Skip to content

Deployment

Sources: Run Deploy Rhapsody on right revision (TRIB 19921174944)

Overview

RaaS deployments are managed via Ansible Tower (for application-level changes) and GitHub Actions (for infrastructure changes via Terraform).

Never restart instances or Rhapsody without approval

Under no circumstances should any AWS instance be started, stopped, or restarted. Similarly, rhapsody.service should never be restarted or stopped without explicit instructions from a senior engineer.

Deploying a Change via Ansible Tower

Step 1: Verify the Branch in Ansible Tower

Before running any deployment, confirm the active branch of the deploy-raas project in Ansible Tower:

  1. Log in to Ansible Tower (tower.us.raas.rhapsody.global or tower.uk.raas.rhapsody.global)
  2. Navigate to Projects → deploy-raas
  3. Check the SCM Branch field

Active branches:

Branch Purpose
master Standard production deployments
work/remove_internal_vpn VPN migration work (check with team before using)

Wrong branch = wrong changes deployed

If the wrong branch is selected, your deployment will include unintended changes. Always confirm the branch before running.

Step 2: Sync the Project

Click Sync on the deploy-raas project to pull the latest commits from GitHub.

Step 3: Check the REVISION Attribute

Before running the Deploy Rhapsody job:

  1. Open the job template: Templates → Deploy Rhapsody
  2. Check the REVISION extra variable — it should match the git commit SHA of your change
  3. If REVISION is wrong, update it before proceeding

Step 4: Create a CloudFormation Changeset (Dry Run)

Run the Deploy Rhapsody job template with deploy_stack: false:

deploy_stack: false

This creates a CloudFormation changeset without executing it.

Step 5: Review the Changeset

  1. Go to AWS console → CloudFormation → Stacks → <customer_code>-rhapsody
  2. Select the stack → Change Sets
  3. Open the pending changeset and review the proposed changes

Changeset review checklist

  • For a whitelist change — the changeset should only update Security Group rules, NOT VPN resources
  • For a software update — it should update Launch Template AMI/UserData and EC2 instance associations
  • Any unexpected resources in the diff (e.g., VPN tunnels) → CANCEL and investigate

Step 6: Execute the Changeset

Only after reviewing and confirming the changeset is correct:

  1. In CloudFormation, select the changeset
  2. Click Execute change set
  3. Monitor the stack events for errors

Step 7: Post-Deployment Verification

After the changeset executes:

  • Rhapsody Management Console accessible (https://<instance>:8444)
  • No active alerts in Coralogix
  • Check bootstrap log if instance was replaced: less /var/log/rhapsody-bootstrap/playbookError.log
  • HSCN customers: VPN tunnels still up in AWS console

Deployment Scenarios

Change Type Playbook / Method Notes
Rhapsody software version Deploy Rhapsody (changeset) AMI update; always do blue/green if possible
Whitelist rules Deploy Rhapsody (changeset) Security Group change only
VPN config Update VPN → Deploy Rhapsody (changeset) See VPN Management
Ansible config only Run specific Ansible playbook No CloudFormation involved
Azure infra change Terraform Unified Workflow (GitHub Actions) See Azure onboarding guide