Create shared dock ami

ansible/consul-values.yml

@@ -17,6 +17,7 @@
       with_items: "{{ consul_seed }}"
 
     - name: get values from consul
+      tags: consul_values
       run_once: true
       when: read_values is defined
       uri:
@@ -26,6 +27,7 @@
       register: values
 
     - name: print values to screen
+      tags: consul_values
       run_once: true
       when: read_values is defined
       debug: msg="{{ item.item.key }}" -> "{{ item.json[0].Value | b64decode }}"

ansible/delta-hosts/hosts

@@ -1,6 +1,9 @@
 [bastion]
 delta-bastion
 
+[user-local]
+127.0.0.1
+
 [hipache]
 delta-hipache httpsCheckForBackend80=false prependIncomingPort=true subDomainDepth=4
 
@@ -172,6 +175,7 @@ shiva
 socket-server
 socket-server-proxy
 swarm-manager
+user-local
 userland
 web
 worker

ansible/dock-generate-launch-config.yml

@@ -0,0 +1,8 @@
+---
+- hosts: redis
+- hosts: consul
+
+- hosts: user-local
+  connection: local
+  roles:
+  - { role: dock_launch_config }

ansible/dock.yml

@@ -13,7 +13,7 @@
 
 - include: charon.yml git_branch="v5.0.1"
 - include: dock-init.yml git_branch="v10.1.2"
-- include: krain.yml git_branch="v0.3.0"
+- include: krain.yml git_branch="v0.3.1"
 
 - hosts: "{{ dock }}"
   tasks:

ansible/gamma-hosts/hosts

@@ -1,6 +1,9 @@
 [bastion]
 gamma-bastion
 
+[user-local]
+127.0.0.1
+
 [hipache]
 gamma-hipache httpsCheckForBackend80=false prependIncomingPort=true subDomainDepth=4
 
@@ -171,6 +174,7 @@ socket-server
 socket-server-proxy
 swarm-manager
 userland
+user-local
 web
 worker
 

ansible/group_vars/all.yml

@@ -207,6 +207,9 @@ navi_mongo_port: 27017
 
 npm_token: c76363e9-78e0-4667-82ac-e2ac01efcfe2
 
+# remote vault
+vault_port: 8200
+
 # local-vault
 vault_local_port: 31836
 vault_addr: http://127.0.0.1:{{ vault_local_port }}

ansible/group_vars/alpha-docker-listener.yml

@@ -13,6 +13,7 @@ container_envs: >
   -e DATADOG_HOST={{ datadog_host_address }}
   -e DATADOG_PORT={{ datadog_port }}
   -e DOCKER_CERT_PATH=/etc/ssl/docker
+  -e IMAGE_INSPECT_LIST=localhost,registry.runnable.com,runnable
   -e LOGGLY_TOKEN={{ loggly_token }}
   -e NODE_ENV={{ node_env }}
   -e RABBITMQ_HOSTNAME={{ rabbit_host_address }}

ansible/group_vars/alpha-krain.yml

@@ -6,7 +6,6 @@ krain_env: default
 # upstart template variables
 app_name: krain
 app_repo: git@github.com:CodeNow/krain.git
-node_env: "{{ krain_env }}"
 
 enviroment_vars: {}
 

ansible/group_vars/alpha-vault.yml

@@ -13,7 +13,7 @@ container_run_opts: >
   -v /opt/vault/client-consul:/opt/vault/client-consul:ro
   -v /opt/vault/server:/opt/vault/server:ro
   -v {{ app_log_dir }}:{{ app_log_dir }}:rw
-  -p {{ ansible_default_ipv4.address }}:8200:8200
+  -p {{ ansible_default_ipv4.address }}:{{ vault_port }}:{{ vault_port }}
   -p {{ ansible_default_ipv4.address }}:8201:8201
   --cap-add IPC_LOCK
   --restart=always

ansible/roles/base_ubuntu/tasks/main.yml

@@ -1,6 +1,7 @@
 ---
 - name: ensure registry.runnable in /etc/hosts
   become: true
+  tags: ensure_registry
   when: dock is not defined
   lineinfile:
     dest=/etc/hosts

ansible/roles/consul_value/tasks/main.yml

@@ -14,7 +14,7 @@
     cache_valid_time=604800
 
 - name: put values into consul
-  tags: deploy
+  tags: deploy, consul_values
   run_once: true
   when: consul_host_address is defined and consul_api_port is defined and consul_values is defined and dock is not defined
   uri:

ansible/roles/dock-images/tasks/main.yml

@@ -5,19 +5,10 @@
     name=docker
     state=started
 
-- name: add runnable registry to /etc/hosts
-  become: true
-  blockinfile:
-    dest: /etc/hosts
-    insertafter: EOF
-    block: |
-      {{ registry_address }} registry.runnable.com
-
 - name: pulling docker images
   become: true
   command: docker pull {{ item }}
   with_items:
-    - "registry.runnable.com/runnable/image-builder:v4.3.0"
     - "swarm:1.2.5"
     - "registry:2.3.1"
     - "google/cadvisor:v0.24.1"

ansible/roles/dock-init/tasks/main.yml

@@ -1,5 +1,6 @@
 ---
 - fail: msg="value tokens need to be defined for this role"
+  tags: vault_files
   when: vault_auth_token is not defined or vault_token_01 is not defined or vault_token_02 is not defined or vault_token_03 is not defined
 
