Skip to content

Commit 0e67afc

Browse files
sean-freemansean-freeman
authored
Merge pull request #22 from sap-linuxlab/dev
release: merge dev to main for 1.0.1
2 parents a67f6b8 + 7c86252 commit 0e67afc

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+2901
-1212
lines changed

‎.github/workflows/ansible-lint-sap_vm_provision.yml

+3
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ jobs:
4141
pip3 install ansible-lint==6.22.1
4242
pip3 install jmespath==1.0.1
4343
44+
- name: Install dependencies for Ansible
45+
run: ansible-galaxy collection install -r /home/runner/work/community.sap_infrastructure/community.sap_infrastructure/requirements.yml
46+
4447
- name: Run ansible-lint
4548
working-directory: /home/runner/work/community.sap_infrastructure/community.sap_infrastructure/roles/sap_vm_provision
4649
run: ansible-lint

‎CHANGELOG.rst

+30
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,36 @@ community.sap_infrastructure Release Notes
44

55
.. contents:: Topics
66

7+
v1.0.1
8+
======
9+
10+
Release Summary
11+
---------------
12+
13+
| Release Date: 2024-04-29
14+
| collection: Bug fix for GH Action requirements
15+
| collection: Bug fix for Ansible Collection dependencies
16+
| sap_hypervisor_node_preconfigure: Bug fix for when condition typo and trident version update
17+
| sap_vm_provision: Documentation update for AWS IAM
18+
| sap_vm_provision: Documentation update for design assumptions with execution impact
19+
| sap_vm_provision: Feature add for all to ensure short hostname is not longer than 13 characters (SAP Note 611361)
20+
| sap_vm_provision: Feature add for all internal variable names prefix with __sap_vm_provision_
21+
| sap_vm_provision: Feature add for all with rescue block to output errors without revealing credential secrets
22+
| sap_vm_provision: Feature add for SAP HANA Scale-Out user-defined variable name prefix with sap_vm_provision
23+
| sap_vm_provision: Feature add for all Ansible Tasks calling Infrastructure Platform APIs default to no_log instead of Environment
24+
| sap_vm_provision: Feature add sample Ansible Playbook for blank Virtual Machine provision
25+
| sap_vm_provision: Feature add for MS Azure SSH Key Pair from new dependency Ansible Module
26+
| sap_vm_provision: Feature add for MS Azure and IBM Cloud Private DNS in separate Resource Group
27+
| sap_vm_provision: Feature add for all Cloud vendors with updated regex for OS Image releases
28+
| sap_vm_provision: Feature add for IBM Power VS using newer hardware machine type (Power10)
29+
| sap_vm_provision: Bug fix for OS Package Repository registration task not triggering
30+
| sap_vm_provision: Bug fix for Web Forward Proxy task not triggering
31+
| sap_vm_provision: Bug fix for ignoring undefined variables (e.g. sap_id_user_password) set on hosts
32+
| sap_vm_provision: Bug fix for IBM Power VS using Power Edge Router default instead of legacy cloud connections
33+
| sap_vm_provision: Bug fix for IBM Power VS OS Image clone from stock and provision
34+
| sap_vm_provision: Bug fix for MS Azure Virtual Machine info response changed data path for IP Address migrating from 1.x to 2.x Ansible Collection
35+
| sap_vm_provision: Bug fix for MS Azure Virtual Machine vm_identity syntax changed migrating from 1.x to 2.x Ansible Collection
36+
737
v1.0.0
838
======
939

‎galaxy.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ namespace: community
1010
name: sap_infrastructure
1111

1212
# The version of the collection. Must be compatible with semantic versioning
13-
version: 1.0.0
13+
version: 1.0.1
1414

1515
# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
1616
readme: README.md

‎playbooks/sample-sap-vm-provision-aws-ec2-vs.yml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
3+
# This sample Ansible Playbook is not a full example,
4+
# which would pass additional variables onto other
5+
# Ansible Roles such as sap_storage_setup.
6+
# It is only to test the provisioning process
7+
# of a small Virtual Machine.
8+
9+
- name: Ansible Play to include_vars
10+
hosts: all
11+
become: true
12+
pre_tasks:
13+
14+
# Alternative to executing ansible-playbook with -e for Ansible Extravars file
15+
- name: Include sample variables for AWS EC2
16+
ansible.builtin.include_vars: ./vars/sample-variables-sap-vm-provision-aws-ec2-vs.yml
17+
18+
19+
- name: Ansible Play to create dynamic inventory group for provisioning
20+
hosts: localhost
21+
gather_facts: false
22+
tasks:
23+
24+
- name: Create dynamic inventory group for Ansible Role sap_vm_provision
25+
ansible.builtin.add_host:
26+
name: "{{ item }}"
27+
group: sap_vm_provision_target_inventory_group
28+
loop: "{{ sap_vm_provision_ibmcloud_vs_host_specifications_dictionary[sap_vm_provision_host_specification_plan].keys() }}"
29+
30+
31+
- name: Ansible Play to provision hosts for SAP
32+
hosts: sap_vm_provision_target_inventory_group # Ansible Play target hosts pattern, use Inventory Group created by previous Ansible Task (add_host)
33+
gather_facts: false
34+
tasks:
35+
36+
- name: Execute Ansible Role sap_vm_provision
37+
ansible.builtin.include_role:
38+
name: community.sap_infrastructure.sap_vm_provision
39+
when: sap_vm_provision_iac_type == "ansible" or sap_vm_provision_iac_type == "ansible_to_terraform"

