cloudlens-ansible-aws/customer_input.yaml.example at main · Keysight-Tech/cloudlens-ansible-aws · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# =====================================================================
# CloudLens Ansible for AWS - Customer Input File
# =====================================================================
# Copy to customer_input.yaml and fill in your values.
# DO NOT commit customer_input.yaml to git.
#
# Quick start:
#   cp customer_input.yaml.example customer_input.yaml
#   # edit it
#   bash quickstart.sh
# =====================================================================

aws:
  profile: "default"

  # ---------------------------------------------------------------
  # Host discovery. These three settings decide which machines the
  # sensor is installed on. They are rendered into the dynamic
  # inventory at run time by scripts/render_inventory.py, so what you
  # write here is what discovery actually searches for.
  # ---------------------------------------------------------------

  # Regions to scan. Remove or empty the list to scan every enabled region.
  regions:
    - us-east-1

  # Tags a running instance must carry to be discovered. EVERY entry must
  # match (they are ANDed), so add your own keys freely:
  #   tag_filters:
  #     Environment: "prod"
  #     Team: "payments"
  tag_filters:
    cloudlens: "yes"
    env: "prod"

  # Exactly these instances, ignoring tags entirely. When set, this wins
  # over tag_filters. Leave it out for normal tag-based discovery.
  # instance_ids:
  #   - i-0123456789abcdef0
  #   - i-0fedcba9876543210

  # The VPC(s) your workloads live in. Both tapping paths follow this list:
  # sensor discovery is confined to it, and the agentless mirror builds one
  # KVO fabric per VPC in it. Leave it out to tap the VPC the deploy built
  # (deploy-stack.sh writes vpc_id here for that). Set it when CloudLens
  # sits in its own VPC and the workloads sit in yours; each VPC beyond the
  # deploy's own also needs collector placement, three distinct subnets in
  # that VPC, given with --source-vpc vpc:az:mgmt:ingress:egress or the
  # --collector-* flags.
  # source_vpc_ids:
  #   - vpc-0abc1234def567890

  # Fine-tuning for both tapping paths.
  # tapping:
  #   # Never touch these instances: no sensor is installed on them and no
  #   # mirror session is created for them, whatever the filters match.
  #   exclude_instance_ids:
  #     - i-0aaaabbbbccccdddd

  # Bring your own hosts: point at an Ansible inventory you already have
  # and AWS discovery is skipped completely. Use this for static hosts,
  # instances in another account, or machines that are not EC2 at all.
  # Connection vars (ansible_user, ansible_ssh_private_key_file,
  # ansible_connection) must live in that file or in a group_vars
  # directory beside it: inventory/group_vars does not apply to it.
  # inventory_file: "/path/to/hosts.ini"

  windows_connection: "ssm"   # ssm | winrm
  linux_connection:   "ssh"   # ssh | ssm
  ssh_key_path:    "~/.aws/your-key.pem"
  ssh_user_ubuntu: "ubuntu"
  ssh_user_rhel:   "ec2-user"

cloudlens:
  manager_ip_or_fqdn: "clms.customer.example.com"
  project_key:        "REPLACE_WITH_PROJECT_KEY"
  custom_tags:        "Env=AWS Region=us-east-1 Customer=Acme"
  # insecure: sensors skip TLS verification (lab default).
  # secure: sensors verify the manager certificate (--ssl_verify yes) and the
  # docker pull uses the trusted registry path. The manager must have its
  # matching TLS certificate imported first (admin page: Import TLS
  # Certificate, TLS 1.2). Set by deploy-stack.sh --secure-sensors.
  registry_type:      "insecure"
  # ssl_verify follows registry_type unless set explicitly, so the two can
  # differ while testing. local_ca_path is the CA file distributed to sensors
  # (deploy-stack.sh --ca-cert); ca_cert_dir is where it lands on the host.
  # ssl_verify:       "yes"
  # local_ca_path:    "/path/to/ca.pem"
  linux_runtime:      "auto"   # auto | docker | podman

vpc_ids:    []
subnet_ids: []