new-edge-engineering/ansible-rundeck

Ansible role defining rundeck installation and configuration.

Ansible Rundeck Role

This is an Ansible role to install, configure and ensure sure rundeck is running. Feedback, bug-reports, requests are welcomed and can be done via github issues.

Execution Requirements

• Tested on Mac OS X with Ansible 2.0.

Role Variables

The following variables can be overridden:

• rundeck_protocol: Defaults to http but should be set to the protocol the web application with accessed by.
• rundeck_domain: Defaults to localhost:4440 but should be set to the host name web application with accessed by.
• rundeck_database_type: Defaults to hsqldb but can be set to postgresql or mysql to use those databases. Users and databases are not automatically created.
• rundeck_database_host: Defaults to localhost and only needs to be set if using an externally hosted database.
• rundeck_database_port: Defaults to None and must be set if using a different database than the default hsqldb.
• rundeck_database_name: Defaults to rundeck but allows you to use a different rundeck database name.
• rundeck_database_user: Defaults to rundeck but allows you to use a different username to accesses the rundeck database.
• rundeck_database_pass: Defaults to rundeck but allows you to use a different password for the user access to the rundeck database.
• rundeck_users: A list of dictionaries of name, password (hashed) and a list of roles (One must be an admin). If empty the default admin is not removed.
• rundeck_plugins: A list of plugin urls that are downloaded and installed into the rundeck libext, default is none.
• rundeck_extra_bootstrap: A list of extra jar urls that are downloaded and installed into the rundeck bootstrap, default is none.
• rundeck_generate_ssh: Automatically generate ssh key, defgault True set to False to stop this action.
• rundeck_ldap: Determine if LDAP authentication should be used, overrides rundeck_users. Default is False. The LDAP server must a user group to privde access to rundeck web interface.
• rundeck_ldap_url: The location of the LDAP server, i.e. ldap://localhost:389
• rundeck_ldap_bind_user: The DN to access the LDAP server, i.e. cn=Manager,dc=example,dc=com
• rundeck_ldap_bind_pass: The DN user password o access the LDAP server, secrent
• rundeck_ldap_user_dn: The DN of the users, i.e. ou=People,dc=test1,dc=example,dc=com
• rundeck_ldap_user_rdn_attr: The attribute that identifies the username, i.e. uid
• rundeck_ldap_user_id_attr: The attribute that identifies the username, i.e. uid
• rundeck_ldap_bindinglogin: Default: false. If true, bind as the user that is authenticating, otherwise bind as the manager and perform a search to verify user password
• rundeck_ldap_user_pass_attr: The attribute that identifies the user password, i.e. userPassword
• rundeck_ldap_user_filter: The objectClass that is used to find user, i.e. account
• rundeck_ldap_role_dn: The DN of the roles, i.e. ou=Groups,dc=test1,dc=example,dc=com
• rundeck_ldap_role_name_attr: The attribute name of the role, i.e. cn
• rundeck_ldap_role_username_attr: This overrides the rundeck_ldap_role_member_attr determine user membership of roles, i.e. uid
• rundeck_ldap_role_member_attr: Used to determine user membership of roles, i.e. member
• rundeck_ldap_role_filter: The objectClass that is used to find role, i.e. groupOfNames
• rundeck_ldap_netsted_groups: Default: false. If true, will resolve all nested groups for authenticated users
• rundeck_ldap_debug: Default: false. Enable/Disable ldap debuging
• rundeck_crowd: Default: False. Determine if Atlassian Crowd authentication should be used, overrides rundeck_users
• rundeck_crowd_jaas_jars: List of URL to get Crowd JAAS jars from
• rundeck_crowd_name: Default: 'RunDeck'. Application name to access Crowd
• rundeck_crowd_pass: Default: 'secret'. Application password to access Crowd
• rundeck_crowd_url: Default: 'http://localhost/crowd/'.
• rundeck_crowd_maxconn: Default: 20. httpMaxConnections
• rundeck_crowd_timeout: Default: 5000. httpTimeout
• rundeck_crowd_proxy_host: Default: Undefined
• rundeck_crowd_proxy_port: Default: Undefined
• rundeck_crowd_proxy_username: Default: Undefined
• rundeck_crowd_proxy_password: Default: Undefined
• rundeck_crowd_debug: Default: False. Enable/Disable Crowd auth debugging

