Skip to content

Commit 018dea7

Browse files
bgraefbgraef
committed
migrate instance setup to individual playbooks for olam
1 parent 70989a6 commit 018dea7

File tree

5 files changed

+233
-61
lines changed

5 files changed

+233
-61
lines changed

‎olam/check_instance_available.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
# Copyright (c) 2024 2025 Oracle and/or its affiliates.
3+
# This software is made available to you under the terms of the Universal Permissive License (UPL), Version 1.0.
4+
# The Universal Permissive License (UPL), Version 1.0 (see COPYING or https://oss.oracle.com/licenses/upl)
5+
# See LICENSE.TXT for details.
6+
7+
- name: Configure new instances
8+
hosts: all:!localhost
9+
gather_facts: false
10+
vars_files:
11+
- default_vars.yml
12+
- oci_vars.yml
13+
14+
tasks:
15+
16+
- name: Wait for systems to become reachable using ssh
17+
ansible.builtin.wait_for:
18+
port: 22
19+
host: '{{ (ansible_ssh_host | default(ansible_host)) | default(inventory_hostname) }}'
20+
search_regex: OpenSSH
21+
delay: 10
22+
timeout: 300
23+
24+
- name: Get a set of all available facts
25+
ansible.builtin.setup:
26+
27+
- name: Print in-memory inventory # noqa: run-once[task]
28+
ansible.builtin.debug:
29+
msg: "{{ groups['all'] }}"
30+
delegate_to: localhost
31+
run_once: true
32+
when: debug_enabled
33+
34+
- name: Print all variables/facts known for a host # noqa: run-once[task]
35+
ansible.builtin.debug:
36+
msg: "{{ hostvars[item] }}"
37+
loop: "{{ groups['all'] | flatten(levels=1) }}"
38+
delegate_to: localhost
39+
run_once: true
40+
when: debug_enabled

‎olam/configure_passwordless_ssh.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
# Copyright (c) 2024 Oracle and/or its affiliates.
3+
# This software is made available to you under the terms of the Universal Permissive License (UPL), Version 1.0.
4+
# The Universal Permissive License (UPL), Version 1.0 (see COPYING or https://oss.oracle.com/licenses/upl)
5+
# See LICENSE.TXT for details.
6+
7+
- name: Configure passwordless ssh between hosts
8+
hosts: all:!localhost
9+
vars_files:
10+
- default_vars.yml
11+
- oci_vars.yml
12+
13+
tasks:
14+
15+
- name: Generate ssh keypair for user
16+
community.crypto.openssh_keypair:
17+
path: ~/.ssh/id_rsa
18+
size: 2048
19+
comment: ol ssh keypair
20+
become: true
21+
become_user: "{{ username }}"
22+
23+
- name: Fetch public key file
24+
ansible.builtin.fetch:
25+
src: "~/.ssh/id_rsa.pub"
26+
dest: "buffer/{{ inventory_hostname }}-id_rsa.pub"
27+
flat: true
28+
become: true
29+
become_user: "{{ username }}"
30+
31+
- name: Copy public key to each destination
32+
ansible.posix.authorized_key:
33+
user: "{{ username }}"
34+
state: present
35+
key: "{{ lookup('file', 'buffer/{{ item }}-id_rsa.pub') }}"
36+
# loop: "{{ groups['all'] | flatten(levels=1) }}"
37+
loop: "{{ ansible_play_hosts_all | difference(['localhost']) }}"
38+
become: true
39+
40+
# - name: Copy public key to each destination for root
41+
# ansible.posix.authorized_key:
42+
# user: "root"
43+
# state: present
44+
# key: "{{ lookup('file', 'buffer/{{ item }}-id_rsa.pub') }}"
45+
# loop: "{{ groups['all'] | flatten(levels=1) }}"
46+
# become: true
47+
48+
- name: Print hostvars for groups
49+
ansible.builtin.debug:
50+
msg: "{{ hostvars[item] }}"
51+
# loop: "{{ groups['all'] | flatten(levels=1) }}"
52+
loop: "{{ ansible_play_hosts_all | difference(['localhost']) }}"
53+
when: debug_enabled
54+
55+
- name: Print vcn subnet_domain_name
56+
ansible.builtin.debug:
57+
var: my_subnet1_domain_name
58+
when: debug_enabled
59+
60+
- name: Accept new ssh fingerprints
61+
ansible.builtin.shell: |
62+
ssh-keyscan -t ecdsa-sha2-nistp256 \
63+
{{ hostvars[item].ansible_hostname }},\
64+
{{ hostvars[item].ansible_default_ipv4.address }},\
65+
{{ hostvars[item].ansible_hostname + '.' + my_subnet1_domain_name }} >> ~/.ssh/known_hosts
66+
with_items:
67+
# - "{{ groups['all'] }}"
68+
"{{ ansible_play_hosts_all | difference(['localhost']) }}"
69+
become: true
70+
become_user: "{{ username }}"
71+
register: result
72+
changed_when: result.rc == 0
73+
74+
# - name: Accept new ssh fingerprints for root
75+
# ansible.builtin.shell: |
76+
# ssh-keyscan -t ecdsa-sha2-nistp256 \
77+
# {{ hostvars[item].ansible_hostname }},\
78+
# {{ hostvars[item].ansible_default_ipv4.address }},\
79+
# {{ hostvars[item].ansible_hostname + '.' + my_subnet1_domain_name }} >> ~/.ssh/known_hosts
80+
# with_items:
81+
# - "{{ groups['all'] }}"
82+
# become: true
83+
# become_user: "root"
84+
# register: result
85+
# changed_when: result.rc == 0