 - name: create vault auth directory
@@ -25,12 +26,10 @@
   - { file_name: 'token-02', value: "{{ vault_token_02 }}" }
   - { file_name: 'token-03', value: "{{ vault_token_03 }}" }
 
-- fail: msg="docks_rollbar_key needs to be defined for this role"
-  when: docks_rollbar_key is not defined
-
 - name: copy rollbar token
   tags: rollbar
   become: true
+  when: docks_rollbar_key is defined
   lineinfile:
     dest="/opt/runnable/dock-init/key/rollbar.token"
     line="{{ docks_rollbar_key }}"

ansible/roles/dock_launch_config/tasks/main.yml

@@ -0,0 +1,72 @@
+---
+- name: load variables
+  include_vars: "group_vars/alpha-krain.yml"
+
+- name: create new config file for krain
+  template:
+    src=upstart.conf
+    dest=~/{{ app_name }}.conf
+    backup=yes
+  vars:
+    - app_name: "krain"
+    - enviroment_vars: enviroment_vars
+
+- name: encode krain config to base64
+  shell: cat ~/{{ app_name }}.conf | base64 -w 0
+  register: krain_base64
+  vars:
+    - app_name: "krain"
+
+- name: load variables
+  include_vars: "group_vars/alpha-charon.yml"
+
+- name: create new config file for charon
+  template:
+    src=upstart.conf
+    dest=~/{{ app_name }}.conf
+    backup=yes
+  vars:
+    - app_name: "charon"
+    - enviroment_vars: enviroment_vars
+
+- name: encode krain config to base64
+  shell: cat ~/{{ app_name }}.conf | base64 -w 0
+  register: charon_base64
+  vars:
+    - app_name: "charon"
+
+- name: register tokens
+  set_fact:
+    vault_tokens:
+    - { file_name: 'auth-token', value: "{{ vault_auth_token }}" }
+    - { file_name: 'token-01', value: "{{ vault_token_01 }}" }
+    - { file_name: 'token-02', value: "{{ vault_token_02 }}" }
+    - { file_name: 'token-03', value: "{{ vault_token_03 }}" }
+
+- name: encode ca.pem to base64
+  shell: cat ./certs/ca.pem | base64 -w 0
+  register: ca_pem_base64
+
+- name: encode ca-key.pem to base64
+  shell: cat ./certs/ca-key.pem | base64 -w 0
+  register: ca_key_pem_base64
+
+- name: encode pass to base64
+  shell: cat ./certs/pass | base64 -w 0
+  register: pass_base64
+
+- name: Generate dock script
+  template:
+    src=init.tmpl
+    dest=~/dock.sh
+  vars:
+    tokens: "{{ vault_tokens }}"
+    is_dock_pool: false
+
+- name: Generate dock script
+  template:
+    src=init.tmpl
+    dest=~/dock-pool.sh
+  vars:
+    tokens: "{{ vault_tokens }}"
+    is_dock_pool: true

ansible/roles/dock_launch_config/templates/init.tmpl

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Set ENV files
+export CONSUL_PORT={{ consul_https_port }}
+export CONSUL_HOSTNAME={{ consul_host_address }}
+export VAULT_PORT={{ vault_port }}
+
+# Create directory for env
+mkdir -p /opt/runnable/dock-init/consul-resources/vault/{{ node_env }}
+chown ubuntu:ubuntu /opt/runnable/dock-init/consul-resources/vault/{{ node_env }}
+chmod 0711 /opt/runnable/dock-init/consul-resources/vault/{{ node_env }}
+
+# Set Vault Tokens (Used for fetching templates)
+{% for item in tokens %}
+echo {{ item.value }} > /opt/runnable/dock-init/consul-resources/vault/{{ node_env }}/{{ item.file_name }}
+{% endfor %}
+
+# Add upstart files for charon and krain
+mkdir -p /docker/app-logs/
+echo {{ krain_base64['stdout'] }} | base64 --decode > /etc/init/krain.conf
+echo {{ charon_base64['stdout'] }} | base64 --decode > /etc/init/charon.conf
+
+# Add Certs (Used for genereting Docker client keys + certs)
+mkdir -p /etc/ssl/docker/
+cho {{ ca_pem_base64['stdout'] }} | base64 --decode > /etc/ssl/docker/ca.pem
+echo {{ ca_key_pem_base64['stdout'] }} | base64 --decode > /etc/ssl/docker/ca-key.pem
+echo {{ pass_base64['stdout'] }} | base64 --decode > /etc/ssl/docker/pass
+chmod -R 0440 /etc/ssl/docker/
+
+# Start services
+{% if is_dock_pool %}
+start amazon-ssm-agent
+{% endif %}
+service krain start
+service charon start
+{% if not is_dock_pool %}
+CONSUL_HOSTNAME={{ consul_host_address }} CONSUL_PORT={{ consul_https_port }} VAULT_PORT={{ vault_port }} bash /opt/runnable/dock-init/init.sh | tee /var/log/user-script-dock-init.log
+{% endif %}