Dependencies

This role does not have a hard dependency on any other role to deploy but rundeck does require java to be installed (decoupled on the communities request). smola's ansible-java-role is a good choice with the following configuration:

• Debian: Ensure java_packages has a debian java package in it, i.e. openjdk-7-jre-headless
• RedHat: Ensure java_packages has a debian java package in it, i.e. java-1.7.0-openjdk, had to adjust role to include RedHat.yml in main.yml to work.

If you choose to use a database then please ensure it is installed before executing this role. The following roles have been used to create databases:

• Ubuntu 12.04 & 14.04/PostgreSQL: postgresql
• Centos 6.5 & 7.0/PostgreSQL: postgresql-on-el6 (with tweeks, watch this space for updates)

Testing

Please check changes using the vagrant boxes provided, i.e.:

cd tests/vagrant-centos65
vagrant up

To use PostgreSQL database, export the playbook first, i.e.:

export PLAYBOOK=postgresql_redhat_test.yml

License

Licensed under the MIT License. See the LICENSE file for details.

ansible-rundeck's Issues

Mysql driver is old

Hi

ansible-rundeck/tasks/configure_for_mysql.yml is currently downloading http://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java-3.0.17-ga.tar.gz. from what i can see this dates back to 2005

The latest version for example is
https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java-8.0.17.tar.gz

Possibly worth making this a configurable variable to ensure latest

Ubuntu 16.04: make sure python-setuptools is present

Hi,

please check if you can confirm.
I tried to apply the role on a Ubuntu 16.04.1 VM and it failed here.
TASK [New-Edge-Engineering.rundeck : Rundeck | Install supporting python packages] *** Friday 30 September 2016 14:00:05 +0200 (0:00:01.313) 0:00:07.146 ****** failed: [opsdeck01.prv.cgn.sprd.net] (item=httplib2) => {"cmd": "/usr/bin/pip install httplib2", "failed": true, "item": "httplib2", "msg": "stdout: Collecting httplib2\n Using cached httplib2-0.9.2.zip\n Complete output from command python setup.py egg_info:\n Traceback (most recent call last):\n File \"<string>\", line 1, in <module>\n ImportError: No module named setuptools\n \n ----------------------------------------\n\n:stderr: Command \"python setup.py egg_info\" failed with error code 1 in /tmp/pip-build-MoUBTV/httplib2/\nYou are using pip version 8.1.1, however version 8.1.2 is available.\nYou should consider upgrading via the 'pip install --upgrade pip' command.\n"}

Reason was/is that the debian package python-setuptools is missing. I installed it by hand and the step from above was successful.

If you can confirm, may you add python-setuptools to the step Rundeck | Install supporting packages in install_debian.yml

Thanks a lot.

The role failed at task "Add Bintray GPG key for rundeck repo"

TASK [roles/New-Edge-Engineering.ansible-rundeck : Debian installation | Add Bintray GPG key for rundeck repo] *********************** fatal: [servername]: FAILED! => {"changed": false, "msg": "Failed to download key at https://bintray.com/user/downloadSubjectPublicKey?username=bintray: HTTP Error 410: Gone"}

Don't automatically prefix rundeck_domain with "rundeck"

It would be useful if the rundeck_domain setting completely controlled the value of the grails.serverURL, and 'rundeck' wasn't automatically prepended to it. This makes it easier to set it to e.g. localhost for testing in a local vagrant.

