Ansible git move

+ Better accessibility
+ Compliant with fdio.infra._function_
  - function [pxe|terraform|ansible|vagrant]
+ dill==0.3.3 also applied on TBs
  - ci-man to follow today
- Docs to be updated in separate patch

Signed-off-by: pmikus <pmikus@cisco.com>
Change-Id: Iff9eaa29d63044188cc8160db2d9b44b7635782a

11 files changed, 430 insertions, 0 deletions

diff --git a/fdio.infra.ansible/roles/consul/defaults/main.yaml b/fdio.infra.ansible/roles/consul/defaults/main.yaml
new file mode 100644
index 0000000000..786554eb58
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/defaults/main.yaml
@@ -0,0 +1,110 @@
+---
+# file: roles/consul/defaults/main.yaml
+
+# Inst - Prerequisites.
+packages: "{{ packages_base + packages_by_distro[ansible_distribution | lower] + packages_by_arch[ansible_machine] }}"
+
+packages_base:
+  - "cgroup-bin"
+  - "curl"
+  - "git"
+  - "libcgroup1"
+  - "unzip"
+  - "htop"
+packages_by_distro:
+  ubuntu:
+    - []
+packages_by_arch:
+  aarch64:
+    - []
+  x86_64:
+    - []
+
+# Inst - Download Consul.
+consul_architecture_map:
+  amd64: "amd64"
+  x86_64: "amd64"
+  armv7l: "arm"
+  aarch64: "arm64"
+  32-bit: "386"
+  64-bit: "amd64"
+consul_architecture: "{{ consul_architecture_map[ansible_architecture] }}"
+consul_version: "1.8.6"
+consul_pkg: "consul_{{ consul_version }}_linux_{{ consul_architecture }}.zip"
+consul_zip_url: "https://releases.hashicorp.com/consul/{{ consul_version }}/{{ consul_pkg }}"
+
+# Inst - System paths.
+consul_bin_dir: "/usr/local/bin"
+consul_config_dir: "/etc/consul.d"
+consul_data_dir: "/var/consul"
+consul_inst_dir: "/opt"
+consul_lockfile: "/var/lock/subsys/consul"
+consul_run_dir: "/var/run/consul"
+consul_ssl_dir: "/etc/consul.d/ssl"
+nomad_config_dir: "/etc/nomad.d"
+
+# Conf - Service.
+consul_node_role: "both"
+consul_restart_handler_state: "restarted"
+nomad_restart_handler_state: "restarted"
+systemd_resolved_state: "stopped"
+
+# Conf - User and group.
+consul_group: "consul"
+consul_group_state: "present"
+consul_manage_group: true
+consul_manage_user: true
+consul_user: "consul"
+consul_user_groups: [ docker, nomad, consul, root ]
+consul_user_state: "present"
+
+# Conf - nomad.d/consul.hcl
+consul_nomad_integration: true
+consul_certificates:
+  - src: "{{ vault_consul_v1_ca_file }}"
+    dest: "{{ consul_ca_file }}"
+  - src: "{{ vault_consul_v1_cert_file }}"
+    dest: "{{ consul_cert_file }}"
+  - src: "{{ vault_consul_v1_key_file }}"
+    dest: "{{ consul_key_file }}"
+
+consul_auto_advertise: true
+consul_checks_use_advertise: true
+consul_server_service_name: "nomad"
+consul_client_service_name: "nomad-client"
+consul_server_auto_join: false
+consul_client_auto_join: true
+consul_ACL_token_set: false
+consul_token: "consul_token_default"
+
+# Conf - base.hcl
+consul_bind_addr: "{{ ansible_default_ipv4.address }}"
+consul_client_addr: "0.0.0.0"
+consul_datacenter: "dc1"
+consul_disable_update_check: true
+consul_enable_debug: false
+consul_enable_syslog: true
+consul_log_level: "INFO"
+consul_node_name: "{{ inventory_hostname }}"
+consul_retry_join: true
+consul_bootstrap_expect: 2
+consul_encrypt: ""
+consul_ca_file: "{{ consul_ssl_dir }}/ca.pem"
+consul_cert_file: "{{ consul_ssl_dir }}/consul.pem"
+consul_key_file: "{{ consul_ssl_dir }}/consul-key.pem"
+consul_ui: true
+consul_recursors:
+  - 1.1.1.1
+  - 8.8.8.8
+
+# Conf - ports.hcl
+consul_port_dns: 53
+consul_port_http: 8500
+consul_port_https: 8501
+consul_port_grpc: 8502
