configure_tower_secrets.yml

---
- name: Configure Secrets Engine in Ansible Tower
  hosts: all
  gather_facts: no
  vars:
    servers_to_monitor: "{{ groups['all'] }}"
  vars_files:
    - ./vars/default-vars.yml
    - ./credentials/tower_creds.yml
    - ./credentials/vault_creds.yml

  tasks:

    - name: Add GCP Secrets Engine to Tower
      block:

        - name: Add GCP Secrets Engine to Tower
          include_role:
            name: gcp-deploy
            tasks_from: provision-secrets-engine-tower

      when: cloud_provider == "gcp"

    - name: Add AWS Secrets Engine to Tower
      block:

        - name: Add AWS Secrets Engine to Tower
          include_role:
            name: aws-deploy
            tasks_from: provision-secrets-engine-tower

      when: cloud_provider == "aws"

    # - name: Deploy AWS Instances
    #   block:
    #
    #     - name: Set Machine Type to Micro
    #       set_fact:
    #         machine_type: t2.micro
    #         ec2_root_volume_name: /dev/xvda
    #       when: instance_size == "micro"
    #
    #     - name: Set Machine Type to Small
    #       set_fact:
    #         machine_type: t2.small
    #         ec2_root_volume_name: /dev/sda1
    #       when: instance_size == "small"
    #
    #     - name: Set Machine Type to Medium
    #       set_fact:
    #         machine_type: t2.medium
    #         ec2_root_volume_name: /dev/sda1
    #       when: instance_size == "medium"
    #
    #     - name: Set Machine Type to large
    #       set_fact:
    #         machine_type: t2.large
    #         ec2_root_volume_name: /dev/sda1
    #       when: instance_size == "large"
    #
    #     - name: Create AWS SSH Key Pair
    #       ec2_key:
    #         region: "{{ ec2_region }}"
    #         name: "{{ ec2_prefix }}-key"
    #       register: create_key
    #
    #     # This is just saving off the private key, this can only be done 1 time on the first creation of the key, pair
    #     - name: Save Private Key Locally
    #       copy:
    #         content: "{{ create_key.key.private_key }}"
    #         dest: "{{ working_dir }}/{{ ec2_prefix }}-key-private.pem"
    #         mode: '0600'
    #       when: create_key.changed
    #       # no_log: yes
    #
    #     - name: Derive Public Key from Private Key
    #       command: "ssh-keygen -y -f {{ working_dir }}/{{ ec2_prefix }}-key-private.pem"
    #       register: pubkey_output
    #       when: create_key.changed
    #       # no_log: yes
    #
    #     - name: Save Public Key Locally
    #       copy:
    #         content: "{{ pubkey_output.stdout }}"
    #         dest: "{{ working_dir }}/{{ ec2_prefix }}-key.pub"
    #         mode: '0400'
    #       when: create_key.changed
    #       no_log: yes
    #
    #     # - name: Set Key information to string
    #     #   set_fact:
    #     #     private_key_content: lookup('file', '{{ working_dir }}/{{ ec2_prefix }}-key-private.pem')
    #
    #     - name: Update Ansible Tower Cloud SSH Credential
    #       tower_credential:
    #         name: Cloud Demo Instances Key
    #         organization: Default
    #         tower_host: "{{ tower_url }}"
    #         tower_username: "{{ tower_user }}"
    #         tower_password: "{{ tower_pass }}"
    #         kind: ssh
    #         username: ec2-user
    #         # ssh_key_data: "{{ working_dir }}/{{ ec2_prefix }}-key-private.pem"
    #         ssh_key_data: "{{ lookup('file', '{{ working_dir }}/{{ ec2_prefix }}-key-private.pem') }}"
    #         tower_verify_ssl: false
    #       delegate_to: localhost
    #       run_once: true
    #       when: create_key.changed
    #
    #     # - name: delete flat-file private key
    #     #   file:
    #     #     path: "{{ working_dir }}/{{ ec2_prefix }}-key-private.pem"
    #     #     state: absent
    #
    #     - name: Gather Subnet Information
    #       ec2_vpc_subnet_info:
    #         region: "{{ ec2_region }}"
    #         filters:
    #           "tag:application": "{{ application }}"
    #           "tag:provisioner": "mford"
    #       register: subnet_info
    #
    #     # - debug:
    #     #     var: subnet_info
    #
    #     - name: "Create ec2 secrets engine instance"
    #       ec2:
    #         assign_public_ip: true
    #         key_name: "{{ ec2_prefix }}-key"
    #         group: "{{ ec2_prefix }}-sg"
    #         instance_type: t2.medium
    #         image: "{{ ec2_image_id }}"
    #         region: "{{ ec2_region }}"
    #         count: 1
    #         wait: "{{ ec2_wait }}"
    #         vpc_subnet_id: "{{ subnet_info.subnets[0].id }}"
    #         instance_tags:
    #           provisioner: mford
    #           application: "{{ application }}"
    #           Name: "{{ application }}-webserver"
    #           demo: appdeployment
    #           group: webserver
    #           ec2_prefix: "{{ ec2_prefix }}"
    #           cloud_provider: aws
    #         volumes:
    #           - device_name: /dev/sda1
    #             volume_type: gp2
    #             volume_size: 10
    #             delete_on_termination: true
    #
    #
    #     - name: "Create EC2 instances for {{ application }}"
    #       ec2:
    #         assign_public_ip: true
    #         key_name: "{{ ec2_prefix }}-key"
    #         group: "{{ ec2_prefix }}-sg"
    #         instance_type: "{{ machine_type }}"
    #         image: "{{ ec2_image_id }}"
    #         region: "{{ ec2_region }}"
    #         count: "{{ num_instances }}"
    #         wait: "{{ ec2_wait }}"
    #         vpc_subnet_id: "{{ subnet_info.subnets[0].id }}"
    #         instance_tags:
    #           provisioner: mford
    #           application: "{{ application }}"
    #           Name: "{{ application }}-server"
    #           demo: appdeployment
    #           group: rhel
    #           ec2_prefix: "{{ ec2_prefix }}"
    #           cloud_provider: aws
    #         volumes:
    #           - device_name: "{{ ec2_root_volume_name }}"
    #             volume_type: gp2
    #             volume_size: "{{ ec2_root_volume_size }}"
    #             delete_on_termination: true
    #
    #   when: cloud_provider == "aws"
    #
    # - name: Deploy GCP Instances
    #   block:
    #     - name: Set Machine Type to Micro
    #       set_fact:
    #         machine_type: f1-micro
    #       when: instance_size == "micro"
    #
    #     - name: Set Machine Type to Small
    #       set_fact:
    #         machine_type: g1-small
    #       when: instance_size == "small"
    #
    #     - name: Set Machine Type to Medium
    #       set_fact:
    #         machine_type: n1-standard-1
    #       when: instance_size == "medium"
    #
    #     - name: Set Machine Type to large
    #       set_fact:
    #         machine_type: n1-standard-2
    #       when: instance_size == "large"
    #
    #     - name: Generate SSH Key pair
    #       openssh_keypair:
    #         path: "{{working_dir }}/id_ssh_rsa"
    #       register: ssh_key_output
    #
    #     - name: Update Ansible Tower Cloud SSH Credential
    #       tower_credential:
    #         name: Cloud Demo Instances Key
    #         organization: Default
    #         tower_host: "{{ tower_url }}"
    #         tower_username: "{{ tower_user }}"
    #         tower_password: "{{ tower_pass }}"
    #         kind: ssh
    #         username: ec2-user
    #         ssh_key_data: "{{ lookup('file', '{{ working_dir }}/id_ssh_rsa') }}"
    #         tower_verify_ssl: false
    #       delegate_to: localhost
    #       run_once: true
    #
    #     - debug:
    #         var: ssh_key_output
    #
    #     - name: Gather Subnet Information
    #       gcp_compute_subnetwork_info:
    #         region: "{{ gcp_region }}"
    #         filters:
    #         - name = "{{ gcp_prefix }}-subnet"
    #       register: subnetwork_info
    #
    #     # - debug:
    #     #     var: subnetwork_info
    #
    #     - name: Gather Network Information
    #       gcp_compute_network_info:
    #         filters:
    #         - name = "{{ gcp_prefix }}-vpc"
    #       register: network_info
    #
    #     # - debug:
    #     #     var: network_info
    #
    #     # - name: add ssh public key to GCP
    #
    #     - name: "Create GCP instances for {{ application }}"
    #       gcp_compute_instance:
    #         name: "{{ application }}-server-{{ item|int }}"
    #         machine_type: "{{ machine_type }}"
    #         disks:
    #         - auto_delete: 'true'
    #           boot: 'true'
    #           initialize_params:
    #             disk_name: "{{ gcp_prefix}}-disk-{{ item|int }}"
    #             disk_size_gb: 20
    #             source_image: "{{ gcp_disk_image }}"
    #         metadata:
    #           ssh-keys: "ec2-user:{{ ssh_key_output.public_key }} ec2-user"
    #         labels:
    #           provisioner: mford
    #           application: "{{ application }}"
    #           demo: appdeployment
    #           group: rhel
    #           cloud_provider: gcp
    #         network_interfaces:
    #         - network: "{{ network_info.resources[0] }}"
    #           access_configs:
    #           - name: External NAT
    #             nat_ip:
    #               name: "{{ gcp_prefix}}-address-{{ item|int }}"
    #             type: ONE_TO_ONE_NAT
    #           subnetwork: "{{ subnetwork_info.resources[0] }}"
    #         zone: "{{ gcp_zone }}"
    #         tags:
    #           items:
    #             - appdeployment
    #             - "{{ application }}"
    #         state: present
    #       with_sequence: count="{{ num_instances }}"
    #       # no_log: true
    #
    #     - name: "Create GCP secrets engine instance"
    #       gcp_compute_instance:
    #         name: "{{ gcp_prefix}}-webserver"
    #         machine_type: n1-standard-1
    #         disks:
    #         - auto_delete: 'true'
    #           boot: 'true'
    #           initialize_params:
    #             disk_name: "{{ gcp_prefix}}-webserver-disk"
    #             disk_size_gb: 20
    #             source_image: "{{ gcp_disk_image }}"
    #         metadata:
    #           ssh-keys: "ec2-user:{{ ssh_key_output.public_key }} ec2-user"
    #         labels:
    #           provisioner: mford
    #           application: "{{ application }}"
    #           demo: appdeployment
    #           group: webserver
    #           cloud_provider: gcp
    #         network_interfaces:
    #         - network: "{{ network_info.resources[0] }}"
    #           access_configs:
    #           - name: External NAT
    #             nat_ip:
    #               name: "{{ gcp_prefix}}-webserver-address"
    #             type: ONE_TO_ONE_NAT
    #           subnetwork: "{{ subnetwork_info.resources[0] }}"
    #         zone: "{{ gcp_zone }}"
    #         tags:
    #           items:
    #             - appdeployment
    #             - "{{ application }}"
    #         state: present
    #       # no_log: true
    #
    #     # #Sequence loop testing
    #     # - set_fact:
    #     #     the_count: 5
    #     #
    #     # - debug:
    #     #     msg: "The item number is {{ item|int }}"
    #     #   with_sequence: count="{{ the_count }}"
    #
    #
    #   when: cloud_provider == "gcp"