‎playbooks/vars/sample-variables-sap-vm-provision-aws-ec2-vs.yml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
3+
# This sample Ansible Playbook is not a full example,
4+
# which would pass additional variables onto other
5+
# Ansible Roles such as sap_storage_setup.
6+
# It is only to test the provisioning process
7+
# of a small Virtual Machine.
8+
9+
####
10+
# Infrastructure Provisioning selection
11+
####
12+
13+
sap_vm_provision_iac_type: "ansible" # ansible , ansible_to_terraform , existing_hosts
14+
sap_vm_provision_iac_platform: "aws_ec2_vs" # aws_ec2_vs , gcp_ce_vm , ibmcloud_vs , ibmcloud_powervs , msazure_vm , ibmpowervm_vm , kubevirt_vm , ovirt_vm , vmware_vm
15+
16+
sap_vm_provision_host_specification_plan: "test_plan_16gb"
17+
sap_vm_provision_dns_root_domain: "poc.cloud"
18+
19+
20+
####
21+
# Infrastructure Provisioning selection
22+
# AWS
23+
#
24+
# Only for use when 'aws_ec2_vs' is value provided for variable sap_vm_provision_iac_platform
25+
####
26+
27+
sap_vm_provision_aws_access_key: "ENTER_STRING_VALUE_HERE"
28+
sap_vm_provision_aws_secret_access_key: "ENTER_STRING_VALUE_HERE"
29+
sap_vm_provision_aws_region: "{{ sap_vm_provision_aws_vpc_availability_zone[:-1] }}"
30+
sap_vm_provision_aws_vpc_availability_zone: "eu-west-2c"
31+
sap_vm_provision_aws_vpc_subnet_create_boolean: "{{ true | default(false) if aws_vpc_subnet_id == 'new' else false }}"
32+
sap_vm_provision_aws_vpc_subnet_id: "ENTER_STRING_VALUE_HERE" # if ansible_to_terraform, use "new"
33+
sap_vm_provision_aws_ec2_vs_host_os_image: "ENTER_STRING_VALUE_HERE"
34+
sap_vm_provision_bastion_user: "ENTER_STRING_VALUE_HERE"
35+
sap_vm_provision_bastion_ssh_port: "ENTER_STRING_VALUE_HERE"
36+
37+
# Only for use when 'ansible' is value provided for variable sap_vm_provision_iac_type
38+
####
39+
sap_vm_provision_bastion_public_ip: "ENTER_STRING_VALUE_HERE"
40+
sap_vm_provision_ssh_bastion_private_key_file_path: "./bastion_rsa"
41+
sap_vm_provision_ssh_host_private_key_file_path: "./hosts_rsa"
42+
sap_vm_provision_aws_key_pair_name_ssh_host_public_key: "ENTER_STRING_VALUE_HERE"
43+
sap_vm_provision_aws_vpc_sg_names: "ENTER_STRING_VALUE_HERE"
44+
45+
46+
####
47+
# Infrastructure Definitions
48+
# AWS
49+
####
50+
51+
sap_vm_provision_aws_ec2_vs_host_os_image_dictionary:
52+
rhel-8-6: "*RHEL-8.6*_HVM*x86_64*"
53+
rhel-8-6-sap-ha: "*RHEL-SAP-8.6.0*"
54+
sles-15-4: "*suse-sles-15-sp4-v202*-hvm-ssd-x86_64*"
55+
sles-15-4-sap-ha: "*suse-sles-sap-15-sp4-v202*-hvm-ssd-x86_64*"
56+
57+
sap_vm_provision_aws_ec2_vs_host_specifications_dictionary:
58+
test_plan_16gb:
59+
test-ec2-vs: # Hostname, must be 13 characters or less
60+
sap_host_type: hana_primary # hana_primary, hana_secondary, nwas_ascs, nwas_ers, nwas_pas, nwas_aas
61+
virtual_machine_profile: r7i.large
62+
disable_ip_anti_spoofing: true
63+
storage_definition:
64+
- name: hana_data
65+
mountpoint: /hana/data
66+
#disk_count: 1 # default: 1, if more then then LVM logical volume will be striped across the defined disks
67+
disk_size: 384 # size in GB, integer
68+
#disk_type: gp3 # default: gp3, for AWS EBS disk type
69+
#disk_iops: # default: null, for AWS EBS with custom IOPS
70+
filesystem_type: xfs # default: xfs

