In this article we will Provision a LightSail host with docker\/docker-compose on it using Terraform and install\/initialize OpenShift Origin on it using Ansible.<\/p>\n\n\n\n
OpenShift<\/a> is Red Hat’s containerization platform which utilizes Kubernetes. Origin<\/a> (what we will be working with here) is the opensource implementation of it.<\/p>\n\n\n\n We will use ‘myweb’ as an example in this article, using the same base path of ‘dev’ that was previously created<\/a>, the container-admin group<\/a> and using ~\/.local\/bin for the binaries.<\/p>\n\n\n\n Please ensure you have gone through the previous Terraform<\/a>, Ansible<\/a>, related preceding articles and ‘Get started with Lightsail for free’<\/a>.<\/p>\n\n\n\n <\/p>\n\n\n\n \u2013> Append lightsail:OpenInstancePublicPorts and lightsail:CloseInstancePublicPorts after lightsail:ReleaseStaticIp.<\/p>\n\n\n\n It will look like this:<\/p>\n\n\n\n Review Policy -> Save Changes<\/p>\n\n\n\n <\/p>\n\n\n\n Go in to the dev directory\/link located within your home directory:<\/p>\n\n\n\n Upgrade the AWS CLI on your host:<\/p>\n\n\n\n Grab the latest version of Terraform:<\/p>\n\n\n\n Unzip it to ~\/.local\/bin and set permissions accordingly on it:<\/p>\n\n\n\n Change to the myweb directory inside terraform:<\/p>\n\n\n\n Upgrade our code to 12.20 (type yes and enter when prompted):<\/p>\n\n\n\n Change our instance from a micro to a medium so it will have sufficient resources to run OpenShift Origin and related:<\/p>\n\n\n\n Output the Public IP of the Provisioned host (along with connection parameters and variables) in to a file which we will feed in to an Ansible playbook run:<\/p>\n\n\n\n Amend an item from the user_data script:<\/p>\n\n\n\n Initialize the directory\/refresh module(s):<\/p>\n\n\n\n Run a dry-run to see what will occur:<\/p>\n\n\n Provision:<\/p>\n\n\n\n Create a work folder for an Ansible playbook:<\/p>\n\n\n\n Create an Ansible playbook which will install\/initialize OpenShift Origin on our provisioned host:<\/p>\n\n\n\n Create a shell script which will pull the latest release of client tools from GitHub, place the needed binaries in ~\/.local\/bin, set insecure registry on Docker and initialize:<\/p>\n\n\n\n <\/p>\n\n\n\n The Lightsail firewall functionality is currently being implemented in Terraform and is not available in Ansible. In the interim, we will create a shell script to open and close ports needed by OpenShift Origin (using the AWS CLI). This script will be run locally via the Playbook during the create and destroy routines:<\/p>\n\n\n\n Run the Ansible playbook after a few minutes (accept the host key by typing yes and hitting enter when prompted):<\/p>\n\n\n\n After a short while, log on to the instance:<\/p>\n\n\n\n To get an overview of the current project with any identified issues:<\/p>\n\n\n\n Log on as Admin via CMD Line and switch to the default project:<\/p>\n\n\n\n Logout of the session:<\/p>\n\n\n\n Please see the Command-Line Walkthrough<\/a>.<\/p>\n\n\n\n <\/p>\n\n\n\n Logout from the host:<\/p>\n\n\n\n Log on as Admin via Web Browser (replace <PUBLIC_IP>):<\/p>\n\n\n\n Please see the Web Console Walkthrough<\/a>.<\/p>\n\n\n\n <\/p>\n\n\n\n To shut down the OpenShift Origin cluster, destroy the working folder and start anew (you can re-run the playbook normally to reinitialize):<\/p>\n\n\n\n <\/p>\n\n\n\n Tear down what was created by first performing a dry-run to see what will occur:<\/p>\n\n\n\n Tear down the instance:<\/p>\n\n\n\n <–<\/p>\n\n\n\n <\/p>\n\n\n\n References: <\/p>\n\n\n\n
