setup-training-environment.yml

---
- name: Wait for Kubernetes Nodes
  hosts: localhost
  gather_facts: False
  any_errors_fatal: "true"
  roles:
    - { role: infra/wait-for-hosts }

- name: Install admin SSH keys
  hosts: all
  tasks:
    - name: Install admin SSH keys
      authorized_key:
        user: "{{ ansible_user }}"
        state: present
        key: "{{ lookup('file', '{{ item }}')}}"
      with_fileglob: 'pubkeys/*.pub'

- name: Set timezone
  hosts: all
  become: yes
  tasks:
    - name: Set timezone
      community.general.timezone:
        name: Pacific/Auckland

- name: Upgrade systems
  become: yes
  hosts: all
  roles:
    - upgrade_system

- name: Set hostnames
  hosts: all
  become: yes
  tasks:
    - name: Set hostname
      ansible.builtin.hostname:
        name: "{{ inventory_hostname }}.flexi.nesi"

- hosts: servers
  any_errors_fatal: "true"
  vars_files:
    - ondemand-config.yml
  roles:
    - { role: pre-checks/letsencrypt-apache2 }
    - { role: pre-checks/letsencrypt-cert }
    - { role: kubectl }

- hosts: servicesnode
  any_errors_fatal: "true"
  vars_files:
    - ondemand-config.yml
  roles:
    - { role: pre-checks/openstack }
    - { role: pre-checks/kubernetes }
    - { role: cluster-ctl/cli-install }
    - { role: capi-cluster/workload }
    - { role: capi-cluster/get-nodes }
    - { role: openondemand-k8s/kuberenetes }

- name: Setup /etc/hosts
  hosts: servers
  become: yes
  gather_facts: yes
  tasks:
    - name: Add IP address of all hosts to all hosts
      lineinfile:
        dest: /etc/hosts
        line: '{{ hostvars[item]["ansible_default_ipv4"]["address"] }} {{ hostvars[item]["ansible_hostname"] }} {{ hostvars[item]["ansible_nodename"] }}'
        state: present
      with_items: "{{ groups['servers'] }}"
    - name: setup hosts ood-idp
      lineinfile:
        dest: /etc/hosts
        line: '{{ hostvars["servicesnode"]["ansible_default_ipv4"]["address"] }} ood-idp.flexi.nesi'
        state: present
    - name: setup hosts ood
      lineinfile:
        dest: /etc/hosts
        line: '{{ hostvars["webnode"]["ansible_default_ipv4"]["address"] }} ood.flexi.nesi'
        state: present

- name: Exchange SSH keys between servers
  hosts: servers
  tasks:
    - name: Generate SSH key pair
      community.crypto.openssh_keypair:
        path: ~/.ssh/id_rsa
        size: 4096
        type: rsa

    - name: Fetch the public key from the node to local
      fetch:
        src: "~/.ssh/id_rsa.pub"
        dest: "tmp/pubkeys/{{ansible_hostname}}-id_rsa.pub"
        flat: yes

    - name: Copy the key to authorized_keys
      authorized_key:
        user: "{{ ansible_user }}"
        state: present
        key: "{{ lookup('file','tmp/pubkeys/{{item}}-id_rsa.pub')}}"
      with_items:
        - "{{ groups['servers'] }}"

- name: Copy SSH key to servicesnode to act as jumphost 
  hosts: servicesnode
  tasks:
    - name: Copy key to servicesnode
      copy:
        src: "{{ lookup('ansible.builtin.env', 'TF_VAR_key_file', default='~/.ssh/id_flexi') }}"
        dest: ~/.ssh/id_flexi
        mode: '0600'

- name: Setup LDAP server
  become: yes
  hosts: servicesnode
  vars_files:
    - ondemand-config.yml
  roles:
    - ldap_server

- name: Setup LDAP clients
  become: yes
  hosts: servers
  vars_files:
    - ondemand-config.yml
  roles:
    - ldap_client

- name: Setup k8s LDAP clients
  become: yes
  hosts: ldap_clients
  vars_files:
    - ondemand-config.yml
  roles:
    - ldap_client

- name: Setup NFS server
  become: yes
  hosts: servicesnode
  vars_files:
    - ondemand-config.yml
  roles:
    - nfs_homes_server

