Droid Basement

Note: This is a duplicate of the AWS Lightsail article, modified for EC2 with some additional amendments.

In this article we will Provision an EC2 host with docker/docker-compose on it using Terraform and install/initialize OpenShift Origin on it using Ansible.

OpenShift is Red Hat’s containerization platform which utilizes Kubernetes. Origin (what we will be working with here) is the opensource implementation of it.

We will use ‘myweb’ as an example in this article, using the same base path of ‘dev’ that was previously created, the container-admin group and using ~/.local/bin for the binaries.

Please ensure you have gone through the previous Terraform, Ansible and related preceding articles.

Please use ‘AWS Free Tier‘ prior to commencing with this article.

–>
Go in to the dev directory/link located within your home directory:

$ cd ~/dev

Update PIP:

$ python3 -m pip install --upgrade --user pip

If there was an update, then forget remembered location references in the shell environment:

$ hash -r pip 

Upgrade the AWS CLI on your host:

$ pip3 install awscli --upgrade --user && chmod 754 ~/.local/bin/aws

Install/Upgrade Ansible:

$ pip3 install ansible --upgrade --user && chmod 754 ~/.local/bin/ansible ~/.local/bin/ansible-playbook

Install/Upgrade Boto3:

$ pip3 install boto3 --upgrade --user

Grab the latest version of Terraform:

$ wget https://releases.hashicorp.com/terraform/0.12.23/terraform_0.12.23_linux_amd64.zip

Unzip it to ~/.local/bin and set permissions accordingly on it (type y and hit enter to replace if upgrading, at the prompt):

$ unzip terraform_0.12.23_linux_amd64.zip -d ~/.local/bin && chmod 754 ~/.local/bin/terraform

Change to the myweb directory inside terraform/aws:

$ cd terraform/aws/myweb

Change our instance from a micro to a medium, so it will have sufficient resources to run OpenShift Origin and related:

$ sed -i s:t3a.micro:t3a.medium: ec2.tf

Output the Public IP of the Provisioned host (along with connection parameters and variables) in to a file which we will feed in to an Ansible playbook run.

Note: Please re-create the file if you have went through the previous Terraform articles:

$ cat << 'EOF' > output.tf
> output "static_public_ip" {
>   value = var.lightsail ? element(aws_lightsail_static_ip.myweb[*].ip_address, 0) : element(aws_eip.external[*].public_ip, 0)
> }
>
> resource "local_file" "hosts" {
>   content              = trimspace("[vps]\n${var.lightsail ? element(aws_lightsail_static_ip.myweb[*].ip_address, 0) : element(aws_eip.external[*].public_ip, 0)} ansible_connection=ssh ansible_user=ubuntu ansible_ssh_private_key_file=~/.ssh/${var.prefix} instance=${var.lightsail ? element(aws_lightsail_instance.myweb[*].name, 0) : element(aws_instance.myweb[*].tags["Name"], 0)} ${var.lightsail ? "" : "instance_sg=${element(aws_security_group.myweb[*].name, 0)}"} ${var.lightsail ? "" : "instance_sg_id=${element(aws_security_group.myweb[*].id, 0)}"} ${var.lightsail ? "" : "instance_vpc_id=${element(aws_vpc.myweb[*].id, 0)}"}")
>   filename             = pathexpand("~/dev/ansible/hosts-aws")
>   directory_permission = 0754
>   file_permission      = 0664
> }
> EOF

Amend an item from the user_data script (if you have went through the AWS/Terraform/Ansible/OpenShift against Lightsail article then this can be disregarded):

$ sed -i 's:sudo apt-key add -:apt-key add -:' scripts/install.sh

Initialize the directory/refresh module(s):

$ terraform init

Run a dry-run to see what will occur:

$ terraform plan -var 'lightsail=false'

Provision:

$ terraform apply -var 'lightsail=false' -auto-approve

Create a work folder for an Ansible playbook:

$ cd ../../../ansible
$ mkdir -p openshift/scripts && cd openshift

Create an Ansible playbook which will install/initialize OpenShift Origin on our provisioned host.

