Add support for Ubuntu containers and WSL verification
- Implemented tasks for managing Ubuntu containers using Podman, including inspection, creation, starting, and SSH setup. - Added verification tasks for WSL and Podman installation, machine existence, and NSSM service status. - Created PowerShell scripts for Podman auto-start on Windows boot. - Introduced Prometheus role with default configurations and installation tasks. - Updated Windows SSH role to improve authorized_keys management and permissions handling. - Modified inventory to include Windows containers host. - Updated Grafana datasource configurations with direct IP addresses for Prometheus instances.
This commit is contained in:
@@ -0,0 +1,389 @@
|
||||
---
|
||||
# ── Phase 1: Podman installer download & install ─────────────────────────
|
||||
|
||||
- name: Check if Podman is already installed
|
||||
ansible.windows.win_shell: |
|
||||
if (Get-Command podman -ErrorAction SilentlyContinue) {
|
||||
Write-Output "__PODMAN_INSTALLED__"
|
||||
exit 0
|
||||
}
|
||||
exit 1
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
register: __podman_installed_check
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Download Podman installer on remote host
|
||||
ansible.windows.win_get_url:
|
||||
url: "{{ windows_containers_installer_url }}"
|
||||
dest: "{{ ansible_env.TEMP | default('C:\\Windows\\Temp') }}\\podman-installer.exe"
|
||||
force: false
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when: __podman_installed_check.rc != 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Install Podman silently
|
||||
ansible.windows.win_shell: |
|
||||
Start-Process "{{ ansible_env.TEMP | default('C:\\Windows\\Temp') }}\podman-installer.exe" -ArgumentList @("/S", "/D={{ windows_containers_install_dir }}") -Wait
|
||||
exit $LASTEXITCODE
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
register: __podman_install_result
|
||||
changed_when: __podman_install_result.rc == 0
|
||||
when: __podman_installed_check.rc != 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Clean up Podman installer
|
||||
ansible.windows.win_file:
|
||||
path: "{{ ansible_env.TEMP | default('C:\\Windows\\Temp') }}\\podman-installer.exe"
|
||||
state: absent
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when: __podman_installed_check.rc != 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Add Podman to PATH if not already present
|
||||
ansible.windows.win_path:
|
||||
name: Path
|
||||
elements:
|
||||
- "{{ windows_containers_install_dir }}"
|
||||
state: present
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when: __podman_installed_check.rc != 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
# ── Phase 2: Dedicated service user ──────────────────────────────────────
|
||||
|
||||
- name: Fail when podman service password is missing
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
windows_containers_service_password must be provided to configure service account
|
||||
.\\{{ windows_containers_service_user }} for NSSM.
|
||||
when: windows_containers_service_password | length == 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Create dedicated podman service user
|
||||
ansible.windows.win_user:
|
||||
name: "{{ windows_containers_service_user }}"
|
||||
password: "{{ windows_containers_service_password }}"
|
||||
account_disabled: false
|
||||
password_never_expires: true
|
||||
user_cannot_change_password: true
|
||||
state: present
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when:
|
||||
- windows_containers_service_password | length > 0
|
||||
no_log: true
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Get localized Users group name via PowerShell
|
||||
ansible.windows.win_powershell:
|
||||
script: |
|
||||
$sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
|
||||
$ntAccount = $sid.Translate([System.Security.Principal.NTAccount])
|
||||
# Handle both local and domain accounts - take the last part after backslash
|
||||
$parts = $ntAccount.Value -split '\\'
|
||||
$parts[-1]
|
||||
register: __users_group_name
|
||||
changed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Debug localized Users group name
|
||||
ansible.builtin.debug:
|
||||
msg: "Localized Users group name is '{{ __users_group_name.output | first }}'"
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Add podman service user to Users group for interactive login
|
||||
ansible.windows.win_group_membership:
|
||||
name: "{{ __users_group_name.output | first }}"
|
||||
members:
|
||||
- ".\\{{ windows_containers_service_user }}"
|
||||
state: present
