WIN_provisioning.yml

---
# Performing automated Windows Server 2022 Boot from SAN installation on Gen10 Synergy Module(s) using an unattended file and a HPE OneView Server Profile Template
#
# Command that can be used to run this playbook:
#    $ ansible-playbook -i hosts WIN_provisioning.yml --ask-vault-password --ask-become-pass
#    or
#    $ ansible-playbook -i hosts WIN_provisioning.yml --vault-password-file ~/secrets/vault_pass.txt  --become-password-file ~/secrets/become_pass.txt 
#>


- name: Performing an unattended Windows Server 2022 Boot from SAN installation on a Gen10 Synergy Module using a OneView Server Profile Template
  hosts: Windows
  collections:
    - hpe.oneview
  gather_facts: no
  vars_files:
    - vars/WIN_vars_encrypted.yml
    - vars/iLO_vars_encrypted.yml # Define the iLO local account created by the server profile template. This account is required by the community.general.hpilo_boot module to manage the server iLO
    #- vars/encrypted_credentials.yml
  vars:
    # HPE Synergy Composer configuration
    config: "{{ playbook_dir }}/oneview_config.json"
    inventory_fqdn: "{{ inventory_hostname | lower }}.{{ domain }}"
    # ansible_python_interpreter: python3
    ansible_host_key_checking: false
    validate_certs: false
    ansible_forks: 5

  tasks:
    
    - name: Checking if Windows Server ISO file "{{ src_iso_file }}" exists in "{{ src_iso_directory }}" on "{{lookup("pipe","hostname")}}" 
      stat:
        path: "{{ src_iso_directory }}/{{ src_iso_file }}"
      register: ISO_Present
      delegate_to: localhost
            
    - name: Creating the directory "{{ src_iso_directory }}" to host the ISO file on "{{ lookup("pipe","hostname") }}"
      become: yes
      file:
        path: "{{ src_iso_directory }}"
        state: directory
      when: ISO_Present.stat.exists == False
      delegate_to: localhost

    - name: Downloading file "{{ src_iso_file }}" to "{{ lookup("pipe","hostname") }}" in "{{ src_iso_directory }}" if not present
      become: yes
      get_url:
        url: "{{ src_iso_url }}/{{ src_iso_file }}"
        dest: "{{ src_iso_directory }}"
        validate_certs: no
      when: ISO_Present.stat.exists == False
      delegate_to: localhost

    - name: Checking if Windows Server ISO file extraction is necessary in "{{ staging_directory }}/baremetal/{{ inventory_hostname }}" on "{{ lookup("pipe","hostname") }}"
      stat:
        path: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}"
      register: ISO_Extracted
      delegate_to: localhost

    # - debug: var=ISO_Extracted

    - name: Creating /mnt/{{ inventory_hostname }} on "{{lookup("pipe","hostname")}}" if it does not exist
      become: yes
      ansible.builtin.file:
        path: /mnt/{{ inventory_hostname }}
        state: directory
        mode: "0755"
      delegate_to: localhost

    - name: Creating "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/" on "{{lookup("pipe","hostname")}}" if it does not exist
      become: yes
      ansible.builtin.file:
        path: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}"
        state: directory
        mode: "0755"
      delegate_to: localhost

    - name: Mounting Windows Server ISO  "{{ src_iso_directory }}/{{ src_iso_file }}" to "/mnt/{{ inventory_hostname }}/"  and copying ISO files to "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/" on "{{lookup("pipe","hostname")}}"
      become: yes
      shell: |
        mount -o loop -t udf {{ src_iso_directory }}/{{ src_iso_file }} /mnt/{{ inventory_hostname }}/
        cp -r /mnt/{{ inventory_hostname }}/. {{ staging_directory }}/baremetal/{{ inventory_hostname }}/
        umount /mnt/{{ inventory_hostname }}
      # when: ISO_Extracted.stat.exists == False
      delegate_to: localhost

    # Creating $OEM$ resources to host the different scripts that we need to run at startup

    - name: Creating $OEM$ on "{{lookup("pipe","hostname")}}" in {{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources to execute scripts at startup
      become: yes
      file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
        mode: 0775
      loop:
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$"
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$1"
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$1/Temp"
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$$"
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$$/Setup"
        - "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$$/Setup/Scripts"
      delegate_to: localhost

    # - name: Download POSH script from GitHub to configure Windows for remote management with Ansible
    #   become: yes
    #   get_url:
    #     url: https://raw.githubusercontent.com/jullienl/HPE-Synergy-baremetal/master/files/ConfigureRemotingForAnsible.ps1
    #     dest: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$1/Temp/winRM.ps1"
    #     mode: "0775"
    #   delegate_to: localhost

