Развертывание ETCD Keeper с помощью Ansible

В прошлой статье рассмотрели ручную установку и запуск etcdkeeper в командной строке.

Автоматизируем этот процесс и развернем etcdkeeper с помощью Ansible, настроим автоматический запуск в виде службы, настроим авторизацию.

Предполагается, что уже установлен etcd сервер и настроены TLS сертификаты для работы с ним (см. прошлую статью)

На управляющем сервере (локальном компьютере) имеем следующую структуру файлов-директорий:

ansible.cfg:

Указываем путь к файлу инвентаря, повышаем привилегии.

inventory/hosts:

Список нод, на которых будут развернуты экземпляры etcdkeeper.

Предварительно должен быть настроен доступ по ssh с помощью ключей.

playbook.yaml — тут будут все задачи по развертыванию кластера.

Разберем его содержимое посекционно.

1. Вводим с консоли пароль для пользователя etcd root:
   
   YAML

   - name: "Ask for credentials etcd root" pause: prompt: "Enter etcd root password: " echo: no register: etcd_root_password

   1 2 3 4 5 6

   - name: "Ask for credentials etcd root"       pause:         prompt: "Enter etcd root password: "         echo: no       register: etcd_root_password

2. Создаем пользователя root:
   
   YAML

   - name: Create user 'root' with TLS using curl shell: | curl --cacert /etc/etcd/ssl/ca.crt \ --cert /etc/etcd/ssl/server.crt \ --key /etc/etcd/ssl/server.key \ -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/user/add \ -d '{"name": "root", "password": "{{ etcd_root_password.user_input }}"}'

   1 2 3 4 5 6 7 8

   - name: Create user 'root' with TLS using curl       shell: |         curl --cacert /etc/etcd/ssl/ca.crt \              --cert /etc/etcd/ssl/server.crt \              --key /etc/etcd/ssl/server.key \              -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/user/add \              -d '{"name": "root", "password": "{{ etcd_root_password.user_input }}"}'

    
3. Создаем роль root:
   
   YAML

   - name: Create 'root' role with TLS using curl shell: | curl --cacert /etc/etcd/ssl/ca.crt \ --cert /etc/etcd/ssl/server.crt \ --key /etc/etcd/ssl/server.key \ -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/role/add \ -d '{"name": "root"}'

   1 2 3 4 5 6 7 8

   - name: Create 'root' role with TLS using curl       shell: |         curl --cacert /etc/etcd/ssl/ca.crt \              --cert /etc/etcd/ssl/server.crt \              --key /etc/etcd/ssl/server.key \              -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/role/add \              -d '{"name": "root"}'

4. Выдаем роль root пользователю root:
   
   YAML

   - name: Grant 'root' role to 'root' user with TLS using curl shell: | curl --cacert /etc/etcd/ssl/ca.crt \ --cert /etc/etcd/ssl/server.crt \ --key /etc/etcd/ssl/server.key \ -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/user/grant \ -d '{"user": "root", "role": "root"}'

   1 2 3 4 5 6 7 8

   - name: Grant 'root' role to 'root' user with TLS using curl       shell: |         curl --cacert /etc/etcd/ssl/ca.crt \              --cert /etc/etcd/ssl/server.crt \              --key /etc/etcd/ssl/server.key \              -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/user/grant \              -d '{"user": "root", "role": "root"}'

5. Включаем аутентификацию:
   
   YAML

   - name: Enable authentication in etcd with TLS using curl shell: | curl --cacert /etc/etcd/ssl/ca.crt \ --cert /etc/etcd/ssl/server.crt \ --key /etc/etcd/ssl/server.key \ -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/enable

   1 2 3 4 5 6 7

   - name: Enable authentication in etcd with TLS using curl       shell: |         curl --cacert /etc/etcd/ssl/ca.crt \              --cert /etc/etcd/ssl/server.crt \              --key /etc/etcd/ssl/server.key \              -X POST https://{{ hostvars[inventory_hostname].ansible_host }}:2379/v3/auth/enable

6. Создаем директорию для бинарника etcdkeeper и сопутствующих файлов, скачиваем дистрибутив и распаковываем его:
   
