4. Provision resources¶
4.1. Provision network resources:¶
$ cd build/
$ ./2-provision-network-resources.sh
This creates firewall rules and a NAT router in vpc-host-project-<uuid>. You can view their configuration in: infrastructure/cluster-networking/main.tf
4.2. Build base VM image¶
$ ./3-build-base-image.sh
Occasionally this will fail, if it does simply try again.
Builds a Ubuntu 20.04 image with Consul, Nomad and Vault installed. For directions on switching to Ubuntu 18.04 see: Changing the Ubuntu version
4.3. Provision cluster instances¶
$ ./4-provision-cluster-instances.sh
This runs terraform apply on the resources described in: infrastructure/cluster-nodes/
You will see your new instances here: https://console.cloud.google.com/compute/instances (be sure your GCP account and service project hashi-cluster-xxxx are selected)
4.4. Configure your domain name DNS¶
Set your domain name DNS record to point to the load-balancer’s public IP address, you will find this in build/conf/project-info.json at: load_balancer_public_ip_address. Your DNS config should look something like this:
You may want to wait for your new DNS settings to propagate before continuing. Ping your domain name until the new IP address appears.
4.5. Initialize the cluster¶
$ ./5-initialize-hashi-cluster.sh
This transfers credentials keys to hashi-server-1 and launches a set of Ansible playbooks to bootstrap Consul, Nomad and Vault. It will take 10-15 minutes to complete, this includes waiting for Google Cloud to provision your SSL certificates.
If it succeeds you will see the following:
waiting for SSL cert to provision and for successful ping from Traefik. This may take up to 15 minutes.
attempting request to: https://your-domain.com/ping
attempting request to: https://your-domain.com/ping
attempting request to: https://your-domain.com/ping
Ping success! Your cluster is up and running.
To be 100% certain that no errors have occurred, scroll up and check every ‘PLAY RECAP’ section to ensure that every row has failed=0:
PLAY RECAP *********************************************************************
10.132.15.192 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
10.132.15.198 : ok=7 changed=4 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
10.132.15.208 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
10.132.15.215 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
10.132.15.216 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
4.5.1. Handling failure¶
Sometimes, about 10% of the time, this script will fail unexpectedly. To try again run:
$ cd infrastructure/cluster-nodes
$ ./tf_destroy.sh
$ ./tf_apply.sh
$ cd ../../build/
$ ./5-initialize-hashi-cluster.sh
Tip
If it keeps failing with the same error, submit an issue on github with your error, or schedule a call with me for assistance.
4.5.2. Get your tokens¶
Scroll up and you will see that some tokens were printed to the terminal:
consul bootstrap token: 68fc76db-68e1-8ed5-cda3-c4e999c1
consul gossip encryption key: HlP1zzUq1fPHPmOijREvHNkL97RyhTTE
consul UI token (read/write): 5d9c505f-06ea-b69f-11e5-ebad2037
consul UI token (read-only): c14f1ae7-4151-4b70-8f28-5ac23151
vault root token: s.XOFjR30ZDSjQ9PYFjjut2mbq
vault write-only token: s.1N3qtpI7jnEbTWnRUDCyHtXZ
Copy these tokens and store them somewhere safe. The Consul bootstrap and Vault root tokens are all-powerful and can be used to create additional highly privileged tokens.
The Consul UI token (read/write) will be used to log in to the Consul web dashboard.
The Vault write-only token will be used to store secrets.
4.5.3. Clean up initialization data¶
The Ansible playbooks leave a trail of sensitive data behind on every instance in /tmp/ansible-data/ and the syslogs may contain sensitive tokens. Run this script to remove this data.
$ ./6-remove-initialization-data.sh