Edit the IAM Policy “AllowLightsail”:
AWS UI Console -> Services -> Security, Identity, & Compliance -> IAM -> Policies -> AllowLightsail -> Edit Policy -> JSON -> <\/p>\n\n\n\n \"lightsail:ReleaseStaticIp\",\n \"lightsail:OpenInstancePublicPorts\",\n \"lightsail:CloseInstancePublicPorts\"<\/pre>\n\n\n\n
$ cd ~\/dev<\/pre>\n\n\n\n
$ pip3 install awscli --upgrade --user && chmod 754 ~\/.local\/bin\/aws<\/pre>\n\n\n\n
$ wget https:\/\/releases.hashicorp.com\/terraform\/0.12.20\/terraform_0.12.20_linux_amd64.zip<\/pre>\n\n\n\n
$ unzip terraform_0.12.20_linux_amd64.zip -d ~\/.local\/bin && chmod 754 ~\/.local\/bin\/terraform<\/pre>\n\n\n\n
$ cd terraform\/myweb<\/pre>\n\n\n\n
$ terraform 0.12upgrade<\/pre>\n\n\n\n
$ sed -i s:micro_2_0:medium_2_0: lightsail.tf<\/pre>\n\n\n\n
$ cat << 'EOF' >> output.tf\n>\n> resource \"local_file\" \"hosts\" {\n> content = \"[vps]\\n${aws_lightsail_static_ip.myweb.ip_address} ansible_connection=ssh ansible_user=ubuntu ansible_ssh_private_key_file=~\/.ssh\/myweb instance=${aws_lightsail_instance.myweb.name}\"\n> filename = \"${path.module}\/..\/..\/ansible\/hosts\"\n> directory_permission = 0754\n> file_permission = 0664\n> }\n> EOF <\/pre>\n\n\n\n$ sed -i 's:sudo apt-key add -:apt-key add -:' scripts\/install.sh<\/pre>\n\n\n\n
$ terraform init<\/pre>\n\n\n
$ terraform plan<\/pre>\n\n\n\n
$ terraform apply -auto-approve<\/pre>\n\n\n\n
$ cd ..\/..\/ansible\n$ mkdir -p openshift\/scripts && cd openshift<\/pre>\n\n\n\n
$ cat << 'EOF' > openshift.yml \n> # Install, initialize OpenShift Origin and create a destroy routine for it\n> ---\n> - hosts: vps\n> connection: local\n>\n> vars:\n> openshift_directory: \/home\/ubuntu\/.local\/etc\/openshift\n>\n> tasks:\n> - name: Discover Services\n> service_facts:\n>\n> - name: Check if openshift directory exists\n> stat:\n> path: \"{{ openshift_directory }}\"\n> register: openshift_dir\n>\n> - name: Open Firewall Ports\n> delegate_to: localhost\n> command: bash -c '.\/scripts\/firewall.sh open {{ hostvars[groups['vps'][0]].instance }}'\n> when:\n> - \"'docker' in services\"\n> - openshift_dir.stat.exists == False\n> \n> - name: Copy and Run install\n> environment:\n> PATH: \"{{ ansible_env.PATH}}:{{ openshift_directory }}\/..\/..\/bin\"\n> args:\n> executable: \/bin\/bash\n> script: \".\/scripts\/install.sh {{ ansible_ssh_host }}\"\n> when:\n> - \"'docker' in services\"\n> - openshift_dir.stat.exists == False\n>\n> - debug: msg=\"Please install docker to proceed.\"\n> when: \"'docker' not in services\"\n>\n> - debug: msg=\"Install script has already been completed. Run this playbook with the destroy tag, then run once again normally to re-intialize openshift.\"\n> when: openshift_dir.stat.exists == True\n>\n> - name: Destroy\n> become: yes\n> environment:\n> PATH: \"{{ ansible_env.PATH}}:{{ openshift_directory }}\/..\/..\/bin\"\n> args:\n> executable: \/bin\/bash\n> shell: \"cd {{ openshift_directory }} && oc cluster down && cd ..\/ && rm -r {{ openshift_directory }}\/..\/..\/..\/.kube {{ openshift_directory }}\"\n> tags: [ 'never', 'destroy' ]\n>\n> - name: Close Firewall Ports\n> delegate_to: localhost\n> command: bash -c '.\/scripts\/firewall.sh close {{ hostvars[groups['vps'][0]].instance }}'\n> tags: [ 'never', 'destroy' ]\n> EOF <\/pre>\n\n\n\n$ cat << 'EOF' > scripts\/install.sh\n> #!