main.yml

---
# Setup OCP4 Helper Node

- hosts: all
  vars_files:
    - ../vars/main.yml
    - ../vars/ports.yml
  handlers:
  - import_tasks: ../handlers/main.yml

  # Running Pretasks like checking hostnames and verifying the version of ansible
  pre_tasks:
  - name: Verify Ansible version.
    assert:
      that: "ansible_version.full is version_compare('2.9', '>=')"
      msg: >
          "You must update Ansible to at least 2.9"
  - name: validate hostnames
    import_tasks: validate_host_names.yaml
    
  tasks:
  - name: generate ssh keys
    import_tasks: generate_ssh_keys.yaml
    when: ssh_gen_key

  - name: set setup facts
    include: set_facts_.yaml

  - name: Install needed packages
    package:
      name: "{{ packages }}"
      state: present

  - name: Install packages for DHCP install
    package:
      name: "{{ dhcppkgs }}"
      state: present
    when: not staticips and not externaldhcp

  - name: Install packages for PXE install
    package:
      name: "{{ pxepkgs }}"
      state: present
    when: not staticips and baremetal

  - name: Install additional package for Intel platforms
    package:
      name: "{{ syslinuxpkgs }}"
      state: present
    when: not staticips and not ppc64le and baremetal

  - name: Remove existing config files
    import_tasks: remove_old_config_files.yaml
    when: remove_old_config_files

  - name: Write out dhcp file
    template:
      src: ../templates/dhcpd.conf.j2
      dest: /etc/dhcp/dhcpd.conf
    notify:
      - restart dhcpd
    when: not staticips and not uefi and not externaldhcp

  - name: Write out dhcp file (UEFI)
    template:
      src: ../templates/dhcpd-uefi.conf.j2
      dest: /etc/dhcp/dhcpd.conf
    notify:
      - restart dhcpd
    when: not staticips and uefi and not externaldhcp

  - name: Setup named configuration files
    block:
    - name: Write out named file
      template:
        src: ../templates/named.conf.j2
        dest: /etc/named.conf
      notify:
        - restart bind
    
    - name: Installing DNS Serialnumber generator
      copy:
        src: ../files/set-dns-serial.sh
        dest: /usr/local/bin/set-dns-serial.sh
        mode: '0555'

    - name: Set zone serial number
      shell: "/usr/local/bin/set-dns-serial.sh"
      register: dymanicserialnumber

    - name: Setting serial number as a fact
      set_fact:
        serialnumber: "{{ dymanicserialnumber.stdout }}"

    - name: Write out "{{ dns.domain | lower }}" zone file
      template:
        src: ../templates/zonefile.j2
        dest: /var/named/zonefile.db
        mode: '0644'
      notify:
        - restart bind

    - name: Write out reverse zone file
      template:
        src: ../templates/reverse.j2
        dest: /var/named/reverse.db
        mode: '0644'
      notify:
        - restart bind

    - name: Write out haproxy config file
      template:
        src: ../templates/haproxy.cfg.j2
        dest: /etc/haproxy/haproxy.cfg
      notify:
        - restart haproxy
      when: dns.lb_ipaddr is not defined or dns.lb_ipaddr == helper.ipaddr  
    when: dhcp.dns is not defined or dhcp.dns == helper.ipaddr 

  - name: Set HTTP server and prepare OCP4 bios
    block:
    - name: Copy httpd conf file
      copy:
        src: ../files/httpd.conf
        dest: /etc/httpd/conf/httpd.conf
      notify:
        - restart httpd

    - name: Create apache directories for installing
      file:
        path: "{{ item }}"
        state: directory
        mode: 0755
      with_items:
        - /var/www/html/install
        - /var/www/html/ignition

