tower_devsecops_deploy.yml

---
- name: Install Ansible Tower
  hosts: adminservers
  become: true
  gather_facts: true 

  collections:
    - redhat_cop.tower_utilities
  tags:
    - tower-install
  
  tasks:
  - name: Install Ansible Tower
    include_role:
      name: install

- name: Configure Tower for JuiceShop Demo
  hosts: localhost
  connection: local
  become: false
  gather_facts: false
  tags:
  - tower-config
  collections:
    - ansible.tower

  tasks:
  - name: Install Tower license
    tower_license:
      manifest: "{{ tower_license }}"
      eula_accepted: true
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-license
  
  - name: Create {{ tower_organization }} Organisation
    tower_organization:
      name: "{{ tower_organization }}"
      description: Juice Shop Ltd Organisation
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-create-org

## Credentials
  - name: Create Automation Hub credential
    tower_credential:
      name: Automation Hub Credential
      description: JuiceShop Automation Hub Credentials
      credential_type: Ansible Galaxy/Automation Hub API Token
      organization: "{{ tower_organization }}"
      inputs:
        url: "{{ tower_hub_credentials.pri_hub_url }}"
        auth_url: "{{ tower_hub_credentials.pri_hub_auth_url }}"
        token: "{{ tower_hub_credentials.pri_hub_token }}"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    no_log: true
    tags:
      - tower-hub-cred

  - name: Create Galaxy credential
    tower_credential:
      name: Galaxy Credential
      description: JuiceShop Automation Hub Credentials
      credential_type: Ansible Galaxy/Automation Hub API Token
      organization: "{{ tower_organization }}"
      inputs:
        url: "{{ tower_hub_credentials.pri_galaxy_url }}"
        token: "{{ tower_hub_credentials.pri_galaxy_token }}"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-hub-cred

  - name: Update {{ tower_organization }} with Hub Credentials
    tower_organization:
      name: "{{ tower_organization }}"
      description: Juice Shop Ltd Organisation
      state: present
      tower_config_file: "{{ tower_config_file }}"
      galaxy_credentials:
        - Automation Hub Credential
        - Galaxy Credential
    tags:
      - tower-org-cred


  - name: Create AWS credential
    tower_credential:
      name: AWS Credentials
      description: JuiceShop AWS Credentials
      kind: aws
      organization: "{{ tower_organization }}"
      username: "{{ aws_username }}"
      password: "{{ aws_password }}"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-aws-cred

  - name: Fetch EC2 private key
    slurp:
      src: "{{ aws_pvt_key }}"
    register: aws_ssh_key
    tags:
      - tower-ec2-cred

  - name: Create EC2 Instance credential
    tower_credential:
      name: EC2 Instance Credential
      description: JuiceShop EC2 Credentials
      credential_type: Machine
      organization: "{{ tower_organization }}"
      inputs:
        username: "{{ aws_ssh_user }}"
        ssh_key_data: "{{ aws_ssh_key['content'] | b64decode }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-ec2-cred

  - name: Fetch Demo VM SSH Key
    slurp:
      src: "{{ demo_ssh_pvt_key_file }}"
    register: demo_ssh_pvt_key
    tags:
      - tower-ssh-cred

  - name: Create Demo VM SSH Credential
    tower_credential:
      name: VM SSH Credential
      description: JuiceShop VM SSH Credential
      credential_type: Machine
      organization: "{{ tower_organization }}"
      inputs:
        username: "{{ demo_ssh_key_username }}"
        ssh_key_data: "{{ demo_ssh_pvt_key['content'] | b64decode }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-ssh-cred

  - name: Create F5 Credential Type
    tower_credential_type:
      name: f5
      description: F5 BigIP Credential
      kind: cloud
      inputs: "{{ lookup('file', 'tower_cred_inputs_f5.json') }}"
      injectors: "{{ lookup('file', 'tower_cred_inputs_f5_injectors.json') }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-f5-cred

  - name: Create F5 Credential  
    tower_credential:
      name: BigIP Credential
      description: BIGIP Credential
      credential_type: f5
      tower_config_file: "{{ tower_config_file }}"
      organization: "{{ tower_organization }}"
      inputs:
        f5_user: "{{ f5_user }}"
        f5_password: "{{ f5_password }}"
    # no_log: true
    tags:
      - tower-f5-cred

  
  - name: Fetch GitHub Key
    slurp:
      src: "{{ github_pvt_key }}"
    register: github_pvt_key_out
    no_log: true
    tags:
      - tower-github-cred


  - name: Create GitHub Credential
    tower_credential:
      organization: "{{ tower_organization }}"
      name: GitHub Credential
      description: JuiceShop GitHub Credential
      credential_type: Source Control
      inputs:
        ssh_key_data: "{{ github_pvt_key_out['content'] | b64decode }}"
        username: craig-br
      tower_config_file: "{{ tower_config_file }}"
    no_log: true
    tags:
      - tower-github-cred

  - name: Create RHSM Credential Type
    tower_credential_type:
      name: rhsm
      description: RHSM Credentials
      kind: cloud
      inputs: "{{ lookup('file', 'tower_cred_inputs_rhsm.json') }}"
      injectors: "{{ lookup('file', 'tower_cred_inputs_rhsm_injectors.json') }}"
      tower_config_file: "{{ tower_config_file }}"
    no_log: true
    tags:
      - tower-rhsm-cred

