summaryrefslogtreecommitdiffstats
path: root/roles/openshift_serviceaccounts/tasks
diff options
context:
space:
mode:
authorStefanie Forrester <sedgar@redhat.com>2015-09-08 16:31:35 -0700
committerStefanie Forrester <sedgar@redhat.com>2015-09-10 16:52:14 -0700
commitcdfd68f642c586d5d2bba7ff3c4721dc417717c1 (patch)
treecbecd37d86ae5d175ff9faec5ff938bbf70b3b0c /roles/openshift_serviceaccounts/tasks
parenta5011b9ad04c552a5fcda77d08cdb5fa77d40f01 (diff)
downloadopenshift-cdfd68f642c586d5d2bba7ff3c4721dc417717c1.tar.gz
openshift-cdfd68f642c586d5d2bba7ff3c4721dc417717c1.tar.bz2
openshift-cdfd68f642c586d5d2bba7ff3c4721dc417717c1.tar.xz
openshift-cdfd68f642c586d5d2bba7ff3c4721dc417717c1.zip
Create service accounts and set up scc rules
Diffstat (limited to 'roles/openshift_serviceaccounts/tasks')
-rw-r--r--roles/openshift_serviceaccounts/tasks/main.yml26
1 files changed, 26 insertions, 0 deletions
diff --git a/roles/openshift_serviceaccounts/tasks/main.yml b/roles/openshift_serviceaccounts/tasks/main.yml
new file mode 100644
index 000000000..9665d0a72
--- /dev/null
+++ b/roles/openshift_serviceaccounts/tasks/main.yml
@@ -0,0 +1,26 @@
+- name: Create service account configs
+ template:
+ src: serviceaccount.j2
+ dest: "/tmp/{{ item }}-serviceaccount.yaml"
+ with_items: accounts
+
+- name: Create {{ item }} service account
+ command: >
+ {{ openshift.common.client_binary }} create -f "/tmp/{{ item }}-serviceaccount.yaml"
+ with_items: accounts
+ register: _sa_result
+ failed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc != 0"
+ changed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc == 0"
+
+- name: Get current security context constraints
+ shell: "{{ openshift.common.client_binary }} get scc privileged -o yaml > /tmp/scc.yaml"
+
+- name: Add security context constraint for {{ item }}
+ lineinfile:
+ dest: /tmp/scc.yaml
+ line: "- system:serviceaccount:default:{{ item }}"
+ insertafter: "^users:$"
+ with_items: accounts
+
+- name: Apply new scc rules for service accounts
+ command: "{{ openshift.common.client_binary }} replace -f /tmp/scc.yaml"