AzureDeploy.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Initial local machine setup\n",
    "\n",
    "## Install and import required modules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!pip3 install wget pycryptodome jumpssh\n",
    "import os\n",
    "import sys\n",
    "from jumpssh import SSHSession # to automate script runs over Jumphost\n",
    "from shutil import which # to find/verify terraform availability\n",
    "from Crypto.PublicKey import RSA # to generate key pair"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Setup the environment variables"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Project variables\n",
    "username        = ''\n",
    "project_id      = ''\n",
    "private_key_name = '' # Don't use file/folder structure - should be in cwd\n",
    "public_key_name = ''\n",
    "install_ad_server = False\n",
    "\n",
    "# Set replacement vars\n",
    "homepath = '/home/' + username\n",
    "epicurl = \"\"\n",
    "installfile = 'bluedata-epic-entdoc-minimal-release-5.0-3008.bin'\n",
    "hcpdomain = 'internal.cloudapp.net' # Default domain name used by local Azure DNS\n",
    "\n",
    "## Azure credentials\n",
    "subscription_id = ''\n",
    "client_id       = ''\n",
    "client_secret   = ''\n",
    "tenant_id       = ''\n",
    "region          = ''\n",
    "\n",
    "%run -i 'my_secrets.py' ### load vars from local file\n",
    "\n",
    "if not (username, project_id, private_key_name, public_key_name, epicurl, subscription_id, client_id, client_secret, tenant_id, region):\n",
    "    raise SystemError('You should fill in all the details')\n",
    "else:\n",
    "    print('All variables are set')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Generate OpenSSH keys if needed"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "if not os.path.isfile(private_key_name) or not os.path.isfile(public_key_name):\n",
    "    key = RSA.generate(2048)\n",
    "    with open(os.open(private_key_name, os.O_CREAT | os.O_WRONLY, 0o600), 'wb') as f:\n",
    "        f.write(key.exportKey('PEM'))\n",
    "\n",
    "    pubkey = key.publickey()\n",
    "    with open(public_key_name, 'wb') as f:\n",
    "        f.write(pubkey.exportKey('OpenSSH'))\n",
    "else:\n",
    "    print('Using existing key files')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Get terraform"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "tf = which('terraform')\n",
    "if not tf:\n",
    "    print('Need to download terraform!')\n",
    "    if sys.platform.startswith('darwin'):\n",
    "        tf = 'https://releases.hashicorp.com/terraform/0.12.24/terraform_0.12.24_darwin_amd64.zip'\n",
    "    elif sys.platform.startswith('linux'):\n",
    "        tf = 'https://releases.hashicorp.com/terraform/0.12.24/terraform_0.12.24_linux_amd64.zip'\n",
    "    elif sys.platform.startswith('win32'):\n",
    "        tf = 'https://releases.hashicorp.com/terraform/0.12.24/terraform_0.12.24_windows_amd64.zip'\n",
    "    tempfile = 'temp.zip'\n",
    "    import wget\n",
    "    tfzip = wget.download(tf)\n",
    "    from zipfile import ZipFile\n",
    "    with ZipFile(tfzip, 'r') as zip_ref:\n",
    "        if sys.platform.startswith('win32'):\n",
    "            zip_ref.extract('terraform.exe')\n",
    "        else:\n",
    "            zip_ref.extract('terraform')\n",
    "    os.remove(tfzip)\n",
    "    tf = os.path.join('.', 'terraform')\n",
    "\n",
    "if tf:\n",
    "    print('Ready to proceed with {}'.format(tf)) \n",
    "else:\n",
    "    raise SystemExit('Please download terraform: https://learn.hashicorp.com/terraform/getting-started/install.html')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Initialize terraform"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "!terraform init"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Pre-flight\n",
    "\n",
    "\n",
    "## Update scripts"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Import keys"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "user_public_key = open(public_key_name, 'r').read().strip()\n",
    "user_private_key = open(private_key_name, 'r').read().strip()\n",
    "\n",
    "if not (user_public_key or user_private_key):\n",
    "    raise SystemExit('You need ssh key pair to proceed')\n",
    "else:\n",
    "    print(user_public_key)\n",
    "    print(user_private_key)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Update cloud-init"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "indent = '  ' # double space for indentation in yaml file\n",
    "cloudinit = open('cloud-init.yaml-template').read().replace(\n",
    "    'ssh-authorized-keys:', 'ssh-authorized-keys:\\n' + (2 * indent) + '- ' + user_public_key\n",
    ").replace(\n",
    "    'name:', 'name: ' + username\n",
    ")\n",
    "\n",
    "with open('cloud-init.yaml', 'w') as f:\n",
    "    f.write(cloudinit)\n",
    "\n",
    "print (cloudinit)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Update terraform.tfvars"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "tfvars = open('terraform.tfvars-template', 'r').read().replace(\n",
    "    'subscription_id = \"\"', 'subscription_id = \"' + subscription_id + '\"'\n",
    ").replace(\n",
    "    'client_id       = \"\"', 'client_id       = \"' + client_id + '\"'\n",
    ").replace(\n",
    "    'client_secret   = \"\"', 'client_secret   = \"' + client_secret + '\"'\n",