Running in a vagrant box has problems with grails port 4440

The install goes smoothly and the login page comes up at port 4440 (defined from framework.properties). But once logged in the grails host and port from rundeck-config.properties takes over and the page 404's.

develop branch looks broken (so look the tags 17.02.12/13)

Hi,

Thank you for this role. I'd like to notify you that PR #18 (and more specifically commit d7e0402) seem to have broken execution of this role by removing the register: rundeck_targeting_version in install_debian.yml needed in both postgresql.yml and mysql.yml (at lines 107 and 92 respectively)

TypeError: '<' not supported between instances of 'int' and 'str'

When I use ansible-galaxy install neel.rundeck -p roles, it will report the following error:

the full traceback was:

Traceback (most recent call last):
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/bin/ansible-galaxy", line 109, in <module>
    exit_code = cli.run()
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/site-packages/ansible/cli/galaxy.py", line 138, in run
    self.execute()
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/site-packages/ansible/cli/__init__.py", line 149, in execute
    fn()
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/site-packages/ansible/cli/galaxy.py", line 386, in execute_install
    installed = role.install()
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/site-packages/ansible/galaxy/role.py", line 242, in install
    loose_versions.sort()
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/distutils/version.py", line 52, in __lt__
    c = self._cmp(other)
  File "/Users/zhangjinjie/.pyenv/versions/3.6.0/lib/python3.6/distutils/version.py", line 337, in _cmp
    if self.version < other.version:
TypeError: '<' not supported between instances of 'int' and 'str'

rundeck_targeting_version is not registered in RHEL / CentOS configuration

Hey,

I'm trying to run this role on CentOS 7, during execution I see below error:
``
TASK: [ansible-rundeck | Rundeck - PostgreSQL | ensure database is used to store projects] ***
fatal: [default] => Failed to template {% if rundeck_targeting_version.stdout|version_compare('2.5.0', '>=') %} True {% else %} False {% endif %}: Version comparison: 'dict object' has no attribute 'stdout'

FATAL: all hosts have already failed -- aborting
``

Selecting last version of Rundeck from Packages files return wrong version

Hello,

$ ansible-galaxy install neel.rundeck

• downloading role 'rundeck', owned by neel
• downloading role from https://github.com/New-Edge-Engineering/ansible-rundeck/archive/v0.0.11.tar.gz
• extracting neel.rundeck to /home/vagrant/.ansible/roles/neel.rundeck
• neel.rundeck (v0.0.11) was installed successfully

With the playbook file install_debian.yml (obtain with ansible-galaxy install neel.rundeck) you get the content of the Packages file (http://dl.bintray.com/rundeck/rundeck-deb/Packages)
Then, you try to find the latest package name and version with this command
shell: "echo '{{ rundeck_packages_info.content }}' | grep Filename | tail -n 1 | awk '{print $2}'"
it return : rundeck-cli_1.0.9-1_all.deb
but the current last version is : rundeck_2.10.8-1-GA_all.deb
Adapted filter would be (as a suggestion) :
cat Packages | grep Filename | grep rundeck-cli -v | sort -V | awk '{print $2}'
Only select rundeck-x.y.z-GA.deb package ordered by version

Best regards,
--Yoann

Doesn't work for the latest version when installing on ubuntu

Thanks for this, it looks great, but it doesn't work with 2.2.3-1-GA. The server http://download.rundeck.org/deb/ no longer exists. It'd also be nice if it checked the SHA1 of the downloaded file as published on the rundeck web site.

Are you open to PRs?

DELETED

DELETED

Remove hard dependency on your OpenJDK role?

Hiya, thanks for sharing your role!

We're using smola.java because of its great support for either OpenJDK or Oracle and choice of Java versions. We have production Java services that have been tested and shown to perform better on Oracle Java, so even though Rundeck is a utility, ideally I'd like to be able to standardize across our infrastructure and not have us pulling in a half dozen different Java roles as Ansible deps.

Would you consider removing the hard dependency, since it's so simple and there are a gillion ways to install Java? AFAIK Rundeck simply respects JAVA_HOME in its user's shell profile (or /etc/default).

