diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml new file mode 100644 index 0000000..ddc852b --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -0,0 +1,84 @@ +--- +# Minimum required RHACM version is 2.17 +ocp_workload_rhacm_hcp_s3_bucket_name: "oidc-storage-{{ guid }}" +ocp_workload_rhacm_hcp_s3_bucket_region: us-east-2 +ocp_workload_rhacm_key_pair_name: hypershift + +# Optionally deploy Hypershift cluster(s) +# Set to an empty array for none (default) +# Number of worker nodes created is the multiple of +# nodepool_replicas x zones +# E.g. 2 zones and 2 nodepool replicas = 4 worker nodes +# The following parameters are optional and will be set to the +# defaults as below: +# - control_plane_availability: SingleReplica +# - infra_availability: SingleReplica +# - network_type: OVNKubernetes +# - etcd_storage_class: gp3-csi +# - root_volume_type: gp3 +# - root_volume_size: 120 +# - zones: [] +# - labels: [] +ocp_workload_rhacm_hcp_deploy_clusters: [] + +# ocp_workload_rhacm_hcp_deploy_clusters: +# - name: development +# infra_id: dev-{{ guid }} +# ocp_release: 4.14.2 +# control_plane_availability: SingleReplica +# infra_availability: SingleReplica +# etcd_storage_class: gp3-csi +# nodepool_replicas: 1 +# worker_instance_type: m5.large +# root_volume_type: gp3 +# root_volume_size: 120 +# network_type: OVNKubernetes +# region: us-west-2 +# zones: # Optional, list zones to deploy into, each zone will get the same number of workers +# - us-west-2a +# labels: +# rhdp_type: sandbox +# rhdp_usage: development + +# - name: production +# infra_id: prod-{{ guid }} +# ocp_release: 4.13.11 +# control_plane_availability: HighlyAvailable +# infra_availability: HighlyAvailable +# etcd_storage_class: gp3-csi +# nodepool_replicas: 2 +# worker_instance_type: m5.large +# root_volume_type: gp3 +# root_volume_size: 120 +# network_type: OVNKubernetes +# region: us-west-2 +# zones: +# - us-west-2a +# - us-west-2b +# labels: +# rhdp_type: sandbox +# rhdp_usage: production + +############################################################################# +# Set up Policies +############################################################################# +# Set up policies for all created clusters. +############################################################################# +ocp_workload_rhacm_hcp_policies_setup: false +ocp_workload_rhacm_hcp_policies_namespace: hcp-policies + +ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git +ocp_workload_rhacm_hcp_policies_repository_branch: main +ocp_workload_rhacm_hcp_policies_repository_path: . +ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" + +############################################################################# +# Set up ManagedClusterSet for clusters with hosted control planes +############################################################################# +# This next section is only to group all managed clusters into a +# ManagedClusterSet. +# All clusters need to have the label: +# "cluster.open-cluster-management.io/clusterset:"" +############################################################################# +ocp_workload_rhacm_hcp_managed_cluster_set_setup: false +ocp_workload_rhacm_hcp_managed_cluster_set_name: hcp diff --git a/roles/ocp_workload_rhacm_hcp/meta/main.yml b/roles/ocp_workload_rhacm_hcp/meta/main.yml new file mode 100644 index 0000000..0c370c5 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: ocp_workload_rhacm_hcp + author: Wolfgang Kulhanek (wkulhane@redhat.com) + description: | + Set up Hypershift on an existing RHACM installation. Minimum required RHACM version is 2.17 + license: MIT + min_ansible_version: "2.9" + platforms: [] + galaxy_tags: + - ocp + - openshift + - acm + - rhacm + - hypershift + - hcp +dependencies: [] diff --git a/roles/ocp_workload_rhacm_hcp/readme.adoc b/roles/ocp_workload_rhacm_hcp/readme.adoc new file mode 100644 index 0000000..3bdb48c --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/readme.adoc @@ -0,0 +1,70 @@ += ocp_workload_rhacm_hcp - Deploys RH ACM Hypershift + +== Role overview + +* This role installs Red Hat ACM Hypershift into an OpenShift Cluster - Red Had Advanced Cluster Manager 2.6+ must be installed previously. It consists of the following tasks files: +** Tasks: link:./tasks/pre_workload.yml[pre_workload.yml] - Sets up an environment for the workload deployment. +*** Debug task will print out: `pre_workload Tasks completed successfully.` + +** Tasks: link:./tasks/workload.yml[workload.yml] - Used to deploy ACM +*** This role deploys ACM (project) +*** Debug task will print out: `workload Tasks completed successfully.