    # Creating a Server Profile in HPE OneView from a boot from SAN Server Profile Template:

    - name: Creating Server Profile "{{ inventory_hostname }}" from Server Profile Template "{{ server_template }}"
      oneview_server_profile:
        config: "{{ config }}"
        data:
          serverProfileTemplateName: "{{ server_template }}"
          name: "{{ inventory_hostname }}"
        # serverHardwareUri: "/rest/server-hardware/39313738-3234-584D-5138-323830343848"
        # server_hardware: Encl1, bay 12
        # If any hardware is provided, it tries to get one available
      delegate_to: localhost
      register: result

    # - debug: var=server_profile
    # - debug: var=serial_number
    # - debug: var=server_hardware
    # - debug: var=compliance_preview
    # - debug: var=created

    - name: Capturing the server hardware name selected for Server Profile creation
      set_fact:
        server_hardware_name: "{{ server_hardware.name }}"

    - name: Capturing MAC of first two management NICs for the configuration of the network settings in configure_network.ps1
      set_fact:
        mac1: "{{ (server_profile.connectionSettings.connections | selectattr('id', 'equalto', 1) | map(attribute='mac') | list)[0] }}"
        mac2: "{{ (server_profile.connectionSettings.connections | selectattr('id', 'equalto', 2) | map(attribute='mac') | list)[0] }}"

    # - debug: var=mac1
    # - debug: var=mac2

    - name: Showing the result of the Server Profile creation task
      debug:
        msg: "Hardware selected: {{ server_hardware_name }} - Result: {{ result.msg }}"

    # - debug: var=boot_lun_size

    # Creation of the SetupComplete.cmd to configure the network settings

    - name: Creating configure_network.ps1 that will be launched by SetupComplete.cmd (creation of a team using the first two NICs and configuration of IP parameters)
      become: yes
      copy:
        force: true
        dest: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$$/Setup/Scripts/configure_network.ps1"
        content: |
          $mac1="{{ mac1 }}"
          $net1=get-netadapter | where MacAddress -eq $mac1.replace(":","-") | select name
          $mac2="{{ mac2 }}"
          $net2=get-netadapter | where MacAddress -eq $mac2.replace(":","-") | select name
          New-NetLbfoTeam -Name mgmt_nw_team -TeamMembers $net1.name,$net2.name -confirm:$false
          netsh interface ip set address mgmt_nw_team static {{os_ip_address}} {{netmask}} {{gateway}}
          netsh interface ip add dns mgmt_nw_team "{{nameserver1}}"
          netsh interface ip add dns mgmt_nw_team "{{nameserver2}}" index=2
          $team_index = Get-NetAdapter -Name mgmt_nw_team | % ifindex
          Set-DnsClient -InterfaceIndex $team_index -ConnectionSpecificSuffix "{{domain}}" -RegisterThisConnectionsAddress $true -UseSuffixWhenRegistering $true
      delegate_to: localhost

    - name: Creating SetupComplete.cmd for the network settings
      become: yes
      # SetupComplete.cmd automatically runs after the Windows Setup process
      # Windows Setup logs the action in the C:\Windows\Panther\UnattendGC\Setupact.log file
      copy:
        force: true
        dest: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/sources/$OEM$/$$/Setup/Scripts/SetupComplete.cmd"
        content: |
          Powershell.exe -ExecutionPolicy Bypass -File "%SYSTEMROOT%/Setup/Scripts/configure_network.ps1" -WindowStyle Hidden > "%SYSTEMROOT%\Panther\UnattendGC\setupcomplete.log" 2>&1
      delegate_to: localhost

    # Creation of the new Windows Server ISO image with unattended installation

    - name: Updating autounattend.xml file
      become: yes
      template:
        src: files/{{ windows_version }}/{{ unattend }}
        dest: "{{ staging_directory }}/baremetal/{{ inventory_hostname }}"
      delegate_to: localhost

    - name: Creating customized bootable ISO in "{{ staging_directory }}/baremetal/{{ inventory_hostname }}/"
      become: yes
      shell: >
        mkisofs 
        -J
        -R
        -l
        -v
        -b boot/etfsboot.com
        -no-emul-boot
        -boot-load-size 4
        -boot-info-table
        -eltorito-alt-boot
        -e "efi/microsoft/boot/efisys_noprompt.bin"
        -no-emul-boot
        -o {{ staging_directory }}/baremetal/{{ inventory_hostname }}.iso
        -graft-points
        {{ staging_directory }}/baremetal/{{ inventory_hostname }}/
      delegate_to: localhost