    - name: Delete OCP4 files, if requested, to download again
      file:
         state: absent
         path: "{{ item }}"
      with_items:
        - "/usr/local/src/openshift-client-linux.tar.gz"
        - "/usr/local/src/openshift-install-linux.tar.gz"
        - "/var/www/html/install/bios.raw.gz"
        - "/var/www/html/install/rootfs.img"
        - "/var/lib/tftpboot/rhcos/initramfs.img"
        - "/var/lib/tftpboot/rhcos/kernel"
      when: force_ocp_download

    - name: Downloading OCP4 installer Bios
      get_url:
        url: "{{ ocp_bios }}"
        dest: /var/www/html/install/bios.raw.gz
        mode: 0555
      when: ("metal" in ocp_bios) and (download_imgs or force_ocp_download) and baremetal

    - name: Downloading OCP4 installer rootfs
      get_url:
        url: "{{ ocp_bios }}"
        dest: /var/www/html/install/rootfs.img
        mode: 0555
      when: ("rootfs" in ocp_bios) and (download_imgs or force_ocp_download) and baremetal

  - name: Start firewalld service
    systemd:
      name: firewalld
      state: started
      enabled: yes

  - name: Open up firewall ports
    firewalld:
      permanent: yes
      immediate: yes
      state: enabled
      port: "{{ item[0] }}"
    delegate_to: "{{ item[1] }}"
    run_once: true
    with_nested:
      - "{{ ports }}"
      - "{{ ansible_play_batch }}"

  - name: Best effort SELinux repair - DNS
    shell: "restorecon -vR /var/named || true"

  - name: Best effort SELinux repair - Apache
    shell: "restorecon -vR /var/www/html || true"

  - name: Create NFS export directory
    file:
      path: /export
      state: directory
      mode: 0777
      owner: "{{ owner }}"
      group: "{{ group }}"
    notify:
      - restart nfs

  - name: Copy NFS export conf file
    copy:
      src: ../files/nfs-exports
      dest: /etc/exports
    notify:
      - restart nfs

  - name: Create TFTP config
    file:
      path: /var/lib/tftpboot/pxelinux.cfg
      state: directory
      mode: 0755
    notify:
      - restart tftp
    when: not staticips and not ppc64le and baremetal

  - name: generate netboot entry for grub2
    shell: grub2-mknetdir --net-directory=/var/lib/tftpboot
    when: not staticips and ppc64le and baremetal

  - name: Create TFTP RHCOS dir
    file:
      path: /var/lib/tftpboot/rhcos
      state: directory
      mode: 0755
    when: not staticips and baremetal

  - name: SEBool allow haproxy connect any port
    seboolean:
      name: haproxy_connect_any
      state: yes
      persistent: yes
    notify:
      - restart haproxy
    when: dns.lb_ipaddr is not defined or dns.lb_ipaddr == helper.ipaddr 

  - name: Setting TFTP server
    when: not ipi and baremetal
    block:
    - name: Copy over files needed for TFTP
      shell: "cp -a /usr/share/syslinux/* /var/lib/tftpboot"
      when: not staticips and not ppc64le

    - name: Downloading OCP4 installer initramfs
      get_url:
        url: "{{ ocp_initramfs }}"
        dest: /var/lib/tftpboot/rhcos/initramfs.img
        mode: 0555
      when: not staticips

    - name: Downloading OCP4 installer kernel
      get_url:
        url: "{{ ocp_install_kernel }}"
        dest: /var/lib/tftpboot/rhcos/kernel
        mode: 0555
      when: not staticips

    - name: Generate pxe config files
      block:
      - name: Set the default tftp file
        template:
          src: ../templates/default.j2
          dest: /var/lib/tftpboot/pxelinux.cfg/default
          mode: 0555
        when: "{{ pxe.generate_default | default(false) }}"
        notify:
          - restart tftp

      - name: Set the bootstrap specific tftp file
        template:
          src: ../templates/pxe-bootstrap.j2
          dest: "/var/lib/tftpboot/pxelinux.cfg/01-{{ bootstrap.macaddr | lower | regex_replace (':', '-')}}"
          mode: 0555
        notify:
          - restart tftp
        when: bootstrap is defined

