---
|
- name: Step 00xxxxx post software
|
hosts: bastions
|
become: no
|
gather_facts: False
|
environment:
|
KUBECONFIG: /home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig
|
tasks:
|
- debug:
|
msg: "Post-Software Steps starting"
|
|
- name: Configure Bastion for CF integration
|
hosts: bastions
|
become: yes
|
gather_facts: False
|
tags:
|
- env-specific
|
- cf_integration
|
- opentlc_integration
|
tasks:
|
- when: install_opentlc_integration|bool
|
block:
|
- name: Include mgr_users vars
|
include_vars:
|
file: mgr_users.yml
|
|
- name: Configure Bastion
|
include_role:
|
name: opentlc-integration
|
vars:
|
no_log: yes
|
|
- name: Configure opentlc-mgr, root and {{ remote_user }} when OpenShift installed
|
when:
|
- install_ocp4 | d(False) | bool
|
block:
|
- name: Create .kube for opentlc-mgr user
|
file:
|
path: /home/opentlc-mgr/.kube
|
state: directory
|
owner: opentlc-mgr
|
group: opentlc-mgr
|
|
- name: Copy /home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig to ~opentlc-mgr
|
copy:
|
src: /home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig
|
dest: /home/opentlc-mgr/.kube/config
|
remote_src: yes
|
owner: opentlc-mgr
|
group: opentlc-mgr
|
mode: 0600
|
|
- name: Set up Student User
|
when: install_student_user | bool
|
block:
|
- name: Create .kube for {{ student_name }} user
|
file:
|
path: /home/{{ student_name }}/.kube
|
state: directory
|
owner: "{{ student_name }}"
|
|
- name: Copy /home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig to ~{{ student_name }}
|
copy:
|
src: /home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig
|
dest: /home/{{ student_name }}/.kube/config
|
remote_src: yes
|
owner: "{{ student_name }}"
|
mode: 0600
|
|
- name: Setup mount bind for cluster directory
|
become: yes
|
mount:
|
path: /home/{{ student_name }}/{{ cluster_name }}
|
src: /home/{{ remote_user }}/{{ cluster_name }}
|
fstype: none
|
opts: defaults,bind,ro
|
state: mounted
|
|
- name: Create OpenShift Bash completion file
|
shell: oc completion bash >/etc/bash_completion.d/openshift
|
|
- name: Configure bashrc to include KUBECONFIG
|
shell: "echo export KUBECONFIG=/home/{{ remote_user }}/{{ cluster_name }}/auth/kubeconfig >> /home/{{ remote_user }}/.bashrc"
|
|
- name: Set up Authentication
|
hosts: bastions
|
become: False
|
gather_facts: False
|
run_once: true
|
tags:
|
- env-specific
|
- setup-authentication
|
tasks:
|
- when:
|
- install_ocp4 | d(False) | bool
|
- install_idm is defined
|
environment:
|
KUBECONFIG: "{{ cluster_name }}/auth/kubeconfig"
|
block:
|
- name: Set up htpasswd
|
when:
|
- install_idm == "htpasswd"
|
block:
|
- name: Generate htpasswd hash for user_password
|
shell: >-
|
htpasswd -nb "userN" "{{ user_password }}"|cut -d: -f2
|
register: htpasswd_line
|
when:
|
- user_password is defined
|
- user_password_hash is not defined
|
|
- name: Set fact user_password_hash
|
set_fact:
|
user_password_hash: "{{ htpasswd_line.stdout }}"
|
when:
|
- user_password is defined
|
- user_password_hash is not defined
|
- htpasswd_line is succeeded
|
|
- name: Generate htpasswd hash for admin user
|
shell: >-
|
htpasswd -nb "admin" "{{ admin_password }}"|cut -d: -f2
|
register: htpasswd_line
|
when:
|
- admin_password_hash is not defined
|
- admin_password is defined
|
|
- name: Set fact admin_password_hash
|
set_fact:
|
admin_password_hash: "{{ htpasswd_line.stdout }}"
|
when:
|
- admin_password is defined
|
- admin_password_hash is not defined
|
- htpasswd_line is succeeded
|
- name: Set fact user_count
|
set_fact:
|
user_count: 200
|
when:
|
- user_count is not defined
|
|
- name: Generate htpasswd file
|
template:
|
src: "./files/htpasswd.j2"
|
dest: "/home/{{ ansible_user }}/users.htpasswd"
|
owner: "{{ ansible_user }}"
|
mode: 0664
|
- name: Upload OAuth Configuration File
|
copy:
|
src: "./files/oauth-htpasswd.yaml"
|
dest: "/home/{{ ansible_user }}/oauth-htpasswd.yaml"
|
owner: "{{ ansible_user }}"
|
mode: 0664
|
- name: Create htpasswd Secret
|
command: oc create secret generic htpasswd-secret -n openshift-config --from-file=htpasswd=$HOME/users.htpasswd
|
ignore_errors: true
|
- name: Update OAuth Configuration
|
shell: "oc apply -f /home/{{ ansible_user }}/oauth-htpasswd.yaml"
|
|
- name: Set up OpenTLC LDAP
|
when:
|
- install_idm == "ldap"
|
block:
|
- name: Check for LDAP Bind Password
|
fail:
|
msg: LDAP Authentication is configured but LDAP BindPassword (bindPassword) is not defined.
