在 OpenShift 4 上部署 Ansible Tower 环境

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.8环境中验证

建议阅读本文的更新版《OpenShift 4 - 安装部署 Ansible Automation Platform 4.x 控制台》

Ansible Tower 可以以镜像的方式部署在OpenShift之上，以下是在OpenShift部署Ansible Tower的说明。

准备OpenShift环境

1. 新建项目

$ oc new-project ansible-tower

安装PostgreSQL

1. 在OpenShift的Developer视图中，在Catalog中找到PostgreSQL Template后进入Instantiate Template。然后按照下面配置设置postgresql，最后创建即可。

Database Service Name: tower-postgresql
PostgreSQL Database Name: tower-db
PostgreSQL Connection Username: tower123
PostgreSQL Connection Password: tower123

2. 查看Postgresql部署状态。

$ oc get all
NAME                                READY   STATUS      RESTARTS   AGE
pod/tower-postgresql-1-deploy       0/1     Completed   0          74m
pod/tower-postgresql-1-gzqfd        1/1     Running     0          74m

NAME                                       DESIRED   CURRENT   READY   AGE
replicationcontroller/tower-postgresql-1   1         1         1       74m

NAME                            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/tower-postgresql        ClusterIP   172.30.235.107   <none>        5432/TCP       74m

NAME                                                  REVISION   DESIRED   CURRENT   TRIGGERED BY
deploymentconfig.apps.openshift.io/tower-postgresql   1          1         1         config,image(postgresql:10)

安装Ansible Tower

1. Ansible Tower是通过Ansible的Playbook安装到OpenShift上的。为此，需要先安装Ansible。

$ yum install -y ansible

2. 下载安装Ansible Tower的脚本

$ curl -LO https://releases.ansible.com/ansible-tower/setup_openshift/ansible-tower-openshift-setup-latest.tar.gz
$ tar -vxf ansible-tower-openshift-setup-latest.tar.gz
$ cd ansible-tower-openshift-setup-3.8.4-1

3. 修改inventory文件，主要修改以下部分的内容。

[all:vars]
 
# This will create or update a default admin (superuser) account in Tower
admin_user=admin
admin_password='admin123'
 
# Tower Secret key
# It's *very* important that this stay the same between upgrades or you will lose
# the ability to decrypt your credentials
secret_key='tower123'
 
# Database Settings
# =================
 
# Set pg_hostname if you have an external postgres server, otherwise
# a new postgres service will be created
pg_hostname=tower-postgresql
 
# If using an external database, provide your existing credentials.
# If you choose to use the provided containerized Postgres depolyment, these
# values will be used when provisioning the database.
pg_username='tower123'
pg_password='tower123'
pg_database='tower-db'
pg_port=5432
pg_sslmode='prefer'  # set to 'verify-full' for client-side enforced SSL
 
# Note: The user running this installer will need cluster-admin privileges.
# Tower's job execution container requires running in privileged mode,
# and a service account must be created for auto peer-discovery to work.
 
# Deploy into Openshift
# =====================
openshift_host=https://<OPENSHIFT_API_SERVER>:6443
openshift_skip_tls_verify=true
openshift_project=ansible-tower
openshift_user=opentlc-mgr
openshift_password=r3dh4t1!
。。。

说明：也可使用https://rheb.hatenablog.com/entry/ansible_tower_on_crc一文中的配置，它自动在安装Tower的过程中自动部署了PostgreSQL。
4. 执行安装Ansible Tower的脚本。

$ ./setup_openshift.sh -- -v
ansible-playbook 2.8.10
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/xiaoyliu-redhat.com/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible-playbook
  python version = 2.7.5 (default, May 31 2018, 09:41:32) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
Using /etc/ansible/ansible.cfg as config file
 
PLAYBOOK: install.yml **********************************************************************************************************************************************
1 plays in install.yml
 
PLAY [Deploy Tower] ************************************************************************************************************************************************
META: ran handlers
。。。

5. 如果在部署Ansible Tower过程中有以下错误，这可能是由于部署的Pod/Container中的配置和ansible-tower项目中的Limit Range有冲突，因此可以在OpenShift控制台的Event中看到以下Warning事件。
   
   
   
   
   
   为了修正以上错误，需要修改ansible-tower项目中名为ansible-tower-core-resource-limits的LimitRange配置。

$ oc edit limitrange ansible-tower-core-resource-limits

按照以下内容修改ansible-tower-core-resource-limits中的配置，然后保存。修改后可再次执行（4）步，执行安装Ansible Tower的安装脚本。

。。。
spec:
  limits:
  -- default:
      cpu: 1500m
      memory: 2Gi
    defaultRequest:
      cpu: 50m
      memory: 256Mi
    max:
      cpu: "4"
      memory: 6Gi
    type: Container
  -- max:
      cpu: "6"
      memory: 12Gi
    type: Pod

6. 最后确认ansible-tower和tower-postgresql安装成功。
   
7. 访问上图中的Ansible Tower的Route。用admin/admin123登录，然后再提供Tower的License（或按照提示申请License）。
8. 最后进入Tower的控制台。
   

参考

https://github.com/canturkolcer/AnsibleTower-on-Openshift/blob/master/AnsibleTower-OCP-Deployment.md
https://servicesblog.redhat.com/2019/03/14/deploying-ansible-tower-on-openshift/
https://catalog.redhat.com/software/container-stacks/detail/preview/5ec5357da7ad03355d87e3a2
https://docs.ansible.com/ansible-tower/3.6.4/html_zh/administration//openshift_configuration.html
https://www.ansiblejunky.com/blog/ansible-tower-in-openshift-on-laptop/
https://rheb.hatenablog.com/entry/ansible_tower_on_crc