      - name: Set the master specific tftp files
        template:
          src: ../templates/pxe-master.j2
          dest: "/var/lib/tftpboot/pxelinux.cfg/01-{{ item.macaddr | regex_replace (':', '-')}}"
          mode: 0555
        with_items: "{{ masters | lower }}"
        notify:
          - restart tftp

      - name: Set the worker specific tftp files
        template:
          src: ../templates/pxe-worker.j2
          dest: "/var/lib/tftpboot/pxelinux.cfg/01-{{ item.macaddr | regex_replace (':', '-')}}"
          mode: 0555
        with_items: "{{ workers | lower }}"
        notify:
          - restart tftp
        when:
          - workers is defined
          - workers | length > 0
      when: not staticips and not ppc64le

    - name: Prepare UEFI netboot configuration
      block:
      - name: Install packages for UEFI install
        package:
          name: "{{ uefipkgs }}"
          state: present

      - name: Create tftp grub2 directory
        file:
          path: /var/lib/tftpboot/grub2
          state: directory
          mode: '0755'

      - name: copy UEFI shim to grub2 tftpboot/grub2 directory
        copy:
          src: /boot/efi/EFI/redhat/shimx64.efi
          dest: /var/lib/tftpboot/grub2/shimx64.efi
          mode: '0555'
          remote_src: yes

      - name: copy grub2 EFI file to tftpboot/grub2 directory
        copy:
          src: /boot/efi/EFI/redhat/grubx64.efi
          dest: /var/lib/tftpboot/grub2/grubx64.efi
          mode: '0555'
          remote_src: yes

      - name: Create the bootstrap specific grub2 file
        template:
          src: ../templates/grub2-bootstrap.j2
          dest: "/var/lib/tftpboot/grub2/grub.cfg-01-{{ bootstrap.macaddr | lower | regex_replace (':', '-')}}"
          mode: 0555
        notify:
          - restart tftp

      - name: Set the master specific tftp files
        template:
          src: ../templates/grub2-master.j2
          dest: "/var/lib/tftpboot/grub2/grub.cfg-01-{{ item.macaddr | regex_replace (':', '-')}}"
          mode: 0555
        with_items: "{{ masters | lower }}"
        notify:
          - restart tftp

      - name: Set the worker specific tftp files
        template:
          src: ../templates/grub2-worker.j2
          dest: "/var/lib/tftpboot/grub2/grub.cfg-01-{{ item.macaddr | regex_replace (':', '-')}}"
          mode: 0555
        with_items: "{{ workers | lower }}"
        notify:
          - restart tftp
        when:
          - workers is defined
          - workers | length > 0
      when: not staticips and not ppc64le and uefi

    - name: Generate grub2 config files
      block:
      - set_fact:
          coreos_inst_url: "coreos.inst.image_url=http://{{ helper.ipaddr }}:8080/install/bios.raw.gz"
        when: ("metal" in ocp_bios)

      - set_fact:
          coreos_inst_url: "coreos.live.rootfs_url=http://{{ helper.ipaddr }}:8080/install/rootfs.img"
        when: ("rootfs" in ocp_bios)

      - name: create grub.cfg
        copy:
          dest: /var/lib/tftpboot/boot/grub2/grub.cfg
          content: |
            default=0
            fallback=1
            timeout=1

      - name: generate grub entry (bootstrap)
        vars:
          role: bootstrap
          mac: "{{ bootstrap.macaddr }}"
        include_tasks: generate_grub.yml
        when: bootstrap is defined

      - name: generate grub entry (masters)
        vars:
          role: master
          mac: "{{ item.macaddr }}"
        include_tasks: generate_grub.yml
        with_items: "{{ masters }}"

      - name: generate grub entry (workers)
        vars:
          role: worker
          mac: "{{ item.macaddr }}"
        include_tasks: generate_grub.yml
        with_items: "{{ workers }}"
        when:
          - workers is defined
          - workers | length > 0
      when: not staticips and ppc64le and (("metal" in ocp_bios) or ("rootfs" in ocp_bios))

