How to create a HashiCorp-enabled Execution Environment

NO HANDS-ON TASKS IN THIS LAB SECTION. EDUCATIONAL ONLY. This is a lab section to discuss how to create an Execution Environment that will enable Terraform Enterprise (HCP Terraform) and HashiCorp Vault Enterprise usage in Ansible Automation Platform.

In this challenge we will discuss how to create an Execution Environment that will enable Terraform Enterprise (HCP Terraform) and HashiCorp Vault Enterprise usage in Ansible Automation Platform. It will include all the dependencies needed.

What is an Execution Environment?

All automation in Red Hat Ansible Automation Platform runs on container images called automation execution environments. Automation execution environments create a common language for communicating automation dependencies, and offer a standard way to build and distribute the automation environment.

In the previous challenge an Execution Environment called Terraform Execution Environment was already created for you. It included the new hashicorp.terraform, and hashicorp.vault collections, the Terraform binary, other cloud collections, and other dependencies.

We feel it’s important to understand how to create an Execution Environment, for this specific scenario.

You can skip this challenge if you are not interested in learning how to create an Execution Environment.

To use HashiCorp Terraform Enterprise (HCP Terraform) and HashiCorp Vault Enterprise in YOUR Ansible Automation Platform environment you must create an Execution Environment that includes the Terraform Enterprise (HCP Terraform) and HashiCorp Vault Enterprise collections, the Terraform binary, other cloud collections, and other dependencies.

The tool needed to create an execution environment is called ansible-builder

Introduction.

In this challenge you will learn:

  • How to create the necessary configuration files needed to create an execution environment

  • How to create the execution environment container image using the ansbile-builder tool

  • How to add the new execution environment to Ansible Automation Platform

Execution Environments

To trigger Terraform Enterprise (HCP Terraform) and HashiCorp Vault Enterprise commands from within Ansible Automation Platform, you will need to create an execution environment container image that contains the Terraform binary and the Red Hat certified collection for HashiCorp Terraform and HashiCorp Vault.

This is easy to do using ansible-builder.

How to create the configuration files for the execution environment

To create an execution environment with ansible-builder, we need an execution environment definition file. The file name will be execution-environment.yml

Below is what the execution-environment.yml file will look like:

---
version: 3

images:
  base_image:
    name: registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9:latest

dependencies:
  galaxy: requirements.yml

options:
  package_manager_path: /usr/bin/microdnf

additional_build_steps:
  prepend_base:
    - RUN $PYCMD -m pip install --upgrade pip setuptools
  append_base:
    - RUN curl "https://releases.hashicorp.com/terraform/1.14.1/terraform_1.14.1_linux_amd64.zip" -o "/terraform.zip"
    - RUN unzip /terraform.zip -d /terraform
    - RUN mv /terraform/terraform /bin

This file defines the rules ansible-builder should use to create the execution environment container, including:

  1. version: the version of ansible-builder to use

  2. images: here you define the base image to use for the container. You are using the ee-minimal-rhel9:latest base image for the build process

  3. dependencies: in this section you can declare dependencies for optionally galaxy (ansible collections), python, and other system dependencies. Notice this section includes a statement galaxy: requirements.yml, this is the file used to define dependent collections found on Ansible Galaxy to be included within the Execution Environment being built

  4. additional_build_steps: here we can list commands to be inserted into the Dockerfile/Containerfile to be executed. In this example, we are also downloading and installing the HashiCorp Terraform binary.

The Terraform binary is only needed if you want to also leverage the cloud.terraform collection modules.

prepend_base is to include commands to be used before the main build steps. append_base is to include commands to be used after the main build steps.

Below is what the requirements.yml file will look like:

collections:
  - name: amazon.aws
  - name: cloud.terraform
  - name: hashicorp.terraform
  - name: hashicorp.vault
  - name: google.cloud
  - name: azure.azcollection

This file defines the Ansible content collections you want to include in your execution environment.

  1. Include the cloud collections amazon.aws, cloud.terraform, google.cloud, and azure.azcollection collections. I include these to allow Terraform Enterprise (and HCP Terraform) to spin up cloud infrastructure on AWS, Azure and GCP.

  2. Most importantly, we are including the hashicorp.terraform and hashicorp.vault collections. These will allow you from Ansible Automation Platform to trigger Terraform Enterprise (and HCP Terraform) and HashiCorp Vault Enterprise operations.

  3. If additional collections are desired, you would include them in the requirements.yml file as well

  4. The cloud.terraform collection is for community Terraform. While it can be made to work with Terraform Enterprise (and HCP Terraform), but that is what the hashicorp.terraform collection is for.

    1. hashicorp.terraform: Automation of Terraform Enterprise (and HCP Terraform) operations using API calls. No Terraform binary is needed.

    2. cloud.terraform: Requires the Terraform binary to be installed in the execution environment or on a dedicated Terraform Host

You will find a copy of the execution-environment.yml and requirements.yml files in the repository you imported in an earlier module.

How to run ansible-builder to build the execution environment container

Run ansible-builder to build the execution environment container.

Below is the command to run ansible-builder to build the execution environment container.

ansible-builder build -v 3 --tag hashicorp-ee

This will build the container image tagged with hashicorp-ee. This will take a few minutes, depending on your machine, and the number of content collections you are including in the execution environment.

To see the newly created image on a RHEL system, you can also use the podman command.

podman images

At this point, you would typically push the container image to a registry such as Quay or Dockerhub or your own Private Automation Hub. If you have a Quay or Dockerhub account already, feel free to create a repository, push the image as you normally would, and use it in the following steps,

Example commands on how to tag and then push the Execution Environment image to Quay.io

podman tag localhost/hashicorp-ee  quay.io/[username]/hashicorp-ee

podman login --username [username] --password [mypassowrd] quay.io

podman push quay.io/[username]/hashicorp-ee

How to add the Terraform Execution Environment to Ansible Automation Platform

To add an execution environment to Ansible Automation Platform, you can follow the steps below.

Expand the Automation Execution menu on the left.

Navigate to Automation Execution → Infrastructure → Execution Environments.

Click on + Create execution environment and enter the following information.

Field Value

Name

myHashiCorp EE (or whatever you would want to name it)

Image

quay.io/acme_corp/terraform_ee (or whatever you would have named it)

Pull

Only pull the image if not present before running

Registry credential

Quay Registry Credential (Only needed if you are using a private registry)

Click on Create execution environment.

This Execution Environment would now be available for use in Ansible Automation Platform.