\/bin\/bash\n> [[ -z $* ]] && { echo \"Please specify a Public IP or Host\/Domain name.\" && exit 1; }\n> # Fetch and Install\n> file_url=\"$(curl -sL https:\/\/github.com\/openshift\/origin\/releases\/latest | grep \"download.*client.*linux-64\" | cut -f2 -d\\\" | sed 's\/^\/https:\\\/\\\/github.com\/')\"\n> [[ -z $file_url ]] && { echo \"The URL could not be obtained. Please try again shortly.\" && exit 1; }\n> file_name=\"$(echo $file_url | cut -f9 -d\/)\"\n> if [[ ! -f $file_name ]]; then\n> curl -sL $file_url --output $file_name\n> folder_name=\"$(tar ztf $file_name 2>\/dev\/null | head -1 | sed s:\/.*::)\"\n> [[ -z $folder_name ]] && { echo \"The archive could not be read. Please try again.\" && rm -f $file_name && exit 1; }\n> tar zxf $file_name\n> mv $folder_name\/oc $folder_name\/kubectl $HOME\/.local\/bin && rm -r $folder_name\n> chmod 754 $HOME\/.local\/bin\/oc $HOME\/.local\/bin\/kubectl\n> fi\n> # Docker insecure\n> [[ $(grep insecure \/etc\/docker\/daemon.json &>\/dev\/null; echo $?) -eq 2 ]] && redirect=\">\"\n> [[ $(grep insecure \/etc\/docker\/daemon.json &>\/dev\/null; echo $?) -eq 1 ]] && redirect=\">>\"\n> [[ $(grep insecure \/etc\/docker\/daemon.json &>\/dev\/null; echo $?) -eq 0 ]] || { sudo bash -c \"cat << 'EOF' $redirect \/etc\/docker\/daemon.json\n> {\n> \\\"insecure-registries\\\" : [ \\\"172.30.0.0\/16\\\" ]\n> }\n> EOF\" && sudo systemctl restart docker; }\n> # OpenShift Origin up\n> [[ ! -d $HOME\/.local\/etc\/openshift ]] && { mkdir -p $HOME\/.local\/etc\/openshift && cd $HOME\/.local\/etc\/openshift; } || { cd $HOME\/.local\/etc\/openshift && oc cluster down; }\n> oc cluster up --public-hostname=$1\n>\n> exit 0\n> EOF <\/pre>\n\n\n\n$ cat << 'EOF' > scripts\/firewall.sh && chmod 754 scripts\/firewall.sh\n> #!\/bin\/bash\n> #\n> openshift_ports=\"53\/UDP 443\/TCP 1936\/TCP 4001\/TCP 7001\/TCP 8053\/UDP 8443\/TCP 10250_10259\/TCP\"\n> #\n> [[ -z $* || $(echo $* | xargs -n1 | wc -l) -ne 2 || ! ($* =~ $(echo '\\<open\\>') || $* =~ $(echo '\\<close\\>')) ]] && { echo \"Please pass in the desired action [ open, close ] and instance [ site_myweb ].\" && exit 2; }\n> #\n> instance=\"$(echo $* | xargs -n1 | sed '\/\\<open\\>\/d; \/\\<close\\>\/d')\"\n> [[ -z $instance ]] && { echo \"Please double-check the passed in instance.\" && exit 1; }\n> action=\"$(echo $* | xargs -n1 | grep -v $instance)\"\n> #\n> for port in $openshift_ports; do\n> aws lightsail $action-instance-public-ports --instance $instance --port-info fromPort=$(echo $port | cut -f1 -d_ | cut -f1 -d\/),protocol=$(echo $port | cut -f2 -d\/),toPort=$(echo $port | cut -f2 -d_ | cut -f1 -d\/)\n> done\n> #\n>\n> exit 0\n> EOF <\/pre>\n\n\n\n$ ansible-playbook -i ..\/hosts openshift.yml<\/pre>\n\n\n\n
$ ssh -i ~\/.ssh\/myweb ubuntu@<The value of static_public_ip that was reported. One can also use 'terraform output static_public_ip' to print it again.><\/pre>\n\n\n\n
$ oc status --suggest<\/pre>\n\n\n\n
$ oc login -u system:admin -n default<\/pre>\n\n\n\n
$ oc logout<\/pre>\n\n\n\n
$ logout<\/pre>\n\n\n\n
https:\/\/<PUBLIC_IP>:8443\/console (You will get a Certificate\/Site warning due to a mismatch).<\/pre>\n\n\n\n
$ ansible-playbook -i ..\/hosts openshift.yml --tags \"destroy\"<\/pre>\n\n\n\n
$ cd ..\/..\/terraform\/myweb && terraform plan -destroy <\/pre>\n\n\n\n
$ terraform destroy -auto-approve<\/pre>\n\n\n\n
how-to-install-openshift-origin-on-ubuntu-18-04<\/a> <\/p>\n\n\n\n