    - name: Installing TFTP Systemd helper
      copy:
        src: ../files/start-tftp.sh
        dest: /usr/local/bin/start-tftp.sh
        mode: '0555'
      when: not staticips

    - name: Installing TFTP Systemd unit file
      copy:
        src: ../files/helper-tftp.service
        dest: /etc/systemd/system/helper-tftp.service
        mode: '0655'
      when: not staticips

  - name: Systemd daemon reload
    systemd:
      daemon_reload: yes
    when: not staticips

  - name: Starting services
    service:
      name: "{{ item }}"
      enabled: yes
      state: started
    with_items:
      - "{{ services }}"

  - name: Starting DHCP/PXE services for baremetal
    service:
      name: "{{ item }}"
      enabled: yes
      state: started
    with_items:
      - dhcpd
      - tftp
      - helper-tftp
    when: not staticips and baremetal

  - name: Starting DHCP services for non baremetal
    service:
      name: "{{ item }}"
      enabled: yes
      state: started
    with_items:
      - dhcpd
    when: not staticips and not baremetal and not externaldhcp

  - name: Unmasking Services
    systemd:
      name: "{{ item }}"
      enabled: yes
      masked: no
    with_items:
      - tftp
    when: not staticips and not ipi and not baremetal

  - name: Copy info script over
    template:
      src: ../templates/checker.sh.j2
      dest: /usr/local/bin/helpernodecheck
      owner: root
      group: root
      mode: 0555

  - name: Copying over nfs-provisioner rbac
    copy:
      src: ../files/nfs-provisioner-rbac.yaml
      dest: /usr/local/src/nfs-provisioner-rbac.yaml
      owner: root
      group: root
      mode: 0666

  - name: Copying over nfs-provisioner deployment
    template:
      src: ../templates/nfs-provisioner-deployment.yaml.j2
      dest: /usr/local/src/nfs-provisioner-deployment.yaml
      owner: root
      group: root
      mode: 0666

  - name: Copying over nfs-provisioner storageclass
    copy:
      src: ../files/nfs-provisioner-sc.yaml
      dest: /usr/local/src/nfs-provisioner-sc.yaml
      owner: root
      group: root
      mode: 0666

  - name: Copying over nfs-provisioner setup script
    copy:
      src: ../files/nfs-provisioner-setup.sh
      dest: /usr/local/bin/nfs-provisioner-setup.sh
      owner: root
      group: root
      mode: 0555

  - name: Copying over a sample PVC file for NFS
    copy:
      src: ../files/registry-pvc.yaml
      dest: /usr/local/src/registry-pvc.yaml
      mode: '0555'

  - name: Chrony configuration
    block:
    - name: Create folder for additional machineconfig
      file:
        path: "{{ machineconfig_path }}"
        state: directory

    - name: Create temporary chrony.conf file
      template:
        src: ../templates/chrony.conf.j2
        dest: /tmp/chrony.conf.tmp

    - name: slurp contents of temporary chrony.conf file
      slurp:
        src: /tmp/chrony.conf.tmp
      register: chronybase64

    - name: Generate Chrony machineconfig
      template:
        src: ../templates/chrony-machineconfig.j2
        dest: "{{ machineconfig_path }}/99-{{item}}-chrony-configuration.yaml"
      loop:
        - master
    - name: Generate Chrony machineconfig
      template:
        src: ../templates/chrony-machineconfig.j2
        dest: "{{ machineconfig_path }}/99-{{item}}-chrony-configuration.yaml"
      loop:
        - worker
      when:
        - workers is defined
        - workers | length > 0
    when: chronyconfig.enabled

  - name: Preparing OCP client
    when: ocp_client is defined
    block:
    - name: Downloading OCP4 client
      get_url:
        url: "{{ ocp_client }}"
        dest: /usr/local/src/openshift-client-linux.tar.gz