+consul_port_serf_lan: 8301
+consul_port_serf_wan: 8302
+consul_port_server: 8300
+
+# Conf - services.json
+consul_services: false
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/handlers/main.yaml b/fdio.infra.ansible/roles/consul/handlers/main.yaml
new file mode 100644
index 0000000000..338baea74e
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/handlers/main.yaml
@@ -0,0 +1,23 @@
+---
+# file roles/consul/handlers/main.yaml
+
+- name: Restart Nomad
+  systemd:
+    daemon_reload: true
+    enabled: true
+    name: "nomad"
+    state: "{{ nomad_restart_handler_state }}"
+
+- name: Restart Consul
+  systemd:
+    daemon_reload: true
+    enabled: true
+    name: "consul"
+    state: "{{ consul_restart_handler_state }}"
+
+- name: Stop Systemd-resolved
+  systemd:
+    daemon_reload: true
+    enabled: false
+    name: "systemd-resolved"
+    state: "{{ systemd_resolved_state }}"
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/meta/main.yaml b/fdio.infra.ansible/roles/consul/meta/main.yaml
new file mode 100644
index 0000000000..4ada8efad6
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/meta/main.yaml
@@ -0,0 +1,9 @@
+---
+# file: roles/consul/meta/main.yaml
+
+# desc: Install consul from stable branch and configure service.
+# inst: Consul
+# conf: ?
+# info: 1.0 - added role
+
+dependencies: [ ]
diff --git a/fdio.infra.ansible/roles/consul/tasks/main.yaml b/fdio.infra.ansible/roles/consul/tasks/main.yaml
new file mode 100644
index 0000000000..99ac52da44
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/tasks/main.yaml
@@ -0,0 +1,182 @@
+---
+# file: roles/consul/tasks/main.yaml
+
+- name: Inst - Update Package Cache (APT)
+  apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  when:
+    - ansible_distribution|lower == 'ubuntu'
+  tags:
+    - consul-inst-prerequisites
+
+- name: Inst - Prerequisites
+  package:
+    name: "{{ packages | flatten(levels=1) }}"
+    state: latest
+  tags:
+    - consul-inst-prerequisites
+
+- name: Conf - Add Consul Group
+  group:
+    name: "{{ consul_group }}"
+    state: "{{ consul_group_state }}"
+  when:
+    - consul_manage_group | bool
+  tags:
+    - consul-conf-user
+
+- name: Conf - Add Consul user
+  user:
+    name: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    groups: "{{ consul_user_groups }}"
+    state: "{{ consul_user_state }}"
+    system: true
+  when:
+    - consul_manage_user | bool
+  tags:
+    - consul-conf-user
+
+- name: Inst - Clean Consul
+  file:
+    path: "{{ consul_inst_dir }}/consul"
+    state: "absent"
+  tags:
+    - consul-inst-package
+
+- name: Inst - Download Consul
+  get_url:
+    url: "{{ consul_zip_url }}"
+    dest: "{{ consul_inst_dir }}/{{ consul_pkg }}"
+  tags:
+    - consul-inst-package
+
+- name: Inst - Unarchive Consul
+  unarchive:
+    src: "{{ consul_inst_dir }}/{{ consul_pkg }}"
+    dest: "{{ consul_inst_dir }}/"
+    creates: "{{ consul_inst_dir }}/consul"
+    remote_src: true
+  tags:
+    - consul-inst-package
+
+- name: Inst - Consul
+  copy:
+    src: "{{ consul_inst_dir }}/consul"
+    dest: "{{ consul_bin_dir }}"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    force: true
+    mode: 0755
+    remote_src: true
+  tags:
+    - consul-inst-package
+
+- name: Conf - Create Directories "{{ consul_data_dir }}"
+  file:
+    dest: "{{ consul_data_dir }}"
+    state: directory
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+  tags:
+    - consul-conf
+
+- name: Conf - Create Directories "{{ consul_ssl_dir }}"