|
when: bindPassword is not defined
|
- name: Get IPA CA Cert
|
get_url:
|
url: "{{ idm_ca_url }}"
|
dest: "/home/{{ ansible_user }}/ipa-ca.crt"
|
mode: 0660
|
- name: Create IPA CA Cert ConfigMap
|
shell: "oc create configmap opentlc-ldap-ca-cert --from-file=ca.crt=/home/{{ ansible_user }}/ipa-ca.crt -n openshift-config"
|
ignore_errors: true
|
- name: Create LDAP Bind Password Secret
|
shell: "oc create secret generic opentlc-ldap-secret --from-literal=bindPassword=\"{{ bindPassword }}\" -n openshift-config"
|
ignore_errors: true
|
- name: Upload OAuth Configuration File
|
copy:
|
src: "./files/oauth-opentlc-ldap.yaml"
|
dest: "/home/{{ ansible_user }}/oauth-opentlc-ldap.yaml"
|
owner: "{{ ansible_user }}"
|
mode: 0664
|
- name: Update OAuth Configuration
|
shell: "oc apply -f /home/{{ ansible_user }}/oauth-opentlc-ldap.yaml"
|
|
- name: Set up Admin User
|
when: admin_user is defined
|
shell: "oc adm policy add-cluster-role-to-user cluster-admin {{ admin_user }}"
|
# try for 5 minutes
|
retries: 30
|
delay: 10
|
register: r_setup_admin_user
|
until: r_setup_admin_user is succeeded
|
|
- name: Remove kubeadmin User
|
when:
|
- admin_user is defined
|
- install_idm != "none"
|
- auth_remove_kubeadmin
|
command: oc delete secret kubeadmin -n kube-system
|
ignore_errors: true
|
|
- name: PostSoftware flight-check
|
hosts: bastions
|
run_once: yes
|
gather_facts: false
|
become: false
|
tags:
|
- post_flight_check
|
tasks:
|
- when:
|
- install_ocp4 | d(False) | bool
|
environment:
|
KUBECONFIG: "{{ cluster_name }}/auth/kubeconfig"
|
ignore_errors: yes
|
block:
|
- name: Get API for command line
|
command: oc whoami --show-server
|
register: showserver
|
|
- when: webconsole is not defined
|
block:
|
- name: Get console route
|
command: oc get route -n openshift-console console -o json
|
register: routeconsole
|
retries: 10
|
delay: 30
|
until: routeconsole is succeeded
|
ignore_errors: yes
|
|
- name: Set webconsole address
|
set_fact:
|
webconsole: "http://{{ routeconsole.stdout | from_json | json_query('spec.host') }}"
|
when: routeconsole is succeeded
|
|
- name: Check DNS webconsole
|
command: nslookup "{{ webconsole | urlsplit('hostname') }}"
|
register: checkdnswebconsole
|
changed_when: false
|
retries: 15
|
until: checkdnswebconsole is succeeded
|
delay: 30
|
|
- name: Check DNS API
|
command: nslookup "{{ showserver.stdout | trim | urlsplit('hostname') }}"
|
register: checkdnsapi
|
changed_when: false
|
|
- name: Webconsole
|
uri:
|
url: "{{ webconsole }}"
|
validate_certs: no
|
register: testwebconsole
|
retries: 5
|
until: testwebconsole is succeeded
|
delay: 60
|
|
- name: Cluster-info
|
command: oc cluster-info
|
register: clusterinfor
|
changed_when: false
|
|
- name: Create project
|
command: oc new-project postflightcheck
|
register: newproject
|
|
- name: New-app
|
command: oc new-app cakephp-mysql-persistent -n postflightcheck
|
register: newapp
|
|
- name: Wait for mysql
|
command: timeout 300 oc rollout status dc/mysql -w -n postflightcheck
|
register: mysqlw
|
changed_when: false
|
|
- name: Wait for php
|
command: timeout 300 oc rollout status dc/cakephp-mysql-persistent -w -n postflightcheck
|
register: phpw
|
changed_when: false
|
retries: 2
|
delay: 60
|
until: phpw is succeeded
|
|
- name: Get route
|
command: >-
|
oc get route
|
-l template=cakephp-mysql-persistent
