Remove code we no longer use.

playbooks/edx-east/edx_service_rds.yml

----
-
-- name: Build service RDS instances
-  hosts: all
-  connection: local
-  # Needed for timestamps
-  gather_facts: True
-  roles:
-    - edx_service_rds  

playbooks/edx-east/edx_vpc.yml

----
-# Sample command: ansible-playbook -c local -i localhost, edx_vpc.yml -e@/Users/feanil/src/edx-secure/cloud_migrations/vpcs/test.yml -vvv
-- name: Create a simple empty vpc
-  hosts: all
-  connection: local
-  gather_facts: False
-  vars:
-    vpc_state: present
-  roles:
-    - edx_vpc

playbooks/roles/asqatasun/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role asqatasun
-#
-ASQATASUN_LOCALE: 'en_US.UTF-8'
-ASQATASUN_DATABASE_NAME: 'asqatasun'
-ASQATASUN_DATABASE_USER: 'asqatasun'
-ASQATASUN_DATABASE_PASSWORD: 'changeme'
-ASQATASUN_DATABASE_HOST: 'localhost'
-ASQATASUN_DATABASE_ENCODING: 'utf8'
-ASQATASUN_DATABASE_COLLATION: 'utf8_general_ci'
-ASQATASUN_URL: 'http://localhost:8080/asqatasun/'
-ASQATASUN_ADMIN_EMAIL: 'admin@example.com'
-ASQATASUN_ADMIN_PASSWORD: 'changeme'
-
-asqatasun_debian_pkgs:
-  - wget
-  - bzip2
-  - openjdk-7-jre
-  - unzip
-  - mysql-server
-  - libmysql-java
-  - python-mysqldb
-  - libtomcat7-java
-  - tomcat7 
-  - libspring-instrument-java
-  - xvfb
-  - libdbus-glib-1-2
-  - mailutils
-  - postfix
-
-locale: "{{ ASQATASUN_LOCALE }}"
-
-asqatasun_download_link: "http://download.asqatasun.org/asqatasun-latest.tar.gz"
-# Asqatasun version that you want to install, get the full list of releases 
-#by clicking in the release tab of the github main interface.
-asqatasun_version: "asqatasun-4.0.0-rc.1"
-
-# Go this link to find your desired ESR Firefox
-# For 32-bit architecture
-# http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-i686/
-# For 64-bit architecture
-# http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-x86_64/
-# Default is en-US in our example
-fixfox_esr_link: "http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-x86_64/en-US/firefox-31.4.0esr.tar.bz2"
-
-# MySQL variables for Asqatasun
-default_character_set: "utf8"
-collation_server: "utf8_general_ci"
-init_connect: "SET NAMES utf8"
-character_set_server: "utf8"
-mysql_max_allowed_packet: "64M"
-
-asqatasun_parameters:
-  db_name: "{{ ASQATASUN_DATABASE_NAME }}"
-  db_user: "{{ ASQATASUN_DATABASE_USER }}"
-  db_password: "{{ ASQATASUN_DATABASE_PASSWORD }}"
-  db_host: "{{ ASQATASUN_DATABASE_HOST }}"
-  db_encoding: "{{ ASQATASUN_DATABASE_ENCODING }}"
-  db_collation: "{{ ASQATASUN_DATABASE_COLLATION }}"
-  url: "{{ ASQATASUN_URL }}"
-  admin_email: "{{ ASQATASUN_ADMIN_EMAIL }}"
-  admin_passwd: "{{ ASQATASUN_ADMIN_PASSWORD }}"