ansible/roles/dock_launch_config/templates/upstart.conf

@@ -0,0 +1,41 @@
+#!upstart
+description "{{ app_name }}"
+author "Anandkumar Patel"
+
+env NPM_BIN=/usr/local/bin/npm
+env APP_DIR=/opt/runnable/{{ app_name }}
+env LOG_FILE={{ app_log_dir }}/{{ app_name }}.log
+env NODE_ENV={{ node_env }}
+
+{% if enviroment_vars is defined %}
+{% for name, value in enviroment_vars.iteritems() %}
+env {{ name }}={{ value }}
+{% endfor %}
+{% endif %}
+
+start on (local-filesystems and net-device-up IFACE=eth0)
+stop on shutdown
+
+script
+  touch $LOG_FILE
+  chdir $APP_DIR
+  echo $$ > /var/run/{{ app_name }}.pid
+  exec $NPM_BIN start >> $LOG_FILE 2>&1
+end script
+
+pre-start script
+  # Date format same as (new Date()).toISOString() for consistency
+  echo "[`date -u +%Y-%m-%dT%T.%3NZ`] (sys) Starting" >> $LOG_FILE
+end script
+
+pre-stop script
+  rm /var/run/{{ app_name }}.pid
+  echo "[`date -u +%Y-%m-%dT%T.%3NZ`] (sys) Stopping" >> $LOG_FILE
+end script
+
+post-start script
+  echo "===== App restarted =====" >> $LOG_FILE
+end script
+
+respawn
+respawn limit 5 1     # give up restart after 5 respawns in 1 seconds

ansible/roles/docker/tasks/main.yml

@@ -15,17 +15,6 @@
     owner=root
     group=root
 
-- name: copy docker certs
-  become: true
-  tags: docker_certs
-  when: dock is defined
-  copy:
-    src=certs/
-    dest=/etc/ssl/docker
-    mode=0440
-    owner=root
-    group=root
-
 - name: create core file dir
   become: true
   when: docker_config == "runnable" and core_file_dir != "/var/log"
@@ -110,10 +99,6 @@
     group=root
     mode=0755
 
-- name: restart docker
-  when: (copied_config.changed and restart is defined) or dock is defined
-  command: sudo service docker restart
-
 - name: create docker group
   become: true
   group:

ansible/roles/git_repo/tasks/main.yml

@@ -9,6 +9,7 @@
     msg: "application Installed: {{ app_name }}, branch : {{ git_branch }} "
 
 - name: create repository dir
+  become: true
   file:
     path=/opt/runnable/{{ app_name }}
     state=directory

ansible/roles/image-builder/tasks/main.yml

@@ -7,10 +7,4 @@
 
 - name: build the image-builder
   tags: deploy
-  command: sudo docker build --no-cache --tag="registry.runnable.com/{{ image_builder_docker_namespace }}:{{ git_branch }}" /opt/runnable/image-builder
-
-- name: push image-builder
-  tags: deploy
-  run_once: true
-  command: sudo docker push "registry.runnable.com/{{ image_builder_docker_namespace }}:{{ git_branch }}"
-  when: dock is not defined
+  command: sudo docker build --no-cache --tag="{{ image_builder_docker_namespace }}:{{ git_branch }}" /opt/runnable/image-builder

ansible/roles/loggly/tasks/main.yml

@@ -122,7 +122,7 @@
     state=present
 
 - name: runnable bin directory
-  tags: [ loggly, clean ] 
+  tags: [ loggly, clean ]
   become: true
   file:
     path=/opt/runnable/bin
@@ -141,7 +141,7 @@
    mode=0700
 
 - name: purge log files
-  tags: [ loggly, clean ] 
+  tags: [ loggly, clean ]
   become: true
   cron:
     name="purge log files"