|
--no-headers
|
-o json
|
-n postflightcheck
|
register: getroute
|
changed_when: false
|
retries: 10
|
delay: 5
|
until: getroute is succeeded
|
|
- name: Test that route is reachable
|
uri:
|
url: "http://{{ getroute.stdout|from_json|json_query('items[0].spec.host') }}"
|
register: testroute
|
retries: 15
|
delay: 5
|
until: testroute is succeeded
|
|
- name: Delete project
|
command: oc delete project postflightcheck
|
|
- name: Switch back to default project
|
command: oc project default
|
|
- agnosticd_user_info:
|
msg: "{{ item }}"
|
loop:
|
- ""
|
- "Post Flight Check"
|
- "DNS Web Console ............... {{ 'OK' if checkdnswebconsole.rc == 0 else 'FAIL' }}"
|
- "DNS API ....................... {{ 'OK' if checkdnsapi.rc == 0 else 'FAIL' }}"
|
- "Web console ................... {{ 'OK' if testwebconsole is succeeded else 'FAIL' }}"
|
- "API ........................... {{ 'OK' if clusterinfor.rc == 0 else 'FAIL' }}"
|
- "Create Project with PV ........ {{ 'OK' if newproject.rc == 0 else 'FAIL' }}"
|
- "App deployed .................. {{ 'OK' if phpw.rc == 0 and mysqlw.rc == 0 else 'FAIL' }}"
|
- "Route ......................... {{ 'OK' if testroute is succeeded else 'FAIL' }}"
|
|
- when:
|
- smoke_tests | bool
|
- >-
|
checkdnswebconsole.rc != 0
|
or checkdnsapi.rc != 0
|
or testwebconsole is failed
|
or clusterinfor.rc != 0
|
or newproject.rc != 0
|
or phpw.rc != 0
|
or mysqlw.rc != 0
|
or testroute is failed
|
fail:
|
msg: "FAIL Smoke tests"
|
ignore_errors: no
|
|
- name: Deploy Default, Infra and Student Workloads
|
import_playbook: ocp_workloads.yml
|
|
- name: Enable Cluster Shutdown and Resume
|
hosts: bastions
|
run_once: yes
|
gather_facts: false
|
become: false
|
tasks:
|
- when:
|
- install_ocp4 | d(False) | bool
|
- ocp4_enable_cluster_shutdown | d(True) | bool
|
environment:
|
KUBECONFIG: "{{ cluster_name }}/auth/kubeconfig"
|
ignore_errors: yes
|
block:
|
- name: Create Daemon Set to renew Bootstrap Credentials
|
k8s:
|
state: present
|
merge_type:
|
- strategic-merge
|
- merge
|
definition: "{{ lookup('file', './files/kubelet-bootstrap-cred-manager-ds.yaml' ) | from_yaml }}"
|
- name: Delete initial Bootstrap Secrets to force regeneration
|
k8s:
|
state: absent
|
api_version: v1
|
kind: Secret
|
name: "{{ item }}"
|
namespace: openshift-kube-controller-manager-operator
|
loop:
|
- "csr-signer-signer"
|
- "csr-signer"
|
# The next tasks are to fix the bug fixed in https://github.com/openshift/cluster-kube-controller-manager-operator/pull/305
|
# Also the operator dealing with prometheus adapters doesn't watch the certificates.
|
# Need to force it to reconcile
|
- name: Wait 15 seconds before next command
|
pause:
|
seconds: 15
|
- name: Get Config Map Definition
|
shell: oc get configmap extension-apiserver-authentication -n kube-system -o yaml >/tmp/extension-apiserver-authentication.yaml
|
- name: Add an empty line to config map file
|
lineinfile:
|
path: /tmp/extension-apiserver-authentication.yaml
|
firstmatch: true
|
insertafter: '-----END CERTIFICATE-----'
|
line: ''
|
- name: Update Config Map with new file
|
k8s:
|
state: present
|
src: /tmp/extension-apiserver-authentication.yaml
|
- name: Tell CloudForms we are done
|
hosts: bastions
|
run_once: yes
|
gather_facts: false
|
become: false
|
tasks:
|
- debug:
|
msg: "Post-Software checks completed successfully"
|