playbooks/roles/asqatasun/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-# Tasks for role asqatasun
-#
-# Overview:
-#
-# Install the Asqatasun, an opensource web site analyzer, 
-# used for web accessibility (a11y) and Search Engine Optimization (SEO)
-#
-# ansible-playbook -i 'asqatasun.example.com,' ./asqatasun.yml  -e@/ansible/vars/deployment.yml -e@/ansible/vars/env-deployment.yml
-#
-- name: Set Postfix options
-  debconf: 
-    name: postifx 
-    question: "{{ item.question }}" 
-    value: "{{ item.value }} " 
-    vtype: "string"
-  with_items:
-    - { question: "postfix/mailname", value: " " }
-    - { question: "postfix/main_mailer_type", value: "Satellite system" }
-  tags:
-    - install
-    - install:configuration
-
-- name: Update locale Setting
-  locale_gen:
-    name: "{{ locale }}"
-    state: present
-  register: set_locale
-  tags:
-    - install
-    - install:base
-
-- name: Reconfigure locale
-  command: dpkg-reconfigure locales
-  when: set_locale.changed
-
-- name: Install the Asqatasun Prerequisites
-  apt: 
-    name: "{{ item }}" 
-    update_cache: yes 
-    state: installed
-  with_items: asqatasun_debian_pkgs
-  tags:
-    - install
-    - install:base
-
-- name: Copy the asqatasun.cnf template to /etc/mysql/conf.d
-  template:
-    dest: /etc/mysql/conf.d/asqatasun.cnf
-    src: etc/mysql/conf.d/asqatasun.cnf.j2
-    owner: root
-    group: root
-  when: "'{{ asqatasun_parameters.db_host }}' == 'localhost'"
-  register: my_cnf
-  tags:
-    - install
-    - install:configuration
-
-- name: Restart MySQL
-  service: 
-    name: mysql 
-    state: restarted
-  when: my_cnf.changed
-
-- name: Create a soft link for tomcat jar and mysql connector
-  file:
-    dest: "{{ item.dest }}"
-    src: "{{ item.src }}"
-    state: link
-  with_items:
-    - { src: '/usr/share/java/spring3-instrument-tomcat.jar', dest: '/usr/share/tomcat7/lib/spring3-instrument-tomcat.jar' }
-    - { src: '/usr/share/java/mysql-connector-java.jar', dest: '/usr/share/tomcat7/lib/mysql-connector-java.jar'}
-  tags:
-    - install
-    - install:configuration
-
-- name: Copy the xvfb template to /etc/init.d
-  template:
-    dest: /etc/init.d/xvfb
-    src: etc/init.d/xvfb.j2
-    owner: root
-    group: root
-    mode: 755
-  register: xvfb
-  tags:
-    - install
-    - install:config
-
-- name: Restart xvfb
-  service: 
-    name: xvfb 
-    pattern: /etc/init.d/xvfb 
-    state: restarted
-    enabled: yes
-  when: xvfb.changed
-  tags:
-    - install
-    - install:config
-
-- name: Download the latest ESR Firfox
-  get_url: 
-    url: "{{ fixfox_esr_link }}" 
-    dest: "/tmp/{{ fixfox_esr_link | basename }}"
-  tags:
-    - install
-    - install:base
-
-- name: Unzip the downloaded Firfox zipped file
-  unarchive: 
-    src: "/tmp/{{ fixfox_esr_link | basename }}" 
-    dest: /opt 
-    copy: no
-  tags:
-    - install
-    - install:base
-
-- name: Download the latest Asqatasun tarball
-  get_url: 
-    url: "{{ asqatasun_download_link }}" 
-    dest: "/tmp/{{ asqatasun_download_link | basename }}"
-  tags:
-    - install
-    - install:base
-
-- name: Unzip the downloaded Asqatasun tarball
-  unarchive: 
-    src: "/tmp/{{ asqatasun_download_link | basename }}" 
-    dest: "/tmp/" 
-    copy: no
-  tags:
-    - install
-    - install:base
-
-- name: Create MySQL database for Asqatasun
-  mysql_db: 
-    name: "{{ asqatasun_parameters.db_name }}"
-    state: present 
-    encoding: "{{ asqatasun_parameters.db_encoding }}"
-    collation: "{{ asqatasun_parameters.db_collation }}"
-  tags:
-    - migrate
-    - migrate:db
-
-- name: Create MySQL user for Asqatasun
-  mysql_user: 
-    name: "{{ asqatasun_parameters.db_user }}"
-    password: "{{ asqatasun_parameters.db_password }}"
-    host: "{{ asqatasun_parameters.db_host }}"  
-    priv: "{{ asqatasun_parameters.db_name }}.*:ALL"
-    state: present
-  tags:
-    - migrate
-    - migrate:db
-
-- name: Check that asqatasun app is running
-  shell: >
-    /bin/ps aux | grep -i asqatasun
-  register: asqatasun_app
-  changed_when: no
-  tags:
-    - install
-    - install:base
-
-- name: Install the Asqatasun
-  shell: >
-    /bin/echo "yes" | ./install.sh --database-user "{{ asqatasun_parameters.db_user }}" \
-    --database-passwd "{{ asqatasun_parameters.db_password }}" \
-    --database-db "{{ asqatasun_parameters.db_name }}" \ 
-    --database-host "{{ asqatasun_parameters.db_host }}" \ 
-    --asqatasun-url http://localhost:8080/asqatasun/ \
-    --tomcat-webapps /var/lib/tomcat7/webapps/ \
-    --tomcat-user tomcat7 \
-    --asqa-admin-email "{{ asqatasun_parameters.admin_email }}" \
-    --asqa-admin-passwd "{{ asqatasun_parameters.admin_passwd }}" \ 
-    --firefox-esr-binary-path /opt/firefox-esr/firefox 
-    --display-port ":99"
-  args:
-    chdir: "/tmp/{{ asqatasun_version }}.i386"
-  when: "asqatasun_app.stdout.find('/etc/asqatasun') == -1"
-  register: asqatasun_install
-  tags:
-    - install
-    - install:base
-
-- name: Restart tomcat7
-  service: 
-    name: tomcat7
-    state: restarted
-  when: asqatasun_install.changed
-

