Merge pull request #1665 from edx/insights-sandbox

Updates to Make Insights Configuration Sandbox-Friendly

playbooks/edx-east/insights.yml

-- name: Deploy Analytics API
+- name: Deploy Insights
   hosts: all
   sudo: True
   gather_facts: True

playbooks/roles/analytics-api/tasks/main.yml

@@ -32,7 +32,7 @@
 # ansible-playbook -i 'api.example.com,' ./analyticsapi.yml  -e@/ansible/vars/deployment.yml -e@/ansible/vars/env-deployment.yml
 #
 
-- fail: msg="You must provide an private key for the analytics repo"
+- fail: msg="You must provide a private key for the analytics repo"
   when: not ANALYTICS_API_GIT_IDENTITY
 
 - include: deploy.yml tags=deploy

playbooks/roles/edx_ansible/templates/update.j2

@@ -51,6 +51,7 @@ repos_to_cmd["configuration"]="$edx_ansible_cmd edx_ansible.yml -e 'configuratio
 repos_to_cmd["read-only-certificate-code"]="$edx_ansible_cmd certs.yml -e 'certs_version=$2'"
 repos_to_cmd["edx-analytics-data-api"]="$edx_ansible_cmd analyticsapi.yml -e 'ANALYTICS_API_VERSION=$2'"
 repos_to_cmd["edx-ora2"]="$edx_ansible_cmd ora2.yml -e 'ora2_version=$2'"
+repos_to_cmd["insights"]="$edx_ansible_cmd insights.yml -e 'INSIGHTS_VERSION=$2'"
 
 
 if [[ -z $1 || -z $2 ]]; then

playbooks/roles/insights/defaults/main.yml

@@ -11,6 +11,8 @@
 # Defaults for role insights
 # 
 
+INSIGHTS_GIT_IDENTITY: !!null
+
 INSIGHTS_MEMCACHE: [ 'localhost:11211' ]
 INSIGHTS_FEEDBACK_EMAIL: 'dashboard@example.com'
 INSIGHTS_MKTG_BASE: 'http://example.com'
@@ -132,9 +134,8 @@ insights_wsgi: "analytics_dashboard.wsgi:application"
 
 insights_django_settings: "analytics_dashboard.settings.production"
 insights_source_repo: "git@{{ COMMON_GIT_MIRROR }}:/edx/edx-analytics-dashboard"
-insights_git_ssh_opts: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-insights_git_ssh: "/tmp/insights_git_ssh"
-insights_git_identity_file: "{{ insights_home }}/git_identity"
+insights_git_ssh_opts: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i {{ insights_git_identity_file }}"
+insights_git_identity_file: "{{ insights_home }}/git-identity"
 insights_manage: "{{ insights_code_dir }}/analytics_dashboard/manage.py"
 
 insights_requirements_base: "{{ insights_code_dir }}/requirements"

playbooks/roles/insights/tasks/deploy.yml

 ---
 
-- name: create .ssh directory
-  file:
-    path="{{ insights_home }}/.ssh" mode=2700 state=directory owner={{ insights_user }} group={{ insights_user }}
-
-- name: create ssh script for git (not authenticated)
-  template: >
-    src=tmp/git_ssh_noauth.sh.j2 dest={{ insights_git_ssh }}
-    owner={{ insights_user }} mode=750
-    
 - name: install read-only ssh key
   copy: >
-    content="{{ COMMON_GIT_IDENTITY }}" dest={{ insights_git_identity_file }}
+    content="{{ INSIGHTS_GIT_IDENTITY }}" dest={{ insights_git_identity_file }}
     owner={{ insights_user }} group={{ insights_user }} mode=0600
 
 - name: setup the insights env file
@@ -26,11 +17,10 @@
   git: >
     dest={{ insights_code_dir }} repo={{ insights_source_repo }} version={{ INSIGHTS_VERSION }}
     accept_hostkey=yes
+    ssh_opts="{{ insights_git_ssh_opts }}"
   register: insights_code_checkout
   notify: restart insights
   sudo_user: "{{ insights_user }}"
-  environment:
-    GIT_SSH: "{{ insights_git_ssh }}"
 
 - name: write out app config file
   template: >
@@ -47,8 +37,6 @@
   sudo_user: "{{ insights_user }}"
   notify: restart insights
   with_items: insights_requirements
-  environment:
-    GIT_SSH: "{{ insights_git_ssh }}"
 
 - name: create nodeenv
   shell: >
@@ -91,6 +79,7 @@
   with_items:
     - "collectstatic --noinput"
     - "compress"
+
 - name: write out the supervisior wrapper
   template: >
     src=edx/app/insights/insights.sh.j2

playbooks/roles/insights/tasks/main.yml

@@ -21,4 +21,7 @@
 #
 #
 
-- include: deploy.yml tags=deploy
\ No newline at end of file
+- fail: msg="You must provide a private key for the Insights repo"
+  when: not INSIGHTS_GIT_IDENTITY
+
+- include: deploy.yml tags=deploy

playbooks/roles/insights/templates/tmp/git_ssh_noauth.sh.j2

-#!/bin/sh
-exec /usr/bin/ssh -o StrictHostKeyChecking=no -i {{ insights_git_identity_file }} "$@"