Note: This accommodates our previous implementation against AWS Lightsail and Microsoft Azure VM:

$ cat << 'EOF' > openshift.yml 
> # Install, initialize OpenShift Origin and create a destroy routine for it
> # This is a unified setup against AWS Lightsail, Microsoft Azure VM and AWS EC2
> ---
> - hosts: vps
>   connection: local
>
>   vars:
>     network_security_group: "{{ hostvars[groups['vps'][0]].instance_nsg }}"
>     instance: "{{ hostvars[groups['vps'][0]].instance }}"
>     resource_group: "{{ hostvars[groups['vps'][0]].instance_rg }}"
>     security_group: "{{ hostvars[groups['vps'][0]].instance_sg }}"
>     security_group_id: "{{ hostvars[groups['vps'][0]].instance_sg_id }}"
>     virtual_private_cloud_id: "{{ hostvars[groups['vps'][0]].instance_vpc_id }}"
>     openshift_directory: /home/ubuntu/.local/etc/openshift
>     ansible_python_interpreter: /usr/bin/python3
>
>   tasks:
>     - name: Discover Services
>       service_facts:
>
>     - name: Check if openshift directory exists
>       stat:
>         path: "{{ openshift_directory }}"
>       register: openshift_dir
>       tags: [ 'destroy' ]
>
>     - name: Open Firewall Ports (AWS Lightsail)
>       delegate_to: localhost
>       args:
>         executable: /bin/bash
>       script: "./scripts/firewall.sh open {{ instance }}"
>       when:
>         - "'instance_nsg' not in hostvars[groups['vps'][0]]"
>         - "'instance_sg' not in hostvars[groups['vps'][0]]"
>         - "'docker' in services"
>         - openshift_dir.stat.exists == False
>
>     - name: Add Network Security Group rules (Microsoft Azure VM)
>       delegate_to: localhost
>       azure_rm_securitygroup:
>         name: "{{ network_security_group }}"
>         resource_group: "{{ resource_group }}"
>         rules:
>          - name: OpenShift-Tcp
>            priority: 1002
>            direction: Inbound
>            access: Allow
>            protocol: Tcp
>            source_port_range: "*"
>            destination_port_range:
>              - 80
>              - 443
>              - 1936
>              - 4001
>              - 7001
>              - 8443
>              - 10250-10259
>            source_address_prefix: "*"
>            destination_address_prefix: "*"
>          - name: OpenShift-Udp
>            priority: 1003
>            direction: Inbound
>            access: Allow
>            protocol: Udp
>            source_port_range: "*"
>            destination_port_range:
>              - 53
>              - 8053
>            source_address_prefix: "*"
>            destination_address_prefix: "*"
>        state: present
>      when:
>        - "'instance_nsg' in hostvars[groups['vps'][0]]"
>        - "'instance_sg' not in hostvars[groups['vps'][0]]"
>        - "'docker' in services"
>        - openshift_dir.stat.exists == False
>
>    - name: Add Security Group rules (AWS EC2)
>      delegate_to: localhost
>      ec2_group:
>        name: "{{ security_group }}"
>        description: OpenShift
>        vpc_id: "{{ virtual_private_cloud_id }}"
>        purge_rules: no
>        rules:
>         - proto: tcp
>           ports:
>             - 80
>             - 443
>             - 1936
>             - 4001
>             - 7001
>             - 8443
>             - 10250-10259
>           cidr_ip: 0.0.0.0/0
>           rule_desc: OpenShift-Tcp
>         - proto: udp
>           ports:
>             - 53
>             - 8053
>           cidr_ip: 0.0.0.0/0
>           rule_desc: OpenShift-Udp
>       state: present
>     when:
>       - "'instance_nsg' not in hostvars[groups['vps'][0]]"
>       - "'instance_sg' in hostvars[groups['vps'][0]]"
>       - "'docker' in services"
>       - openshift_dir.stat.exists == False
>
>   - name: Copy and Run install
>     environment:
>       PATH: "{{ ansible_env.PATH}}:{{ openshift_directory }}/../../bin"
>     args:
>       executable: /bin/bash
>     script: "./scripts/install.sh {{ ansible_ssh_host }}"
>     when:
>       - "'docker' in services"
>       - openshift_dir.stat.exists == False
>
>   - debug: msg="Please install docker to proceed."
>     when: "'docker' not in services"
>
>   - debug: msg="Install script has already been completed.  Run this playbook with the destroy tag, then run once again normally to re-intialize openshift."
>     when: openshift_dir.stat.exists == True
>
>   - name: Destroy
>     become: yes
>     environment:
>       PATH: "{{ ansible_env.PATH }}:{{ openshift_directory }}/../../bin"
>     args:
>       executable: /bin/bash
>     shell:
>       "cd {{ openshift_directory }} && oc cluster down && cd ../ && rm -rf {{ openshift_directory }}/../../../.kube {{ openshift_directory }}"
>     when: openshift_dir.stat.exists == True
>     tags: [ 'never', 'destroy' ]
>
>   - name: Close Firewall Ports (AWS Lightsail)
>     delegate_to: localhost
>     args:
>       executable: /bin/bash
>     script: "./scripts/firewall.sh close {{ instance }}"
>     when:
>       - "'instance_nsg' not in hostvars[groups['vps'][0]]"
>       - "'instance_sg' not in hostvars[groups['vps'][0]]"
>     tags: [ 'never', 'destroy' ]
>
>   - name: Delete Network Security Group rules (Microsoft Azure VM)
>     delegate_to: localhost
>     command:
>       bash -ic "az-login-sp && (az network nsg rule delete -g {{ resource_group }} --nsg-name {{ network_security_group }} -n {{ item }})"
>     with_items:
>       - OpenShift-Tcp
>       - OpenShift-Udp
>     when:
>       - "'instance_nsg' in hostvars[groups['vps'][0]]"
>       - "'instance_sg' not in hostvars[groups['vps'][0]]"
>     tags: [ 'never', 'destroy' ]
>
>   - name: Delete Security Group rules (AWS EC2)
>     delegate_to: localhost
>     command:
>       bash -c "[[ {{ item }} -eq 53 || {{ item }} -eq 8053 ]] && protocol=udp || protocol=tcp && aws ec2 revoke-security-group-ingress --group-id {{ security_group_id }} --port {{ item }} --protocol $protocol --cidr 0.0.0.0/0"
>     with_items:
>       - 80
>       - 443
>       - 1936
>       - 4001
>       - 7001
>       - 8443
>       - 10250-10259
>       - 53
>       - 8053
>     when:
>       - "'instance_nsg' not in hostvars[groups['vps'][0]]"
>       - "'instance_sg' in hostvars[groups['vps'][0]]"
>     tags: [ 'never', 'destroy' ]
> EOF

