create-private-agent-network-ec2.yml

---
#
# Create a VPC network, subnets et al for use with build-private-agent-cluster.yml
# Launch a bastion into VPC for running build-private-agent-cluster.yml with required private network access
#
- name: Create Lightbend EC2 network w/ Private Agents
  hosts: localhost
  connection: local
  gather_facts: False

# This image is Ubuntu 16.04 LTS amd64 hvm:ebs-ssd in us-east-1
# For updates and other regions https://cloud-images.ubuntu.com/locator/ec2/
#
# Must be changed to region local Ubuntu AMI for all other regions
#
  vars:
    BASTION_IMAGE: "ami-cd0f5cb6"
    BASTION_INSTANCE_TYPE: "t2.large"
    BASTION_VOL_TYPE: "gp2"
    BASTION_VOL_SIZE: 100
    EC2_REGION: us-east-1
    admin_name: "Lightbend Admin Access"
    core_name: "Lightbend Core Node"
    ingress_name: "Lightbend ELB Ingress"
    private_agent_name: "Lightbend Private Agent"
    public_agent_name: "Lightbend Public Agent"

  tasks:
    - name: Create VPC
      local_action:
        module: ec2_vpc
        cidr_block: 10.100.0.0/16
        resource_tags:
          Name: "Lightbend Enterprise Suite Cluster VPC"
        region: "{{ EC2_REGION }}"
        dns_hostnames: yes
        dns_support: yes
        internet_gateway: True
        route_tables:
          - subnets:
              - 10.100.1.0/24
              - 10.100.3.0/24
              - 10.100.5.0/24
            routes:
              - dest: 0.0.0.0/0
                gw: igw
        subnets:
          - cidr: 10.100.1.0/24
            az: "{{ EC2_REGION }}a"
            resource_tags:
               Name: "Lightbend {{ EC2_REGION }}-A Public SN"
          - cidr: 10.100.3.0/24
            az: "{{ EC2_REGION }}b"
            resource_tags:
                Name: "Lightbend {{ EC2_REGION }}-B Public SN"
            # Use 'a' or 'b' again for 2 AZs
          - cidr: 10.100.5.0/24
            az: "{{ EC2_REGION }}c"
            resource_tags:
                Name: "Lightbend {{ EC2_REGION }}-C Public SN"
        state: present
      register: vpc

    - name: Create NAT Gateway
      ec2_vpc_nat_gateway:
        state: present
        subnet_id:  "{{ vpc.subnets[0].id }}"
        wait: yes
        region: "{{ EC2_REGION }}"
        if_exist_do_not_create: true
      register: nat_gateway

    - name: Create Private Subnets
      ec2_vpc_subnet:
        state: present
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ EC2_REGION }}"
        cidr: 10.100.2.0/24
        az: "{{ EC2_REGION }}a"
        resource_tags:
          Name: "Lightbend {{ EC2_REGION }}-A Private SN"
      register: private_SN_A

    - name: Create Private Subnet
      ec2_vpc_subnet:
        state: present
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ EC2_REGION }}"
        cidr: 10.100.4.0/24
        az: "{{ EC2_REGION }}b"
        resource_tags:
          Name: "Lightbend {{ EC2_REGION }}-B Private SN"
      register: private_SN_B

    - name: Create Private Subnets
      ec2_vpc_subnet:
        state: present
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ EC2_REGION }}"
        cidr: 10.100.6.0/24
        az: "{{ EC2_REGION }}c"
        resource_tags:
          Name: "Lightbend {{ EC2_REGION }}-C Private SN"
      register: private_SN_C

    - name: Set up NAT-protected route table
      ec2_vpc_route_table:
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ EC2_REGION }}"
        subnets:
          - "Lightbend {{ EC2_REGION }}-A Private SN"
          - "Lightbend {{ EC2_REGION }}-B Private SN"
          - "Lightbend {{ EC2_REGION }}-C Private SN"
        routes:
          - dest: 0.0.0.0/0
            gateway_id: "{{ nat_gateway.nat_gateway_id}}"