playbooks/roles/asqatasun/templates/etc/init.d/xvfb.j2

-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          xvfb
-# Required-Start:    $remote_fs $syslog
-# Required-Stop:     $remote_fs $syslog
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: XVFB - Virtual X server display
-# Description:       XVFB - Virtual X server display
-### END INIT INFO
-
-# Author: Matthieu Faure <mfaure@asqatasun.org>
-
-# Do NOT "set -e"
-# TODO: improve with help from /etc/init.d/skeleton
-
-RUN_AS_USER=tomcat7
-OPTS=":99 -screen 1 1024x768x24 -nolisten tcp"
-XVFB_DIR=/usr/bin
-PIDFILE=/var/run/xvfb
-
-case $1 in
-
-start)
-	start-stop-daemon --chuid $RUN_AS_USER -b --start --exec $XVFB_DIR/Xvfb --make-pidfile --pidfile $PIDFILE -- $OPTS &
-;;
-
-stop)
-	start-stop-daemon --stop --user $RUN_AS_USER --pidfile $PIDFILE
-	rm -f $PIDFILE
-;;
-
-restart)
-	if start-stop-daemon --test --stop --user $RUN_AS_USER --pidfile $PIDFILE >/dev/null; then
-		$0 stop
-	fi;
-	$0 start
-;;
-
-*)
-	echo "Usage: $0 (start|restart|stop)"
-	exit 1
-;;
-
-esac
-
-exit 0

playbooks/roles/asqatasun/templates/etc/mysql/conf.d/asqatasun.cnf.j2

-[client]
-default-character-set={{ default_character_set }}
-
-[mysql]
-default-character-set={{ default_character_set }}
-
-[mysqld]
-collation-server = {{ collation_server }}
-init-connect={{ "\'" + init_connect + "\'" }}
-character-set-server = {{ character_set_server }}
-max_allowed_packet = {{ mysql_max_allowed_packet }}

