winPB: automate jenkins service installation (#2994)

* winPB: automate jenkins service installation

* Update JenkinsAgentService.xml.j2

* Update main.yml

* Update main.yml

* add workspace to be overridden

* Update JenkinsAgentService.xml.j2

* add support for pulling jenkins secret from secrets repo

* add docs

* Update README.md

Author: gdams

ansible/playbooks/AdoptOpenJDK_Windows_Playbook/README.md

@@ -2,55 +2,26 @@
 
 There's a process to setting up Windows machines and getting them connected to Jenkins. If not followed, issues can occur with Jenkins workspaces (See: https://github.com/adoptium/infrastructure/issues/1674).
 
-1) Log on to the Windows machine via RDP and run the `ConfigureRemotingForAnsible` commands listed in [main.yml](https://github.com/adoptium/infrastructure/blob/master/ansible/playbooks/AdoptOpenJDK_Windows_Playbook/main.yml).
+1. Log on to the Windows machine via RDP and run the `ConfigureRemotingForAnsible` commands listed in [main.yml](https://github.com/adoptium/infrastructure/blob/master/ansible/playbooks/AdoptOpenJDK_Windows_Playbook/main.yml).
 
 Note: If setting up a win2012r2 machine, `[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12` needs to be executed to stop `Invoke-WebRequest` encountering a `Could not create SSL/TLS secure channel` error. See: https://github.com/adoptium/infrastructure/issues/1858
 
-2) Run the playbook on the machine, without skipping the 'adoptopenjdk' and 'jenkins' tags. (See [this](https://github.com/adoptium/infrastructure/blob/master/ansible/README.md) for more information).
+1. Run the playbook on the machine, without skipping the 'adoptopenjdk' and 'jenkins' tags. (See [this](https://github.com/adoptium/infrastructure/blob/master/ansible/README.md) for more information).
 
-3) Login as the Jenkins user on the machine via RDP, and ensure access can be gained, and create 2 directories, one for the jenkins workspace ( typically called workspace, and a parallel directory called agent.
+1. Login as the Jenkins user on the machine via RDP, and ensure access can be gained, and create 2 directories, one for the jenkins workspace ( typically called workspace, and a parallel directory called agent.
 
-4) On any machine, in a web browser, login to [ci.adoptium.net](https://ci.adoptium.net/), create a new node ( best done as a copy of an existing node ), but ensure the launch option is set to "Launch Agent By Connecting It To A Controller"
+1. On any machine, in a web browser, login to [ci.adoptium.net](https://ci.adoptium.net/), create a new node ( best done as a copy of an existing node ), but ensure the launch option is set to "Launch Agent By Connecting It To A Controller"
 
-5) Login as the administrator user on the machine via RDP, and download the relevant [WinSW - Windows Service Wrapper](https://github.com/winsw/winsw/releases/) executable for the platform, e.g [WinSW-x64.exe](https://github.com/winsw/winsw/releases/download/v2.12.0/WinSW-x64.exe)  and copy the downloaded file to the agent directory created in step 3.
+1. Jenkins service creation is now automated by the [Jenkins_Service_Installation](./roles/Jenkins_Service_Installation/) role which automatically creates the relevant config files and installs [WIN-SW](https://github.com/winsw/winsw). In order to take advantage of this role you must first set a variable called `jenkins_secret` which is set to the secret JNLP string defined in Jenkins when you create the new node. This can be done in one of two ways:
 
-6) In the created agent directory, rename the file downloaded in step 5) from WinSW-x64.exe to something meaningful, e.g. JenkinsAgentService.exe
+    1. Add the machine to the secrets repo config file in `secrets/vendor_files/Jenkins_Secrets.yml.gpg`. Simply add a new line using the following schema, commit and push:
 
-7) Create an accompanying XML file in the agent directory, and give it the same name as the renamed executable, but with an xml file extension, e.g JenkinsAgentService.xml.
+    ```yaml
+    <hostname>: <secret>
+    ```
 
-8) Now edit the xml file and populate the file in a similar fashion to the below, the key , edit the fields from the example shown below as appropriate:
-   - **id** :  This should be set to a unique name for the windows service
-   - **name** : This should be set to a descriptive name, and will be the name of the service displayed on the screen in windows
-   - **description** : This should be set to a meaningful description
-   - **executable** : This should be set to the full path to the  java executable, that will be used to run the jenkins agent.
-   - **arguments** This can be obtained from the node configuration page in Jenkins, the *xxxxxx* should reflect the name of the node being created in jenkins, and the *yyyyyyyy* string will be an encoded hex string, used for passing the jenkins user password
-   - **download from** the URL here should be changed to match the jenkins server name, from which the service can download the agent.jar
+    2. Set the variable manually in the [adoptopenjdk_variables.yml](./group_vars/all/adoptopenjdk_variables.yml) file.
 
-	All other fields can be left as in the example.
+Note that the role will be skipped if it cannot find a `jenkins_secret` variable. The role will also not remove any previosuly created service using the previous JNLP process.
 