+  file:
+    dest: "{{ consul_ssl_dir }}"
+    state: directory
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+  tags:
+    - consul-conf
+
+- name: Conf - Create Config Directory
+  file:
+    dest: "{{ consul_config_dir }}"
+    state: directory
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0755
+  tags:
+    - consul-conf
+
+- name: Conf - Nomad integration Consul Configuration
+  template:
+    src: consul.hcl.j2
+    dest: "{{ nomad_config_dir }}/consul.hcl"
+    owner: "nomad"
+    group: "nomad"
+    mode: 0644
+  when:
+    - consul_nomad_integration | bool
+  tags:
+    - consul-conf
+
+- name: Conf - Base Configuration
+  template:
+    src: base.hcl.j2
+    dest: "{{ consul_config_dir }}/base.hcl"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0644
+  tags:
+    - consul-conf
+
+- name: Conf - Ports Configuration
+  template:
+    src: ports.hcl.j2
+    dest: "{{ consul_config_dir }}/ports.hcl"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0644
+  tags:
+    - consul-conf
+
+- name: Conf - Telemetry Configuration
+  template:
+    src: telemetry.hcl.j2
+    dest: "{{ consul_config_dir }}/telemetry.hcl"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0644
+  tags:
+    - consul-conf
+
+- name: Conf - Services Configuration
+  template:
+    src: services.json.j2
+    dest: "{{ consul_config_dir }}/services.json"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0644
+  when:
+    - consul_services
+  tags:
+    - consul-conf
+
+- name: Conf - Copy Certificates And Keys
+  copy:
+    content: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ consul_user }}"
+    group: "{{ consul_group }}"
+    mode: 0600
+  no_log: true
+  loop: "{{ consul_certificates | flatten(levels=1) }}"
+  tags:
+    - consul-conf
+
+- name: Conf - System.d Script
+  template:
+    src: "consul_systemd.service.j2"
+    dest: "/lib/systemd/system/consul.service"
+    owner: "root"
+    group: "root"
+    mode: 0644
+#  notify:
+#    - "Restart Consul"
+#    - "Stop Systemd-resolved"
+#    - "Restart Nomad"
+  tags:
+    - consul-conf
diff --git a/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2
new file mode 100644
index 0000000000..536c48d847
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2
@@ -0,0 +1,43 @@
+node_name = "{{ consul_node_name }}"
+datacenter = "{{ consul_datacenter }}"
+
+bind_addr = "{{ consul_bind_addr }}"
+client_addr = "{{ consul_client_addr }}"
+data_dir = "{{ consul_data_dir }}"
+
+enable_syslog = {{ consul_enable_syslog | bool | lower }}
+enable_debug = {{ consul_enable_debug | bool | lower }}
+disable_update_check = {{ consul_disable_update_check | bool | lower }}
+log_level = "{{ consul_log_level }}"
+
+server = {{ consul_node_server | bool | lower }}
+encrypt = "{{ consul_encrypt }}"
+{% if consul_node_server | bool == True %}
+bootstrap_expect = {{ consul_bootstrap_expect }}
+verify_incoming = true
+verify_outgoing = true
+verify_server_hostname = true
+ca_file = "{{ consul_ca_file }}"
+cert_file = "{{ consul_cert_file }}"
+key_file = "{{ consul_key_file }}"
+auto_encrypt {
+  allow_tls = true
+}
+{% else %}
+verify_incoming = false
+verify_outgoing = false
+verify_server_hostname = false
+ca_file = "{{ consul_ca_file }}"
+auto_encrypt {
+  tls = false
+}
+{% endif %}
+{% if consul_retry_join | bool -%}
+retry_join = [ {% for ip_port in consul_retry_servers -%} "{{ ip_port }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ]
+{%- endif %}
+