    - name: Create Admin SG
      local_action:
        module: ec2_group
        name: "{{ admin_name }}"
        description: "{{ admin_name }}"
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        state: present
      register: admin_sg

    - name: Create Ingress SG
      local_action:
        module: ec2_group
        name: "{{ ingress_name }}"
        description: "{{ ingress_name }}"
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        state: present
      register: ingress_sg

    - pause:
        prompt: "Prevent timing hazard of dependencies"
        seconds: 5

    - name: Create Public Agent SG
      local_action:
        module: ec2_group
        name: "{{ public_agent_name }}"
        description: "{{ public_agent_name }}"
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
      register: public_agent_sg

    - name: Create Private Agent SG
      local_action:
        module: ec2_group
        name: "{{ private_agent_name }}"
        description: "{{ private_agent_name }}"
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        state: present
      register: private_agent_sg

    - name: Create Core Nodes SG
      local_action:
        module: ec2_group
        name: "{{ core_name }}"
        description: "{{ core_name }}"
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        state: present
      register: core_sg

    - name: Admin SG Rules
      local_action:
        module: ec2_group
        name: "{{ admin_name }}"
        description: "{{ admin_name }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: 0.0.0.0/0

    - name: Ingress SG Rules
      local_action:
        module: ec2_group
        name: "{{ ingress_name }}"
        description: "{{ ingress_name }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0

    - name: Public Agents SG Rules
      local_action:
        module: ec2_group
        name: "{{ public_agent_name }}"
        description: "{{ public_agent_name }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          # Admin SSH
          - proto: tcp
            from_port: 22
            to_port: 22
            group_id: "{{ admin_sg.group_id}}"
          # Remoting
          - proto: tcp
            from_port: 2552
            to_port: 2552
            group_id: "{{ core_sg.group_id}}"
          # ELB health check
          - proto: tcp
            from_port: 9009
            to_port: 9009
            group_id: "{{ ingress_sg.group_id }}"
          # Visualizer
          - proto: tcp
            from_port: 9999
            to_port: 9999
            group_id: "{{ ingress_sg.group_id }}"

    - name: Private Agents
      local_action:
        module: ec2_group
        name: "{{ private_agent_name }}"
        description: "{{ private_agent_name }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          # Admin SSH
          - proto: tcp
            from_port: 22
            to_port: 22
            group_id: "{{ admin_sg.group_id}}"
          # Akka Remoting
          - proto: tcp
            from_port: 2552
            to_port: 2552
            group_id: "{{ core_sg.group_id}}"
          # Proxy access
          - proto: tcp
            from_port: 10000
            to_port: 10999
            group_name: "{{ core_sg.group_id }}"
          # Proxy access from ConductR private agents
          - proto: tcp
            from_port: 10000
            to_port: 10999
            group_name: "{{ private_agent_sg.group_id }}"
          # Proxy access from ConductR public agents
          - proto: tcp
            from_port: 10000
            to_port: 10999
            group_name: "{{ public_agent_sg.group_id }}"

    - name: Core Nodes
      local_action:
        module: ec2_group
        name: "{{ core_name }}"
        description: "{{ core_name }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          # Admin SSH
          - proto: tcp
            from_port: 22
            to_port: 22
            group_id: "{{ admin_sg.group_id}}"
          # Status Server, Control Proto, and Service Locator
          # Akka Remoting, Control Protocol, Bundle Stream Server,
          # Status Server and Service Locator
          - proto: tcp
            from_port: 9004
            to_port: 9008
            group_id: "{{ public_agent_sg.group_id }}"
          - proto: tcp
            from_port: 9004
            to_port: 9008
            group_id: "{{ private_agent_sg.group_id }}"
          - proto: tcp
            from_port: 9004
            to_port: 9008
            group_name: "{{ core_sg.group_id }}"

