summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorScott Dodson <sdodson@redhat.com>2016-11-15 17:19:14 -0500
committerScott Dodson <sdodson@redhat.com>2016-11-15 17:19:14 -0500
commit5f55d7c7e2ce19e2d01bc0b86d6d1194afe03c03 (patch)
tree4ca2a8bb335f8e30241dd7e68cf78e33a797fc66
parent731b265e56920b776b38c66a23f7c83f5a6a0187 (diff)
downloadopenshift-5f55d7c7e2ce19e2d01bc0b86d6d1194afe03c03.tar.gz
openshift-5f55d7c7e2ce19e2d01bc0b86d6d1194afe03c03.tar.bz2
openshift-5f55d7c7e2ce19e2d01bc0b86d6d1194afe03c03.tar.xz
openshift-5f55d7c7e2ce19e2d01bc0b86d6d1194afe03c03.zip
Fix a few places where we're not specifying the admin kubeconfig
-rw-r--r--roles/openshift_hosted_logging/tasks/deploy_logging.yaml18
1 files changed, 12 insertions, 6 deletions
diff --git a/roles/openshift_hosted_logging/tasks/deploy_logging.yaml b/roles/openshift_hosted_logging/tasks/deploy_logging.yaml
index 4feb5abcf..5e445cb37 100644
--- a/roles/openshift_hosted_logging/tasks/deploy_logging.yaml
+++ b/roles/openshift_hosted_logging/tasks/deploy_logging.yaml
@@ -40,7 +40,7 @@
- name: "Create templates for logging accounts and the deployer"
command: >
- {{ openshift.common.client_binary }} create
+ {{ openshift.common.client_binary }} create --config={{ mktemp.stdout }}/admin.kubeconfig
-f {{ hosted_base }}/logging-deployer.yaml
--config={{ mktemp.stdout }}/admin.kubeconfig
-n logging
@@ -49,31 +49,37 @@
changed_when: "'created' in logging_import_template.stdout"
- name: "Process the logging accounts template"
- shell: "{{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig process logging-deployer-account-template | {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig create -f -"
+ shell: >
+ {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig
+ process logging-deployer-account-template | {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig create -f -
register: process_deployer_accounts
failed_when: process_deployer_accounts.rc == 1 and 'already exists' not in process_deployer_accounts.stderr
- name: "Set permissions for logging-deployer service account"
command: >
- {{ openshift.common.client_binary }} adm --config={{ mktemp.stdout }}/admin.kubeconfig policy add-cluster-role-to-user oauth-editor system:serviceaccount:logging:logging-deployer
+ {{ openshift.common.client_binary }} adm --config={{ mktemp.stdout }}/admin.kubeconfig
+ policy add-cluster-role-to-user oauth-editor system:serviceaccount:logging:logging-deployer
register: permiss_output
failed_when: "permiss_output.rc == 1 and 'exists' not in permiss_output.stderr"
- name: "Set permissions for fluentd"
command: >
- {{ openshift.common.client_binary }} adm policy add-scc-to-user privileged system:serviceaccount:logging:aggregated-logging-fluentd
+ {{ openshift.common.client_binary }} adm --config={{ mktemp.stdout }}/admin.kubeconfig
+ policy add-scc-to-user privileged system:serviceaccount:logging:aggregated-logging-fluentd
register: fluentd_output
failed_when: "fluentd_output.rc == 1 and 'exists' not in fluentd_output.stderr"
- name: "Set additional permissions for fluentd"
command: >
- {{ openshift.common.client_binary }} adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:logging:aggregated-logging-fluentd
+ {{ openshift.common.client_binary }} adm policy --config={{ mktemp.stdout }}/admin.kubeconfig
+ add-cluster-role-to-user cluster-reader system:serviceaccount:logging:aggregated-logging-fluentd
register: fluentd2_output
failed_when: "fluentd2_output.rc == 1 and 'exists' not in fluentd2_output.stderr"
- name: "Add rolebinding-reader to aggregated-logging-elastic-search"
command: >
- {{ openshift.common.client_binary }} adm policy add-cluster-role-to-user rolebinding-reader \
+ {{ openshift.common.client_binary }} adm --config={{ mktemp.stdout }}/admin.kubeconfig
+ policy add-cluster-role-to-user rolebinding-reader \
system:serviceaccount:logging:aggregated-logging-elasticsearch
register: rolebinding_reader_output
failed_when: "rolebinding_reader_output == 1 and 'exists' not in rolebinding_reader_output.stderr"