From cdfd68f642c586d5d2bba7ff3c4721dc417717c1 Mon Sep 17 00:00:00 2001
From: Stefanie Forrester <sedgar@redhat.com>
Date: Tue, 8 Sep 2015 16:31:35 -0700
Subject: Create service accounts and set up scc rules

---
 playbooks/common/openshift-master/config.yml       |  9 ++++++++
 roles/openshift_serviceaccounts/tasks/main.yml     | 26 ++++++++++++++++++++++
 .../templates/serviceaccount.j2                    |  4 ++++
 3 files changed, 39 insertions(+)
 create mode 100644 roles/openshift_serviceaccounts/tasks/main.yml
 create mode 100644 roles/openshift_serviceaccounts/templates/serviceaccount.j2

diff --git a/playbooks/common/openshift-master/config.yml b/playbooks/common/openshift-master/config.yml
index 4a4a69f50..64cf7a65b 100644
--- a/playbooks/common/openshift-master/config.yml
+++ b/playbooks/common/openshift-master/config.yml
@@ -236,3 +236,12 @@
   tasks:
   - file: name={{ g_master_mktemp.stdout }} state=absent
     changed_when: False
+
+- name: Configure service accounts
+  hosts: oo_first_master
+
+  vars:
+    accounts: ["router", "registry"]
+
+  roles:
+  - openshift_serviceaccounts
diff --git a/roles/openshift_serviceaccounts/tasks/main.yml b/roles/openshift_serviceaccounts/tasks/main.yml
new file mode 100644
index 000000000..9665d0a72
--- /dev/null
+++ b/roles/openshift_serviceaccounts/tasks/main.yml
@@ -0,0 +1,26 @@
+- name: Create service account configs
+  template:
+    src: serviceaccount.j2
+    dest: "/tmp/{{ item }}-serviceaccount.yaml"
+  with_items: accounts
+
+- name: Create {{ item }} service account
+  command: >
+    {{ openshift.common.client_binary }} create -f "/tmp/{{ item }}-serviceaccount.yaml"
+  with_items: accounts
+  register: _sa_result
+  failed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc != 0"
+  changed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc == 0"
+
+- name: Get current security context constraints
+  shell: "{{ openshift.common.client_binary }} get scc privileged -o yaml > /tmp/scc.yaml"
+
+- name: Add security context constraint for {{ item }}
+  lineinfile:
+    dest: /tmp/scc.yaml
+    line: "- system:serviceaccount:default:{{ item }}"
+    insertafter: "^users:$"
+  with_items: accounts
+
+- name: Apply new scc rules for service accounts
+  command: "{{ openshift.common.client_binary }} replace -f /tmp/scc.yaml"
diff --git a/roles/openshift_serviceaccounts/templates/serviceaccount.j2 b/roles/openshift_serviceaccounts/templates/serviceaccount.j2
new file mode 100644
index 000000000..931e249f9
--- /dev/null
+++ b/roles/openshift_serviceaccounts/templates/serviceaccount.j2
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ item }}
-- 
cgit v1.2.3