Run book for DSS installation

Hi @gnaldi62
& @Ignacio_Toledo
,

I would like to share the https://galaxy.ansible.com/datarsense/dataikudss ansible role which has been created to fully automate the DSS installation with LDAP configuration, and standalone SPARK support.

The role pre-install tasks take care of preparing the server environment (dss service user creation, installing system packages, tuning sysctl, ...) before downloading and installing DSS & DSS standalone spark package.

The role has been designed to be compatible with restricted network environment in which securit devices might deny direct access to dataiku CDN. This feature might be required for your bank customers.

The https://github.com/dataiku/dataiku-ansible-modules module is used by the role to configure LDAP settings in an enterprise environment (succesfully tested with Active Directory). The role could probably be extended following the same logic to configure SSO settings.

Feel free to provide any feedback on this thread or to open an issue in the project repository (https://github.com/datarsense/ansible-role-dataikudss/issues)

Cheers,

Matthieu

I agree that the toughest par was to find the required OS package for each OS version. Example for a Debian 10 environment:

- name: Disable SELinux
become: true
ansible.posix.selinux:
state: disabled
register: result
failed_when: result.msg | default('ok', True) is not search('(^ok$|libselinux-python|(SELinux state changed))')
tags: [setup]

- name: Increase system limits as required by DSS
become: true
pam_limits:
domain: "{{ dss_service_user }}"
limit_item: "{{ item }}"
limit_type: "-"
value: 65536
loop:
- nofile
- nproc
tags: [setup]

- name: Create service user
become: true
ansible.builtin.user:
name: "{{ dss_service_user }}"
home: "{{ dss_service_user_home_basedir }}/{{ dss_service_user }}"
shell: "{{ dss_service_user_shell }}"
state: present
tags: [setup, dss-setup]

- name: Allow admin group executing playbook to run any commands as DSS service user
become: true
community.general.sudoers:
name: enable-sudoer-admin-runas-dss-account
state: present
user: "{{ ansible_user_id }}"
runas: "{{ dss_service_user }}"
commands: ALL

- name: Create dss install directory
become: true
ansible.builtin.file:
path: "{{ dss_install_dir_location }}"
state: directory
owner: "{{ dss_service_user }}"
mode: "u=rwx,g=rx,o=rx"
tags: [setup, dss-setup]

- name: Create dss data directory
become: true
ansible.builtin.file:
path: "{{ dss_service_user_home_basedir }}/{{ dss_service_user }}/{{ datadir }}"
state: directory
owner: "{{ dss_service_user }}"
mode: "u=rwx,g=,o="
tags: [setup, dss-setup]

- name: Installing sudo package
ansible.builtin.apt:
name: "{{ packages }}"
state: present
vars:
packages:
- sudo

- name: Installing dependencies
become: true
ansible.builtin.apt:
name: "{{ packages }}"
state: present
update_cache: yes
vars:
packages:
- acl
- curl
- git
- libexpat1
- libncurses5
- nginx
- unzip
- zip
- default-jre-headless
- python2.7
- libpython2.7
- libfreetype6
- libgomp1

- name: Installing Debian 10 specific packages
become: true
ansible.builtin.apt:
name: "{{ packages }}"
state: present
vars:
packages:
- python3.7
- python3-distutils
- python3-pip
- python3-setuptools
- python2-minimal
- python-six
when: ansible_facts['os_family'] == 'Debian' and ansible_facts ['distribution_major_version'] == '10'

The ansible role setup the required dependencies for DSS install, and then installs and configure DSS server.

It can be used in a playbook in which a second role is used for configuring nginx as an SSL reverse-proxy and gathering the SSL certificate from a provider of your choice : some people might choose to use another web gateway to secure their DSS deployment (Citrix ADC, F5, ...)

As these two parts of the deployment are not DSS specific tasks, I choosed to keep them outside of the dss role to make it suit different deployment environments.