2 files changed, 51 insertions, 25 deletions

diff --git a/roles/openshift_manageiq/tasks/main.yaml b/roles/openshift_manageiq/tasks/main.yaml
index bdaf64b3f..a7214482f 100644
--- a/roles/openshift_manageiq/tasks/main.yaml
+++ b/roles/openshift_manageiq/tasks/main.yaml
@@ -50,6 +50,16 @@
   failed_when: "'already exists' not in osmiq_create_cluster_role.stderr and osmiq_create_cluster_role.rc != 0"
   changed_when: osmiq_create_cluster_role.rc == 0
 
+- name: Create Hawkular Metrics Admin Cluster Role
+  shell: >
+    echo {{ manageiq_metrics_admin_clusterrole | to_json | quote }} |
+    {{ openshift.common.client_binary }}
+    --config={{manage_iq_tmp_conf}}
+    create -f -
+  register: oshawkular_create_cluster_role
+  failed_when: "'already exists' not in oshawkular_create_cluster_role.stderr and oshawkular_create_cluster_role.rc != 0"
+  changed_when: oshawkular_create_cluster_role.rc == 0
+
 - name: Configure role/user permissions
   command: >
     {{ openshift.common.client_binary }} adm {{item}}
diff --git a/roles/openshift_manageiq/vars/main.yml b/roles/openshift_manageiq/vars/main.yml
index 6a0c5b41b..3f24fd6be 100644
--- a/roles/openshift_manageiq/vars/main.yml
+++ b/roles/openshift_manageiq/vars/main.yml
@@ -1,36 +1,52 @@
+---
 manageiq_cluster_role:
-    apiVersion: v1
-    kind: ClusterRole
-    metadata:
-      name: management-infra-admin
-    rules:
-    - resources:
-      - pods/proxy
-      verbs:
-      - '*'
+  apiVersion: v1
+  kind: ClusterRole
+  metadata:
+    name: management-infra-admin
+  rules:
+  - resources:
+    - pods/proxy
+    verbs:
+    - '*'
+
+manageiq_metrics_admin_clusterrole:
+  apiVersion: v1
+  kind: ClusterRole
+  metadata:
+    name: hawkular-metrics-admin
+  rules:
+  - apiGroups:
+    - ""
+    resources:
+    - hawkular-metrics
+    - hawkular-alerts
+    verbs:
+    - '*'
 
 manageiq_service_account:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: management-admin
+  apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: management-admin
 
 manageiq_image_inspector_service_account:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: inspector-admin
+  apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: inspector-admin
 
 manage_iq_tmp_conf: /tmp/manageiq_admin.kubeconfig
 
 manage_iq_tasks:
-    - policy add-role-to-user -n management-infra admin -z management-admin
-    - policy add-role-to-user -n management-infra management-infra-admin -z management-admin
-    - policy add-cluster-role-to-user cluster-reader system:serviceaccount:management-infra:management-admin
-    - policy add-scc-to-user privileged system:serviceaccount:management-infra:management-admin
-    - policy add-cluster-role-to-user system:image-puller system:serviceaccount:management-infra:inspector-admin
-    - policy add-scc-to-user privileged system:serviceaccount:management-infra:inspector-admin
-    - policy add-cluster-role-to-user self-provisioner system:serviceaccount:management-infra:management-admin
+- policy add-role-to-user -n management-infra admin -z management-admin
+- policy add-role-to-user -n management-infra management-infra-admin -z management-admin
+- policy add-cluster-role-to-user cluster-reader system:serviceaccount:management-infra:management-admin
+- policy add-scc-to-user privileged system:serviceaccount:management-infra:management-admin
+- policy add-cluster-role-to-user system:image-puller system:serviceaccount:management-infra:inspector-admin
+- policy add-scc-to-user privileged system:serviceaccount:management-infra:inspector-admin
+- policy add-cluster-role-to-user self-provisioner system:serviceaccount:management-infra:management-admin
+- policy add-cluster-role-to-user hawkular-metrics-admin system:serviceaccount:management-infra:management-admin
 
 manage_iq_openshift_3_2_tasks:
-    - policy add-cluster-role-to-user system:image-auditor system:serviceaccount:management-infra:management-admin
+- policy add-cluster-role-to-user system:image-auditor system:serviceaccount:management-infra:management-admin