->     <service>
->       <id>Jenkins</id>
->       <name>Jenkins</name>
->      <description>This service runs an agent for Jenkins automation server.</description>
->      <executable>C:\openjdk\jdk-17\bin\java.exe</executable>
->      <arguments>-Xrs -jar "%BASE%\agent.jar" -jnlpUrl https://ci.adoptium.net/computer/xxxxxxxxxx/jenkins-agent.jnlp -secret yyyyyyyyyyyyy -workDir=F:\workspace</arguments>
->      <logmode>rotate</logmode>
->      <onfailure action="restart" />
->        <download from="https://ci.adoptium.net/jnlpJars/agent.jar" to="%BASE%\agent.jar"/>
->      </service>
-
-9)  As the windows administrator, open an elevated command prompt, and now create the Jenkins agent service by following this process :
-
-	 - cd to the agent directory ( where the executable and xml file are stored )
-	 - run the executable with a parameter install (e.g **.\JenkinsAgentService.exe INSTALL**)
- 
-	 You should get confirmation prompts on screen that the service has been created.
-	 
-	- Next open the windows services dialog, and identify the Jenkins service that has just been created. Right click on the service and select **Properties** from the pop up menu.
-	- Select the log on tab from the dialog, and change the logon type from local system account to the jenkins account, and enter the password for the jenkins user, followed by **Ok**
-	- Finally right click on the service, and select **Start** from the pop up menu.
-	
-	You should now get some confirmations, that the Jenkins user has been granted the log on as a service permission, and you should be able to start the service, and check that the agent is online and available in Jenkins.
-	
 The jenkins service should then be started.
-

ansible/playbooks/AdoptOpenJDK_Windows_Playbook/main.yml

@@ -83,6 +83,9 @@
     - NSClient                    # Required For Nagios Monitoring
     - shortNames
     - Dragonwell                  # Dragonwell bootstrap image
+    - role: Jenkins_Service_Installation # Automate installing the jenkins service
+      tags: [jenkins, adoptopenjdk]
+      when: jenkins_secret is defined  # Only run if jenkins_secret is defined
     - role: Thunderbird
       tags: [Thunderbird, jck, adoptopenjdk]
     - role: logs

ansible/playbooks/AdoptOpenJDK_Windows_Playbook/roles/Get_Vendor_Files/tasks/main.yml

@@ -55,3 +55,13 @@
   when:
     - local_vendor_files.stat.exists
   run_once: true
+
+- name: Parse Jenkins_Secrets.yml if it's defined
+  set_fact: jenkins_secrets="{{ Jenkins_Secrets_yml | from_yaml }}"
+  when:
+    - Jenkins_Secrets_yml is defined
+
+- name: Set jenkins_secret for host if defined
+  set_fact: jenkins_secret="{{ jenkins_secrets[inventory_hostname] }}"
+  when:
+    - (jenkins_secrets is defined) and (inventory_hostname in jenkins_secrets)

ansible/playbooks/AdoptOpenJDK_Windows_Playbook/roles/Jenkins_Service_Installation/tasks/main.yml

@@ -0,0 +1,68 @@
+---
+###############################
+# Jenkins Service Installaion #
+###############################
+
+- name: Check if Jenkins service already exists
+  win_service:
+    name: Jenkins
+  register: jenkins_service
+  failed_when: false
+
+# Allow workspace to be overridden by a variable in inventory.yml
+- name: Set workspace variable
+  set_fact:
+    workspace: C:\Users\{{ Jenkins_Username }}\workspace
+  when: (jenkins_service.exists == false) and (workspace is not defined)
+
+- name: Create workspace directory in C:\Users\{{ Jenkins_Username }}
+  win_file:
+    path: "{{ workspace }}"
+    state: directory
+    recurse: yes
+    owner: "{{ Jenkins_Username }}"
+  when: jenkins_service.exists == false
+
+- name: Create agent directory in C:\Users\{{ Jenkins_Username }}
+  win_file:
+    path: C:\Users\{{ Jenkins_Username }}\agent
+    state: directory
+    recurse: yes
+    owner: "{{ Jenkins_Username }}"
+  when: jenkins_service.exists == false
+
+# TODO: Add support for Windows Aarch64 native binary once it's available
+- name: Download WIN-SW
+  win_get_url:
+    url: https://github.com/winsw/winsw/releases/download/v2.12.0/WinSW-x64.exe
+    dest: C:\Users\{{ Jenkins_Username }}\agent\JenkinsAgentService.exe
+  when: jenkins_service.exists == false
+
+- name: Create xml file from template for Jenkins Agent Service
+  win_template:
+    src: "{{ role_path }}/templates/JenkinsAgentService.xml.j2"
+    dest: C:\Users\{{ Jenkins_Username }}\agent\JenkinsAgentService.xml
+    owner: "{{ Jenkins_Username }}"
+  when: jenkins_service.exists == false
+
+- name: Install Jenkins Service
+  win_shell: .\JenkinsAgentService.exe install
+  args:
+    chdir: C:\Users\{{ Jenkins_Username }}\agent
+  when: jenkins_service.exists == false
+
+- name: Grant Jenkins user the Logon as a service right
+  win_user_right:
+    name: SeServiceLogonRight
+    users:
+      - "{{ Jenkins_Username }}"
+    action: add
+  when: jenkins_service.exists == false
+
+- name: Start Jenkins Service
+  win_service:
+    name: Jenkins
+    username: "{{ Jenkins_Username }}"
+    password: "{{ Jenkins_Win_Passwd }}"
+    start_mode: auto
+    state: started

ansible/playbooks/AdoptOpenJDK_Windows_Playbook/roles/Jenkins_Service_Installation/templates/JenkinsAgentService.xml.j2

@@ -0,0 +1,10 @@
+<service>
+	<id>Jenkins</id>
+	<name>Jenkins</name>
+	<description>This service runs an agent for Jenkins automation server.</description>
+	<executable>C:\openjdk\jdk-17\bin\java.exe</executable>
+	<arguments>-Xrs -jar "%BASE%\agent.jar" -jnlpUrl https://ci.adoptium.net/computer/{{ inventory_hostname }}/jenkins-agent.jnlp -secret {{ jenkins_secret }} -workDir=C:\Users\{{ Jenkins_Username }}\workspace</arguments>
+	<logmode>rotate</logmode>
+	<onfailure action="restart" />
+	<download from="https://ci.adoptium.net/jnlpJars/agent.jar" to="%BASE%\agent.jar"/>
+</service>