-
Notifications
You must be signed in to change notification settings - Fork 541
4990 ec2 ansible scripting #5063
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 12 commits
780b89e
884ae90
8db31c9
9d04a2b
15e4454
510a390
a35c847
cde128a
490d941
6ce1215
7bc6af8
19e2915
6570aea
1d1794c
7052fdf
0ae6dc1
6c9dec0
5a91095
42c7391
36df01f
9dbf2be
be995cc
5c053a6
713a896
7317998
a3f9078
5ed3eb1
59c158a
7021ae1
562c9c7
746eec5
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| #!/bin/bash -x | ||
| #Initially Referred to this doc: https://docs.aws.amazon.com/cli/latest/userguide/tutorial-ec2-ubuntu.html | ||
|
|
||
| #TODO: allow arbitrary repo, not just IQSS. Will require changing it on the ansible side as well | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @donsizemore and I talked about this at http://irclog.iq.harvard.edu/dataverse/2018-09-18 and he just made a change at IQSS/dataverse-ansible@7ea1f7a which may mean we need to adjust the sed command below.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think my current sed will work fine with the change actually. Worth ensuring tho |
||
| DEPLOY_FILE=dataverse_deploy_info.txt | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Where is DEPLOY_FILE used? Is it cruft?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. cruft! |
||
|
|
||
| if [ "$1" = "" ]; then | ||
| echo "No branch name provided" | ||
| exit 1 | ||
| else | ||
| BRANCH_NAME=$1 | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should we make the indentation consistent? https://google.github.io/styleguide/shell.xml#Indentation says, "Indent 2 spaces. No tabs." |
||
| if [[ $(git ls-remote --heads https://github.com/IQSS/dataverse.git $BRANCH_NAME | wc -l) -eq 0 ]]; then | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This looks slightly brittle but maybe it's fine for now. |
||
| echo "Branch does not exist on the Dataverse github repo" | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| #Create security group if it doesn't already exist | ||
| echo "*Checking for existing security group" | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Minor but
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fine by me |
||
| GROUP_CHECK=$(aws ec2 describe-security-groups --group-name devenv-sg) | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Being new to AWS, I'm not sure what a security group is or why it's helpful or necessary. |
||
| if [[ "$?" -ne 0 ]]; then | ||
| echo "*Creating security group" | ||
| aws ec2 create-security-group --group-name devenv-sg --description "security group for development environment" | ||
| aws ec2 authorize-security-group-ingress --group-name devenv-sg --protocol tcp --port 22 --cidr 0.0.0.0/0 | ||
| aws ec2 authorize-security-group-ingress --group-name devenv-sg --protocol tcp --port 8080 --cidr 0.0.0.0/0 | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Shouldn't port 80 be open too? And 443? |
||
| echo "*End creating security group" | ||
| else | ||
| echo "*Security group already exists." | ||
| fi | ||
|
|
||
| echo "*Checking for existing key pair" | ||
| if ! [ -f devenv-key.pem ]; then | ||
| echo "*Creating key pair" | ||
| PRIVATE_KEY=$(aws ec2 create-key-pair --key-name devenv-key --query 'KeyMaterial' --output text) | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We need a way to avoid this error: An error occurred (InvalidKeyPair.Duplicate) when calling the CreateKeyPair operation: The keypair 'devenv-key' already exists. |
||
| if [[ $PRIVATE_KEY = '-----BEGIN RSA PRIVATE KEY-----'* ]]; then | ||
| printf -- "$PRIVATE_KEY">devenv-key.pem | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. devenv-key.pem (or whatever we call it) should be added to .gitignore.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fixed in a commit, I already had it done locally. |
||
| chmod 400 devenv-key.pem | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Why is the key made read only?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Best practice so that other users can't access it. Some systems won't even read the key if its not set to 400 |
||
| echo "*New key pair created" | ||
| fi | ||
| echo "*End creating key pair" | ||
| else | ||
| echo "*Key pair alraedy exists." | ||
| fi | ||
|
|
||
| #AMI ID for centos7 acquired by this (very slow) query Sept 10th 2018 | ||
| #This does not need to be run every time, leaving it in here so it is remembered | ||
| #aws ec2 describe-images --owners 'aws-marketplace' --filters 'Name=product-code,Values=aw0evgkw8e5c1q413zgy5pjce' --query 'sort_by(Images, &CreationDate)[-1].[ImageId]' --output 'text' | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It would be good to explain that "aw0evgkw8e5c1q413zgy5pjce" is a product code for "CentOS 7 (x86_64) - with Updates HVM" as described at https://aws.amazon.com/marketplace/pp/B00O7WM7QW and https://wiki.centos.org/Cloud/AWS . HVM stands for "Hardware Virtual Machine". I'm a little confused about why this one time step is necessary. Is it to retrieve the string "ami-9887c6e7" as the one we want to use? From what I understand "ami-9887c6e7" is only available in the "us-east-1" region, which is weird to me. |
||
|
|
||