Create a shell script which will pull the latest release of client tools from GitHub, place the needed binaries in ~/.local/bin, set insecure registry on Docker and initialize (if you have went through the AWS/Terraform/Ansible/OpenShift against Lightsail article then this can be disregarded):

$ cat << 'EOF' > scripts/install.sh
> #!/bin/bash
> [[ -z $* ]] && { echo "Please specify a Public IP or Host/Domain name." && exit 1; }
> # Fetch and Install
> file_url="$(curl -sL https://github.com/openshift/origin/releases/latest | grep "download.*client.*linux-64" | cut -f2 -d\" | sed 's/^/https:\/\/github.com/')"
> [[ -z $file_url ]] && { echo "The URL could not be obtained.  Please try again shortly." && exit 1; }
> file_name="$(echo $file_url | cut -f9 -d/)"
> if [[ ! -f $file_name ]]; then
>         curl -sL $file_url --output $file_name
>         folder_name="$(tar ztf $file_name 2>/dev/null | head -1 | sed s:/.*::)"
>         [[ -z $folder_name ]] && { echo "The archive could not be read.  Please try again." && rm -f $file_name && exit 1; }
>         tar zxf $file_name
>         mv $folder_name/oc $folder_name/kubectl $HOME/.local/bin && rm -r $folder_name
>         chmod 754 $HOME/.local/bin/oc $HOME/.local/bin/kubectl
> fi
> # Docker insecure
> [[ $(grep insecure /etc/docker/daemon.json &>/dev/null; echo $?) -eq 2 ]] && redirect=">"
> [[ $(grep insecure /etc/docker/daemon.json &>/dev/null; echo $?) -eq 1 ]] && redirect=">>"
> [[ $(grep insecure /etc/docker/daemon.json &>/dev/null; echo $?) -eq 0 ]] || { sudo bash -c "cat << 'EOF' $redirect /etc/docker/daemon.json
> {
>         \"insecure-registries\" : [ \"172.30.0.0/16\" ]
> }
> EOF" && sudo systemctl restart docker; }
> # OpenShift Origin up
> [[ ! -d $HOME/.local/etc/openshift ]] && { mkdir -p $HOME/.local/etc/openshift && cd $HOME/.local/etc/openshift; } || { cd $HOME/.local/etc/openshift && oc cluster down; }
> oc cluster up --public-hostname=$1
>
> exit 0
> EOF 

Note: If you have already went through the AWS/Terraform/Ansible/OpenShift for Lightsail article or you don’t want to use Lightsail, then this can be disregarded.

The Lightsail firewall functionality is currently being implemented in Terraform and is not available in Ansible. In the interim, we will create a shell script to open and close ports needed by OpenShift Origin (using the AWS CLI). This script will be run locally via the Playbook during the create and destroy routines.

Note2: Port 80 is already open when the Lightsail host is provisioned:

$ cat << 'EOF' > scripts/firewall.sh && chmod 754 scripts/firewall.sh
> #!/bin/bash
> #
> openshift_ports="53/UDP 443/TCP 1936/TCP 4001/TCP 7001/TCP 8053/UDP 8443/TCP 10250_10259/TCP"  
> #
> [[ -z $* || $(echo $* | xargs -n1 | wc -l) -ne 2 || ! ($* =~ $(echo '\<open\>') || $* =~ $(echo '\<close\>')) ]] && { echo "Please pass in the desired action [ open, close ] and instance [ site_myweb ]." && exit 2; }
> #
> instance="$(echo $* | xargs -n1 | sed '/\<open\>/d; /\<close\>/d')"
> [[ -z $instance ]] && { echo "Please double-check the passed in instance." && exit 1; }
> action="$(echo $* | xargs -n1 | grep -v $instance)"
> #
> for port in $openshift_ports; do
>         aws lightsail $action-instance-public-ports --instance $instance --port-info fromPort=$(echo $port | cut -f1 -d_ | cut -f1  -d/),protocol=$(echo $port | cut -f2 -d/),toPort=$(echo $port | cut -f2 -d_ | cut -f1 -d/)
> done
> #
>
> exit 0
> EOF 

Run the Ansible playbook after a few minutes (accept the host key by typing yes and hitting enter when prompted):

$ ansible-playbook -i ../hosts-aws openshift.yml

Note: Disregard the warning regarding mismatch descriptions on the Security Group. This will not be modified so the original description was not exported out to be used here.

Note2: If a Terraform apply is run again after the security group modification (addition of rules for OpenShift), then those rules will be destroyed. In that case, please run a Playbook destroy then run again to reinitialize.

After a short while, log on to the instance:

$ ssh -i ~/.ssh/myweb ubuntu@<The value of static_public_ip that was reported.  One can also use 'terraform output static_public_ip' to print it again.>

To get an overview of the current project with any identified issues:

$ oc status --suggest

Log on as Admin via CMD Line and switch to the default project:

$ oc login -u system:admin -n default

Logout of the session:

$ oc logout

Please see the Command-Line Walkthrough.

Logout from the host:

$ logout

Log on as Admin via Web Browser (replace <PUBLIC_IP>):

https://<PUBLIC_IP>:8443/console (You will get a Certificate/Site warning due to a mismatch).

Please see the Web Console Walkthrough.

