_tenant}}"
AZURE_SECRET: "{{azure_password}}"
AZURE_SUBSCRIPTION_ID: "{{azure_subscription_id}}"
# AZURE_CONFIG_DIR: create a specific config dir for this stack to allow concurrent access
AZURE_CONFIG_DIR: "/tmp/.azure-{{project_tag}}"
command: "az vm restart --resource-group {{az_resource_group}} --name '{{inventory_hostname}}'"
delegate_to: localhost
when: rwait is failed
- name: wait for linux host to be available (retry)
wait_for_connection:
when: rwait is failed
- ping:
register: rping
retries: 3
delay: 10
until: rping is succeeded
# < get internal domain name for later use
- name: Get internal fqdn
command: domainname -d
register: internalfqdn_r
changed_when: false
- name: NetworkManager get active interface uuid
command: nmcli --get-values UUID connection show --active
register: result_active_uuid
changed_when: false
- name: set fact internal_azure_dns_suffix for later use
set_fact:
internal_azure_dns_suffix: "{{internalfqdn_r.stdout}}"
nm_active_connection: "{{result_active_uuid.stdout}}"
- name: Stat /etc/cloud/cloud.cf file
stat:
path: /etc/cloud/cloud.cfg
register: cloud_cfg_file
- name: disable updating hostname in /etc/cloud/cloud.cfg
lineinfile:
dest: /etc/cloud/cloud.cfg
regexp: 'update_hostname$'
line: '# - update_hostname'
backup: yes
when: cloud_cfg_file.stat.exists
tags: disable_cloud_cfg_hostname
- name: Populate /etc/hosts
lineinfile:
dest: /etc/hosts
regexp: ' {{hostvars[item].internaldns}}$'
line: '{{hostvars[item].private_ip_address}} {{hostvars[item].internaldns}}'
with_items: "{{ groups['all'] }}"
- name: Set facts for Windows hosts if any exist and wait_for_connection
gather_facts: false
hosts:
- windows
tasks:
- name: set facts for remote access
set_fact:
ansible_become: false
ansible_connection: winrm
ansible_host: "{{ public_dns_name }}"
ansible_password: "{{ windows_password | default(hostvars['localhost'].generated_windows_password) }}"
ansible_port: 5986
ansible_user: "{{ remote_user | default('Administrator') }}"
ansible_winrm_server_cert_validation: ignore
- name: wait for windows host to be available
wait_for_connection:
timeout: 900
connect_timeout: 60
delay: 120
register: rwait
ignore_errors: true
- name: restart instance if wait_for_connection failed
become: false
environment:
AZURE_CLIENT_ID: "{{azure_service_principal}}"
AZURE_TENANT: "{{azure_tenant}}"
AZURE_SECRET: "{{azure_password}}"
AZURE_SUBSCRIPTION_ID: "{{azure_subscription_id}}"
# AZURE_CONFIG_DIR: create a specific config dir for this stack to allow concurrent access
AZURE_CONFIG_DIR: "/tmp/.azure-{{project_tag}}"
command: "az vm restart --resource-group {{az_resource_group}} --name '{{inventory_hostname}}'"
delegate_to: localhost
when: rwait is failed
- name: wait for windows host to be available (retry)
wait_for_connection:
timeout: 900
connect_timeout: 60
delay: 120
when: rwait is failed
- name: Detect and map data disks for Azure
hosts: all
become: true
gather_facts: false
tasks:
- when: instances is defined
block:
- name: Map Azure disks using LUN.
include_role:
name: infra-azure-disk-map
vars:
disk_map_device:
name: "{{ item.name }}"
lun: "{{ index }}"
when: item.enable|d(true)
loop_control:
index_var: index
loop: >-
{{ instances
| json_query("
[?name == '" + instance_canonical_name + "']
| [].volumes[]
")
}}
ignore_errors: true
- name: Create Azure Service Principal for OSBA/Cloud Provider
hosts: localhost
connection: local
gather_facts: False
become: no
tags:
- env-specific
- create_azure_service_principal
environment:
AZURE_CLIENT_ID: "{{azure_service_principal}}"
AZURE_TENANT: "{{azure_tenant}}"
AZURE_SECRET: "{{azure_password}}"
AZURE_SUBSCRIPTION_ID: "{{azure_subscription_id}}"
# AZURE_CONFIG_DIR: create a specific config dir for this stack to allow concurrent access
AZURE_CONFIG_DIR: "/tmp/.azure-{{project_tag}}"
tasks:
- include_role:
name: infra-azure-create-service-principal
when: env_type == "ocp-workshop"