    - name: Unarchiving OCP4 client
      unarchive:
        src: /usr/local/src/openshift-client-linux.tar.gz
        dest: /usr/local/bin
        remote_src: yes

  - name: Preparing OCP installer
    when: ocp_installer is defined
    block:
    - name: Downloading OCP4 Installer
      get_url:
        url: "{{ ocp_installer }}"
        dest: /usr/local/src/openshift-install-linux.tar.gz

    - name: Unarchiving OCP4 Installer
      unarchive:
        src: /usr/local/src/openshift-install-linux.tar.gz
        dest: /usr/local/bin
        remote_src: yes

  - name: Removing files that are not needed
    file:
      path: /usr/local/bin/README.md
      state: absent

  - name: Install and configure helm
    when: helm_source is defined
    block:
    - name: Create helm source directory
      file:
        path: "{{ item }}"
        state: directory
        mode: 0755
      with_items:
        - /usr/local/src/helm

    - name: Downloading helm source binary tarball
      get_url:
        url: "{{ helm_source }}"
        dest: /usr/local/src/helm/helm-client.tar.gz

    - name: Unarchiving helm tarball
      unarchive:
        src: /usr/local/src/helm/helm-client.tar.gz
        dest: /usr/local/src/helm
        remote_src: yes

    - name: Copy helm cli to bin directory for amd64
      copy:
        src: /usr/local/src/helm/linux-amd64/helm
        dest: /usr/local/bin/helm
        owner: root
        group: root
        mode: '0755'
        remote_src: true
      when: not ppc64le

    - name: Copy helm cli to bin directory for ppc64le
      copy:
        src: /usr/local/src/helm/linux-ppc64le/helm
        dest: /usr/local/bin/helm
        owner: root
        group: root
        mode: '0755'
        remote_src: true
      when: ppc64le

  - name: Set the local resolv.conf file
    template:
      src: ../templates/resolv.conf.j2
      dest: /etc/resolv.conf

  - name: Get network device system name
    shell: "nmcli -t dev show {{ networkifacename }} | grep GENERAL.CONNECTION | cut -d: -f2"
    register: devicesystemname

  - name: Setting network device system name as a fact
    set_fact:
      dsname: "{{ devicesystemname.stdout }}"

  - name: Setting DNS server ip on network interface "{{ dsname }}" to 127.0.0.1
    shell: 'nmcli con mod "{{ dsname }}" ipv4.dns 127.0.0.1'

  - name: Setting DNS search path on network interface "{{ dsname }}" to "{{ dns.clusterid }}.{{ dns.domain | lower }}"
    shell: 'nmcli con mod  "{{ dsname }}" ipv4.dns-search {{ dns.clusterid }}.{{ dns.domain | lower }}'

  - name: Restarting NetworkManager
    service:
      name: "{{ item }}"
      state: restarted
    with_items:
      - NetworkManager

  - name: Setup keepalived service
    when: high_availability is defined
    import_tasks: setup_keepalived.yaml

  - name: Setup Local Registry
    when: setup_registry.deploy
    block:
    - name: Install registry packages
      package:
        name: "{{ registry }}"
        state: present

    - name: Setup Registry
      import_tasks: setup_registry.yaml

  - name: Enable restart always for critical services
    include_tasks: restart_config.yaml
    loop: "{{ critical_services }}"

  - name: Disable named service
    service:
      name: named
      state: stopped
    when: dhcp.dns is defined and dhcp.dns != helper.ipaddr

  - name: Disable haproxy service
    service:
      name: haproxy
      state: stopped
    when: (dhcp.dns is defined and dhcp.dns != helper.ipaddr) or (dns.lb_ipaddr is defined and dns.lb_ipaddr != helper.ipaddr)

  - name:  Information about this install
    debug:
      msg:
        - "Please run /usr/local/bin/helpernodecheck for information"