Build packer image for OOD 2.x

added Backlog label

added Sprint 22-15 label and removed Backlog label

marked this issue as related to devops#19

mentioned in issue devops#19

changed milestone to %ood2x preview

assigned to @atlurie

We were having issue connecting via ssh for ansible provisioning.

Though we were able to make an ssh connection for packer build instance, ansible provisioning step would error out with permission denied

We were able to connect to the target from the build host via ansible’s ssh by providing remote-user to ansible and a private key file to use. They were being set to None and ansible-keyxxxxxxxxx previously i.e. it was using a temp keypair generated while the remote user was set to None by default.

Packer was able to auth using the keypair we specified, but ansible was trying to use the temp keypair it generated contrary to our assumption that it would use the same ssh bits implicitly for auth. We had to tell it to use the keypair we provided for ssh communicator in the ansible provisioner section directly.


(env) ubuntu@build-host:~/build/packer-openstack-hpc-image$ ansible -u centos --private-key ~/.ssh/id_rsa -i ~/build/CRI_XCBC/hosts ood -m ping
[WARNING]: Found both group and host with same name: ood
ood | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

The resulting ansible provisioner block:
  provisioner "ansible" {
    use_proxy =  false
    ssh_authorized_key_file = "/home/ubuntu/.ssh/id_rsa.pub"
    ansible_env_vars = ["ANSIBLE_HOST_KEY_CHECKING=False"]
    playbook_file = "../CRI_XCBC/ood-packer.yaml"
    roles_path = "./ansible/roles"
    inventory_file = "../CRI_XCBC/hosts"
    extra_arguments = [
      "--extra-vars", "root_ssh_key='${var.root_ssh_key}'",
      "--private-key=${var.ssh_private_key_file}",
      "--user=centos",
      "-vvvv"
    ]
  }
}

The ood-packer.yaml

---
- hosts: ood
  become: true
  roles:
    - { name: 'ood', tags: 'ood' }
    #- { name: 'ood_auth_regex', tags: 'ood_auth_regex' }
    - { name: 'ood_uab_ui', tags: 'ood_uab_ui' }
    - { name: 'ood_easter_egg', tags: 'ood_easter_egg' }
    - { name: 'ood_shib_install', tags: 'ood_shib_install', when: install_shib }
    - { name: 'ood_shib_config', tags: 'ood_shib_config', when: configure_shib }
    - { name: 'ood_user_reg_cloud', tags: 'ood_user_reg_cloud' }
    - { name: 'ood_vnc_form', tags: 'ood_vnc_form' }
    - { name: 'ood_jupyter', tags: 'ood_jupyter', when: jupyter_provision}
    - { name: 'ood_updated_rstudio', tags: 'ood_updated_rstudio', when: rstudio_provision }
    - { name: 'ood_deprecated_rstudio', tags: 'ood_deprecated_rstudio', when: rstudio_provision_deprecated }
    - { name: 'ood_matlab', tags: 'ood_matlab', when: matlab_provision }
    - { name: 'ood_sas', tags: 'ood_sas', when: sas_provision }
    - { name: 'ood_ansys', tags: 'ood_ansys', when: ansys_provision }
    - { name: 'ood_igv', tags: 'ood_igv', when: igv_provision }
    - { name: 'ood_jupyter_lab', tags: 'ood_jupyter_lab', when: jupyter_provision}
    - { name: 'ood_enable_sandbox', tags: 'ood_enable_sandbox', when: enable_sandbox }

Remove ood_auth_regex role from our code base Reason:

It is outdated because we replaced it with the python version - user_auth.py
The remote_user parsing is taken care of by Apache in ood_shib_config. We moved it from uab_ood_auth.regex to Apache.

The role ood was errored out as it could not satisfy installing the dependency lua-posix which is part of epel-release. This task is part of the prep_ood which we don't run here. It is part of the playbook targeted for ohpc based dev cluster.

Issue - https://github.com/jprorama/CRI_XCBC/issues/386

Error:

    openstack.image: TASK [ood_shib_config : Install require package] *******************************
    openstack.image: fatal: [ood]: FAILED! => changed=false
    openstack.image:   msg: Unable to find any of pip2, pip to use.  pip needs to be installed.
    openstack.image:
    openstack.image: PLAY RECAP *********************************************************************
    openstack.image: ood                        : ok=29   changed=27   unreachable=0    failed=1    skipped=1    rescued=0    ignored=0

Description:

aws_s3 module in ansible is used to download shib config tar from s3. This module has a dependency on boto3 pkg. boto3 is a Python3 only package.

Solution:
- Need pip3 and Python3 to install boto3.
boto3 pkg install still fails after fixing above issue as it can't find the pip3 executable.

Solution:
- point the task to pip3 executable.
As the ansible module to download the shib config tar is inherently dependent on Python3, we need to set the task to use a Python3 interpreter.

Solution:
- Set the interpreter at task level to point to Python3.
NOTE: This wouldn't work if we set it globally in /etc/ansible/ansible.cfg because it would break yum installs in all the previous tasks and roles in the playbook because ansible uses Python2.X under the hood for yum module. So the yum install from the first solution would also break.

Issue - https://github.com/jprorama/CRI_XCBC/issues/387

Error: The role ood_uab_ui fails with an error: variable app_name is undefined.

Description: The var app_name was defined in a task and it was used in a different task afterwards, so the scope of the var ends in the task it is defined. Since the scope of it wasn't defined at a role level (i.e at the start of the role) rather just the task, it considers the variable as undefined.

Solution:

Use {{ item }} attribute of the loop for task

Issue: https://github.com/jprorama/CRI_XCBC/issues/388

Implemented by PR !5 (merged)

mentioned in merge request !5 (merged)

closed

changed the description

Build packer image for OOD 2.x

Designs

Child items ...

Activity