| #The AMI ID only works for region us-east-1, for now just forcing that | ||
| #Using this image ID a 1-time requires subscription per root account, which was done through the UI | ||
| #Also, change the instance size as your own peril. Previous attempts of setting it smaller than medium have caused solr and maven to crash weirdly during install | ||
| echo "*Creating ec2 instance" | ||
| INSTACE_ID=$(aws ec2 run-instances --image-id ami-9887c6e7 --security-groups devenv-sg --count 1 --instance-type t2.medium --key-name devenv-key --query 'Instances[0].InstanceId' --block-device-mappings '[ { "DeviceName": "/dev/sda1", "Ebs": { "DeleteOnTermination": true } } ]' | tr -d \") | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Typo: "INSTACE_ID" We might want to make "t2.medium" a variable so we can more easily change it. We might want some more error checking here. |
||
| echo "Instance ID: "$INSTACE_ID | ||
| echo "*End creating EC2 instance" | ||
|
|
||
| PUBLIC_DNS=$(aws ec2 describe-instances --instance-ids $INSTACE_ID --query "Reservations[*].Instances[*].[PublicDnsName]" --output text) | ||
| PUBLIC_IP=$(aws ec2 describe-instances --instance-ids $INSTACE_ID --query "Reservations[*].Instances[*].[PublicIpAddress]" --output text) | ||
|
|
||
| echo "Connecting to the instance. This may take a minute as it is being spun up" | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This "may take a minute" message should probably be the last thing you see before the long wait and may need to say "may take 10 minutes" or so. Also, not only is the instance being spun up. Dataverse is being installed. |
||
|
|
||
| echo "New EC2 instance created at $PUBLIC_DNS" | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Perhaps this note about the IP can be rolled into the main message above. |
||
|
|
||
| #ssh into instance now and run ansible stuff | ||
| #Note: an attempt was made to pass the branch name in the ansible-playbook call | ||
| # via -e "dataverse.branch=$BRANCH_NAME", but it gets overwritten due to the order | ||
| # of operations for where ansible looks for variables. | ||
| ssh -i devenv-key.pem -o 'StrictHostKeyChecking no' -o 'UserKnownHostsFile=/dev/null' -o 'ConnectTimeout=300' centos@${PUBLIC_DNS} << EOF | ||
| sudo yum -y install git nano ansible | ||
| git clone https://github.com/IQSS/dataverse-ansible.git dataverse | ||
| export ANSIBLE_ROLES_PATH=. | ||
| sed -i "s/branch:/branch: $BRANCH_NAME/" dataverse/defaults/main.yml | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Over at http://irclog.iq.harvard.edu/dataverse/2018-09-18 @donsizemore suggests trying He linked to https://docs.ansible.com/ansible/2.6/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable which shows "extra vars (always win precedence)".
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I tried this and could not get the variable preference to work. It seemed like the blank variable in the config was taking preference. But I may just be a noob about this. command line is definitely the lowest preference. |
||
| ansible-playbook -i dataverse/inventory dataverse/dataverse.pb --connection=local | ||
| EOF | ||
|
|
||
| echo "New EC2 instance created at $PUBLIC_DNS (Public IP $PUBLIC_IP ). When you are done, please terminate your instance with: aws ec2 terminate-instances --instance-ids $INSTACE_ID" | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Instead of just the IP we should give the user a link to click. And does it have to be an IP? Does it get a DNS entry automatically?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. DNS would take extra code and would have extra cost |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| #!/bin/bash | ||
|
|
||
| #This script gets all the instances from ec2 and sends terminate to them | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This "destroy" script is useful but a "list" or "read" script (I'm thinking CRUD) would be nice. "Give me a list of all the running instances and a command for each instance to destroy some or all of them" |
||
| #Its pretty basic and probably shouldn't be trusted at this point. Namely: | ||
| # - You can kill instances other people are using | ||
| # - It will try to kill instances that are already dead, which makes output hard to read | ||
| # - If it fails for some reason it's hard to tell the script didn't work right | ||
|
|
||
| INSTANCES=$(aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId]' --output text) | ||
|
|
||
| aws ec2 terminate-instances --instance-ids $INSTANCES | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High level comments as of 19e2915:
Great work. We need some documentation, probably in the dev guide, maybe in a new section called "deployment" or "validation" or somewhere under the existing "testing" page. The audience is someone that we've instructed to spin up an arbitrary branch. This person may not be a Python user and may not have the
awsbinary installed already. They will need help with all the config under~/.awsthat's required. We need to explain that onlyregion = us-east-1is supported, etc.One comment on the shebang line is that we could consider removing "-x" but it's probably useful for now, even if it's a little verbose.