  - name: Create RHSM Credential
    tower_credential:
      organization: "{{ tower_organization }}"
      name: RHSM
      description: JuiceShop RHSM Credentials
      credential_type: rhsm
      inputs:
        rhsm_username: "{{ rhsm_username }}"
        rhsm_password: "{{ rhsm_password }}"
      tower_config_file: "{{ tower_config_file }}"
    no_log: true
    tags:
      - tower-rhsm-cred
  
## Projects
# @todo chnage branch to master
  - name: Create Project
    tower_project:
      name: JuiceShop Project
      organization: "{{ tower_organization }}"
      allow_override: true
      description: JuiceShop Playbooks
      scm_branch: development
      scm_clean: false
      scm_credential: GitHub Credential
      scm_type: git
      scm_url: "{{ github_scm_url }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-git-project


  - name: Create AWS Inventory
    tower_inventory:
      name: AWS Inventory
      description: JuiceShop AWS Instances
      organization: "{{ tower_organization }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-aws-inv    

  - name: AWS Inventory Source
    tower_inventory_source:
      name: AWS Source
      description: JuiceShop AWS Source
      inventory: AWS Inventory
      credential: AWS Credentials
      overwrite: true
      overwrite_vars: true
      source: ec2
      update_on_launch: false
      tower_config_file: "{{ tower_config_file }}"
      source_vars:
        keyed_groups:
          - prefix: tag
            key: tags
        hostname:
          - dns-name
    tags:
      - tower-aws-inv 

  - name: Create On-Prem Inventory
    tower_inventory:
      name: "On Prem Inventory"
      description: JuiceShop On-Prem Instances
      organization: "{{ tower_organization }}"
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-onprem-inv

  - tower_host:
      inventory: On Prem Inventory
      name: "{{ item.name }}"
      description: "{{ item.description }}"
      variables: "{{ item.variables }}"
      tower_config_file: "{{ tower_config_file }}"
    loop: "{{ on_prem_inv_vars }}"
    tags:
      - tower-onprem-inv

  - tower_group:
      name: "{{ item.name }}"
      description: "{{ item.description }}"
      variables: "{{ item.variables | default({})}}"
      hosts: "{{ item.hosts }}"
      inventory: On Prem Inventory
      tower_config_file: "{{ tower_config_file }}"
    loop: "{{ onprem_inv_group_vars }}"
    tags:
      - tower-onprem-inv
 
  ## Job Templates:
  - name: Create Cloud Instances Workflow
    tower_workflow_job_template:
      name: Cloud Instances Workflow
      new_name: Cloud Instances Workflow
      description: Deploy JuiceShop Cloud Instances
      organization: "{{ tower_organization }}"
      inventory: AWS Inventory
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-workflow-cloud-instances

  - name: Create Job Templates
    tower_job_template:
      name: "{{ item.name }}"
      job_type: "{{ item.job_type| default ('run')  }}"
      playbook: "{{ item.playbook }}"
      project: "{{ item.project | default ('JuiceShop Project') }}"
      credentials:  "{{ item.credentials | default ('AWS Credentials') }}"
      description: "{{ item.description }}"
      inventory: "{{ item.inventory | default ('AWS Inventory') }}"
      concurrent_jobs_enabled: "{{ item.concurrent_jobs_enabled | default('false') }}"
      become_enabled: "{{ item.become_enabled | default('false') }}"
      ask_limit_on_launch: "{{ item.ask_limit_on_launch | default('false') }}"
      ask_variables_on_launch: "{{ item.ask_variables_on_launch | default('false') }}"
      extra_vars: "{{ item.extra_vars | default({}) }}"
      limit: "{{ item.limit | default('') }}"
      use_fact_cache: "{{ item.use_fact_cache | default('false') }}"
      verbosity: "{{ item.verbosity | default('0') }}"
      tower_config_file: "{{ tower_config_file }}"
    loop: "{{ job_template_vars }}"
    tags:
      - tower-job-templates
  
  - name: Add Job Templates to Cloud Instance Workflow
    tower_workflow_job_template_node:
      identifier: "{{ item.identifier }}"
      workflow: "{{ item.workflow | default('Cloud Instances Workflow')}}"
      organization: "{{ tower_organization }}"
      unified_job_template: "{{ item.name }}"
      success_nodes: "{{ item.success_nodes | default('[]') }}"
      tower_config_file: "{{ tower_config_file }}"
    loop: "{{ workflow_cloud_inst_vars }}"
    tags:
      - tower-workflow-templates

  ## Users
  - name: Create Jenkins user
    tower_user:
      username: "{{ jenkins_user }}"
      password: "{{ jenkins_pwd }}"
      email: jenkins@vagrant.local
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-user-jenkins

  - name: Give Jenkins user access to JuiceShop Org
    tower_role:
      user: "{{ jenkins_user }}"
      role: member
      organization: "{{ tower_organization }}"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-user-jenkins

  - name: Give Jenkins user access to SSH key
    tower_role:
      user: "{{ jenkins_user }}"
      role: read
      credential: "VM SSH Credential"
      organization: "{{ tower_organization }}"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags: 
      - tower-user-jenkins

  - name: Give Jenkins user access to Workflows
    tower_role:
      user: "{{ jenkins_user }}"
      role: execute
      workflow: "Cloud Instances Workflow"
      state: present
      tower_config_file: "{{ tower_config_file }}"
    tags:
      - tower-user-jenkins
  
  - name: Give users access to job templates
    tower_role:
      user: "{{ item.user }}"
      role: "{{ item.role }}"
      job_template: "{{ item.job_template }}"
      state: "{{ item.state }}"
      tower_config_file: "{{ tower_config_file }}"
    loop: "{{ tower_user_vars }}"
    tags:
      - tower-users