    - name: Launch Bastion Node
      local_action:
        module: ec2
        image: "{{ BASTION_IMAGE }}"
        instance_type: "{{ BASTION_INSTANCE_TYPE }}"
        keypair: "{{ KEYPAIR }}"
        region: "{{ EC2_REGION }}"
        group_id: "{{ admin_sg.group_id }}"
        vpc_subnet_id: "{{ vpc.subnets[0].id }}"
        assign_public_ip: yes
        instance_tags:
          Name: "Lightbend Admin Bastion"
          Role: Bastion Node
        count: 1
        volumes:
          - device_name: /dev/sda1
            device_type: "{{ BASTION_VOL_TYPE }}"
            volume_size: "{{ BASTION_VOL_SIZE }}"
            delete_on_termination: true
        wait: yes
      register: ec2

    - name: Add to bastion_public
      add_host:
        groupname: "bastion_public"
        hostname: "{{ ec2.instances[0].public_ip }}"

    - name: Wait for SSH to come up
      wait_for:
        host: "{{ groups.bastion_public[0] }}"
        port: 22
        delay: 60
        timeout: 320
        state: started

    - name: Create ELB
      local_action:
        module: ec2_elb_lb
        name: "Lightbend-ELB-{{ EC2_REGION }}"
        scheme: internet-facing
        security_group_ids: "{{ ingress_sg.group_id }}"
        state: present
        cross_az_load_balancing: yes
        region: "{{ EC2_REGION }}"
        subnets:
          - "{{ vpc.subnets[0].id }}"
          - "{{ vpc.subnets[1].id }}"
          - "{{ vpc.subnets[2].id }}"
        listeners:
          # Upload a cert to use SSL
          # Example listener for Visualizer 80 -> 9999
          - protocol: http
            load_balancer_port: 80
            instance_port: 9999
        health_check:
            ping_protocol: http
            ping_port: 9009
            ping_path: /status
            response_timeout: 5
            interval: 30
            unhealthy_threshold: 2
            healthy_threshold: 3
      register: elb

    - debug: msg="ELB zone name {{ elb.elb.dns_name }}"

    - debug: msg="Add listeners to {{ elb.elb.dns_name }} to expose bundle endpoints"

    - debug: msg="Upload x.509 certificate to ELB for SSL endpoints"

    - name: Create vars file
      template:
        src: templates/vars-private-agent.j2
        dest: "vars/{{ EC2_REGION }}_private_agent_vars.yml"

    - debug: msg="Vars file vars/{{ EC2_REGION }}_private_agent_vars.yml created"

- name: Setup Bastion
  hosts: bastion_public
  user: "ubuntu"
  gather_facts: False
  sudo: True

  vars:
   REMOTE_USER: "ubuntu"

  vars_files:
    - "vars/{{ EC2_REGION }}_private_agent_vars.yml"

  tasks:
    - include: python/tasks/main.yml
    - include: ntp/tasks/main.yml
    - include: ansible/tasks/setup-ansible.yml
    - include: conductr/tasks/install-cli-pip.yml
    - include: java/tasks/openjdk.yml
    - include: system/tasks/update-ubuntu.yml

# Copy to Bastion to complete:
# * ConductR and ConductR-Agent systemd deb files
# * Private PEM key for nodes
# * .dockercfg for nodes, if needed
# * lightbend commercial.credentials
# * access token
# * vars file from network creation
#
# Export to Env
# * AWS Keys
# * Source Ansible hacking/env-setup
# * Disable host checking with export ANSIBLE_HOST_KEY_CHECKING=False
#
# Run build cluster play from bastion
# Build Cluster `nohup ansible-playbook build-private-agent-cluster-ec2.yml -e "VARS_FILE=vars/{{EC2_REGION}}_vars.yml" --private-key /path/to/{{keypair}} > build_private_cluster.out &`