blob: d93a25a215e36c135f27153c6ce13d307213a460 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
- name: Create service account configs
template:
src: serviceaccount.j2
dest: "/tmp/{{ item }}-serviceaccount.yaml"
with_items: accounts
- name: Create {{ item }} service account
command: >
{{ openshift.common.client_binary }} create -f "/tmp/{{ item }}-serviceaccount.yaml"
with_items: accounts
register: _sa_result
failed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc != 0"
changed_when: "'serviceaccounts \"{{ item }}\" already exists' not in _sa_result.stderr and _sa_result.rc == 0"
- name: Get current security context constraints
shell: "{{ openshift.common.client_binary }} get scc privileged -o yaml > /tmp/scc.yaml"
- name: Add security context constraint for {{ item }}
lineinfile:
dest: /tmp/scc.yaml
line: "- system:serviceaccount:default:{{ item }}"
insertafter: "^users:$"
with_items: accounts
- name: Apply new scc rules for service accounts
command: "{{ openshift.common.client_binary }} update -f /tmp/scc.yaml"
|
