deploy.yml

---
- hosts: localhost
  become: False
  sudo: False
  gather_facts: False
  tasks:

    - name: confirm that ansible version meets requirements
      fail:
        msg: "Ansible version is {{ ansible_version.full }}; 1.9 is required"
      when: ansible_version.full|version_compare('1.9', '<')
  

- hosts: all:!maia01
  environment: harness_http_proxy_environment
  roles:
    - chrony


- hosts: controller:compute
  environment: harness_http_proxy_environment
  roles:
    - docker


- hosts: controller:compute
  environment: harness_http_proxy_environment
  tasks:

    - name: ensure that login user is in the docker group
      user:
        name: "{{ ansible_ssh_user }}"
        groups: docker
        append: yes
        state: present


- hosts: controller
  environment: harness_http_proxy_environment
  roles:
    - mysql
    - rabbitmq-server
    - keystone
    - glance
    - nova-controller
    - neutron-controller
    - cinder-controller
    - cinder-volume
    - horizon


#- hosts: network
#  environment: harness_http_proxy_environment
#  tasks:

#    - name: enable net.ipv4.ip_no_pmtu_disc in sysctl
#      sysctl:
#        name: net.ipv4.ip_no_pmtu_disc
#        value: "1"
#        state: present


- hosts: network
  environment: harness_http_proxy_environment
  roles:
    - neutron-network


- hosts: compute
  environment: harness_http_proxy_environment
  roles:
    - nova-compute-docker


- hosts: controller:compute
  environment: harness_http_proxy_environment
  tags:
    - dockerimages
  tasks:

    - name: ensure docker is configured to use http_proxy
      lineinfile:
        dest: /etc/default/docker
        line: export http_proxy="{{ lookup('env', 'http_proxy') }}"
        state: present
      register: default_docker
      when: ansible_distribution == 'Ubuntu'

    - name: restart docker if necessary
      command: service docker restart
      when: default_docker|changed

    - name: ensure docker pull images have been pulled
      environment: harness_no_http_proxy_environment
      command: docker pull "{{ item.name }}:{{ item.tag }}"
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_pull_images
      register: docker_image_pull
      changed_when: -1 != docker_image_pull.stdout.find("Downloaded newer image")

    - name: ensure docker image build directories exist
      file:
        path: "{{ item }}"
        owner: "{{ ansible_ssh_user }}"
        state: directory
      with_items:
        - "{{ ansible_env.PWD }}/.ansible_cache"
        - "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild"
        - "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild-sync"

    - name: synchronize local repositories to remotes for sync tracking
      synchronize:
        src: "harness/{{ item.dir }}"
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild-sync"
        archive: no
        checksum: yes
        recursive: yes
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images
      register: dockerbuild_sync

    - name: synchronize local repositories to remotes for docker build
      synchronize:
        src: "harness/{{ item.dir }}"
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild"
        archive: no
        checksum: yes
        recursive: yes
      when: dockerbuild_sync|changed and 
            inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images

    - name: ensure that docker image builds are configured to use http_proxy
      lineinfile:
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild/{{ item.dir }}/{{ item.buildsub }}/Dockerfile"
        line: ENV http_proxy={{ lookup('env', 'http_proxy') }}
        insertafter: ^MAINTAINER
        state: present
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images

    - name: ensure that docker image builds are configured to use https_proxy
      lineinfile:
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild/{{ item.dir }}/{{ item.buildsub }}/Dockerfile"
        line: ENV https_proxy={{ lookup('env', 'https_proxy') }}
        insertafter: ^MAINTAINER
        state: present
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images

    - name: ensure that docker images are configured to NOT use http_proxy at runtime...
      lineinfile:
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild/{{ item.dir }}/{{ item.buildsub }}/Dockerfile"
        line: ENV http_proxy=''
        insertbefore: ^CMD
        state: present
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images

    - name: ensure that docker images are configured to NOT use https_proxy at runtime...
      lineinfile:
        dest: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild/{{ item.dir }}/{{ item.buildsub }}/Dockerfile"
        line: ENV https_proxy=''
        insertbefore: ^CMD
        state: present
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images

    - name: ensure docker build images have been built
      environment: harness_no_http_proxy_environment
      docker_image:
        docker_api_version: '1.18'
        name: "{{ item.name }}"
        tag: "{{ item.tag }}"
        path: "{{ ansible_env.PWD }}/.ansible_cache/dockerbuild/{{ item.dir }}/{{ item.buildsub }}"
        state: present
      when: inventory_hostname in groups['{{ item.group }}']
      with_items: harness_docker_build_images
      register: docker_image_build
      until: docker_image_build|success
      retries: 3
      delay: 3


- hosts: compute
  environment: harness_http_proxy_environment
  tasks:

    - name: ensure required packages for hresmonagent are installed
      apt:
        pkg: "{{ item }}"
        state: latest
        update_cache: yes
        cache_valid_time: 600
      with_items:
        - python-bottle
 
