Skip to content

Commit aed2798

Browse files
wmudgejimright
wmudge
and
jimright
authored
Create CDP Private Cloud Base on AWS IaaS definition (#136)
* Initial commit of PvC on AWS * Update README and revert to cloudera.infra FreeIPA roles * Update database version and README * Add example for PvC Base on AWS * Update to support 7.1.9 cluster * Update requirements for length of name_prefix * Add Terraform module for bastion host * Add Terraform module for cluster assets * Update .gitignore for Terraform artifacts * Remove CDP credentials and add and mount SSH private key file in the Ansible Navigator configuration * Remove config.yml and add config-template.yml * Update to include basic security group for intra-cluster * Add intra-cluster security group roles for ingress and egress * Refactor tf_cluster to tf_hosts, limiting scope to only instances * Update tf_bastion * Create tf_network to manage cluster networking only * Create tf_proxied_cluster root module * Update tf_bastion output to remove nested values * Add missing terraform stanza and output variable for hosts for tf_hosts * Update tf_proxied_cluster for Ansible inventory * Set ansible_ssh_private_key_file to the SSH_PRIVATE_KEY_FILE environment variable * Refactor pre_setup_resource.yml playbook into the local role, cluster_reqs * Add Terraform variables template for infrastructure * Update tf_bastion to accept an outside AMI image id * Update AMI image to RHEL 8.6 * Add domain for Ansible hosts * Add VPC to output * Add domain to variables * Add license header * Add Terraform inventory plugin * Remove cloudera.exe.provision assets * Remove legacy infrastructure configuration and update FreeIPA parameters * Update config-template.yml and README for Terraform inventory execution * Update cluster_reqs role for pre/post-distribution tasks * Update instance names for deployment * Remove IPA_USER and IPA_PASSWORD dependencies. Update KRB and LDAP parameters. * Add deployment summary artifacts * Update README for summary playbook and "all-in-one" option * Move to base/aws-iaas directory. * Remove ecs-on-aws example (future work) * Update LDAP references for Ranger and Atlas * Add summary playbook for post-installation use * Update CA Subject for FreeIPA server * Fix errant prefix variable Signed-off-by: Jim Enright <jenright@cloudera.com> Signed-off-by: Webster Mudge <wmudge@cloudera.com> Co-authored-by: Jim Enright <jenright@cloudera.com>
1 parent bcf6e21 commit aed2798

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+2801
-0
lines changed

‎private-cloud/base/aws-iaas/.gitignore‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Copyright 2023 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Ansible Navigator assets
16+
ansible-navigator.log
17+
runs
18+
context
19+
20+
# Terraform deployments
21+
tf_deployment*
22+
23+
# Local .terraform directories
24+
**/.terraform/*
25+
26+
# .tfstate files
27+
*.tfstate
28+
*.tfstate.*
29+
30+
# .lock files
31+
*.terraform.lock.hcl
32+
33+
# .tfvars files
34+
*.tfvars
35+
36+
# Static inventory files
37+
inventory_static*
38+
39+
# Per-user configuration files
40+
config.yml
41+
42+
# Per-deployment artifacts
43+
*-DEPLOYMENT.html
44+
*-DEPLOYMENT.md
45+
*.ca.crt