playbooks/roles/edx_service_rds/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role edx_service_rds
-# 
-
-#
-# vars are namespaced with the module name.
-#
-edx_service_rds_role_name: edx_service_rds
-
-E_D_C: "prod-sample-app"
-EDX_SERVICE_RDS_INSTANCE_SIZE: 10
-EDX_SERVICE_RDS_INSTANCE_TYPE: "db.m1.small"
-EDX_SERVICE_RDS_ROOT_USER: "root"
-# no unicode, c cedilla , passwords
-EDX_SERVICE_RDS_ROOT_PASSWORD: "plus_ca_change"
-EDX_SERVICE_RDS_ENGINE: "MySQL"
-EDX_SERVICE_RDS_ENGINE_VERSION: "5.6.22"
-EDX_SERVICE_RDS_PARAM_GROUP_ENGINE: "mysql5.6"
-# will vary depending upon engine, examples assume
-# MySQL 56
-EDX_SERVICE_RDS_PARAM_GROUP_PARAMS:
-  character_set_client: "utf8"
-  character_set_connection: "utf8"
-  character_set_database: "utf8"
-  character_set_filesystem: "utf8"
-  character_set_results: "utf8"
-  character_set_server: "utf8"
-  collation_connection: "utf8_unicode_ci"
-  collation_server: "utf8_unicode_ci"
-EDX_SERVICE_RDS_MULTI_AZ: No
-EDX_SERVICE_RDS_MAINT_WINDOW: "Mon:00:00-Mon:01:15"
-EDX_SERVICE_RDS_BACKUP_DAYS: 30
-EDX_SERVICE_RDS_BACKUP_WINDOW: "02:00-03:00"
-
-EDX_SERVICE_RDS_SUBNET_1_AZ: "us-east-1c"
-EDX_SERVICE_RDS_SUBNET_1_CIDR: "{{ vpc_class_b }}.50.0/24"
-EDX_SERVICE_RDS_SUBNET_2_AZ: "us-east-1d"
-EDX_SERVICE_RDS_SUBNET_2_CIDR: "{{ vpc_class_b }}.51.0/24"
-
-# The defaults are permissive, override
-EDX_SERVICE_RDS_SECURITY_GROUP:
-  name: "{{ e_d_c }}-rds-sg"
-  description: "RDS ingress and egress."
-  rules:
-    - proto: "tcp"
-      from_port: "3306"
-      to_port: "3306"
-      cidr_ip: "0.0.0.0/0"
-  rules_egress:
-    - proto: "tcp"
-      from_port: "3306"
-      to_port: "3306"
-      cidr_ip: "0.0.0.0/0"
-
-# The defaults are permissive, override
-EDX_SERVICE_RDS_VPC_DB_ACL:
-  name: "{{ e_d_c }}-db"
-  rules:
-    - number: "100"
-      type: "ingress"
-      protocol: "tcp"
-      from_port: 3306
-      to_port: 3306
-      cidr_block: "0.0.0.0/0"
-      rule_action: "allow"
-    - number: "100"
-      type: "egress"
-      protocol: "all"
-      from_port: 0
-      to_port: 65535
-      cidr_block: "0.0.0.0/0"
-      rule_action: "allow"
-
-EDX_SERVICE_RDS_VPC_DB_ROUTE_TABLE:
-  - cidr: "{{ vpc_class_b }}.0.0/16"
-    gateway: 'local'
-      
-# typically override the all caps vars, but may
-# be convenient to override the entire structure
-# if you spanning more than two subnets
-edx_service_rds_vpc_db_subnets:
-  - name: "{{ E_D_C }}-db-{{ EDX_SERVICE_RDS_SUBNET_1_AZ }}"
-    cidr: "{{ EDX_SERVICE_RDS_SUBNET_1_CIDR }}"
-    az: "{{ EDX_SERVICE_RDS_SUBNET_1_AZ }}"
-  - name: "{{ E_D_C }}-db-{{ EDX_SERVICE_RDS_SUBNET_2_AZ }}"
-    cidr: "{{ EDX_SERVICE_RDS_SUBNET_2_CIDR }}"
-    az: "{{ EDX_SERVICE_RDS_SUBNET_2_AZ }}"
-      
-edx_service_rds_state: "present"
-
-edx_service_rds_db:
-  state: "{{ edx_service_rds_state }}"
-  name: "{{ E_D_C }}-primary"
-  size: "{{ EDX_SERVICE_RDS_INSTANCE_SIZE }}"
-  instance_type: "{{ EDX_SERVICE_RDS_INSTANCE_TYPE }}"
-  root_user: "{{ EDX_SERVICE_RDS_ROOT_USER }}"
-  root_password: "{{ EDX_SERVICE_RDS_ROOT_PASSWORD }}"
-  engine: "{{ EDX_SERVICE_RDS_ENGINE }}"
-  engine_version: "{{ EDX_SERVICE_RDS_ENGINE_VERSION }}"
-  multi_az: "{{ EDX_SERVICE_RDS_MULTI_AZ }}"
-  maint_window: "{{ EDX_SERVICE_RDS_MAINT_WINDOW }}"
-  backup_days: "{{ EDX_SERVICE_RDS_BACKUP_DAYS }}"
-  backup_window: "{{ EDX_SERVICE_RDS_BACKUP_WINDOW }}"
-  param_group:
-    name: "{{ E_D_C}}"
-    engine: "{{ EDX_SERVICE_RDS_PARAM_GROUP_ENGINE }}"
-    params: "{{ EDX_SERVICE_RDS_PARAM_GROUP_PARAMS }}"
-      
-
-#
-# OS packages
-#
-
-edx_service_rds_debian_pkgs: []
-
-edx_service_rds_redhat_pkgs: []