    - name: clone hresmonagent repository
      git:
        repo: https://github.com/harnesscloud/hresmonagent.git
        dest: /hresmonagent
        update: no


- hosts: all
  gather_facts: True
  tags:
    - harness


- hosts: controller
  environment: harness_no_http_proxy_environment
  tags:
    - harness
  tasks:

    - name: update admin.openrc from template
      template:
        src: templates/admin.openrc
        dest: "{{ ansible_env.PWD }}/admin.openrc"
        owner: "{{ ansible_ssh_user }}"
        mode: 0600

    - name: create harness tenant
      keystone_user:
        endpoint: "{{ openstack_identity_admin_url }}"
        token: "{{ openstack_identity_admin_token }}"
        tenant: harness
        tenant_description: "Harness Tenant"

    - name: create harness user
      keystone_user:
        endpoint: "{{ openstack_identity_admin_url }}"
        token: "{{ openstack_identity_admin_token }}"
        tenant: harness
        user: harness
        password: "{{ openstack_identity_harness_password }}"

    - name: associate _member_ role with harness user
      keystone_user:
        endpoint: "{{ openstack_identity_admin_url }}"
        token: "{{ openstack_identity_admin_token }}"
        tenant: harness
        user: harness
        role: _member_

    - name: update harness.openrc template
      template:
        src: templates/harness.openrc
        dest: "{{ ansible_env.PWD }}/harness.openrc"
        owner: "{{ ansible_ssh_user }}"
        mode: 0600

    - name: check to see what images have been registered with glance
      command: glance --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" image-list
      register: glance_image_check
      changed_when: false

    - name: import harnesscloud/conpaas-director image into glance if necessary
      shell: echo "docker save {{ item }}" | glance --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" image-create --name={{ item }} --is-public=true --container-format=docker --disk-format=raw
      when: -1 == glance_image_check.stdout.find("{{ item }}")
      with_items:
        - harnesscloud/baseimage-cloud
        - harnesscloud/conpaas-director
        - harnesscloud/conpaas-worker

    - name: query glance for harnesscloud/conpaas-director image id
      glance_image:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        name: harnesscloud/conpaas-director
        file: /tmp/dummy
        state: present
      register: conpaas_director_image
 
    - name: query glance for harnesscloud/conpaas-worker image id
      glance_image:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        name: harnesscloud/conpaas-worker
        file: /tmp/dummy
        state: present
      register: conpaas_worker_image
    
    # Ansible neutron modules lists all tenants to get ids, but this is not
    # permitted for non-admin users. Need to fix neutron_* modules as non-admin
    # *should* be able to create networks, associate floating ips, etc.

    - name: ensure harness user has admin role
      keystone_user:
        endpoint: "{{ openstack_identity_admin_url }}"
        token: "{{ openstack_identity_admin_token }}"
        tenant: harness
        user: harness
        role: admin

    - name: ensure internal network is registered
      neutron_network:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        tenant_name: harness
        name: harness-net
        state: present
      register: openstack_network_internal

    - name: ensure subnet internal network is registered
      neutron_subnet:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        tenant_name: harness
        name: harness-subnet
        network_name: harness-net
        cidr: 192.168.13.0/24
        enable_dhcp: true
        gateway_ip: 192.168.13.1
        dns_nameservers: 8.8.8.8,8.8.4.4
        state: present

    - name: ensure router exists
      neutron_router:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        tenant_name: harness
        name: harness-router
        state: present

    - name: ensure router has interface connected to internal network
      neutron_router_interface:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        tenant_name: harness
        router_name: harness-router
        subnet_name: harness-subnet
        state: present

    - name: ensure router has external network gateway
      neutron_router_gateway:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        router_name: harness-router
        network_name: public
        state: present

    - name: create ssh keypair
      become_user: "{{ ansible_ssh_user }}"
      command: ssh-keygen -q -f {{ ansible_env.PWD }}/.ssh/id_rsa -P ""
               creates={{ ansible_env.PWD }}/.ssh/id_rsa

    - name: capture public key in variable
      command: cat {{ ansible_env.PWD }}/.ssh/id_rsa.pub
      register: pubkey
      changed_when: false

    - name: add ssh keypair to nova
      nova_keypair:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        name: harness-keypair
        public_key: "{{ pubkey.stdout }}"
        state: present

    # the neutron_sec_group module needs work...
    
    - name: verify existence of harness security group
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-show harness-secgroup
      register: verify_secgroup
      ignore_errors: yes
      changed_when: false
    
    - name: create harness-secgroup security group if necessary
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-create harness-secgroup
      when: verify_secgroup|failed
   
    - name: ensure that harness-secgroup allows ping
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-rule-create --direction=ingress --protocol=icmp harness-secgroup
      when: verify_secgroup|failed

    - name: ensure that harness-secgroup allows ssh
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-rule-create --direction=ingress --protocol=tcp --port-range-min=22 --port-range-max=22 harness-secgroup
      when: verify_secgroup|failed

