{"id":2371,"date":"2018-03-26T16:57:50","date_gmt":"2018-03-26T20:57:50","guid":{"rendered":"http:\/\/blog.domb.net\/?p=2371"},"modified":"2018-03-27T11:01:37","modified_gmt":"2018-03-27T15:01:37","slug":"aws-multi-az-ansible-tower-cluster-backed-by-rds-and-fronted-by-alb","status":"publish","type":"post","link":"https:\/\/blog.domb.net\/?p=2371","title":{"rendered":"AWS Multi – AZ Ansible Tower Cluster backed by RDS and fronted by ALB"},"content":{"rendered":"

Ever wondered how you could run ansible tower in clustered mode across\u00a0multiple AZ in AWS?\u00a0 This post will describe how you can build the following architecture:<\/p>\n

 <\/p>\n

\"\"<\/p>\n

First, build 3 ec2 instances each in a different AZ’s. You should be more than ok with t2.large instance sizes. The subnets in the VPC can be private. If you have a private VPC make sure you have a nat gateway so that the instance can talk to the internet.<\/p>\n

\"\"<\/p>\n

Then make sure you are adding the correct security group (sg) settings to the instances<\/p>\n

\"\"<\/p>\n

Once you have the security groups attached to the ec2 instances you can go ahead to the RDS tab and create the postrges\u00a09.4 database. Choose production and multi-az. If you filled out everything correctly you should see something like<\/p>\n

\"\"<\/p>\n

The connection string can be found all the way on the bottom of the page<\/p>\n

tower.cqdtdsqmastk.us-east-1.rds.amazonaws.com<\/strong><\/p>\n

Also, make sure that your instance has the RDS SG attached so it can talk to the database.<\/p>\n

Next login into your main ansible tower node and download the latest tower<\/p>\n

[ec2-user@ip-10-0-1-247 ~]$ wget http:\/\/releases.ansible.com\/ansible-tower\/setup-bundle\/ansible-tower-setup-bundle-latest.el7.tar.gz\r\n<\/pre>\n
Untar the directory and\u00a0cd into it<\/p>\n
\n
\n
[ec2-user@ip-10-0-1-247 ~]$ tar -xzvf ansible-tower-setup-bundle-latest.el7.tar.gz && cd ~\/ansible-tower-setup-bundle-3.2.3-1.el7<\/pre>\n
Next, edit the inventory file<\/p>\n
\n
\n
[ec2-user@ip-10-0-1-247 ~]$ cat inventory\r\n\r\n[tower]\r\nip-10-0-1-247.ec2.internal ansible_user=ec2-user ansible_ssh_private_key_file=\/home\/ec2-user\/ansible-tower-setup-bundle-3.2.3-1.el7\/ansible.pem\r\nip-10-0-2-222.ec2.internal ansible_user=ec2-user ansible_ssh_private_key_file=\/home\/ec2-user\/ansible-tower-setup-bundle-3.2.3-1.el7\/ansible.pem\r\nip-10-0-3-210.ec2.internal ansible_user=ec2-user ansible_ssh_private_key_file=\/home\/ec2-user\/ansible-tower-setup-bundle-3.2.3-1.el7\/ansible.pem\r\n\r\n\r\n[instance_group_east_b_c]\r\n\r\nip-10-0-2-222.ec2.internal\r\nip-10-0-3-210.ec2.internal\r\n\r\n[instance_group_east_a_c]\r\nip-10-0-1-247.ec2.internal\r\nip-10-0-3-210.ec2.internal\r\n\r\n[database] \r\n[all:vars]\r\n\r\nadmin_password='opensource2018'\r\npg_host='tower.cqdtdsqmastk.us-east-1.rds.amazonaws.com'\r\npg_port='5432'\r\npg_database='awx'\r\npg_username='awx'\r\npg_password='opensource2018'\r\n\r\nrabbitmq_port=5672\r\nrabbitmq_vhost=tower\r\nrabbitmq_username=tower\r\nrabbitmq_password='opensource2018'\r\nrabbitmq_cookie=cookiemonster\r\n# Needs to be true for fqdns and ip addresses\r\n\r\nrabbitmq_use_long_name=true # IMPORTANT\r\n# Isolated Tower nodes automatically generate an RSA key for authentication;\r\n# To disable this behavior, set this value to false\r\n# isolated_key_generation=true\r\n\r\n<\/pre>\n
As you are in AWS you will need to enable the following 2 repos<\/p>\n
\n
\n
[ec2-user@ip-10-0-1-247 ~]$ yum-config-manager --enable rhui-REGION-rhel-server-extras &&yum-config-manager --enable rhui-REGION-rhel-server-optional<\/pre>\n
Install ansible<\/p>\n
[ec2-user@ip-10-0-1-247 ~]$ yum install ansible -y<\/pre>\n
Once finished launch the installation<\/p>\n
\n
\n
[ec2-user@ip-10-0-1-247 ~]$ ANSIBLE_BECOME=True .\/setup.sh<\/pre>\n
If the installation is successful you should no be able to login\u00a0to one of the tower\u00a0hosts via its public fqdn assigned by AWS.<\/p>\n
As we want to have a single entry point to the cluster we front end it with an ALB ( you will also need to have Route53 setup correctly for this to work) Go ahead and create the ELB. The cert and key for SSL can be found in \/etc\/tower. Make sure you upload the cert when creating the ALB. You also see that it spans across the 3 AZ’s.<\/p>\n
\"\"<\/p>\n
Lastly, create an alias in route53 pointing to the ALB.<\/p>\n
\"\"<\/p>\n
It will take a few minutes until the alias is available. Log in into your Tower instance<\/p>\n
\"\"<\/p>\n
You can then go to configuration instance groups to validate your config<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
 <\/p>\n
 <\/p>\n
Congratulations if you read until here. You now have a fully HA Tower installation with AWS managed ELB and RDS.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n<\/div>\n<\/div>\n
<\/div>\n<\/div>\n<\/div>\n
<\/div>\n<\/div>\n
 <\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Ever wondered how you could run ansible tower in clustered mode across\u00a0multiple AZ in AWS?\u00a0 This post will describe how you can build the following architecture:   First, build 3 ec2 instances each in a different AZ’s. You should be more than ok with t2.large instance sizes. The subnets in the VPC can be private….<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[64],"tags":[71,108,142,141,34],"class_list":["post-2371","post","type-post","status-publish","format-standard","hentry","category-ansible","tag-ansible-tower","tag-aws","tag-multi-az","tag-rds","tag-redhat"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2371"}],"version-history":[{"count":9,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2371\/revisions"}],"predecessor-version":[{"id":2395,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2371\/revisions\/2395"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}