Since it would be a less batteries-included experience for users of your role to have to manually add a Java role, I can understand if you'd prefer not to change it. I'm just trying to think about how Galaxy users might deal with this situation in general, it comes up regularly, with Java being a leading culprit—so I'm open to ideas. I'd much rather use your role and contribute back config file templates and such as we need them than to have a fork or vendored copy that we're lazy about because it's divergent.

Thanks for your consideration.

Also, could you bump a version on the Galaxy site please? It looks like you added the Postgres support (which needs docs 😉) and other changes since the last one. I use git SHAs like neel.rundeck,4b121be158e88 for most 3rd-party roles, but the ansible-galaxy CLI tool seems to not support that if the author has actual point versions set up on Galaxy. That system is kind of a mess in its present state, but that's another rant...

feature: cleaner user management (yml) and password generation

I tried your role several ways but ended up just basically writing it again.. (better for me to understand rundeck this way)

I hacked up some stuff to allow me to maintain users via ansible..
Its not elegant but it works.. so thought it might be of use to you too:

Example vars.yml

rundeck_user:
  - name: sysadmin
    pass: "duff beer gets tastier daily"
    roles:
      - user
      - admin
      - architect
      - deploy
      - build

  - name: deploy
    pass: "cloudy cloudy cloud cloud"
    roles:
     - user
     - deploy

Then a whole horrid bunch of hacks like this:

- name: remove default user
  lineinfile:
    dest: /etc/rundeck/realm.properties
    regexp: "^admin:admin,"
#user,admin,architect,deploy,build"
    state: absent
  notify: restart rundeck

- name: register a tmpfile name
  shell: mktemp
  register: mktemp
  changed_when: false

#Its a hack but it works[tm]
- name: generate the realm into a tmp file
  shell: HASH="$(java -cp {{ rundeck_jetty_jar }} org.eclipse.jetty.util.security.Password "{{ item.pass }}" 2>&1 | grep OBF )" ; printf "{{ item.name }}:$HASH,{{ item.roles|join(',')}}\n" >> {{ mktemp.stdout }}
  with_items: rundeck_user
  changed_when: false
  failed_when: false

- name: Checking for realm changes
  shell: diff {{ mktemp.stdout }} /etc/rundeck/realm.properties
  register: diff
  changed_when: false
  failed_when: false

- name: updating realm
  command: cp -pf {{ mktemp.stdout }} /etc/rundeck/realm.properties
  when: diff.rc != 0
  notify: restart rundeck

- name: cleanup
  changed_when: false
  file: name={{ mktemp.stdout }} state=absent

Regards -D

DELETED

DELETED

Change rundeck_download_check to something else

When an ubuntu server is rebooted, the deb file will be deleted from /tmp. The next time this playbook runs it will download the deb again even if rundeck is already installed. It would be better to check whether rundeck is already installed in some other way before downloading the file.

It'd be handy to add this because it can be necessary to reboot frequently when working with vagrants.

Discover Version Number Taks fails on RHEL

I get the below error running this on CentOS 7

TASK [neel.rundeck : discover version number] **********************************
fatal: [rundeck.aem.bt.com]: FAILED! => {"changed": true, "cmd": "dpkg -s rundeck | grep -i version", "delta": "0:00:00.002894", "end": "2017-03-24 11:17:55.840221", "failed": true, "rc": 1, "start": "2017-03-24 11:17:55.837327", "stderr": "/bin/sh: dpkg: command not found", "stdout": "", "stdout_lines": [], "warnings": []}

I think this is down to the below section in main.yml

# install rundeck
- include: install_debian.yml
  when: ansible_os_family == 'Debian'

- include: install_redhat.yml
  when: ansible_os_family == 'RedHat'

- name: discover version number
  shell: dpkg -s rundeck | grep -i version
  register: rundeck_targeting_version

Looks like you need to push that discover version number task up into install_debian.yml & install_redhat.yml and use something like rpm -qi rundeck on Redhat instead of dpkg.

Thanks