    - name: Creating /usr/share/nginx/html/isos/ on "{{lookup("pipe","hostname")}}" if it does not exist
      become: yes
      file:
        path: /usr/share/nginx/html/isos/
        state: directory
        mode: "0755"
      delegate_to: localhost

    - name: Moving created ISO to the nginx default html folder of "{{ lookup("pipe","hostname") }}"
      become: yes
      shell: |
        mv {{ staging_directory }}/baremetal/{{ inventory_hostname }}.iso /usr/share/nginx/html/isos/
      delegate_to: localhost

    - name: Update SELinux security contexts so that Nginx is allowed to serve content from the "/usr/share/nginx/html/isos/" directory.
      become: yes
      shell: |
        chcon -vR system_u:object_r:httpd_sys_content_t:s0 /usr/share/nginx/html/isos/
      delegate_to: localhost


    # Starting the OS unattended installation

    - name: Powering on and booting "{{ server_hardware_name }}" from created ISO using iLO Virtual Media
      community.general.hpilo_boot:
        host: "{{ server_hardware.mpHostInfo.mpIpAddresses[1].address }}"
        login: "{{ iLO_username }}"
        password: "{{ iLO_password }}"
        media: cdrom
        image: 'http://{{ lookup("pipe","hostname") }}/isos/{{ inventory_hostname }}.iso'
      delegate_to: localhost

    - name: Waiting for Windows Server installation to complete - Waiting for "{{ os_ip_address }}" to respond...
      wait_for:
        timeout: 2000
        host: "{{ os_ip_address }}"
        port: 3389
      register: boot_wait_time
      delegate_to: localhost

    - debug:
        msg: "{{ inventory_hostname }} installation took {{ (boot_wait_time.elapsed / 60) | round | int }} minutes"

    # Cleaning up staging files

    - name: Deleting all related files from staging location and nginx web server folder
      become: yes
      shell: |
        rm -rf {{ inventory_hostname }}
        rm -rf temp/{{ inventory_hostname }}
        rm -f /usr/share/nginx/html/isos/{{ inventory_hostname }}.iso
        rm -rf /mnt/{{ inventory_hostname }}
      args:
        chdir: "{{ staging_directory }}/baremetal"
      delegate_to: localhost

    - name: Collecting product_id found in install.xml file of the HPE iSUT package
      become: yes
      shell: |
        unzip -p files/{{ windows_version }}/{{ iSUT_package }} install.xml | grep "product id" | awk '{ print substr ($0, 16, 36 ) }'
      register: iSUT_product_id
      delegate_to: localhost

    - name: Collecting product_id found in install.xml file of the HPE AMS package
      become: yes
      shell: |
        unzip -p files/{{ windows_version }}/{{ AMS_package }} install.xml | grep "product id" | awk '{ print substr ($0, 16, 36 ) }'
      register: AMS_product_id
      delegate_to: localhost

      # - debug: msg='{{ iSUT_product_id.stdout }}'
      # - debug: msg='{{ AMS_product_id.stdout }}'

# Adding a DNS record for the newly provisioned server in the defined DNS server

- name: Creating a DNS record for the bare metal Windows Server
  hosts: Windows
  gather_facts: no
  vars:
    ansible_forks: 5
  vars_files:
    - vars/Windows_DNS_vars_encrypted.yml
  tasks:
    - name: Adding {{ inventory_hostname }} with {{ os_ip_address }} on {{ dns_server }} in {{ domain }} DNS domain
      community.windows.win_dns_record:
        name: "{{ inventory_hostname }}"
        type: "A"
        value: "{{ os_ip_address }}"
        zone: "{{ domain }}"
        state: present
      delegate_to: "{{ dns_server }}"

# Installing iSUT and AMS on the server through WinRM for online installation of HPE drivers for Windows Server

- name: Installing HPE iSUT and HPE AMS on the server for online installation of HPE drivers for Windows Server
  hosts: Windows
  collections:
    - hpe.oneview
  gather_facts: no
  vars_files:
    - vars/WIN_vars_encrypted.yml
    - vars/WinRM_vars_encrypted.yml
  vars:
    # HPE Synergy Composer configuration
    config: "{{ playbook_dir }}/oneview_config.json"
    ansible_forks: 5

  tasks:
    - name: Copying HPE iSUT package file to {{ inventory_hostname }}
      win_copy:
        src: files/{{ windows_version }}/{{ iSUT_package }}
        dest: c:\Temp\sut.exe

    - name: Copying HPE AMS package file to {{ inventory_hostname }}
      win_copy:
        src: files/{{ windows_version }}/{{ AMS_package }}
        dest: c:\Temp\amsd.exe

