The template creates an OpenShift Container Platform user using the supplied values adminUsername and adminPassword in the ARM template parameters when creating the infrastructure and it will be granted the cluster-admin role for the OpenShift Container Platform environment.

A Red Hat account is required to use this template. This account must have appropriate subscriptions available in the account in order to use the template. Either a username and password may be supplied, or an organization ID and activation key.

To be able to access the RPM packages the Pool ID for the subscriptions is required. The next section will show how to locate the Pool ID.

# subscription-manager list --available

+-------------------------------------------+
    Available Subscriptions
+-------------------------------------------+
Subscription Name:   Red Hat OpenShift Container Platform, Premium (1-2 Sockets)
Provides:            Red Hat OpenShift Enterprise Application Node
                     Red Hat OpenShift Container Platform
                     Red Hat OpenShift Enterprise Client Tools
                     Red Hat Enterprise Linux Server
                     Red Hat Enterprise Linux Atomic Host
                     Red Hat OpenShift Enterprise Infrastructure
                     Red Hat CloudForms
SKU:                 MCT2862
Contract:            38154141
Pool ID:             1b152951269116311123bc522341e1
Provides Management: No
Available:           64
Suggested:           1
Service Level:       Premium
Service Type:        L1-L3
Subscription Type:   Stackable
Ends:                25/08/2017
System Type:         Virtual

Instead using username/password combination, an activation key and organization ID can be used. The activation key is a simple string, chosen by the end-user that contains the subscriptions the user attaches to it to avoid using passwords in the registration procedure. The organization ID is the Red Hat ID for the customer organizations and it is required when using activation keys to identify the activation keys within the organization.

Perform the following steps to obtain the organization ID and activation key.

$ subscription-manager identity
system identity: 8c85ab6d-495c-451e-b38e-5f09bc3342a0
name: bastion
org name: 6616399
org ID: 6616399

It is required to create a Microsoft Azure service principal in order to be able to deploy the infrastructure using the ARM template. The service principal object defines the policy and permissions for an application’s use in a specific tenant, providing the basis for a security principal to represent the application at run-time.

In order to create the Azure Active Directory (AAD) client id, and password, the Node.js Azure CLI package is required.

Follow this instructions to create it in a RHEL/CentOS/Fedora system:

With the above information ready, go to https://github.com/openshift/openshift-ansible-contrib/tree/master/reference-architecture/azure-ansible and click the [Deploy To Azure] button near the bottom of the page. This will then show the form, to allow the deployment to be started.

Figure 3.1. ARM Template

The ARM templates may be deployed via Ansible playbook when you wish to have a repeatable method of creating a cluster, or you wish to create multiple clusters.

In the reference scripts, a additional directory is provided, ansibledeployocp. This provides example playbooks to directly create clusters using Ansible in a Linux environment.

First, install git and ansible.

$ sudo yum -y install ansible git

Then clone the openshift-ansible-contrib repository to a RHEL based host.

$ git clone https://github.com/openshift/openshift-ansible-contrib
$ cd openshift-ansible-contrib/reference-architecture/azure-ansible/ansibledeployocp/

Next, install the dependencies using the prepare playbook:

$ ansible-playbook playbooks/prepare.yml

Microsoft Azure credentials needs to be stored in a file at ~/.azure/credentials with the following format (do not use quotes or double quotes):

[default]
subscription_id=00000000-0000-0000-0000-000000000000
tenant=11111111-1111-1111-1111-111111111111
client_id=33333333-3333-3333-3333-333333333
secret=ServicePrincipalPassword

Where subscription_id and tenant parameters can be obtained from the Microsoft Azure cli:

$ sudo yum install -y nodejs
$ sudo npm install -g azure-cli
$ azure login
$ azure account show
info:    Executing command account show
data:    Name                        : Acme Inc.
data:    ID                          : 00000000-0000-0000-0000-000000000000
data:    State                       : Enabled
data:    Tenant ID                   : 11111111-1111-1111-1111-111111111111
data:    Is Default                  : true
data:    Environment                 : AzureCloud
data:    Has Certificate             : Yes
data:    Has Access Token            : Yes
data:    User name                   : youremail@yourcompany.com
data:
info:    account show command OK

The client_id is the "Service Principal Name" parameter when you create the serviceprincipal:

$ azure ad sp create -n azureansible -p ServicePrincipalPassword

info:    Executing command ad sp create
+ Creating application ansiblelab
+ Creating service principal for application 33333333-3333-3333-3333-333333333
data:    Object Id:               44444444-4444-4444-4444-444444444444
data:    Display Name:            azureansible
data:    Service Principal Names:
data:                             33333333-3333-3333-3333-333333333
data:                             http://azureansible
info:    ad sp create command OK

The secret is the serviceprincipal password.

Ansible Parameters required

The ansible playbook needs some parameters to be specified. There is a vars.yaml example file included in this repository that should be customized with your environment data.

PARAMETERS

$ cp vars.yaml.example vars.yaml
$ vim vars.yaml

Optional (default values are set in playbooks/roles/azure-deploy/default/main.yaml)

Running the deploy

$ ansible-playbook -e @vars.yaml playbooks/deploy.yaml

PLAY [localhost] 

TASK [Destroy Azure Deploy]  changed: [localhost] TASK [Destroy Azure Deploy] 
ok: [localhost]

TASK [Create Azure Deploy] 
changed: [localhost]

PLAY RECAP **
localhost                  : ok=3    changed=2    unreachable=0    failed=0