    ").replace(\n",
    "    'tenant_id       = \"\"', 'tenant_id       = \"' + tenant_id + '\"'\n",
    ").replace(\n",
    "    'region = \"\"', 'region = \"' + region + '\"'\n",
    ").replace(\n",
    "    'project_id         = \"\"', 'project_id         = \"' + project_id + '\"'\n",
    ").replace(\n",
    "    'user               = \"\"', 'user               = \"' + username + '\"'\n",
    ").replace(\n",
    "    'ssh_pub_key_path   = \"\"', 'ssh_pub_key_path   = '+ repr(public_key_name).replace('\\'', '\"')\n",
    ")\n",
    "\n",
    "with open('terraform.tfvars', 'w') as f:\n",
    "    f.write(tfvars)\n",
    "\n",
    "print(tfvars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Ready to Deploy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Deployment Plan"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true,
    "tags": []
   },
   "outputs": [],
   "source": [
    "!terraform plan -out plan.out"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Run the Deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "!terraform apply -auto-approve \"plan.out\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Post Deployment\n",
    "\n",
    "At this stage, we should have all resources available to start configuring and installing HPE Container Platform"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Get outputs from Terraform"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def get_tfoutput(param):\n",
    "    tfo = !terraform output $param\n",
    "    return tfo.s\n",
    "\n",
    "jumphost_ssh_command = get_tfoutput('jumphost_ssh_command').replace(\n",
    "    'ssh', 'ssh -i ' + private_key_name\n",
    ")\n",
    "connection_info = jumphost_ssh_command # temprorarily store until xrdp is ready\n",
    "\n",
    "user_password = get_tfoutput('jumphost_password')\n",
    "jumphost_public_ip = get_tfoutput('jumphost_public_ip')\n",
    "jumphost_public_dns_name = get_tfoutput('jumphost_public_dns_name')\n",
    "controller_private_ip = get_tfoutput('controller_private_ip')\n",
    "jumphost_private_ip = get_tfoutput('jumphost_private_ip')\n",
    "gateway_private_ip = get_tfoutput('gateway_private_ip')\n",
    "certfile = 'cacert.pem'\n",
    "certkeyfile = 'cakey.pem'\n",
    "import re\n",
    "worker_private_ips = re.sub('\\[|\\]|\\s|\"', '', get_tfoutput('worker_private_ips')).replace(',', ' ').strip().split(' ')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Configure Jumphost for RDP access, local CA and optional AD service"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "jumphost_init_file = os.path.join('scripts', 'jumphost-init.sh')\n",
    "jumphost_init_script = open(os.path.join('scripts', 'jumphost_init.sh-template')).read().strip()\n",
    "\n",
    "jumphost_init_script = jumphost_init_script.replace('echo pass', 'echo ' + user_password + ' | sudo passwd --stdin ' + username)\n",
    "\n",
    "# Install minica\n",
    "jumphost_init_script = jumphost_init_script.replace(\n",
    "    'hcp_domains', ','.join([hcpdomain, jumphost_public_dns_name, 'localhost'])\n",
    ").replace(\n",
    "    'hcp_ips', ','.join([jumphost_public_ip, jumphost_private_ip, controller_private_ip, gateway_private_ip, *(worker_private_ips), '127.0.0.1'])\n",
    ").replace(\n",
    "    'certfile', certfile\n",
    ").replace(\n",
    "    'keyfile', certkeyfile\n",
    ")\n",
    "\n",
    "# Install AD Server\n",
    "if install_ad_server:\n",
    "    jumphost_init_script += '\\necho AD server installation not implemented!'\n",
    "\n",
    "with open(jumphost_init_file, 'w') as f:\n",
    "    f.write(jumphost_init_script)\n",
    "\n",
    "print(jumphost_init_script)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Prepare bluedata_install.sh script"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "bluedata_install_script = open(os.path.join('scripts', 'bluedata_install.sh-template')).read().strip()\n",
    "bluedata_install_script_file = os.path.join('scripts', 'bluedata_install.sh')\n",
    "\n",
    "# Replace vars\n",
    "bluedata_install_script = bluedata_install_script.replace(\n",
    "    '/homepath', homepath\n",
    ").replace(\n",
    "    'epicurl', epicurl\n",
    ").replace(\n",
    "    'installfile', installfile\n",
    ").replace(\n",
    "    'certfile', certfile\n",
    ").replace(\n",
    "    'certkeyfile', certkeyfile\n",
    ").replace(\n",
    "    'controller_ip', controller_private_ip\n",
    ").replace(\n",
    "    'worker_ips', ','.join([*(worker_private_ips)])\n",
    ").replace(\n",
    "    'hcpdomain', project_id + '.local'\n",
    ")\n",
    "\n",
    "with open(bluedata_install_script_file, 'w') as f:\n",
    "    f.write(bluedata_install_script)\n",
    "\n",
    "print(bluedata_install_script)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Pre-flight for script runs\n",
    "\n",
    "Allow 2-3 minutes for cloud-init to finish updating packages and rebooting."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "## Check output\n",
    "def printExit(exit_code, output):\n",
    "    if exit_code != 0:\n",
    "        raise SystemExit(output)\n",
    "    else:\n",
    "        print(output)\n",
    "\n",
    "## connect to jumphost\n",
    "jumphost_ssh_session = SSHSession(jumphost_public_ip, username=username, private_key_file=private_key_name).open()\n",
    "\n",