‎olam/create_instance.yml

Lines changed: 9 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -261,70 +261,18 @@
261261
ansible.builtin.include_tasks: "build.yml"
262262
loop: "{{ lookup('dict', compute_instances, wantlist=True) }}"
263263

264-
- name: Configure new instances
265-
hosts: all
266-
become: true
267-
gather_facts: false
268-
vars_files:
269-
- default_vars.yml
270-
- oci_vars.yml
271-
vars:
272-
username: "oracle"
273-
user_default_password: "oracle"
274-
private_key: "id_rsa"
275-
debug_enabled: false
264+
- name: Check if instances are available
265+
ansible.builtin.import_playbook: "check_instance_available.yml"
276266

277-
tasks:
278-
279-
- name: Wait for systems to become reachable
280-
ansible.builtin.wait_for_connection:
281-
vars:
282-
python_version: "/usr/bin/python3"
283-
ansible_python_interpreter: "{{ python_version if localhost_python_interpreter is defined | default(omit) }}"
267+
- name: Setup and configure instance basics
268+
ansible.builtin.import_playbook: "provision_instance_basics.yml"
284269

285-
- name: Get a set of all available facts
286-
ansible.builtin.setup:
270+
- name: Configure passwordless SSH
271+
ansible.builtin.import_playbook: "configure_passwordless_ssh.yml"
287272

288-
- name: Print in-memory inventory
289-
ansible.builtin.debug:
290-
msg: "{{ groups['all'] }}"
291-
delegate_to: localhost
292-
when:
293-
- debug_enabled
294-
- inventory_hostname == ansible_play_hosts_all[0]
295-
296-
- name: Print all variables/facts known for a host
297-
ansible.builtin.debug:
298-
msg: "{{ hostvars[item] }}"
299-
loop: "{{ groups['all'] | flatten(levels=1) }}"
300-
delegate_to: localhost
301-
when:
302-
- debug_enabled
303-
- inventory_hostname == ansible_play_hosts_all[0]
304-
305-
- name: Configure instance
306-
ansible.builtin.include_tasks: "host_setup.yml"
307-
when: >-
308-
inventory_hostname in
309-
groups['control']|default([])
310-
+ groups['server']|default([])
311-
+ groups['execution']|default([])
312-
+ groups['db']|default([])
313-
314-
- name: Configure passwordless SSH
315-
ansible.builtin.include_tasks: "passwordless_setup.yml"
316-
when: passwordless_ssh
317-
318-
- name: Install Oracle Linux Automation Engine
319-
ansible.builtin.dnf:
320-
name:
321-
- ansible-core
322-
state: present
323-
retries: 5
324-
delay: 10
325-
when:
326-
- inventory_hostname in groups['control']|default([])
327-
- use_olae_only
273+
- name: Install Oracle Linux Automation Engine
274+
ansible.builtin.import_playbook: "deploy_olae.yml"
275+
when: use_olae_only
328276