‎private-cloud/base/aws-iaas/README.md‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
# PvC Base Cluster on AWS IaaS
2+
3+
> Constructs a CDP Private Cloud Base cluster running on AWS IaaS.
4+
5+
## Known Issues
6+
7+
| Issue | Description | Workaround |
8+
|-------|-------------|------------|
9+
| Cluster instances unavailable after the `external_setup.yml` Playbook | The cluster EC2 instances become unavailable after the `external_setup.yml` Playbook. During subsequent playbooks the hosts becomes unreachable and in the EC2 console the VM instances fail the reachability health check. | Restart the EC2 instances via the console. |
10+
11+
## Requirements
12+
13+
To run, you need:
14+
15+
* Docker (or a Docker alternative)
16+
* `ansible-navigator`
17+
* AWS credentials
18+
* CDP Private Cloud Base license file
19+
* SSH key(s) for bastion/jump host and cluster
20+
21+
### Configuration Variables
22+
23+
Configuration is passed via environment variables and an user-managed configuration file.
24+
25+
#### Environment Variables
26+
27+
* Set up the following definition environment variables:
28+
29+
| Variable | Description | Status |
30+
|----------|-------------|--------|
31+
| `SSH_PUBLIC_KEY_FILE` | File path to the SSH public key that will be uploaded to the cloud provider (using the `name_prefix` variable as the key label). E.g. `/Users/example/.ssh/demo_ops.pub` | Mandatory |
32+
| `SSH_PRIVATE_KEY_FILE` | File path to the SSH private key. E.g. `/Users/example/.ssh/demo_ops` | Mandatory |
33+
| `CDP_LICENSE_FILE` | File path to a CDP Private Cloud Base license. E.g. `/Users/example/Documents/example_cloudera_license.txt` | Mandatory |
34+
| `AWS_PROFILE` | The profile label for your AWS credentials. Otherwise, use the associated `AWS_*` parameters. | Mandatory |
35+
36+
#### Configuration file variables
37+
38+
Copy `config-template.yml` to `config.yml` and edit this user-facing configuration file to match your particular deployment.
39+
40+
> [!IMPORTANT]
41+
> `name_prefix` should be 4-7 characters and is the "primary key" for the deployment.
42+
43+
```yaml
44+
name_prefix: "{{ mandatory }}" # Unique identifier for the deployment
45+
infra_region: "us-east-2"
46+
domain: "{{ name_prefix }}.cldr.example" # The deployment subdomain
47+
realm: "CLDR.DEPLOYMENT" # The Kerberos realm
48+
common_password: "Example776" # For external services
49+
admin_password: "Example776" # For Cloudera-related services
50+
deployment_tags:
51+
deployment: "{{ name_prefix }}"
52+
deploy-tool: cloudera-deploy
53+
```
54+
55+
## Execution
56+
57+
## All-in-One
58+
59+
You can run all of the following steps at once, if you wish:
60+
61+
```bash
62+
ansible-navigator run \
63+
pre_setup.yml \
64+
external_setup.yml \
65+
internal_setup.yml \
66+
base_setup.yml \
67+
summary.yml \
68+
-e @definition.yml \
69+
-e @config.yml
70+
```
71+
72+
### Pre-setup Playbook
73+
74+
This definition-specific playbook includes tasks such as:
75+
76+
* Instructure provisioning
77+
* FreeIPA DNS and KRB services provisioning
78+
79+
Run the following command
80+
81+
```bash
82+
ansible-navigator run pre_setup.yml \
83+
-e @definition.yml \
84+
-e @config.yml
85+
```
86+
87+
Once the pre-setup playbook completes confirm that:
88+
89+
* You can connect to each node via the inventory - see [Confirm SSH Connectivity](#confirm-ssh-connectivity) for help. You can also run `ansible-navigator run validate_dns_lookups.yml` to check connectivity and DNS.
90+
* Connect to FreeIPA UI and login with the `IPA_USER` and `IPA_PASSWORD` credentials in the configuration file. See [Cluster Access](#cluster-access) for details.
91+
92+
### Platform Playbooks
93+
94+
These playbooks configure and deploy PVC Base. They use the infrastructure provisioned.
95+
96+
Tasks include:
97+
98+
* System/host configuration
99+
* Cloudera Manager server and agent installation and configuration
100+
* Cluster template imports
101+
102+
Run the following:
103+
104+
```bash
105+
# Run the 'external' system configuration
106+
ansible-navigator run external_setup.yml \
107+
-e @definition.yml \
108+
-e @config.yml
109+
```
110+
111+
```bash
112+
# Run the 'internal' Cloudera installations and configurations
113+
ansible-navigator run internal_setup.yml \
114+
-e @definition.yml \
115+
-e @config.yml
116+
```
117+
118+
```bash
119+
# Run the Cloudera cluster configuration and imports
120+
ansible-navigator run base_setup.yml \
121+
-e @definition.yml \
122+
-e @config.yml
123+
```
124+
125+
```bash
126+
# Produce a deployment summary and retrieve the FreeIPA CA certificate
127+
ansible-navigator run summary.yml \
128+
-e @definition.yml \
129+
-e @config.yml
130+
```
131+
132+
## Cluster Access
133+
134+
Once the cluster is up, you can access all of the UIs within, including the FreeIPA sidecar, via a SSH tunnel:
135+
136+
```bash
137+
ssh -D 8157 -q -C -N ec2-user@<IP address of jump host>
138+
```
139+
140+
Use a SOCKS5 proxy switcher in your browser (an example is the SwitchyOmega browser extension).
141+
142+
In the SOCKS5 proxy configuration, set _Protocol_ to `SOCKS5`, _Server_ to `localhost`, and _Port_ to `8157`. Ensure the SOCKS5 proxy is active when clicking on the CDP UI that you wish to access.
143+
144+
> [!CAUTION]
145+
> You will get a SSL warning for the self-signed certificate; this is expected given this particular definition as the local FreeIPA server has no upstream certificates. However, you can install this CA certificate to remove this notification.
146+
147+
In addition, you can log into the jump host via SSH and get to any of the servers within the cluster. Remember to forward your SSH key!
148+
149+
```bash
150+
ssh -A -C -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ec2-user@<IP address of jump host>
151+
```
152+
153+
> [!NOTE]
154+
> The above assume you are using the default AMI image set in the Terraform configuration. If not, adjust the SSH user appropriately.
155+
156+
## Teardown
157+
158+
Run the following:
159+
160+
```bash
161+
ansible-navigator run pre_teardown.yml \
162+
-e @definition.yml \
163+
-e @config.yml
164+
```
165+
166+
You can also run the direct Terraform command:
167+
168+
```bash
169+
ansible-navigator exec -- terraform -chdir=tf_proxied_cluster destroy -auto-approve
170+
```
171+
172+
## Troubleshooting
173+
174+
### Confirm SSH Connectivity
175+
176+
Run the following:
177+
178+
```bash
179+
ansible-navigator exec -- ansible -m ansible.builtin.ping -i inventory.yml all
180+
```
181+
182+
This will check to see if the inventory file is well constructed and the hosts are available via SSH.