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when:
|
||||
- windows_containers_service_password | length > 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Grant "Log on as a service" right to podman service account
|
||||
ansible.windows.win_user_right:
|
||||
name: SeServiceLogonRight
|
||||
users:
|
||||
- ".\\{{ windows_containers_service_user }}"
|
||||
action: add
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when:
|
||||
- windows_containers_service_password | length > 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Grant "Log on locally" right to podman service account (required for Ansible become)
|
||||
ansible.windows.win_user_right:
|
||||
name: SeInteractiveLogonRight
|
||||
users:
|
||||
- ".\\{{ windows_containers_service_user }}"
|
||||
action: add
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when:
|
||||
- windows_containers_service_password | length > 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Grant "Log on as a batch job" right to podman service account
|
||||
ansible.windows.win_user_right:
|
||||
name: SeBatchLogonRight
|
||||
users:
|
||||
- ".\\{{ windows_containers_service_user }}"
|
||||
action: add
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
when:
|
||||
- windows_containers_service_password | length > 0
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
# ── Phase 3: Podman machine setup ──────────────────────────────────────
|
||||
|
||||
- name: Get Podman executable path
|
||||
ansible.windows.win_shell: where.exe podman.exe 2>&1
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
register: __podman_where
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Set Podman executable path from where output
|
||||
ansible.builtin.set_fact:
|
||||
__podman_exe: "{{ (__podman_where.stdout_lines | last).strip() }}"
|
||||
when:
|
||||
- __podman_where is not failed
|
||||
- __podman_where.stdout | trim != ""
|
||||
|
||||
- name: Default Podman executable path if not on PATH or where failed
|
||||
ansible.builtin.set_fact:
|
||||
__podman_exe: "{{ windows_containers_install_dir }}\\podman.exe"
|
||||
when: __podman_where is failed or __podman_where.stdout | trim == ""
|
||||
|
||||
# ── Phase 4: Podman machine init ────────────────────────────────────────
|
||||
|
||||
- name: Initialize Podman machine
|
||||
ansible.windows.win_shell: |
|
||||
$machinesJson = (podman machine ls --format json 2>$null | Out-String).Trim()
|
||||
$machines = @()
|
||||
if ($machinesJson) {
|
||||
$machines = $machinesJson | ConvertFrom-Json
|
||||
}
|
||||
|
||||
$machine = $machines | Where-Object { $_.Name -eq "{{ windows_containers_machine_name }}" } | Select-Object -First 1
|
||||
if (-not $machine) {
|
||||
podman machine init "{{ windows_containers_machine_name }}" --cpus {{ windows_containers_machine_cpus }} --memory {{ windows_containers_machine_memory }} --disk-size {{ windows_containers_machine_disk_size }}
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "Failed to initialize Podman machine {{ windows_containers_machine_name }}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
$afterInitJson = (podman machine ls --format json 2>$null | Out-String).Trim()
|
||||
$afterInitMachines = @()
|
||||
if ($afterInitJson) {
|
||||
$afterInitMachines = $afterInitJson | ConvertFrom-Json
|
||||
}
|
||||
|
||||
$createdMachine = $afterInitMachines | Where-Object { $_.Name -eq "{{ windows_containers_machine_name }}" } | Select-Object -First 1
|
||||
if (-not $createdMachine) {
|
||||
Write-Error "Podman machine {{ windows_containers_machine_name }} is still missing after init"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Output "__PODMAN_MACHINE_CREATED__"
|
||||
}
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: "{{ windows_containers_service_user }}"
|
||||
register: __podman_init
|
||||
changed_when: "'__PODMAN_MACHINE_CREATED__' in (__podman_init.stdout + __podman_init.stderr)"
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Start Podman machine on boot via NSSM service only
|
||||
ansible.windows.win_shell: |
|
||||
# Podman machine will be started on boot via NSSM service (PodmanAutoStart)
|
||||
# No need to start it during playbook execution
|
||||
podman machine status "{{ windows_containers_machine_name }}" 2>$null | Out-Null
|
||||
$status = $LASTEXITCODE
|
||||
if ($status -eq 0) {
|
||||
Write-Output "Podman machine {{ windows_containers_machine_name }} is already running"
|
||||
exit 0
|
||||
}
|
||||
Write-Output "Podman machine not running (will start on boot)"
|
||||
exit 0
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: "{{ windows_containers_service_user }}"