329277
- name: Install Oracle Linux Automation Manager
330278
vars:

‎olam/deploy_olae.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# Copyright (c) 2024 2025 Oracle and/or its affiliates.
3+
# This software is made available to you under the terms of the Universal Permissive License (UPL), Version 1.0.
4+
# The Universal Permissive License (UPL), Version 1.0 (see COPYING or https://oss.oracle.com/licenses/upl)
5+
# See LICENSE.TXT for details.
6+
7+
8+
- name: Install Oracle Linux Automation Engine
9+
hosts: control
10+
vars_files:
11+
- default_vars.yml
12+
become: true
13+
14+
tasks:
15+
16+
- name: Install ansible-core package
17+
ansible.builtin.dnf:
18+
name:
19+
- ansible-core
20+
state: present
21+
retries: 5
22+
delay: 10

‎olam/provision_instance_basics.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
# Copyright (c) 2024 2025 Oracle and/or its affiliates.
3+
# This software is made available to you under the terms of the Universal Permissive License (UPL), Version 1.0.
4+
# The Universal Permissive License (UPL), Version 1.0 (see COPYING or https://oss.oracle.com/licenses/upl)
5+
# See LICENSE.TXT for details.
6+
7+
- name: Provision instance basics
8+
hosts: control:server:execution:db
9+
vars_files:
10+
- default_vars.yml
11+
- oci_vars.yml
12+
13+
tasks:
14+
15+
- name: Grow the root filesystem
16+
ansible.builtin.shell: |
17+
/usr/libexec/oci-growfs -y
18+
become: true
19+
register: result
20+
changed_when: result.rc == 0
21+
22+
- name: Add user account with access to sudo
23+
ansible.builtin.user:
24+
name: "{{ username }}"
25+
password: "{{ user_default_password | password_hash('sha512') }}"
26+
comment: Ansible created user
27+
groups: wheel
28+
append: true
29+
update_password: on_create
30+
become: true
31+
32+
- name: Set authorized key for user using local public key file
33+
ansible.posix.authorized_key:
34+
user: "{{ username }}"
35+
state: present
36+
key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/' + private_key + '.pub') }}"
37+
become: true
38+
39+
- name: Set user with passwordless sudo access
40+
vars:
41+
sudo_content: "{{ username }} ALL=(ALL:ALL) NOPASSWD: ALL"
42+
ansible.builtin.lineinfile:
43+
path: "/etc/sudoers.d/{{ username }}"
44+
regexp: "{{ username }} ALL="
45+
line: "{{ sudo_content }}"
46+
state: present
47+
create: true
48+
mode: "0644"
49+
become: true
50+
51+
- name: Create the ansible tmp directory if it does not exist
52+
ansible.builtin.file:
53+
path: ~/.ansible/tmp
54+
state: directory
55+
mode: '0700'
56+
become: true
57+
become_user: "{{ username }}"
58+
59+
- name: Add locale settings to .bashrc
60+
ansible.builtin.lineinfile:
61+
dest: ~/.bashrc
62+
line: "{{ item }}"
63+
with_items:
64+
- 'export LC_ALL="en_US.UTF-8"'
65+
- 'export LC_CTYPE="en_US.UTF-8"'
66+
become: true
67+
become_user: "{{ username }}"
68+
69+
- name: Configure firewall to log denied packets
70+
ansible.builtin.command:
71+
cmd: firewall-cmd --set-log-denied=all
72+
when: debug_enabled
73+
register: firewall_result
74+
changed_when: firewall_result.rc == 0
75+
become: true
76+
77+
# Check denied packets with "journalctl -x -e" or with "dmesg | grep -i REJECT"

0 commit comments

Comments
 (0)