To shut down the OpenShift Origin cluster, destroy the working folder and start anew (you can re-run the playbook normally to reinitialize):

$ ansible-playbook -i ../hosts openshift.yml --tags "destroy"

Tear down what was created by first performing a dry-run to see what will occur:

$ cd ../../terraform/aws/myweb && terraform plan -var 'lightsail=false' -destroy 

Tear down the instance:

$ terraform destroy -var 'lightsail=false' -auto-approve

<–

References:
how-to-install-openshift-origin-on-ubuntu-18-04

Source:
ansible_openshift

Note: Some of this is a duplicate of the AWS Lightsail article; modified for EC2.

EC2 is the compute service in AWS. It is flexible, adaptable, scalable and is able to run Virtual Machine workloads to fit most every need.

In this article we will use Ansible (Infrastructure as Code) to swiftly bring up an AWS EC2 instance in us-east-1 on a static IP (Elastic IP), in a new VPC with an Internet Gateway, add a DNS Zone (Route 53) for the site in mention and install docker/docker-compose on it.

We will use ‘myweb’ as an example in this article, using the same base path of ‘dev’ that was previously created, the container-admin group (some of the IAM policy implemented there will be in use here) and using ~/.local/bin|lib for the binaries/libraries.

Please use ‘AWS Free Tier‘ prior to commencing with this article.

–>
Go in to the dev directory/link located within your home directory:

$ cd ~/dev

Install/Upgrade Ansible:

$ pip3 install ansible --upgrade --user && chmod 754 ~/.local/bin/ansible ~/.local/bin/ansible-playbook

Install/Upgrade Boto3:

$ pip3 install boto3 --upgrade --user

Install/Upgrade Boto (required by ec2_eip):

$ pip3 install boto --upgrade --user

Create a work folder and change in to it:

$ mkdir -p ansible/myweb/scripts && cd ansible/myweb

Add an IAM Policy to the container-admin group so it will have access to EC2 and related (EIP/VPC/Routes/IGW/Route 53/SG/KeyPair):
AWS UI Console -> Services -> Security, Identity, & Compliance -> IAM -> Policies -> Create Policy -> JSON (replace <AWS ACCOUNT ID> in the Resource arn with your Account’s ID (shown under the top right drop-down (of your name) within the My Account page next to the Account Id: under Account Settings)).

Note: This is identical to the section in the AWS/Terraform article, but adds an allowance for route53:ListHostedZones, ec2:DescribeInstanceStatus and ec2:UpdateSecurityGroupRuleDescriptionsEgress:

 {
     "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Action": [
                 "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                 "ec2:TerminateInstances",
                 "route53:GetChange",
                 "route53:GetHostedZone",
                 "route53:ChangeTagsForResource",
                 "route53:DeleteHostedZone",
                 "route53:ListTagsForResource" 
             ],
             "Resource": [
                "arn:aws:ec2:*:<AWS ACCOUNT ID>:security-group/",
                "arn:aws:ec2:*:<AWS ACCOUNT ID>:instance/*",
                "arn:aws:route53:::hostedzone/*",
                "arn:aws:route53:::change/*"
             ]      
         },
         {
             "Effect": "Allow",
             "Action": [
                 "ec2:DisassociateAddress",
                 "ec2:DeleteSubnet",
                 "ec2:DescribeAddresses",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceAttribute",
                 "ec2:CreateVpc",
                 "ec2:AttachInternetGateway",
                 "ec2:DescribeVpcAttribute",
                 "ec2:AssociateRouteTable",
                 "ec2:DescribeInternetGateways",
                 "ec2:DescribeNetworkInterfaces",
                 "ec2:CreateInternetGateway",
                 "ec2:CreateSecurityGroup",
                 "ec2:DescribeVolumes",
                 "ec2:DescribeAccountAttributes",
                 "ec2:ModifyVpcAttribute",
                 "ec2:DescribeKeyPairs",
                 "ec2:DescribeNetworkAcls",
                 "ec2:DescribeRouteTables",
                 "ec2:DescribeInstanceStatus",
                 "ec2:ReleaseAddress",
                 "ec2:ImportKeyPair",
                 "ec2:DescribeTags",
                 "ec2:DescribeVpcClassicLinkDnsSupport",
                 "ec2:CreateRouteTable",
                 "ec2:DetachInternetGateway",
                 "ec2:DisassociateRouteTable",
                 "ec2:AllocateAddress",
                 "ec2:DescribeInstanceCreditSpecifications",
                 "ec2:DescribeSecurityGroups",
                 "ec2:DescribeVpcClassicLink",
                 "ec2:DescribeImages",
                 "ec2:DescribeVpcs",
                 "ec2:DeleteVpc",
                 "ec2:AssociateAddress",
                 "ec2:CreateSubnet",
                 "ec2:DescribeSubnets",
                 "ec2:DeleteKeyPair",
                 "route53:CreateHostedZone",
                 "route53:ListHostedZones",
                 "sts:GetCallerIdentity"
             ],
             "Resource": "*"
         }
     ]
 }