playbooks/roles/edx_service_rds/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-#
-#
-# Tasks for role edx_service_rds
-# 
-# Overview:
-#
-# Creates a VPC RDS instance and related network infrastructure, e.g.,
-# subnets, subnet groups, acls, as well as an instance specific
-# parameter group.
-#
-# NB: When using a boto profile other than the default, you will need
-# to export AWS_PROFILE because some tasks do not properly process
-# the profile argument.
-#
-# NB: You should currently not use this play for deleting databases as
-# the final snapshot functionality doesn't work properly in the ansible
-# module.  First it default to not taking a final snapshot and
-# when you specify one, it throw a key error.
-#
-# Dependencies:
-#
-# Assumes a working VPC, ideally created via the edx_vpc role as this
-# role will produce configuration output that this role requires
-# like the VPC, route table and subnet IDs.
-# 
-# Example play:
-#
-# export AWS_PROFILE=sandbox
-# ansible-playbook -i 'localhost,' edx_service_rds.yml -e@/path/to/secure-repo/cloud_migrations/vpcs/vpc-file.yml -e@/path/to/secure-repo/cloud_migrations/dbs/e-d-c-rds.yml
-#
-# TODO:
-# - handle db deletes and updates
-# - handle DNS updates, consider that a different profile may be required for this.
-#
-
-- name: create database route table
-  ec2_rt:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    region: "{{ aws_region }}"
-    state: "{{ edx_service_rds_state }}"
-    name: "{{ e_d_c }}-db"
-    routes: "{{ EDX_SERVICE_RDS_VPC_DB_ROUTE_TABLE }}"
-  register: created_db_rt
-
-- name: create db network acl
-  ec2_acl:
-    profile: "{{ profile }}"
-    name: "{{ EDX_SERVICE_RDS_VPC_DB_ACL.name }}"
-    vpc_id: "{{ vpc_id }}"
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    rules: "{{ EDX_SERVICE_RDS_VPC_DB_ACL.rules }}"
-  register: created_db_acl
-
-- name: create db subnets
-  ec2_subnet:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    region: "{{ aws_region }}"
-    state: "{{ edx_service_rds_state }}"
-    name: "{{ item.name }}"
-    cidr: "{{ item.cidr }}"
-    az: "{{ item.az }}"
-    route_table_id: "{{ created_db_rt.id }}"
-    network_acl_id: "{{ created_db_acl.id }}"
-  with_items: edx_service_rds_vpc_db_subnets
-  register: created_db_subnets
-
-- name: Apply function to subnet data
-  util_map:
-    function: 'zip_to_list'
-    input: "{{ created_db_subnets.results }}"
-    args:
-      - "subnet_id"
-  register: subnet_data
-
-- name:
-  rds_subnet_group:
-    state: "{{ edx_service_rds_state }}"
-    profile: "{{ profile }}"
-    region: "{{ aws_region }}"
-    name: "{{ e_d_c }}"
-    description: "{{ e_d_c }}"
-    subnets: "{{ subnet_data.function_output }}"
-
-- name: create RDS security group
-  ec2_group:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    name: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.name }}"
-    rules: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.rules }}"
-    description: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.description }}"
-    rules_egress: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.rules_egress }}"
-  register: created_rds_security_group
-
-- name: create instance parameter group
-  rds_param_group:
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    name: "{{ edx_service_rds_db.param_group.name }}"
-    description: "{{ edx_service_rds_db.param_group.name }}"
-    engine: "{{ edx_service_rds_db.param_group.engine }}"
-    params: "{{ edx_service_rds_db.param_group.params }}"
-  register: created_param_group
-
-  #  
-  # Create the database
-  #
-- name: Create service database
-  rds:
-    command: "create"
-    region: "{{ aws_region }}"
-    instance_name: "{{ edx_service_rds_db.name }}"
-    db_engine: "{{ edx_service_rds_db.engine }}"
-    engine_version: "{{ edx_service_rds_db.engine_version }}"
-    size: "{{ edx_service_rds_db.size }}"
-    instance_type: "{{ edx_service_rds_db.instance_type }}"
-    username: "{{ edx_service_rds_db.root_user }}"
-    password: "{{ edx_service_rds_db.root_password }}"
-    subnet: "{{ e_d_c }}"
-    vpc_security_groups: "{{ created_rds_security_group.group_id }}"
-    multi_zone: "{{ edx_service_rds_db.multi_az }}"
-    maint_window: "{{ edx_service_rds_db.maint_window }}"
-    backup_window: "{{ edx_service_rds_db.backup_window }}"
-    backup_retention: "{{ edx_service_rds_db.backup_days }}"
-    parameter_group: "{{ edx_service_rds_db.param_group.name }}"
-    tags:
-      Environment: "{{ env }}"
-      Application: "{{ deployment }}"
-  when: edx_service_rds_db.state == 'present'
-  register: created_db
-
-  # 
-  # Delete the database, need to debug module for this to
-  # full work.
-  #
-- name: Delete service database
-  rds:
-    command: "delete"
-    region: "{{ aws_region }}"
-    instance_name: "{{ edx_service_rds_db.name }}"
-    # bug inthe module related to final snapshots
-    #snapshot: "{{ edx_service_rds_db.name }}-final-{{ ansible_date_time.epoch }}"
-    snapshot: "red-blue"
-  when: edx_service_rds_db.state == 'absent'

