<a id="ansible-install"></a>

# Install Confluent Platform with Ansible Playbooks

This topic describes the installation steps for Confluent Platform.

<a id="ansible-install-collection"></a>

## Install all Confluent Platform components

1. Configure required settings in the `hosts.yml` file as described in
   [Configure Ansible Playbooks for Confluent Platform](ansible-configure.md#ansible-configure).
2. (Optional) Validate hosts before installing Confluent Platform:
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.validate_hosts
   ```

   To validate hosts for an individual component, use the `--tag` flag as
   below:
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.validate_hosts --tags=<component-name>
   ```

   `<component-name>` can be `kafka_broker`, `kafka_controller`,
   `schema_registry`, `kafka_rest`, `kafka_connect`, `ksql`,
   or `control_center_next_gen`.
3. Install or update [Control Center](#ansible-install-c3-next-gen).
4. Install or update all Confluent Platform:
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.all
   ```

<a id="ansible-install-component"></a>

## Install individual Confluent Platform components

You can use the Ansible tags to install individual components. You must follow
the correct order given below to satisfy the dependencies among the components.
For example, Kafka brokers will not install until the certificate authority is
generated and the KRaft controller is installed.

Similarly, when you update a component section in the `hosts.yml` file, you
can optionally update the component and the preceding components in the order.

1. Generate the certificate authority (CA) if TLS encryption is enabled and
   using self-signed certificates. Additionally, a key pair for the MDS token, a
   private key and a public certificate, will be generated.
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.all --tags=certificate_authority
   ```
2. Install [Control Center](#ansible-install-c3-next-gen).
3. Install KRaft controller.
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.all --tags=kafka_controller
   ```
4. Install Kafka.
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.all --tags=kafka_broker
   ```
5. Install Schema Registry, REST Proxy, Connect, and ksqlDB in any order.
   ```bash
   ansible-playbook -i hosts.yml confluent.platform.all --tags=schema_registry
   ansible-playbook -i hosts.yml confluent.platform.all --tags=kafka_rest
   ansible-playbook -i hosts.yml confluent.platform.all --tags=kafka_connect
   ansible-playbook -i hosts.yml confluent.platform.all --tags=ksql
   ```

<a id="ansible-install-c3-next-gen"></a>

## Install Confluent Control Center

Confluent Control Center is available as a separate package and follows independent versions.

Control Center requires the bcrypt function. Install bcrypt with the following command
on the control node:

```bash
pip install bcrypt
```

After you [prepare the host](ansible-prepare.md#ansible-prepare) and [configure](ansible-configure.md#ansible-configure-c3-next-gen), run the following command to install Control Center:

```bash
ansible-playbook -i hosts.yml confluent.platform.all --tags=control_center_next_gen
```

The Control Center package includes Prometheus and Alert Manager.

Now when you install Kafka and KRaft as described above in
[Install all Confluent Platform components](#ansible-install-collection) or [Install individual Confluent Platform components](#ansible-install-component), Kafka and
KRaft start sending metrics to Control Center, and you will see the metrics in Control Center.

<a id="ansible-install-without-root-access"></a>

## Install Confluent Platform without root access

Ansible Playbooks for Confluent Platform is a collection of tasks, some of which do not require root access.
You can run those tasks as a non-privileged user. However, there are certain
steps where you need root access.

#### NOTE
The non-root installation flow described in this section has known issues
that can prevent a fully non-root deployment. For assistance with deploying
without root access, contact [Confluent support](https://support.confluent.io/).

If you do not have root access, you can use Ansible tags to filter out and skip
running the tasks that need root access.

The skipped tasks that need root access are still required to be executed,
for example, using a customized script or another Ansible tower that has root
access.

The following tags are used to separate out tasks that require root and non-root
access:

* `systemd`: Tag for systemd-related tasks
* `sysctl`: Tag for sysctl-related tasks on the Kafka brokers
* `privileged`: Tag for tasks that require elevated permissions
* `filesystem`: Tag for filesystem-related tasks across components

  Use this tag to skip configuration folder management, such as creating,
  updating, and changing permissions on files and folders, usually along with
  the other tags, such as `privileged` and `systemd`.
* `configuration`: Tag for configuration-related tasks, such as creating,
  editing, changing permissions for component config files

If you do not have root access, skip the root access tasks with the
`--skip-tags` flag and the above tags, for example, `--skip-tags
privileged,sysctl,systemd,filesystem,configuration`.

For details on Ansible tags, see [Confluent Ansible Playbook tags](https://github.com/confluentinc/cp-ansible/blob/master/docs/TAGS.md).

For a sample inventory, see [non-root sample inventory](https://github.com/confluentinc/cp-ansible/blob/master/docs/sample_inventories/non_root_deployment.yml).

## Next step

* [Update a Running Confluent Platform Configuration Using Ansible Playbooks](ansible-reconfigure.md#ansible-reconfigure).
* [Troubleshoot Ansible Playbooks for Confluent Platform](ansible-troubleshooting.md#ansible-troubleshooting).
* [Upgrade Confluent Platform with Ansible Playbooks](ansible-upgrade.md#ansible-upgrade).