Review Policy ->

Name: AllowEC2
Description: Allow access to EC2 and related.

Create Policy.

Groups -> container-admin -> Attach Policy -> Search for AllowEC2 -> Attach Policy.

Generate an SSH Key Pair (no password) and restrict permissions on it:

$ ssh-keygen -q -t rsa -b 2048 -N '' -f ~/.ssh/myweb && chmod 400 ~/.ssh/myweb

Create a hosts file and specify localhost:

$ cat << 'EOF' > hosts
> [local]
> localhost
> EOF

The following is performed with this script/code:

• create a Route 53 DNS Zone of myweb.com (no A records will be added)
• create a Virtual Private Cloud for network 10.0.0.0/16 (tenancy is default)
• add a subnet of 10.0.1.0/24 within the VPC
• allocate a static Public IP
• create a Security Group and add a Security rule for allowing SSH (port 22) Inbound
• create an Internet Gateway and add a route out to it
• create a T3a.micro instance (tenancy is default) based off of Ubuntu 18_04, our public key added as authorized and reference an extraneous file for user_data (initialization script on Virtual Machine boot). Elastic/Root Block Store is GP2
• DNS support is enabled but DNS host names is not
• tag all resources

Note: assign_public_ip was needed (an assignment at boot from the Amazon pool) so as not to disrupt user_data execution, due to Elastic IP (Static) being bound a bit later:

$ cat << 'EOF' > aws_ec2.yml
> # Create an AWS EC2 instance and add a way to destroy it
> ---
> - hosts: local
>   connection: local
>
>   vars:
>     region: us-east-1
>     prefix: myweb
>     subnet_name: internal
>
>   tasks:
>   - name: Create a DNS Zone
>     route53_zone:
>       state: present
>       zone: "{{ prefix }}.com"
>       comment: "{{ prefix }}-dn"
>
>   - name: Create a Virtual Private Cloud
>     ec2_vpc_net:
>       state: present
>       name: "{{ prefix }}-vpc"
>       cidr_block: 10.0.0.0/16
>       region: "{{ region }}"
>       dns_hostnames: no
>       tenancy: default
>       tags:
>           Site: "{{ prefix }}.com"
>           Name: "{{ prefix }}-vpc"
>     register: vpc
>
>   - name: Create a Security Group and allow inbound port(s)
>     ec2_group:
>       state: present
>       name: "{{ prefix }}"
>       description: Allow Ports
>       vpc_id: "{{ vpc.vpc.id }}"
>       region: "{{ region }}"
>       rules:
>         - proto: tcp
>           from_port: 22
>           to_port: 22
>           cidr_ip: 0.0.0.0/0
>           rule_desc: SSH
>       rules_egress:
>         - proto: -1
>           from_port: 0
>           to_port: 0
>           cidr_ip: 0.0.0.0/0
>           rule_desc: All
>       tags:
>           Site: "{{ prefix }}.com"
>           Name: "{{ prefix }}-sg"
>     register: sg
>
>   - name: Add a Subnet
>     ec2_vpc_subnet:
>       state: present
>       vpc_id: "{{ vpc.vpc.id }}"
>       cidr: 10.0.1.0/24
>       region: "{{ region }}"
>       az: "{{ region }}a"
>       tags:
>           Site: "{{ prefix }}.com"
>           Name: "{{ subnet_name }}"
>     register: internal
>
>   - name: Create an Internet Gateway
>     ec2_vpc_igw:
>       state: present
>       vpc_id: "{{ vpc.vpc.id }}"
>       region: "{{ region }}"
>       tags:
>           Site: "{{ prefix }}.com"
>           Name: "{{ prefix }}-igw"
>     register: igw
>
>   - name: Add a route to the Internet Gateway
>     ec2_vpc_route_table:
>       state: present
>       vpc_id: "{{ vpc.vpc.id }}"
>       region: "{{ region }}"
>       subnets: "{{ internal.subnet.id }}"
>       routes:
>         - dest: 0.0.0.0/0
>           gateway_id: "{{ igw.gateway_id }}"
>       tags:
>           Site: "{{ prefix }}.com"
>           Name: "{{ prefix }}-rt"
>
>   - name: Add Public Key as authorized
>     ec2_key:
>       state: present
>       name: "{{ prefix }}"
>       key_material: "{{ lookup('file', '~/.ssh/{{ prefix }}.pub') }}"
>       region: "{{ region }}"
>
>   - name: Select Ubuntu 18.04
>     ec2_ami_info:
>       region: "{{ region }}"
>       owners: 099720109477 # Canonical
>       filters:
>         name: "ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*"
>     register: ec2_ami
>
>     # Get the latest Ubuntu 18.04 AMI
>   - set_fact:
>       ec2_ami_latest: "{{ ec2_ami.images | selectattr('name', 'defined') | sort(attribute='creation_date') | last }}"
>
>   - name: Create an Ubuntu Virtual Machine with key based access and run a script on boot
>     ec2_instance:
>       state: present
>       name: "{{ prefix }}-ec2"
>       key_name: "{{ prefix }}"
>       region: "{{ region }}"
>       instance_type: t3a.micro
>       image_id: "{{ ec2_ami_latest.image_id }}"
>       security_group: "{{ sg.group_id }}"
>       network:
>         assign_public_ip: true
>       wait: yes
>       wait_timeout: 500
>       vpc_subnet_id: "{{ internal.subnet.id }}"
>       tenancy: default
>       user_data: "{{ lookup('file', './scripts/install.sh') }}"
>       tags:
>           Site: "{{ prefix }}.com"
>     register: ec2
>
>   - name: Allocate and Associate a Static Public IP
>     ec2_eip:
>       state: present
>       region: "{{ region }}"
>       in_vpc: yes
>       reuse_existing_ip_allowed: yes
>       device_id: "{{ ec2.instance_ids[0] }}"
>     register: eip
>