    "## Upload private key if not there\n",
    "if not jumphost_ssh_session.exists(private_key_name):\n",
    "    jumphost_ssh_session.put(private_key_name, private_key_name, permissions='600')\n",
    "    print('Private key uploaded to jumphost...')\n",
    "print('Jumphost ready to connect to other nodes')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Init jumphost"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "(exit_code, jumphost_install_log) = jumphost_ssh_session.run_cmd(jumphost_init_script, continuous_output=True)\n",
    "if exit_code == 0:\n",
    "    jumphost_ssh_session.file('jumphost_install.log', jumphost_install_log, permissions='644')\n",
    "    connection_info = '\\nConnect using SSH\\n{}\\n\\nConnect using RDP\\nIP: {}\\nUsername: {}\\nPassword: {}\\n'.format(jumphost_ssh_command, jumphost_public_ip, username, user_password)\n",
    "else:\n",
    "    raise SystemExit(jumphost_install_log)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Init all hosts (controller, gateway and workers)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "## worker connections to jumphost\n",
    "for host in [controller_private_ip, gateway_private_ip, *worker_private_ips]:\n",
    "    print(host + ' initialization starting')\n",
    "    host_session = jumphost_ssh_session.get_remote_session(host, username=username, private_key_file=private_key_name)\n",
    "    host_session.put(private_key_name, private_key_name, permissions='600')\n",
    "    print('Private key uploaded to host ' + host)\n",
    "    host_init_file = open(os.path.join('scripts', 'host-init.sh')).read().strip()\n",
    "    host_session.file('host-init.sh', host_init_file, permissions='755')\n",
    "    (exit_code, host_init_log) = host_session.run_cmd('./host-init.sh', continuous_output=True)\n",
    "    jumphost_ssh_session.file('host-' + host + '_init.log', host_init_log, permissions='644')\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Init controller"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "## controller connection from jumphost\n",
    "controller_ssh_session = jumphost_ssh_session.get_remote_session(controller_private_ip, username=username, private_key_file=private_key_name)\n",
    "\n",
    "## Upload install script\n",
    "controller_ssh_session.file('bluedata_install.sh', bluedata_install_script, permissions='755')\n",
    "print('Installation script uploaded to controller...')\n",
    "\n",
    "## Transfer certificate files to the controller\n",
    "jumphost_ssh_session.get(hcpdomain + '/cert.pem', certfile)\n",
    "jumphost_ssh_session.get(hcpdomain + '/key.pem', certkeyfile)\n",
    "controller_ssh_session.put(certfile, certfile, permissions='600')\n",
    "controller_ssh_session.put(certkeyfile, certkeyfile, permissions='600')\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Start BlueData installation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "## Start installation\n",
    "(exit_code, bluedata_install_log) = controller_ssh_session.run_cmd('sudo ./bluedata_install.sh', continuous_output=True)\n",
    "if exit_code == 0:\n",
    "    jumphost_ssh_session.file('bluedata_install.log', bluedata_install_log, permissions='644')\n",
    "else:\n",
    "    raise SystemExit(bluedata_install_log)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Clean up"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "controller_ssh_session.close()\n",
    "jumphost_ssh_session.close()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Ready to serve!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "print(connection_info)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Post Installation\n",
    "\n",
    "Follow the steps to complete installation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "gateway_public_dns_name = get_tfoutput('gateway_public_dns_name')\n",
    "print(open(os.path.join('scripts', 'install_complete-template.txt')).read().strip().replace(\n",
    "    'private_key_name', private_key_name\n",
    ").replace(\n",
    "    'controller_private_ip', controller_private_ip\n",
    ").replace(\n",
    "    'worker_private_ips', ','.join(worker_private_ips)\n",
    ").replace(\n",
    "    'gateway_private_ip', gateway_private_ip\n",
    ").replace(\n",
    "    'gateway_dns_name', gateway_public_dns_name\n",
    "))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### TODO: Adding gateway"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "add_gateway_script = ''\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### TODO: Adding worker nodes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "add_workers_script = ''"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Destroy Deployment"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Run command `terraform destroy --auto-approve` to automatically destroy the whole deployment."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# TODO\n",
    "\n",
    "- Add AzureAD and NFS server options\n",
    "- Disable firewall ports except for gateway (https) and controller (ssh)\n",
    "- Enable adding gateway & worker nodes"
   ]
  }
 ],
 "metadata": {
  "file_extension": ".py",
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.7-final"
  },
  "mimetype": "text/x-python",
  "name": "python",
  "npconvert_exporter": "python",
  "pygments_lexer": "ipython3",
  "version": 3
 },
 "nbformat": 4,
 "nbformat_minor": 2
}