‎private-cloud/base/aws-iaas/ansible-navigator.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Copyright 2023 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
ansible-navigator:
18+
playbook-artifact:
19+
save-as: "runs/{playbook_name}-{time_stamp}.json"
20+
21+
ansible-runner:
22+
artifact-dir: runs
23+
rotate-artifacts-count: 3
24+
25+
logging:
26+
level: debug
27+
append: False
28+
29+
ansible:
30+
inventory:
31+
entries:
32+
- inventory.yml
33+
34+
execution-environment:
35+
container-engine: docker
36+
enabled: True
37+
environment-variables:
38+
pass:
39+
- AWS_PROFILE
40+
- SSH_PUBLIC_KEY_FILE
41+
- SSH_PRIVATE_KEY_FILE
42+
- CDP_LICENSE_FILE
43+
#- IPA_USER
44+
#- IPA_PASSWORD
45+
set:
46+
ANSIBLE_SSH_CONTROL_PATH: "/dev/shm/cp%%h-%%p-%%r"
47+
ANSIBLE_CALLBACK_WHITELIST: "ansible.posix.profile_tasks"
48+
ANSIBLE_GATHERING: "smart"
49+
ANSIBLE_DEPRECATION_WARNINGS: False
50+
ANSIBLE_HOST_KEY_CHECKING: False
51+
ANSIBLE_SSH_RETRIES: 10
52+
image: ghcr.io/cloudera-labs/cldr-runner:aws-latest
53+
pull:
54+
arguments:
55+
- "--tls-verify=false"
56+
volume-mounts:
57+
- src: "${SSH_PUBLIC_KEY_FILE}"
58+
dest: "${SSH_PUBLIC_KEY_FILE}"
59+
- src: "${SSH_PRIVATE_KEY_FILE}"
60+
dest: "${SSH_PRIVATE_KEY_FILE}"
61+
- src: "${CDP_LICENSE_FILE}"
62+
dest: "${CDP_LICENSE_FILE}"
63+
- src: "~/.aws"
64+
dest: "/runner/.aws"
65+
options: "Z"
66+
- src: "~/.ssh"
67+
dest: "/runner/.ssh"
68+
options: "Z"
69+
container-options:
70+
- "--network=host"

‎private-cloud/base/aws-iaas/base_postfix.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Copyright 2023 Cloudera, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
---
16+
17+
- name: Postfix CDP Private Cloud clusters
18+
hosts: localhost
19+
connection: local
20+
gather_facts: yes
21+
vars:
22+
definition_path: "./"
23+
tasks:
24+
- name: Set of deployment variables from definition.yml
25+
ansible.builtin.include_role:
26+
name: cloudera.exe.init_deployment
27+
public: yes
28+
when: init__completed is undefined
29+
30+
- name: Prepare inventory for PvC Plays
31+
ansible.builtin.include_role:
32+
name: cloudera.exe.init_deployment
33+
public: yes
34+
tasks_from: prep_pvc.yml
35+
tags:
36+
- always
37+
38+
- name: Init run tasks for all nodes
39+
hosts: all
40+
gather_facts: no
41+
tasks:
42+
- name: Group hosts by host template and TLS
43+
ansible.builtin.include_role:
44+
name: cloudera.cluster.deployment.groupby
45+
46+
- name: Check connectivity to Inventory
47+
ansible.builtin.wait_for_connection:
48+
tags:
49+
- always
50+
51+
- name: Postfix clusters for CDP Private Cloud
52+
ansible.builtin.import_playbook: cloudera.exe.pvc_base_postfix.yml

0 commit comments

Comments
 (0)