>   - debug: msg="Public IP (Static) is {{ eip.public_ip }} for {{ ec2.instances[0].tags.Name }}"
>     when: eip.public_ip is defined
>
>   - debug: msg="Run this playbook for {{ ec2.instances[0].tags.Name }} shortly to Allocate, Associate and list the Static Public IP."
>     when: eip.public_ip is not defined
>
>   - name: Destroy the Elastic IP
>     # Gather EC2 info.
>     ec2_instance_info:
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ prefix }}-ec2"
>         instance-state-name: [ "running", "present", "started", "stopped" ]
>     register: ec2
>     tags: [ 'never', 'destroy' ]
>
>     # Gather EIP info.
>   - ec2_eip_info:
>       filters:
>         instance-id: "{{ ec2.instances[0].instance_id }}"
>     register: eip
>     when: ec2.instances[0].instance_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_eip:
>       state: absent
>       region: "{{ region }}"
>       device_id: "{{ eip.addresses[0].instance_id }}"
>       release_on_disassociation: yes
>     when: eip.addresses[0].instance_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Elastic Compute 2 instance
>     ec2_instance:
>       state: absent
>       instance_ids: "{{ ec2.instances[0].instance_id }}"
>     when: ec2.instances[0].instance_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Public Key
>     ec2_key:
>       state: absent
>       name: "{{ prefix }}"
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Route to the Internet Gateway
>     # Gather Route info.
>     ec2_vpc_route_table_info:
>       region: "{{ region }}"
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ prefix }}-rt"
>     register: rt
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_vpc_route_table:
>       state: absent
>       vpc_id: "{{ rt.route_tables[0].vpc_id }}"
>       region: "{{ region }}"
>       route_table_id: "{{ rt.route_tables[0].id }}"
>       lookup: id
>     when: rt.route_tables[0].vpc_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Subnet
>     # Gather Subnet info.
>     ec2_vpc_subnet_info:
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ subnet_name }}"
>     register: internal
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_vpc_subnet:
>       state: absent
>       vpc_id: "{{ internal.subnets[0].vpc_id }}"
>       cidr: "{{ internal.subnets[0].cidr_block }}"
>       when: internal.subnets[0].vpc_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Internet Gateway
>     # Gather IGW info.
>     ec2_vpc_igw_info:
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ prefix }}-igw"
>     register: igw
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_vpc_igw:
>       state: absent
>       vpc_id: "{{ igw.internet_gateways[0].attachments[0].vpc_id }}"
>       region: "{{ region }}"
>     when: igw.internet_gateways[0].attachments[0].vpc_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Security Group
>     # Gather SG info.
>     ec2_group_info:
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ prefix }}-sg"
>     register: sg
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_group:
>       state: absent
>       group_id: "{{ sg.security_groups[0].group_id }}"
>     when: sg.security_groups[0].group_id is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the Virtual Private Cloud
>     # Gather VPC info.
>     ec2_vpc_net_info:
>       filters:
>         tag:Site: "{{ prefix }}.com"
>         tag:Name: "{{ prefix }}-vpc"
>     register: vpc
>     tags: [ 'never', 'destroy' ]
>
>   - ec2_vpc_net:
>       state: absent
>       name: "{{ prefix }}-vpc"
>       cidr_block: "{{ vpc.vpcs[0].cidr_block }}"
>       region: "{{ region }}"
>     when: vpc.vpcs[0].cidr_block is defined
>     tags: [ 'never', 'destroy' ]
>
>   - name: Destroy the DNS Zone
>     route53_zone:
>       state: absent
>       zone: "{{ prefix }}.com"
>       tags: [ 'never', 'destroy' ]
> EOF 