    - name: Installing Integrated Smart Update Tools
      win_package:
        path: c:\Temp\sut.exe
        product_id: "{{ iSUT_product_id.stdout }}"
        arguments: /s
      register: SUT_install
      # failed_when is required because the installation of the package returns a false error.
      failed_when: "SUT_install.rc != 0 and SUT_install.rc != 1"

    - name: Installing HPE Agentless Management Service
      win_package:
        path: c:\Temp\amsd.exe
        product_id: "{{ AMS_product_id.stdout }}"
        arguments: /s
      register: AMS_install
      # failed_when is required because the installation of the package returns a false error.
      failed_when: "AMS_install.rc != 0 and AMS_install.rc != 1"

    - name: Configuring iSUT mode to allow OS driver updates via HPE OneView Server Profile
      win_shell:
        sut.exe -set mode=autodeploy
        #sut -set mode=AutoDeployReboot
        #sut -set mode=AutoStage
        #sut -set mode=OnDemand
      register: sut_status

    - debug: msg="{{ sut_status.stdout }}"

    # Command required if iLO Security mode is FIPS
    - name: Configuring iSUT credentials to communicate with iLO
      remote_user: root
      command: sut -set ilousername="{{ iLO_username }}" ilopassword="{{ iLO_password }}"
      register: sut_credentials

    # - debug: msg="{{ sut_credentials.stdout }}"

    - name: Capturing facts about the HPE Synergy Service Pack "{{ SSP_version }}"
      oneview_firmware_driver_facts:
        config: "{{ config }}"
        version: "{{ SSP_version }}"
        name: "HPE Synergy Service Pack"
      delegate_to: localhost
      vars:
        ansible_connection: local

    # - debug: var=firmware_drivers

    - name: Capturing HPE Synergy Service Pack "{{ SSP_version }}" firmware baseline uri
      set_fact:
        firmwareBaselineUri: "{{ firmware_drivers.uri }}"

    # - debug: var=firmwareBaselineUri    

    # Changing the OneView Server Profile to enable OS drivers installation using the defined HPE Synergy Service Pack.

    - name: Setting HPE Synergy Service Pack "{{ SSP_version }}" as the firmware baseline of server profile "{{ inventory_hostname }}" and enabling Firmware and OS Drivers using SUT
      oneview_server_profile:
        config: "{{ config }}"
        state: "present"
        data:
          name: "{{ inventory_hostname }}"
          firmware:
            manageFirmware: true
            firmwareBaselineUri: "{{ firmwareBaselineUri }}"
            firmwareInstallType: "FirmwareAndOSDrivers"
      register: result
      delegate_to: localhost
      vars:
        ansible_connection: local

    - debug: msg="{{ result.msg }}"

    # Waiting for HPE drivers to be installed

    # By the time, joining Microsoft Active Directory domain

    - name: Joining domain {{ domain }}
      microsoft.ad.membership:
        dns_domain_name: "{{ domain }}"
        hostname: "{{ inventory_hostname }}"
        domain_admin_user: "{{ win_domain_admin_user }}"
        domain_admin_password: "{{ win_domain_admin_password }}"
        state: domain
      register: domain_state

    # Waiting for HPE drivers to be installed

    - name: Monitoring SUT status for 'reboot the system' message
      oneview_server_hardware_facts:
        config: "{{ config }}"
        name: "{{ server_hardware.name }}"
      retries: 100
      delay: 60
      until: >
        (server_hardwares.serverSettings.firmwareAndDriversInstallState.installState == "Activated") 
        or 
        (server_hardwares.serverSettings.firmwareAndDriversInstallState.installState == "InstalledPendingReboot")
      delegate_to: localhost
      vars:
        ansible_connection: local

    # Host reboots for the HPE drivers/firmware activation are managed by HPE OneView

    # - name: Rebooting host for the HPE drivers/firmware activation and waiting for it to restart
    #   win_reboot:
    #     msg: "Reboot initiated by Ansible"
    #     connect_timeout: 5
    #     reboot_timeout: 1000
    #     pre_reboot_delay: 0
    #     post_reboot_delay: 30
    #   when: server_hardwares.serverSettings.firmwareAndDriversInstallState.installState == "InstalledPendingReboot"

    - name: Displaying install completed message
      debug:
        msg:
          - "{{ inventory_hostname }}.{{domain}} Installation completed !"
          - "OS is configured and running the HPE OS drivers and firmware update." 
          - "Check Server Profile activity of {{ inventory_hostname }} in HPE OneView."