blob: 89d9e3aa709dbcd6246c40ad80783932efec1a49 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
- name: test if service accounts exists
command: >
{{ openshift.common.client_binary }} get sa {{ item }} -n {{ openshift_serviceaccounts_namespace }}
with_items: openshift_serviceaccounts_names
failed_when: false
changed_when: false
register: account_test
- name: create the service account
shell: >
echo {{ lookup('template', '../templates/serviceaccount.j2')
| from_yaml | to_json | quote }} | {{ openshift.common.client_binary }} create -f -
when: item.1.rc != 0
with_together:
- openshift_serviceaccounts_names
- account_test.results
- name: test if scc needs to be updated
command: >
{{ openshift.common.client_binary }} get scc {{ item }} -o yaml
changed_when: false
failed_when: false
register: scc_test
with_items: openshift_serviceaccounts_sccs
- name: Grant the user access to the privileged scc
command: >
{{ openshift.common.admin_binary }} policy add-scc-to-user
privileged system:serviceaccount:{{ openshift_serviceaccounts_namespace }}:{{ item.0 }}
when: "openshift.common.version_gte_3_1_or_1_1 and item.1.rc == 0 and 'system:serviceaccount:{{ openshift_serviceaccounts_namespace }}:{{ item.0 }}' not in {{ (item.1.stdout | from_yaml).users }}"
with_nested:
- openshift_serviceaccounts_names
- scc_test.results
####
#
# Support for 3.0.z
#
####
- name: tmp dir for openshift
file:
path: /tmp/openshift
state: directory
owner: root
mode: 700
when: not openshift.common.version_gte_3_1_or_1_1
- name: Create service account configs
template:
src: serviceaccount.j2
dest: "/tmp/openshift/{{ item }}-serviceaccount.yaml"
with_items: openshift_serviceaccounts_names
when: not openshift.common.version_gte_3_1_or_1_1
- name: Get current security context constraints
shell: >
{{ openshift.common.client_binary }} get scc privileged -o yaml
--output-version=v1 > /tmp/openshift/scc.yaml
changed_when: false
when: not openshift.common.version_gte_3_1_or_1_1
- name: Add security context constraint for {{ item }}
lineinfile:
dest: /tmp/openshift/scc.yaml
line: "- system:serviceaccount:{{ openshift_serviceaccounts_namespace }}:{{ item }}"
insertafter: "^users:$"
with_items: openshift_serviceaccounts_names
when: not openshift.common.version_gte_3_1_or_1_1
- name: Apply new scc rules for service accounts
command: "{{ openshift.common.client_binary }} update -f /tmp/openshift/scc.yaml --api-version=v1"
when: not openshift.common.version_gte_3_1_or_1_1
|