Create the shell script for user_data.

Note: If you have gone through the AWS/Ansible against Lightsail article, then this can be disregarded:

$ cat << 'EOF' > scripts/install.sh
> #!/bin/bash
>
> MY_HOME="/home/ubuntu"
> export DEBIAN_FRONTEND=noninteractive
>
> # Install prereqs
> apt update
> apt install -y python3-pip apt-transport-https ca-certificates curl software-properties-common
> # Install docker
> curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
> add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
> apt update
> apt install -y docker-ce
> # Install docker-compose
> su ubuntu -c "mkdir -p $MY_HOME/.local/bin"
> su ubuntu -c "pip3 install docker-compose --upgrade --user && chmod 754 $MY_HOME/.local/bin/docker-compose"
> usermod -aG docker ubuntu
> # Add PATH
> printf "\nexport PATH=\$PATH:$MY_HOME/.local/bin\n" >> $MY_HOME/.bashrc
>
> exit 0
> EOF

Run the playbook:

$ ansible-playbook -i hosts aws_ec2.yml

Log on to the instance after a short while:

$ ssh -i ~/.ssh/myweb ubuntu@<The value of public_ip that was reported.  One can also re-run the playbook to print it again.>

Type yes and hit enter to accept.

On the host (a short while is needed for the run-once script to complete):

$ docker --version
$ docker-compose --version
$ logout

Tear down the instance:

$ ansible-playbook -i hosts aws_ec2.yml --tags "destroy"

<–

References:

Source:
ansible_myweb