- name: Setup NFS clients
  become: yes
  hosts: servers
  vars_files:
    - ondemand-config.yml
  roles:
    - nfs_homes_client

- name: Add users
  become: yes
  hosts: servicesnode
  vars_files:
    - ondemand-config.yml
  roles:
    - ldap_add_users

- name: Setup keycloak
  become: yes
  hosts: servicesnode
  vars_files:
    - ondemand-config.yml
  roles:
    - keycloak

- name: Setup linux host cluster
  become: yes
  hosts: webnode
  roles:
    - apptainer

# run ondemand role
- name: Install ondemand
  become: yes
  hosts: webnode
  vars_files:
    - ondemand-config.yml
  pre_tasks:
    - name: Get keycloak client secret
      community.general.keycloak_clientsecret_info:
        client_id: ondemand.flexi
        realm: ondemand
        auth_client_id: admin-cli
        auth_keycloak_url: "https://{{ oidc_hostname }}"
        auth_realm: master
        auth_username: admin
        auth_password: "{{ keycloak_admin_password }}"
        validate_certs: false
      register: keycloak_secret
      no_log: true
      
    - name: Set keycloak client secret fact for ondemand
      set_fact:
        oidc_client_secret: "{{ keycloak_secret.clientsecret_info.value }}"
      no_log: true

    - name: Set ood_install_apps variable
      set_fact:
        ood_install_apps: "{{ ood_install_apps|default({}) | ansible.builtin.combine({ item.key: { 'repo': item.value.repo, 'version': item.value.version } }) }}"
      with_items: "{{ ood_apps | dict2items }}"
      when: item.value.enabled == true

    - name: Set pinned_apps variable
      set_fact:
        pinned_apps: "{{ pinned_apps + [ 'sys/' + item.key ] }}"
      with_items: "{{ ood_apps | dict2items }}"
      when: item.value.enabled == true
      vars:
        pinned_apps: []
  roles:
    - osc.open_ondemand

- name: Post ondemand setup
  hosts: webnode
  become: true
  vars_files:
    - ondemand-config.yml
  pre_tasks:
    - name: Install dependencies for interactive apps
      apt:
        name:
          - ncat
          - websockify
        state: present
  roles:
    - role: openondemand-k8s/web-node
    - role: openondemand-webnode-config

- name: Install ondemand_exporter and grafana app
  hosts: webnode
  become: true
  vars_files:
    - ondemand-config.yml
  roles:
    - monitoring/ondemand_exporter
    - monitoring/grafana_webnode

- name: Install prometheus node exporter
  hosts: servers
  become: true
  vars_files:
    - ondemand-config.yml
  roles:
    - prometheus.prometheus.node_exporter

- name: Install prometheus and grafana
  hosts: servicesnode
  become: true
  vars_files:
    - ondemand-config.yml
  roles:
    - prometheus.prometheus.prometheus
    - monitoring/prometheus
    - grafana.grafana.grafana
    - monitoring/kube_prometheus

- name: Setup k8s nodes for containers apps
  become: true
  hosts: k8s_nodes
  vars_files:
    - ondemand-config.yml
  roles:
    - container-apps/k8s

- name: Setup webnode for containers apps
  become: true
  hosts: webnode
  vars_files:
    - ondemand-config.yml
  roles:
    - container-apps/webnode

- name: Provisioning application data to user homes
  become: yes
  hosts: servicesnode
  vars_files:
    - ondemand-config.yml
  roles:
    - app-data/scrnaseq

# should be a way to do this without rebooting (at the end because rebooting deletes the kubeconfig in /tmp...)
- name: Verify trainers group
  become: yes
  hosts: servers
  tasks:
    - name: Check trainer1 in trainers group
      ansible.builtin.shell: groups trainer1 | grep trainers
      register: trainers_group_test
      failed_when: trainers_group_test.rc != 0 and trainers_group_test.rc != 1

    - name: Reboot if trainer1 not in trainers group
      ansible.builtin.reboot:
      when: trainers_group_test.rc == 1

# at the very end so the slack notification goes after the reboot
- name: Install/run utility scripts/functions
  hosts: servicesnode
  become: yes
  vars_files:
    - ondemand-config.yml
  roles:
    - utils