   YAML

   - name: "Create directory for etcdkeeper binaries" file: path: /opt/etcdkeeper/bin state: directory owner: root group: root mode: 0700 - name: "Download the tarball into the /tmp directory" get_url: url: https://github.com/evildecay/etcdkeeper/releases/download/v0.7.8/etcdkeeper-v0.7.8-linux_x86_64.tar.gz dest: /tmp/etcdkeeper.tar.gz owner: root group: root mode: 0600 force: True validate_certs: no - name: "Extract the contents of the tarball" unarchive: src: /tmp/etcdkeeper.tar.gz dest: /opt/etcdkeeper/bin/ decrypt: True remote_src: True

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

   - name: "Create directory for etcdkeeper binaries"       file:         path: /opt/etcdkeeper/bin         state: directory         owner: root         group: root         mode: 0700       - name: "Download the tarball into the /tmp directory"       get_url:         url: https://github.com/evildecay/etcdkeeper/releases/download/v0.7.8/etcdkeeper-v0.7.8-linux_x86_64.tar.gz         dest: /tmp/etcdkeeper.tar.gz         owner: root         group: root         mode: 0600         force: True         validate_certs: no     - name: "Extract the contents of the tarball"       unarchive:         src: /tmp/etcdkeeper.tar.gz         dest: /opt/etcdkeeper/bin/         decrypt: True         remote_src: True

   Возможен вариант, что архив будет в формате 7z, ниже вариант таска для такого случая:
   
   YAML

   Example 7z archive unpack - name: "Download the zip into the /tmp directory" get_url: url: https://github.com/evildecay/etcdkeeper/releases/download/v0.7.8/etcdkeeper-v0.7.8-linux_x86_64.zip dest: /tmp/etcdkeeper.zip owner: root group: root mode: 0600 force: yes validate_certs: no - name: "Ensure p7zip is installed" apt: name: p7zip-full state: present - name: Unpack the 7z archive command: "7z x -y /tmp/etcdkeeper.zip -o/opt/etcdkeeper/bin" args: chdir: /opt/etcdkeeper/bin register: unzip_output - name: Debug unzip output debug: var: unzip_output

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

   Example 7z archive unpack     - name: "Download the zip into the /tmp directory"       get_url:         url: https://github.com/evildecay/etcdkeeper/releases/download/v0.7.8/etcdkeeper-v0.7.8-linux_x86_64.zip         dest: /tmp/etcdkeeper.zip         owner: root         group: root         mode: 0600         force: yes         validate_certs: no     - name: "Ensure p7zip is installed"       apt:         name: p7zip-full         state: present     - name: Unpack the 7z archive       command: "7z x -y /tmp/etcdkeeper.zip -o/opt/etcdkeeper/bin"       args:         chdir: /opt/etcdkeeper/bin       register: unzip_output     - name: Debug unzip output       debug:         var: unzip_output

    
7. Выставляем права на запуск, копируем файл запуска сервиса через systemd:
   
   YAML

   - name: "Set permissions for etcdkeeper" file: path: /opt/etcdkeeper/bin/etcdkeeper state: file owner: root group: root mode: 0700 - name: "Add /opt/etcdkeeper/bin/ to the $PATH environment variable" lineinfile: path: /etc/profile line: export PATH="$PATH:/opt/etcdkeeper/bin" state: present create: True insertafter: EOF - name: "Create a etcdkeeper service" copy: src: files/etcdkeeper.service remote_src: False dest: /etc/systemd/system/etcdkeeper.service owner: root group: root mode: 0644

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

   - name: "Set permissions for etcdkeeper"       file:         path: /opt/etcdkeeper/bin/etcdkeeper         state: file         owner: root         group: root         mode: 0700     - name: "Add /opt/etcdkeeper/bin/ to the $PATH environment variable"       lineinfile:         path: /etc/profile         line: export PATH="$PATH:/opt/etcdkeeper/bin"         state: present         create: True         insertafter: EOF     - name: "Create a etcdkeeper service"       copy:         src: files/etcdkeeper.service         remote_src: False         dest: /etc/systemd/system/etcdkeeper.service         owner: root         group: root         mode: 0644

8. Стартуем сервис etcdkeeper:
   
   YAML

   - name: "Stop the etcdkeeper service" command: systemctl stop etcdkeeper - name: "Enable the etcdkeeper service" command: systemctl enable etcdkeeper - name: "Start the etcdkeeper service" command: systemctl restart etcdkeeper

   1 2 3 4 5 6 7 8 9

   - name: "Stop the etcdkeeper service"       command: systemctl stop etcdkeeper       - name: "Enable the etcdkeeper service"       command: systemctl enable etcdkeeper       - name: "Start the etcdkeeper service"       command: systemctl restart etcdkeeper