Preparing your Workstation to use the Ansible Playbooks

Table of Contents

Less prerequisites: Dockerfiles
Less prerequistes: python virtualenvs
- OSP cloud-provider
Prerequisites
Software Requirements on workstation
- Software required for deployment
Configuring your workstation
OpenStack
- Azure
- Virtualenv

Less prerequisites: Dockerfiles

It is possible to run agnosticd with docker. This way you don’t have to install anything (except Docker).

If you want to use docker to deploy, look at the tools/builds Readme.

Less prerequistes: python virtualenvs

It is now encouraged to use python virtualenvs to develop from your laptop.

Please have a look at tools/virtualenvs.

OSP cloud-provider

In your home directory

# Create the virtualenv
$ virtualenv virtualenvs/openstack-ansible-2.9
Using base prefix '/usr'
New python executable in /home/fridim/virtualenvs/openstack-ansible-2.9/bin/python
Installing setuptools, pip, wheel...
done.

# Activate the virtualenv
$ . virtualenvs/openstack-ansible-2.9/bin/activate
(openstack-ansible-2.9) $

# Install the modules

# python 2:
(openstack-ansible-2.9) $ pip install -r https://raw.githubusercontent.com/redhat-cop/agnosticd/development/tools/virtualenvs/openstack-ansible-2.9-python2.txt


# python 3:
(openstack-ansible-2.9) $ pip install -r https://raw.githubusercontent.com/redhat-cop/agnosticd/development/tools/virtualenvs/openstack-ansible-2.9-python3.txt


# latest modules (should work with both python2 and python3)
(openstack-ansible-2.9) $ pip install -r https://raw.githubusercontent.com/redhat-cop/agnosticd/development/tools/virtualenvs/openstack-ansible-latest.txt

Prerequisites

In order to use these playbooks, you will need to set a few things up.

Software Requirements on workstation

Some deployments would require a Red Hat Customer Portal account that has appropriate subscriptions. This is not required for the playbook themselves.

Note
Red Hat employee subscriptions can be used

Software required for deployment

Python
Python Boto version 2.41 or greater
Git any version would do.
Ansible version 2.1.2 or greater
awscli bundle tested with version 1.11.32 Python and the Python dependencies may be installed via your OS' package manager (eg: python2-boto on Fedora/CentOS/RHEL) or via pip. Python virtualenv can also work.

Note

on Fedora, all dependencies are packaged and can be easily installed via dnf install wget git awscli python3-boto3 ansible ansible-lint yamllint (botocore and python will be pulled automatically through dependencies). The lint tools are optional but are recommended tools to check the quality of your code.

Example script to install required software

# Install basic packages
yum install -y  wget python python-boto unzip python2-boto3.noarch tmux git ansible

# Another option to configure python boto is:
git clone git://github.com/boto/boto.git
cd boto
python setup.py install

#Install boto3
pip install boto3

#Install pywinrm if you plan to deploy windows VMs
#pip install pywinrm

# Enable epel repositories for Ansible
cd /tmp
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install `ls *epel*.rpm`

# Install ansible and checked install version (required 2.2.0.0)
yum install -y ansible
ansible --version


## Install aws cli
curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"
unzip awscli-bundle.zip
sudo ./awscli-bundle/install -i /usr/local/aws -b /bin/aws
aws --version

Mac OS installation steps:

# Install Python3
brew install python

# For python2 do
brew install python@2

# Depending on whether you did python3 or python2, use the pip3 or pip command
pip3 install boto3

#Install pywinrm if you plan to deploy windows VMs
#pip3 install pywinrm

# Install Ansible
pip3 install ansible

# Install awscli
brew install awscli

Configuring your workstation

Configure the EC2 Credentials

You will need to place your EC2 credentials in the ~/.aws/credentials file:

mkdir ~/.aws
cat << EOF >>  ~/.aws/credentials
[default]
aws_access_key_id = AKIAJAAYOURACCESSKEY
aws_secret_access_key = rT54UYOURSECRETACCESSKEY

EOF

Add the SSH Key to the SSH Agent (optional) If your operating system has an SSH agent and you are not using your default configured SSH key, you will need to add the private key you use with your EC2 instances to your SSH agent:
```
ssh-add <path to key file>
```

Note	If you use an SSH config that specifies what keys to use for what hosts this step may not be necessary.

AWS Permissions and Policies

AWS credentials for the account above must be used with the AWS command line tool (detailed below)

An AWS IAM account with the following permissions:

Policies can be defined for Users, Groups or Roles
Navigate to: AWS Dashboard → Identity & Access Management → Select Users or Groups or Roles → Permissions → Inline Policies → Create Policy → Custom Policy
Policy Name: openshift (your preference)

Policy Document:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1459269951000",
            "Effect": "Allow",
            "Action": [
                "cloudformation:*",
                "iam:*",
                "route53:*",
                "elasticloadbalancing:*",
                "ec2:*",
                "cloudwatch:*",
                "autoscaling:*",
                "s3:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Note	Finer-grained permissions are possible, and pull requests are welcome.

