大規模なAgent Controlのインストレーションを自動化する

# site.yml
---
- name: Create a throwaway bootstrap credential for this run
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Download the latest newrelic-auth-cli
      ansible.builtin.get_url:
        # GitHub's /releases/latest/download/ redirect always resolves to the
        # newest release, so there's no version variable to keep in sync here.
        url: "https://github.com/newrelic/newrelic-auth-rs/releases/latest/download/newrelic-auth-cli_amd64.tar.gz"
        dest: /tmp/newrelic-auth-cli.tar.gz
        mode: "0644"

    - name: Extract newrelic-auth-cli
      ansible.builtin.unarchive:
        src: /tmp/newrelic-auth-cli.tar.gz
        dest: /tmp/
        remote_src: true

    - name: Record the newrelic-auth-cli version used for this run
      ansible.builtin.command:
        cmd: /tmp/newrelic-auth-cli --version
      register: nr_auth_cli_version
      changed_when: false

    - name: Show the newrelic-auth-cli version used for this run
      ansible.builtin.debug:
        msg: "{{ nr_auth_cli_version.stdout }}"

    - name: Create the bootstrap credential
      ansible.builtin.command:
        cmd: >
          /tmp/newrelic-auth-cli create-bootstrap-identity secret
          --name "ansible-bootstrap-{{ ansible_date_time.epoch }}"
          --organization-id {{ newrelic_organization }}
          --environment {{ newrelic_region }}
      environment:
        NR_AUTH_API_KEY: "{{ newrelic_api_key }}"
      register: bootstrap_output
      no_log: true

    - name: Save the bootstrap credential for the install play below
      ansible.builtin.set_fact:
        nr_bootstrap_client_id: "{{ (bootstrap_output.stdout | from_json).client_id }}"
        nr_bootstrap_client_secret: "{{ (bootstrap_output.stdout | from_json).identity_type.L1.client_secret }}"
      no_log: true

- name: Install Agent Control
  hosts: all
  become: true
  roles:
    - role: newrelic.newrelic_install
      vars:
        targets:
          - agent-control
  environment:
    NEW_RELIC_API_KEY: "{{ newrelic_api_key }}"
    NEW_RELIC_ACCOUNT_ID: "{{ newrelic_account_id }}"
    NEW_RELIC_REGION: "{{ newrelic_region }}"
    NEW_RELIC_ORGANIZATION: "{{ newrelic_organization }}"
    NEW_RELIC_AUTH_CLIENT_ID: "{{ hostvars['localhost']['nr_bootstrap_client_id'] }}"
    NEW_RELIC_AUTH_CLIENT_SECRET: "{{ hostvars['localhost']['nr_bootstrap_client_secret'] }}"
    NR_CLI_FLEET_ID: "{{ newrelic_fleet_id }}"

require 'json'

# GitHub's /releases/latest/download/ redirect always resolves to the newest
# release, so there's no version to keep in sync with this recipe.
newrelic_auth_cli_url = 'https://github.com/newrelic/newrelic-auth-rs/releases/latest/download/newrelic-auth-cli_amd64.tar.gz'
system("curl -sS -L '#{newrelic_auth_cli_url}' -o /tmp/newrelic-auth-cli.tar.gz && tar -xzf /tmp/newrelic-auth-cli.tar.gz -C /tmp")
Chef::Log.info("newrelic-auth-cli version: #{`/tmp/newrelic-auth-cli --version`.strip}")

bootstrap = JSON.parse(`NR_AUTH_API_KEY=#{node['newrelic']['api_key']} /tmp/newrelic-auth-cli create-bootstrap-identity secret \
  --name "chef-bootstrap-#{node.name}-#{Time.now.to_i}" \
  --organization-id #{node['newrelic']['organization']} \
  --environment #{node['newrelic']['region']}`)

newrelic_install 'agent-control' do
  action                 :install
  new_relic_api_key      node['newrelic']['api_key']
  new_relic_account_id   node['newrelic']['account_id']
  new_relic_region       node['newrelic']['region']
  targets                ['agent-control']
  env(
    'NEW_RELIC_ORGANIZATION' => node['newrelic']['organization'],
    'NEW_RELIC_AUTH_CLIENT_ID' => bootstrap['client_id'],
    'NEW_RELIC_AUTH_CLIENT_SECRET' => bootstrap.dig('identity_type', 'L1', 'client_secret'),
    'NR_CLI_FLEET_ID' => node['newrelic']['fleet_id']
  )
end

# Save the Linux tab's script as files/agent-control-automated-install.sh
# in this module, then:

class profile::agent_control_install (
  String $newrelic_api_key,
  String $newrelic_account_id,
  String $newrelic_organization,
  String $newrelic_region      = 'US',
  String $newrelic_fleet_id    = '',
) {
  file { '/opt/newrelic-agent-control-install.sh':
    ensure => file,
    mode   => '0700',
    source => 'puppet:///modules/profile/agent-control-automated-install.sh',
  }
  -> exec { 'run newrelic-agent-control-install':
    command     => '/opt/newrelic-agent-control-install.sh',
    path        => ['/usr/bin', '/bin', '/usr/local/bin'],
    environment => [
      "NEW_RELIC_API_KEY=${newrelic_api_key}",
      "NEW_RELIC_ACCOUNT_ID=${newrelic_account_id}",
      "NEW_RELIC_ORGANIZATION=${newrelic_organization}",
      "NEW_RELIC_REGION=${newrelic_region}",
      "NR_CLI_FLEET_ID=${newrelic_fleet_id}",
      'NEW_RELIC_CLI_SKIP_CORE=1',
    ],
    unless      => 'test -f /etc/newrelic-agent-control/keys/agent-control-identity.key',
    logoutput   => true,
  }
}