‎requirements.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ collections:
66
version: 1.1.0
77
- name: amazon.aws
88
type: galaxy
9-
version: 5.4.0
9+
version: 7.2.0
1010
- name: community.aws
1111
type: galaxy
12-
version: 5.4.0
12+
version: 7.1.0
1313
- name: azure.azcollection
1414
type: galaxy
15-
version: 1.15.0
15+
version: 2.2.0
1616
- name: google.cloud
1717
type: galaxy
1818
version: 1.1.3

‎roles/sap_hypervisor_node_preconfigure/tasks/platform/redhat_ocp_virt/main.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383

8484
- name: Include setup worker nodes
8585
ansible.builtin.include_tasks: "platform/{{ sap_hypervisor_node_platform }}/setup-worker-nodes.yml"
86-
when: sap_hypervisor_node_preconfigure_setup_workers
86+
when: sap_hypervisor_node_preconfigure_setup_worker_nodes
8787

8888
# How to wait for node to be scheduleable? (NodeSchedulable)
8989
- name: Wait for all k8s nodes to be ready

‎roles/sap_hypervisor_node_preconfigure/vars/platform_defaults_redhat_ocp_virt.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ sap_hypervisor_node_preconfigure_install_hpp: false
99
sap_hypervisor_node_preconfigure_install_trident: false
1010

1111
# URL of the trident installer package to use
12-
sap_hypervisor_node_preconfigure_install_trident_url: https://github.com/NetApp/trident/releases/download/v23.01.0/trident-installer-23.01.0.tar.gz
12+
sap_hypervisor_node_preconfigure_install_trident_url: https://github.com/NetApp/trident/releases/download/v23.10.0/trident-installer-23.10.0.tar.gz
1313

1414
# should SRIOV be enabled for unsupported NICs
1515
sap_hypervisor_node_preconfigure_sriov_enable_unsupported_nics: true
@@ -27,4 +27,4 @@ sap_hypervisor_node_preconfigure_ignore_minimal_memory_check: false
2727
sap_hypervisor_node_preconfigure_install_operators: true
2828

2929
# Configure the workers?
30-
sap_hypervisor_node_preconfigure_setup_workers: true
30+
sap_hypervisor_node_preconfigure_setup_worker_nodes: true

‎roles/sap_vm_provision/PLATFORM_GUIDANCE.md

+50
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,56 @@ aws iam attach-group-policy --group-name 'ag-sap-automation' --policy-arn arn:aw
148148
aws iam attach-group-policy --group-name 'ag-sap-automation' --policy-arn arn:aws:iam::aws:policy/AmazonRoute53FullAccess
149149
```
150150

151+
It is recommended to create new AWS IAM Policy with detailed actions to improve security.
152+
```json
153+
{
154+
"Version": "2012-10-17",
155+
"Statement": [
156+
{
157+
"Sid": "VisualEditor0",
158+
"Effect": "Allow",
159+
"Action": [
160+
"ec2:DescribeImages",
161+
"ec2:DescribeInstances",
162+
"ec2:DescribeTags",
163+
"ec2:DescribeInstanceAttribute",
164+
"ec2:DescribeSubnets",
165+
"ec2:DescribeSecurityGroups",
166+
"ec2:RunInstances",
167+
"ec2:CreateTags",
168+
"ec2:DescribeInstanceStatus",
169+
"ec2:ModifyInstanceAttribute",
170+
"ec2:DescribeRouteTables",
171+
"route53:ListHostedZones",
172+
"route53:ListResourceRecordSets",
173+
"route53:ChangeResourceRecordSets",
174+
"route53:GetChange",
175+
"ec2:DescribeVolumes",
176+
"ec2:CreateVolume",
177+
"ec2:DeleteVolume",
178+
"ec2:AttachVolume",
179+
"ec2:DetachVolume",
180+
"ec2:TerminateInstances",
181+
"ec2:CreateRoute",
182+
"iam:GetRole",
183+
"iam:CreateRole",
184+
"iam:ListInstanceProfilesForRole",
185+
"iam:CreateInstanceProfile",
186+
"iam:AddRoleToInstanceProfile",
187+
"iam:ListAttachedRolePolicies",
188+
"iam:ListRoleTags",
189+
"iam:PutRolePolicy",
190+
"iam:GetInstanceProfile",
191+
"iam:PassRole",
192+
"ec2:AssociateIamInstanceProfile",
193+
"ec2:ReplaceRoute"
194+
],
195+
"Resource": "*"
196+
}
197+
]
198+
}
199+
```
200+
151201
</details>
152202

153203
<details>

‎roles/sap_vm_provision/README.md

+6
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,12 @@ This required structure will:
162162
var: groups
163163
```
164164
165+
### Design assumptions with execution impact
166+
167+
- For Hyperscaler Cloud Service Providers that use Resource Groups (IBM Cloud, Microsoft Azure):
168+
- Virtual Machine and associated resources (Disks, Network Interfaces, Load Balancer etc.) will be provisioned to the same Resource Group as the targeted network/subnet.
169+
- Optional: Private DNS may be allocated to another Resource Group, and an optional variable is provided for this.
170+
165171
### Tags to control execution
166172
167173
There are no tags used to control the execution of this Ansible Role

0 commit comments

Comments
 (0)