|
||||
register: __podman_status_check
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Deploy Podman auto-start PowerShell script
|
||||
ansible.windows.win_template:
|
||||
src: podman-auto-start.ps1.j2
|
||||
dest: "{{ windows_containers_install_dir }}\\auto-start-podman.ps1"
|
||||
mode: "0644"
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Deploy batch wrapper to avoid path-with-spaces issues in NSSM
|
||||
ansible.windows.win_template:
|
||||
src: podman-auto-start.bat.j2
|
||||
dest: "{{ windows_containers_install_dir }}\\auto-start-podman.bat"
|
||||
mode: "0644"
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Delete existing PodmanAutoStart service via NSSM
|
||||
ansible.windows.win_shell: |
|
||||
$existing = Get-CimInstance Win32_Service -Filter "Name='PodmanAutoStart'" -ErrorAction SilentlyContinue
|
||||
if ($existing) {
|
||||
Stop-Service -Name PodmanAutoStart -Force -ErrorAction SilentlyContinue
|
||||
Start-Sleep -Seconds 2
|
||||
$null = nssm.exe remove PodmanAutoStart confirm
|
||||
Start-Sleep -Seconds 2
|
||||
}
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
changed_when: true
|
||||
failed_when: false
|
||||
no_log: true
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Register Podman auto-start service via NSSM (batch wrapper for proper path quoting)
|
||||
ansible.windows.win_shell: |
|
||||
$installDir = "{{ windows_containers_install_dir }}"
|
||||
$batchPath = Join-Path $installDir "auto-start-podman.bat"
|
||||
nssm.exe install PodmanAutoStart "`"$batchPath`""
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
changed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Create log directory for Podman auto-start
|
||||
ansible.windows.win_file:
|
||||
path: C:\Logs\Podman
|
||||
state: directory
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Grant podman service user full control over log directory
|
||||
ansible.windows.win_acl:
|
||||
path: C:\Logs\Podman
|
||||
user: ".\\{{ windows_containers_service_user }}"
|
||||
rights: FullControl
|
||||
type: allow
|
||||
state: present
|
||||
inherit: ContainerInherit, ObjectInherit
|
||||
propagation: None
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Configure Podman auto-start service via NSSM
|
||||
ansible.windows.win_shell: |
|
||||
$installDir = "{{ windows_containers_install_dir }}"
|
||||
nssm.exe set PodmanAutoStart AppDirectory $installDir
|
||||
nssm.exe set PodmanAutoStart DisplayName "Podman Auto Start"
|
||||
nssm.exe set PodmanAutoStart Description "Starts Podman machine and containers on boot"
|
||||
nssm.exe set PodmanAutoStart Start SERVICE_AUTO_START
|
||||
nssm.exe set PodmanAutoStart AppRestartDelay 30000
|
||||
nssm.exe set PodmanAutoStart AppStdout "C:\Logs\Podman\auto-start.log"
|
||||
nssm.exe set PodmanAutoStart AppStderr "C:\Logs\Podman\auto-start-error.log"
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
changed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Set PodmanAutoStart service account via NSSM
|
||||
ansible.windows.win_shell: |
|
||||
nssm.exe set PodmanAutoStart ObjectName ".\{{ windows_containers_service_user }}" "{{ windows_containers_service_password }}"
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
changed_when: true
|
||||
no_log: true
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
|
||||
- name: Start PodmanAutoStart service
|
||||
ansible.windows.win_shell: |
|
||||
$svc = Get-CimInstance Win32_Service -Filter "Name='PodmanAutoStart'" -ErrorAction SilentlyContinue
|
||||
if ($svc -and $svc.State -ne 'Running') {
|
||||
nssm.exe start PodmanAutoStart
|
||||
Start-Sleep -Seconds 5
|
||||
$svc = Get-CimInstance Win32_Service -Filter "Name='PodmanAutoStart'"
|
||||
Write-Output "PodmanAutoStart service state: $($svc.State)"
|
||||
} else {
|
||||
Write-Output "PodmanAutoStart service already running or not found"
|
||||
}
|
||||
become: true
|
||||
become_method: ansible.builtin.runas
|
||||
become_user: SYSTEM
|
||||
register: __podman_auto_start_service
|
||||
changed_when: "'state: Running' in (__podman_auto_start_service.stdout)"
|
||||
failed_when: false
|
||||
tags:
|
||||
- roles::windows_containers::podman_install
|
||||
# ansible.windows.win_shell: podman pull "{{ windows_containers_image }}"
|
||||
# become: true
|
||||
# become_method: ansible.builtin.runas
|
||||
# become_user: "{{ windows_containers_service_user }}"
|
||||
# register: __podman_pull
|
||||
# changed_when: false
|
||||
# tags:
|
||||
# - roles::windows_containers::podman_install
|
||||
Reference in New Issue
Block a user