playbooks/roles/edx_vpc/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role edx_vpc
-# 
-
-#
-# vars are namespace with the module name.
-#
-vpc_role_name: vpc
-
-#
-# OS packages
-#
-
-vpc_debian_pkgs: []
-
-vpc_redhat_pkgs: []

playbooks/roles/edx_vpc/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-#
-#
-# Tasks for role edx_vpc
-# 
-# Overview:
-# This role creates an opinionated vpc for containing cluster of edx services.
-# 
-# It currently assumes that we will be multi-az, with a single NAT, and all
-# traffic going over that NAT.  A public subnet, and both public and private
-# route tables are created by default that can be used by new services in this
-# vpc.  The public subnet should house ELBs and any newly created private subnets
-# can use the existing private route table to be able to reach the internet from
-# private machines.
-# 
-#
-# Example play:
-#
-# ansible-playbook -c local -i localhost, edx_vpc.yml -e@/Users/feanil/src/edx-secure/cloud_migrations/vpcs/test.yml
-
-# DO NOT use the subnet or route table sections of this command.
-# They will delete any subnets or rts not defined here which is
-# probably not what you want, since other services were added
-# to the vpc whose subnets and rts are not enumerated here.
-- name: create a vpc
-  local_action:
-    profile: "{{ vpc_aws_profile }}"
-    module: "ec2_vpc_local"
-    resource_tags: "{{ vpc_tags }}"
-    cidr_block: "{{ vpc_cidr }}"
-    region: "{{ vpc_aws_region }}"
-    state: "{{ vpc_state }}"
-    internet_gateway: yes
-    wait: yes
-  register: created_vpc
-
-# A default network acl is created when a vpc is created so each VPC
-# should have one but we create one here that allows access to the
-# outside world using the internet gateway.
-- name: create public network acl
-  ec2_acl:
-    profile: "{{ vpc_aws_profile }}"
-    name: "{{ vpc_public_acl.name }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    state: "present"
-    region: "{{ vpc_aws_region }}"
-    rules: "{{ vpc_public_acl.rules }}"
-  register: created_public_acl
-
-- name: create public route table
-  ec2_rt:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ vpc_name }}-public"
-    routes: "{{ vpc_public_route_table }}"
-  register: created_public_rt
-
-- name: create public subnets
-  ec2_subnet:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ item.name }}"
-    cidr: "{{ item.cidr }}"
-    az: "{{ item.az }}"
-    route_table_id: "{{ created_public_rt.id }}"
-    network_acl_id: "{{ created_public_acl.id }}"
-  with_items: vpc_public_subnets
-  register: created_public_subnets
-
-- name: create NAT security group
-  ec2_group:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    state: "present"
-    region: "{{ vpc_aws_region }}"
-    name: "{{ nat_security_group.name }}"
-    rules: "{{ nat_security_group.rules }}"
-    description: "{{ nat_security_group.description }}"
-    rules_egress: "{{ nat_security_group.rules_egress }}"
-  register: created_nat_security_group
-
-- name: check to see if we already have a nat instance
-  local_action:
-    module: "ec2_lookup"
-    region: "{{ vpc_aws_region }}"
-    tags:
-      - Name: "{{ vpc_name }}-nat-instance"
-  register: nat_instance
-
-- name: create nat instance
-  local_action:
-    module: "ec2"
-    state: "present"
-    wait: yes
-    source_dest_check: false
-    region: "{{ vpc_aws_region }}"
-    profile: "{{ vpc_aws_profile }}"
-    group_id: "{{ created_nat_security_group.group_id }}"
-    key_name: "{{ vpc_keypair }}"
-    vpc_subnet_id: "{{ created_public_subnets.results[0].subnet_id }}"
-    instance_type: "{{ vpc_nat_instance_type }}"
-    instance_tags:
-      Name: "{{ vpc_name }}-nat-instance"
-    image: "{{ vpc_nat_ami_id }}"
-  register: new_nat_instance
-  when: nat_instance.instances|length == 0
-
-# We need to do this instead of registering the output of the above
-# command because if the above command get skipped, the output does
-# not contain information about the instance.
-- name: lookup the created nat_instance
-  local_action:
-    module: "ec2_lookup"
-    region: "{{ vpc_aws_region }}"
-    tags:
-      - Name: "{{ vpc_name }}-nat-instance"
-  register: nat_instance
-
-- name: assign eip to nat
-  ec2_eip:
-    profile: "{{ vpc_aws_profile }}"
-    region: "{{ vpc_aws_region }}"
-    instance_id: "{{ nat_instance.instances[0].id }}"
-    in_vpc: true
-    reuse_existing_ip_allowed: true
-  when: new_nat_instance.changed
-
-- name: create private route table
-  ec2_rt:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ vpc_name }}-private"
-    routes: "{{ vpc_private_route_table }}"
-  register: created_private_rt
-
-- name: output a vpc_config for using to build services
-  local_action:
-    module: template
-    src: "vpc_config.yml.j2"
-    dest: "~/{{ e_d }}.yml"