    - name: ensure that harness-secgroup allows http
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-rule-create --direction=ingress --protocol=tcp --port-range-min=80 --port-range-max=80 harness-secgroup
      when: verify_secgroup|failed

    - name: ensure that harness-secgroup allows https
      command: neutron --os-auth-url "{{ openstack_identity_public_url }}" --os-tenant-name harness --os-username harness --os-password "{{ openstack_identity_harness_password }}" security-group-rule-create --direction=ingress --protocol=tcp --port-range-min=443 --port-range-max=443 harness-secgroup
      when: verify_secgroup|failed

    - name: ensure that harness iaas services are running
      docker:
        name: harness-iaas-services
        image: harnesscloud/iaas-deployment-docker-image
        docker_api_version: '1.18'
        net: bridge
        env:
          main_PASSWORD: "{{ openstack_identity_harness_password }}"
          main_NOVA_ENDPOINT: "{{ openstack_compute_endpoint_host }}:5000"
          CRS_DEFAULT_IMAGE: "{{ conpaas_worker_image.id }}"
          network_UUID: "{{ openstack_network_internal.id }}"
          overcommit_CPU_RATIO: "{{ openstack_compute_cpu_allocation_ratio|int }}"
          overcommit_MEM_RATIO: "{{ openstack_compute_ram_allocation_ratio|int }}"
          overcommit_DISK_RATIO: "{{ openstack_compute_disk_allocation_ratio|int }}"
        ports:
          - 7075:7075
          - 8889:8889
          - 56789:56789
        state: started

    - name: ensure that /xtreemfs_data directory exists
      file:
        path: /xtreemfs_data
        owner: root
        group: root
        mode: 0755
        state: directory

    - name: ensure that harness xtreemfs configuration is updated from templates
      template:
        src: templates/xtreemfs_data/{{ item }}
        dest: /xtreemfs_data/{{ item }}
        owner: root
        group: root
        mode: 0644
      with_items:
        - dirconfig.properties
        - irm.properties
        - mrcconfig.properties
        - osdconfig.properties
        - schedulerconfig.properties
        - scheduler.osd_capabilities

    - name: ensure that xtreemfs-osd service is running
      docker:
        name: xtreemfs-harness-osd
        image: xtreemfs/xtreemfs-harness-osd
        docker_api_version: '1.18'
        net: bridge
        expose:
          - 32640
        ports:
          - 32640:32640
        volumes:
          - /xtreemfs_data:/xtreemfs_data:rw
        state: started

    - name: ensure that xtreemfs-manager service is running
      docker:
        name: xtreemfs-harness-manager
        image: xtreemfs/xtreemfs-harness-manager
        docker_api_version: '1.18'
        net: bridge
        expose:
          - 30080
          - 32636
          - 32638
          - 32642
        ports:
          - 30080:30080
          - 32636:32636
          - 32638:32638
          - 32642:32642
        volumes:
          - /xtreemfs_data:/xtreemfs_data:rw
        state: started

    - name: create a new conpaas-admin virtual machine instance
      nova_compute:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        name: conpaas-director
        flavor_id: 2
        image_id: "{{ conpaas_director_image.id }}"
        nics:
          - net-id: "{{ openstack_network_internal.id }}"
        key_name: harness-keypair
        security_groups: harness-secgroup
        wait: "yes"
        state: present
        user_data: |
          export USERNAME=test
          export PASSWORD=password
          export IP_PREFIX=192.168.13.
          export CRS_URL=http://{{ openstack_controller_ip }}:56789
          export IMAGE_ID=harnesscloud/conpaas-worker
        availability_zone: 'host:{{ hostvars[groups.compute[0]].ansible_hostname }}'

    - name: ensure floating ip is associated with vm instance
      neutron_floating_ip:
        auth_url: "{{ openstack_identity_public_url }}"
        login_tenant_name: harness
        login_username: harness
        login_password: "{{ openstack_identity_harness_password }}"
        instance_name: conpaas-director
        network_name: public
        state: present
      register: harness_floating_ip

    - name: ping harness virtual machine
      command: ping -c 4 {{ harness_floating_ip.public_ip }}
      changed_when: false
      register: ping_harness_vm
      until: ping_harness_vm|success
      retries: 5
      delay: 5

    - name: wait for ssh to become available
      wait_for:
        delay: 10
        host: "{{ harness_floating_ip.public_ip }}"
        port: 22

    - name: verify that virtual machine can be logged into via ssh
      become_user: "{{ ansible_ssh_user }}"
      command: ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@{{ harness_floating_ip.public_ip }} hostname
      changed_when: false

    - name: print success message
      debug:
        msg: >
             Success! The playbook has completed and the install has passed
             basic tests. The HARNESS cloud should be ready for use.

    - name: display CRS url
      debug:
        msg: "CRS url: {{ harness_deployment_crs_url }}"

    - name: display ConPaaS url
      debug:
        msg: "ConPaaS url: {{ harness_deployment_conpaas_url }}"