AWS existing resources

A route53 public hosted zone is required for the scripts to create the various DNS entries for the resources it creates. Two DNS entries will be created for workshops:
- master.guid.domain.tld - a DNS entry pointing to the master
- *.cloudapps.guid.domain.tld - a wildcard DNS entry pointing to the router/infrastructure node

An EC2 SSH keypair should be created in advance and you should save the key file to your system.

REGION=us-west-1
KEYNAME=ocpworkshop
openssl genrsa -out ~/.ssh/${KEYNAME}.pem 2048
openssl rsa -in ~/.ssh/${KEYNAME}.pem -pubout > ~/.ssh/${KEYNAME}.pub
chmod 400 ~/.ssh/${KEYNAME}.pub
chmod 400 ~/.ssh/${KEYNAME}.pem
touch ~/.ssh/config
chmod 600 ~/.ssh/config
aws ec2 import-key-pair --key-name ${KEYNAME} --region=$REGION --output=text --public-key-material "`cat ~/.ssh/${KEYNAME}.pub | grep -v PUBLIC`"

Caution

Key pairs are created per region, you will need to specify a different keypair for each region or duplicate the keypair into every region.

REGIONS="ap-southeast-1 ap-southeast-2 OTHER_REGIONS..."
for REGION in `echo ${REGIONS}` ;
  do
    aws ec2 import-key-pair --key-name ${KEYNAME} --region=$REGION --output=text --public-key-material "`cat ~/.ssh/${KEYNAME}.pub | grep -v PUBLIC`"
  done

OpenStack

# Install python modules needed by ansible
sudo pip install openstacksdk

# Install openstack CLIs
sudo pip install python-openstackclient python-heatclient

Note	on Fedora `dnf install python3-openstacksdk python3-openstackclient python-openstackclient-doc python-openstackclient-lang python3-heatclient python-heatclient-doc python3-dns` will do the job (you may choose to skip doc and lang packages).

Azure

If you want to deploy on azure you will need the Azure client.

Source documentation

in a nutshell (tested on fedora 28) - Azure cli (system-wide)

# Install the azure-cli system-wide
sudo -i
rpm --import https://packages.microsoft.com/keys/microsoft.asc
cat >> /etc/yum.repos.d/azure-cli.repo <<EOF
[azure-cli]
name=Azure CLI
baseurl=https://packages.microsoft.com/yumrepos/azure-cli
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
EOF

yum check-update
yum install -y azure-cli

We recommend you install the ansible module in a virtualenv.

in a nutshell (tested on fedora 28) - Azure ansible module (use virtualenv)

# /!\ careful this will update ansible as well
# Use a virtualenv for those:
pip install --upgrade pip
pip install --upgrade --force ansible[azure]

Note	`--force` is used here, because of a known issue.

Service principal

It’s better to use a service principal instead of your main credentials. Refer to the official documentation.

in a nutshell

az login
az ad sp create-for-rbac
az login --service-principal -u <user> -p <password-or-cert> --tenant <tenant>

env_secret_vars.yml

azure_service_principal: "service principal client id"
azure_password: "service principal password or cert"
azure_tenant: "tenant ID"
azure_region: "Azure location, ex: EuropeWest"
azure_subscription_id: "Subscription id"

Virtualenv

If you want to use virtualenv, you can try & adapt this:

cd ansible
mkdir ~/virtualenv-aad
virtualenv ~/virtualenv-aad -p python2.7
. ~/virtualenv-aad/bin/activate
export CC=gcc-5
pip install -r requirements.txt

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Preparing_your_workstation.adoc

Preparing_your_workstation.adoc

Preparing your Workstation to use the Ansible Playbooks

Less prerequisites: Dockerfiles

Less prerequistes: python virtualenvs

OSP cloud-provider

Prerequisites

Software Requirements on workstation

Software required for deployment

Configuring your workstation

Configure the EC2 Credentials

AWS Permissions and Policies

AWS existing resources

OpenStack

Azure

Service principal

Virtualenv

Files

Preparing_your_workstation.adoc

Latest commit

History

Preparing_your_workstation.adoc

File metadata and controls

Preparing your Workstation to use the Ansible Playbooks

Less prerequisites: Dockerfiles

Less prerequistes: python virtualenvs

OSP cloud-provider

Prerequisites

Software Requirements on workstation

Software required for deployment

Configuring your workstation

Configure the EC2 Credentials

AWS Permissions and Policies

AWS existing resources

OpenStack

Azure

Service principal

Virtualenv