playbooks/roles/edx_vpc/templates/vpc_config.yml.j2

-#
-# Configuration for the environment-deployment
-#
-profile: "{{ vpc_aws_profile }}"
-vpc_id: "{{ created_vpc.vpc_id }}"
-vpc_cidr: "{{ vpc_cidr }}"
-vpc_class_b: "{{ vpc_class_b }}"
-
-env: "{{ vpc_environment }}"
-deployment: "{{ vpc_deployment }}"
-e_d_c: "{{ vpc_environment }}-{{ vpc_deployment }}-{{ '{{' }} cluster {{ '}}' }}"
-aws_region: "{{ vpc_aws_region }}"
-
-
-aws_availability_zones:
-{% for subnet in vpc_public_subnets %}
-  - {{ subnet.az }}
-{% endfor %}
-
-# Should this be service specific
-ssl_cert: "{{ vpc_ssl_cert }}"
-
-# used for ELB
-public_route_table: "{{ created_public_rt.id }}"
-# used for service subnet
-private_route_table: "{{ created_private_rt.id }}"
-instance_key_name: "{{ vpc_keypair }}"
-
-# subject to change #TODO: provide the correct var for the eni
-nat_device: "{{ nat_instance.instances[0].id }}"
-
-public_subnet_1: "{{ vpc_public_subnets[0].cidr }}"
-public_subnet_2: "{{ vpc_public_subnets[1].cidr }}"
-
-# /28 per AZ NEEDE?
-# private_subnet_1: "{{ vpc_class_b }}.110.16/28"
-# private_subnet_2: "{{ vpc_class_b }}.120.16/28"
-
-elb_subnets:
-{% for subnet in created_public_subnets.results %}
-  - "{{ subnet.subnet_id }}"
-{% endfor %}
-
-#
-# Do not use vars in policies :(
-# Should be specific to the service right?
-role_policies: []
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-s3-policy"
-#     document: |
-#       {
-#         "Statement":[
-#           {
-#             "Effect":"Allow",
-#             "Action":["s3:*"],
-#             "Resource":["arn:aws:s3:::edx-stage-edx"]
-#           }
-#         ]
-#         }  
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-create-instance-tags"
-#     document: |
-#       {
-#         "Statement": [
-#           {
-#             "Effect": "Allow",
-#             "Action": ["ec2:CreateTags"],
-#             "Resource": ["arn:aws:ec2:us-east-1:xxxxxxxxxxxx:instance/*"]
-#           }
-#         ]
-#         }        
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-describe-ec2"
-#     document: |
-#         {"Statement":[
-#         {"Resource":"*",
-#         "Action":["ec2:DescribeInstances","ec2:DescribeTags","ec2:DescribeVolumes"],
-#         "Effect":"Allow"}]}