+ui = {{ consul_ui | bool | lower }}
+
+{% if consul_recursors -%}
+recursors = [ {% for server in consul_recursors -%} "{{ server }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ]
+{%- endif %}
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/templates/consul.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/consul.hcl.j2
new file mode 100644
index 0000000000..c78e5e1ce5
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/consul.hcl.j2
@@ -0,0 +1,12 @@
+consul {
+    auto_advertise = {{ consul_auto_advertise | bool | lower }}
+    checks_use_advertise = {{ consul_checks_use_advertise | bool | lower }}
+    client_auto_join = {{ consul_client_auto_join | bool | lower }}
+    client_service_name = "{{ consul_client_service_name }}"
+    server_service_name = "{{ consul_server_service_name }}"
+    server_auto_join = {{ consul_server_auto_join | bool | lower }}
+{% if consul_ACL_token_set == True %}
+    token = "{{ consul_token }}"
+{% endif %}
+
+}
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2
new file mode 100644
index 0000000000..8e1ef1310d
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2
@@ -0,0 +1,21 @@
+[Unit]
+Description=Consul Service
+Documentation=https://www.nomadproject.io/docs/
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+# TODO: Decrease privilege
+ExecReload=/bin/kill -SIGHUP $MAINPID
+ExecStart={{ consul_bin_dir }}/consul agent -config-dir {{ consul_config_dir }}
+KillSignal=SIGTERM
+LimitNOFILE=infinity
+LimitNPROC=infinity
+Restart=on-failure
+RestartSec=1
+User=root
+Group=root
+Environment="GOMAXPROCS=2"
+
+[Install]
+WantedBy=multi-user.target
diff --git a/fdio.infra.ansible/roles/consul/templates/ports.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/ports.hcl.j2
new file mode 100644
index 0000000000..a658060ce8
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/ports.hcl.j2
@@ -0,0 +1,9 @@
+ports {
+    dns = {{ consul_port_dns }}
+    http = {{ consul_port_http }}
+    https = {{ consul_port_https }}
+    grpc = {{ consul_port_grpc }}
+    serf_lan = {{ consul_port_serf_lan }}
+    serf_wan = {{ consul_port_serf_wan }}
+    server = {{ consul_port_server }}
+}
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/templates/services.json.j2 b/fdio.infra.ansible/roles/consul/templates/services.json.j2
new file mode 100644
index 0000000000..3245ba92a4
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/services.json.j2
@@ -0,0 +1,13 @@
+{
+    "services": [
+{% for item in consul_services %}
+        {
+            "name": "{{ item.name }}",
+            "port": {{ item.port }}
+        }
+{%- if not loop.last %},
+{% endif %}
+{% endfor %}
+
+    ]
+}
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/templates/telemetry.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/telemetry.hcl.j2
new file mode 100644
index 0000000000..ec7fabc9da
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/templates/telemetry.hcl.j2
@@ -0,0 +1,3 @@
+telemetry {
+    prometheus_retention_time = "24h"
+}
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/vars/main.yaml b/fdio.infra.ansible/roles/consul/vars/main.yaml
new file mode 100644
index 0000000000..b46333a7a7
--- /dev/null
+++ b/fdio.infra.ansible/roles/consul/vars/main.yaml
@@ -0,0 +1,5 @@
+---
+# file: roles/consul/vars/main.yaml
+
+consul_node_client: "{{ (consul_node_role == 'client') or (consul_node_role == 'both') }}"
+consul_node_server: "{{ (consul_node_role == 'server') or (consul_node_role == 'both') }}"