--- # playbook.yml - name: "Provision Image" hosts: default become: True roles: - role: gdb.aws vars: aws_profiles: - profile_name: 'sme-dev' role_arn: 'arn:aws:iam::475275892927:role/cross_account_deployment_role' - profile_name: 'sme-prod' role_arn: 'arn:aws:iam::323555055331:role/cross_account_deployment_role' - profile_name: 'gdb-delphi-dev' role_arn: 'arn:aws:iam::475275892927:role/cross_account_deployment_role' - profile_name: 'gdb-delphi-prod' role_arn: 'arn:aws:iam::323555055331:role/cross_account_deployment_role' - profile_name: 'gdb-core-dev' role_arn: 'arn:aws:iam::582412345909:role/cross_account_deployment_role' - profile_name: 'gdb-core-prod' role_arn: 'arn:aws:iam::885200931856:role/cross_account_deployment_role' - profile_name: 'gdb-databricks-dev' role_arn: 'arn:aws:iam::745243859288:role/cross_account_deployment_role' - profile_name: 'gdb-databricks-prod' role_arn: 'arn:aws:iam::807702934854:role/cross_account_deployment_role' - profile_name: 'gdb-infra-dev' role_arn: 'arn:aws:iam::483193324480:role/cross_account_deployment_role' - profile_name: 'gdb-infra-prod' role_arn: 'arn:aws:iam::890208661333:role/cross_account_deployment_role' - profile_name: 'gdb-apollo-dev' role_arn: 'arn:aws:iam::725764004555:role/cross_account_deployment_role' - profile_name: 'gdb-apollo-prod' role_arn: 'arn:aws:iam::801577982711:role/cross_account_deployment_role' - profile_name: 'gdb-prodhub-dev' role_arn: 'arn:aws:iam::703740486246:role/cross_account_deployment_role' - profile_name: 'gdb-whitelist-legacy' role_arn: 'arn:aws:iam::322697034778:role/cross_account_deployment_role' region: 'eu-west-1' - role: gdb.buildx - role: gdb.bundletool - role: geerlingguy.swap swap_file_size_mb: '4096' - role: geerlingguy.packer packer_version: 1.9.1 tasks: - name: Update all packages ansible.builtin.yum: name: "*" state: latest update_only: yes - name: Install packages ansible.builtin.yum: name: "{{ packages }}" state: latest update_cache: yes vars: packages: - git - jq - python-pip - yum-utils - mailcap - amazon-linux-extras - qemu-user-static - java-17-amazon-corretto - name: Add extras repository ansible.builtin.shell: yum-config-manager --enable extras - name: Install docker-ce (centos) via amazon-linux-extras packages ansible.builtin.shell: "amazon-linux-extras install docker=stable -y" - name: Enable Docker CE service at startup ansible.builtin.service: name: docker state: started enabled: yes - name: Install ansible2 via amazon-linux-extras packages ansible.builtin.shell: "amazon-linux-extras install ansible2 -y" - name: Set java to correct version alternatives: name: java path: "/usr/lib/jvm/java-17-amazon-corretto.x86_64/bin/java" # The stock Amazon Linux 2 AMI ships yum-cron enabled, which runs an # automatic OS update on first boot. That upgrades the live JVM out from # under a connected agent and drops the Jenkins connection. Disable it and # lock Corretto so runtime updates can never swap the JVM on a live agent. - name: Disable automatic OS updates (yum-cron) if present ansible.builtin.service: name: yum-cron state: stopped enabled: no register: yum_cron_disable failed_when: - yum_cron_disable is failed - "'Could not find the requested service' not in yum_cron_disable.msg" - name: Install yum versionlock plugin ansible.builtin.yum: name: yum-plugin-versionlock state: present - name: Lock Corretto so runtime updates can't swap the JVM ansible.builtin.command: yum versionlock java-17-amazon-corretto args: creates: /etc/yum/pluginconf.d/versionlock.list - name: Install python packages ansible.builtin.pip: name: "{{ packages }}" executable: "/usr/bin/pip3" vars: packages: - bumpversion - name: Check if docker-compose is installed ansible.builtin.command: docker-compose --version register: dc_output changed_when: false ignore_errors: true - name: Get latest release of docker-compose from GitHub ansible.builtin.get_url: url: https://api.github.com/repos/docker/compose/releases/latest dest: /tmp/docker-compose-latest.json when: dc_output.failed - name: Read docker-compose release info ansible.builtin.command: cat /tmp/docker-compose-latest.json register: dc_info changed_when: false when: dc_output.failed - name: Set docker-compose version ansible.builtin.set_fact: dc_version: "{{ (dc_info.stdout | from_json).tag_name }}" when: dc_output.failed - name: Download docker-compose from GitHub ansible.builtin.get_url: url: "https://github.com/docker/compose/releases/download/{{ dc_version }}/docker-compose-{{ ansible_system }}-{{ ansible_userspace_architecture }}" dest: /usr/local/bin/docker-compose mode: '0755' when: dc_output.failed - name: Clean up ansible.builtin.file: path: /tmp/docker-compose-latest.json state: absent when: dc_output.failed - name: Update user limits on the number of inotify resources and inotify file watches ansible.posix.sysctl: name: fs.inotify.max_user_watches value: '524288' state: present - name: Install .NET SDK signing key and package repository ansible.builtin.yum: name: https://packages.microsoft.com/config/centos/7/packages-microsoft-prod.rpm state: present - name: Install .NET SDK 2.2 ansible.builtin.yum: name: "dotnet-sdk-2.2" state: present when: ansible_architecture == "x86_64" - name: Install Octopus CLI become: False ansible.builtin.shell: "dotnet tool install Octopus.DotNet.Cli --version 7.4.3663 --tool-path /home/ec2-user/octopus" when: ansible_architecture == "x86_64" - name: Update PATH variable become: False ansible.builtin.shell: "echo 'export PATH=/home/ec2-user/octopus:$PATH' >> /home/ec2-user/.bashrc" run_once: True when: ansible_architecture == "x86_64" - name: Add the user 'ec2-user' to the group 'docker' ansible.builtin.user: name: ec2-user groups: ec2-user,docker append: yes - name: Reset ssh connection to allow user changes to affect 'current login user' ansible.builtin.meta: reset_connection - name: Create builder for docker buildx become: False ansible.builtin.shell: 'docker buildx create --use' run_once: True when: ansible_architecture == "x86_64" # - name: Replace docker build with buildx # become: False # ansible.builtin.shell: 'docker buildx install' # run_once: True