` + +** Tasks: link:./tasks/post_workload.yml[post_workload.yml] - Used to + configure the workload after deployment +*** This role doesn't do anything here +*** Debug task will print out: `post_workload Tasks completed successfully.` + +** Tasks: link:./tasks/remove_workload.yml[remove_workload.yml] - Used to + delete the workload +*** This role uninstalls ACM and related resources +*** Debug task will print out: `remove_workload Tasks completed successfully.` + +== Review the defaults variable file + +* This file link:./defaults/main.yml[./defaults/main.yml] contains all the variables you need to define to control the deployment of your workload. +* The variable *ocp_username* is mandatory to assign the workload to the correct OpenShift user. +* A variable *silent=True* can be passed to suppress debug messages. +* Other variables: +** *ocp_workload_rhacm_hcp_acm_project*: The name of the project where ACM is deployed. Default: `open-cluster-management` +** *ocp_workload_rhacm_hcp_acm_release*: ACM release to be deployed. Default: `release-1.0` +** *ocp_workload_rhacm_hcp_docker_registry*: ACM Container Registry. Default: `registry.access.redhat.com/rhacm1-tech-preview` + +* You can modify any of these default values by adding `-e "variable_name=variable_value"` to the command line + +=== Deploy a Workload with the `ocp-workload` playbook [Mostly for testing] + +---- +TARGET_HOST="bastion.na311.openshift.opentlc.com" +OCP_USERNAME="mavazque-redhat.com" +WORKLOAD="ocp_workload_rhacm_hcp" +GUID=1001 + +# a TARGET_HOST is specified in the command line, without using an inventory file +ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \ + -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \ + -e"ansible_user=ec2-user" \ + -e"ocp_username=${OCP_USERNAME}" \ + -e"ocp_workload=${WORKLOAD}" \ + -e"silent=False" \ + -e"guid=${GUID}" \ + -e"ACTION=create" +---- + +=== To Delete an environment + +---- +TARGET_HOST="bastion.na311.openshift.opentlc.com" +OCP_USERNAME="mavazque-redhat.com" +WORKLOAD="ocp_workload_rhacm_hcp" +GUID=1002 + +# a TARGET_HOST is specified in the command line, without using an inventory file +ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \ + -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \ + -e"ansible_user=ec2-user" \ + -e"ocp_username=${OCP_USERNAME}" \ + -e"ocp_workload=${WORKLOAD}" \ + -e"guid=${GUID}" \ + -e"ACTION=remove" +---- diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml new file mode 100644 index 0000000..d298626 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -0,0 +1,78 @@ +--- +- name: Print debug statement + ansible.builtin.debug: + msg: "Creating cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}." + +- name: Wait for HostedCluster CRD to be registered + kubernetes.core.k8s_info: + api_version: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + name: hostedclusters.hypershift.openshift.io + register: r_crd + retries: 60 + delay: 30 + until: r_crd.resources | length | int > 0 + +- name: Include AWS Role Prep + ansible.builtin.include_tasks: prep_aws_roles.yaml + +- name: Ensure hosted cluster doesn't already exist + kubernetes.core.k8s_info: + api_version: hypershift.openshift.io/v1beta1 + kind: HostedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + namespace: local-cluster + register: r_hosted_cluster + +- name: Deploy hosted cluster {{ _ocp_workload_rhacm_hcp_cluster_name }} + when: r_hosted_cluster.resources | length == 0 + block: + - name: Run hcp CLI to deploy hosted cluster + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: >- + /usr/bin/hcp create cluster aws + --auto-repair + --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} + --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} + --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} + --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} + --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} + --name {{ _ocp_workload_rhacm_hcp_cluster_name }} + --namespace local-cluster + --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} + --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} + --region {{ _ocp_workload_rhacm_hcp_cluster_region }} + --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-multi + --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} + --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} + --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} + --role-arn "{{ r_role_arn.stdout }}" + --sts-creds /tmp/sts-creds.json + --pull-secret /tmp/pull_secret.json + --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}" + --endpoint-access=Public + changed_when: true + --generate-ssh + register: r_hcp_create_cluster + retries: 5 + delay: 30 + until: r_hcp_create_cluster.rc == 0 + ignore_errors: true + + - name: Print hcp command output + ansible.builtin.debug: + msg: "{{ r_hcp_create_cluster.stdout }}" + + - name: Abort + when: r_hcp_create_cluster.rc > 0 + ansible.builtin.fail: + msg: "Cluster creation failed. Aborting." + +- name: Create managed cluster to add cluster to ACM + kubernetes.core.k8s: + state: present + template: managed-cluster.yaml.j2 diff --git a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml new file mode 100644 index 0000000..acd4327 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml @@ -0,0 +1,108 @@ +--- +- name: Get ManagedCluster + kubernetes.core.k8s_info: + api_version: cluster.open-cluster-management.io/v1 + kind: ManagedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + register: r_managed_cluster + retries: 120 + delay: 10 + until: + - r_managed_cluster.resources | length > 0 + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs is defined + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs | length > 0 + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url is defined + - r_managed_cluster.resources[0].status.clusterClaims is defined + - r_managed_cluster.resources[0] | to_json | from_json | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | length > 0 + +- name: Get ManagedCluster URLs + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cluster_api_url: >- + {{ r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url }} + _ocp_workload_rhacm_hcp_cluster_console_url: >- + {{ r_managed_cluster.resources[0] | to_json | from_json + | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | first }} + +- name: Get HostedCluster + kubernetes.core.k8s_info: + api_version: hypershift.openshift.io/v1beta1 + kind: HostedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + namespace: local-cluster + register: r_hosted_cluster + retries: 120 + delay: 10 + until: + - r_hosted_cluster.resources[0].status.kubeadminPassword is defined + - r_hosted_cluster.resources[0].status.kubeadminPassword.name is defined + - r_hosted_cluster.resources[0].status.kubeadminPassword.name | length > 0 + - r_hosted_cluster.resources[0].status.kubeconfig is defined + - r_hosted_cluster.resources[0].status.kubeconfig.name is defined + - r_hosted_cluster.resources[0].status.kubeconfig.name | length > 0 + +- name: Get Secret names for credentials + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cluster_kubeadmin_password: >- + {{ r_hosted_cluster.resources[0].status.kubeadminPassword.name }} + _ocp_workload_rhacm_hcp_cluster_kubeconfig: >- + {{ r_hosted_cluster.resources[0].status.kubeconfig.name }} + +- name: Get kubeadmin password + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeadmin_password }}" + namespace: local-cluster + register: r_kubeadmin_password + retries: 60 + delay: 5 + until: + - r_kubeadmin_password is defined + - r_kubeadmin_password.resources | length > 0 + - r_kubeadmin_password.resources[0].data.password is defined + - r_kubeadmin_password.resources[0].data.password | length > 0 + +- name: Get kubeconfig + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeconfig }}" + namespace: local-cluster + register: r_kubeconfig + retries: 60 + delay: 5 + until: + - r_kubeconfig is defined + - r_kubeconfig.resources | length > 0 + - r_kubeconfig.resources[0].data.kubeconfig is defined + - r_kubeconfig.resources[0].data.kubeconfig | length > 0 + +- name: Set up bastion with credentials + become: true + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + block: + - name: Write kubeconfig file for student user + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeconfig" + content: "{{ r_kubeconfig.resources[0].data.kubeconfig | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: ug=rw,o=r + + - name: Write kubeadmin password file for student user + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeadmin-password" + content: "{{ r_kubeadmin_password.resources[0].data.password | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: ug=rw,o=r + +- name: "Save credentials for cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}" + agnosticd.core.agnosticd_user_info: + data: >- + {{ { + _ocp_workload_rhacm_hcp_cluster_name ~ '-kubeadmin-password': r_kubeadmin_password.resources[0].data.password | b64decode, + _ocp_workload_rhacm_hcp_cluster_name ~ '-admin-kubeconfig': r_kubeconfig.resources[0].data.kubeconfig | b64decode, + _ocp_workload_rhacm_hcp_cluster_name ~ '-api-url': _ocp_workload_rhacm_hcp_cluster_api_url, + _ocp_workload_rhacm_hcp_cluster_name ~ '-console-url': _ocp_workload_rhacm_hcp_cluster_console_url + } }} diff --git a/roles/ocp_workload_rhacm_hcp/tasks/main.yml b/roles/ocp_workload_rhacm_hcp/tasks/main.yml new file mode 100644 index 0000000..23308e3 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/main.yml @@ -0,0 +1,11 @@ +--- +# -------------------------------------------------- +# Do not modify this file +# -------------------------------------------------- +- name: Running workload provision tasks + when: ACTION == "provision" + ansible.builtin.include_tasks: workload.yml + +- name: Running workload removal tasks + when: ACTION == "destroy" + ansible.builtin.include_tasks: remove_workload.yml diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml new file mode 100644 index 0000000..3e63422 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -0,0 +1,100 @@ +--- +- name: Get ARN for hosted cluster user + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + cmd: >- + aws sts get-caller-identity --query "Arn" + register: r_arn + changed_when: false + +- name: Debug r_arn + ansible.builtin.debug: + msg: "{{ r_arn.stdout }}" + +- name: Create trust-relationship.json + ansible.builtin.template: + src: trust-relationship.json.j2 + dest: /tmp/trust-relationship.json + mode: ug=rw,o=r + +- name: Apply trust-relationship.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam create-role + --role-name hcp-cli-role + --assume-role-policy-document file://trust-relationship.json + --query "Role.Arn" + changed_when: true + ignore_errors: true + +- name: Get trust-relationship.json Arn + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam get-role + --role-name hcp-cli-role + --query "Role.Arn" + register: r_role_arn + changed_when: false + ignore_errors: true + +- name: Debug r_role_arn + ansible.builtin.debug: + msg: "{{ r_role_arn.stdout }}" + +- name: Create awspolicy-hcp-cli-role.json + ansible.builtin.template: + src: awspolicy-hcp-cli-role.json.j2 + dest: /tmp/awspolicy-hcp-cli-role.json + mode: "0664" + +- name: Apply awspolicy-hcp-cli-role.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam put-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json + --policy-document file://awspolicy-hcp-cli-role.json + changed_when: true + ignore_errors: true + +- name: Get STS credentials + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.shell: + chdir: /tmp + cmd: >- + aws sts get-session-token --output json > sts-creds.json + register: r_sts + changed_when: true + +- name: Read STS credentials file + ansible.builtin.slurp: + src: /tmp/sts-creds.json + register: r_sts_creds + +- name: Copy STS credentials to bastion + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + ansible.builtin.copy: + content: "{{ r_sts_creds.content | b64decode }}" + dest: /tmp/sts-creds.json + mode: ug=rw,o=r diff --git a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml new file mode 100644 index 0000000..3f0c8c7 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml @@ -0,0 +1,97 @@ +--- +############################################################################# +# Remove RHACM Policies (ArgoCD Application + supporting resources) +############################################################################# +- name: Remove ArgoCD Application for policies + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: argoproj.io/v1alpha1 + kind: Application + name: hcp-policies + namespace: openshift-gitops + state: absent + ignore_errors: true + +- name: Remove ManagedClusterSetBinding + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSetBinding + name: hcp + namespace: "{{ ocp_workload_rhacm_hcp_policies_namespace }}" + state: absent + ignore_errors: true + +- name: Remove policies namespace + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: v1 + kind: Namespace + name: "{{ ocp_workload_rhacm_hcp_policies_namespace }}" + state: absent + ignore_errors: true + +############################################################################# +# Remove ManagedClusterSet +############################################################################# +- name: Remove ManagedClusterSet resources + when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool + kubernetes.core.k8s: + api_version: "{{ item.api_version }}" + kind: "{{ item.kind }}" + name: "{{ item.name }}" + namespace: "{{ item.namespace | default(omit) }}" + state: absent + loop: + - api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSetBinding + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}" + namespace: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker" + - api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSet + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}" + - api_version: v1 + kind: Namespace + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker" + loop_control: + label: "{{ item.kind }}/{{ item.name }}" + ignore_errors: true + +############################################################################# +# Remove AWS IAM resources +############################################################################# +- name: Delete IAM inline policy from hcp-cli-role + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: >- + aws iam delete-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json + changed_when: true + ignore_errors: true + +- name: Delete IAM role hcp-cli-role + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: >- + aws iam delete-role + --role-name hcp-cli-role + changed_when: true + ignore_errors: true + +############################################################################# +# Remove S3 bucket +############################################################################# +- name: Delete S3 bucket + amazon.aws.s3_bucket: + name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + state: absent + force: true + aws_access_key: "{{ aws_access_key_id }}" + aws_secret_key: "{{ aws_secret_access_key }}" + ignore_errors: true diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml new file mode 100644 index 0000000..6f9f748 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -0,0 +1,276 @@ +--- +############################################################################# +# Prerequisite Checks +############################################################################# +- name: Ensure RHACM MultiClusterHub is deployed + kubernetes.core.k8s_info: + api_version: "operator.open-cluster-management.io/v1" + kind: MultiClusterHub + name: multiclusterhub + namespace: open-cluster-management + register: r_rhacm_multiclusterhub + +- name: Assert that MultiClusterHub is available + ansible.builtin.assert: + that: + - r_rhacm_multiclusterhub.resources | length == 1 + - r_rhacm_multiclusterhub.resources[0].status.phase is defined + - r_rhacm_multiclusterhub.resources[0].status is defined + - r_rhacm_multiclusterhub.resources[0].status.phase == "Running" + # quiet: true + fail_msg: "MultiClusterHub not found on cluster. Can not continue." + success_msg: "MultiClusterHub found on cluster. Ready to set up Hypershift." + +- name: Assert that MultiClusterHub is version 2.17.0 or higher + ansible.builtin.assert: + that: "r_rhacm_multiclusterhub.resources[0].status.currentVersion is version('2.17.0', '>=')" + quiet: true + fail_msg: "MultiClusterHub not at version 2.17.0 or higher. Please upgrade your RHACM. Can not continue." + success_msg: "MultiClusterHub found on cluster in version 2.17.0 or higher. Ready to set up Hypershift." + +############################################################################# +# AWS S3 bucket setup +############################################################################# +- name: Create AWS S3 bucket + amazon.aws.s3_bucket: + name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + state: present + aws_access_key: "{{ aws_access_key_id }}" + aws_secret_key: "{{ aws_secret_access_key }}" + public_access: + block_public_acls: false + block_public_policy: false + ignore_public_acls: true + restrict_public_buckets: false + +- name: Update s3 bucket + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + cmd: >- + aws s3api delete-public-access-block + --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + changed_when: true + +- name: Copy policy file + ansible.builtin.template: + src: bucket-policy.json.j2 + dest: /tmp/bucket-policy.json + mode: ug=rw,o=r + +- name: Apply bucket policy + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws s3api put-bucket-policy + --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + --policy file://bucket-policy.json + changed_when: true + +- name: Remove temporary policy file + ansible.builtin.file: + state: absent + path: /tmp/bucket-policy.json + +############################################################################# +# Configure HyperShift +############################################################################# +- name: Create s3 credentials secret + kubernetes.core.k8s: + state: present + template: secret-s3-credentials.yaml.j2 + +- name: Generate an OpenSSH keypair for HyperShift + community.crypto.openssh_keypair: + path: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}" + register: r_hypershift_key + +- name: Read private key from filesystem + ansible.builtin.slurp: + src: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}" + register: r_hypershift_private_key + +- name: Read public key from filesystem + ansible.builtin.slurp: + src: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}.pub" + register: r_hypershift_public_key + +- name: Create hypershift aws credentials secret + kubernetes.core.k8s: + state: present + template: secret-aws-credentials.yaml.j2 + +############################################################################# +# Install HCP CLI +############################################################################# +- name: Wait until HCP CLI download deployment is ready + kubernetes.core.k8s_info: + api_version: apps/v1 + kind: Deployment + namespace: multicluster-engine + name: hcp-cli-download + wait: true + wait_condition: + type: Available + status: "True" + wait_sleep: 30 + wait_timeout: 1800 + +- name: Get HCP CLI download URL + kubernetes.core.k8s_info: + api_version: console.openshift.io/v1 + kind: ConsoleCLIDownload + name: hcp-cli-download + register: r_hcp_cli_download + retries: 20 + delay: 10 + until: r_hcp_cli_download.resources | length > 0 + +- name: Set HCP CLI download URL + when: r_hcp_cli_download.resources | length > 0 + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cli_url: >- + {{ r_hcp_cli_download.resources[0] | to_json | from_json + | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} + +- name: Install HCP CLI on Bastion + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + block: + - name: Download HCP CLI + ansible.builtin.get_url: + url: "{{ _ocp_workload_rhacm_hcp_cli_url }}" + validate_certs: false + dest: /tmp/hcp.tar.gz + mode: ug=rw,o=r + register: r_hcp_cli + until: r_hcp_cli is success + retries: 10 + delay: 10 + + - name: Install HCP CLI on bastion + become: true + ansible.builtin.unarchive: + src: /tmp/hcp.tar.gz + remote_src: true + dest: /usr/bin + mode: ug=rwx,o=rx + owner: root + group: root + args: + creates: /usr/bin/hcp + + - name: Remove downloaded file + ansible.builtin.file: + state: absent + path: /tmp/hcp.tar.gz + + - name: Setup HCP CLI bash completion + become: true + ansible.builtin.shell: "/usr/bin/hcp completion bash >/etc/bash_completion.d/hcp" + args: + creates: /etc/bash_completion.d/hcp + + - name: Write pull secret to a file + ansible.builtin.copy: + content: "{{ ocp4_pull_secret }}" + dest: /tmp/pull_secret.json + mode: ug=rw,o=r + +############################################################################# +# Set up Policies +# Automatically configure newly deployed HCP clusters +############################################################################# +- name: Set up Policies + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + state: present + template: "{{ item }}" + loop: + - policies/namespace-policies.yaml.j2 + - policies/managedclustersetbinding.yaml.j2 + - policies/secret.yaml.j2 + - policies/application.yaml.j2 + +############################################################################# +# Set up ManagedClusterSet Policies +############################################################################# +- name: Set up ManagedClusterSet + when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool + kubernetes.core.k8s: + state: present + template: "{{ item }}" + loop: + - managedclusterset/namespace-submariner-broker.yaml.j2 + - managedclusterset/managedclusterset.yaml.j2 + - managedclusterset/managedclustersetbinding.yaml.j2 + +############################################################################# +# Wait for ConfigMap kube-public/oidc-storage-provider-s3-config to be +# available before proceeding +############################################################################# +- name: Wait for ConfigMap kube-public/oidc-storage-provider-s3-config + kubernetes.core.k8s_info: + api_version: v1 + kind: ConfigMap + name: oidc-storage-provider-s3-config + namespace: kube-public + register: r_oidc_configmap + until: + - r_oidc_configmap.resources is defined + - r_oidc_configmap.resources | length > 0 + retries: 60 + delay: 10 + +############################################################################# +# Deploy managed HyperShift clusters +############################################################################# +- name: Deploy Hypershift clusters + when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 + ansible.builtin.include_tasks: create_hypershift_cluster.yml + vars: + _ocp_workload_rhacm_hcp_cluster_name: "{{ cluster.name }}" + _ocp_workload_rhacm_hcp_cluster_infra_id: "{{ cluster.infra_id }}" + _ocp_workload_rhacm_hcp_cluster_ocp_release: "{{ cluster.ocp_release }}" + _ocp_workload_rhacm_hcp_cluster_control_plane_availability: "{{ cluster.control_plane_availability | default('SingleReplica') }}" + _ocp_workload_rhacm_hcp_cluster_infra_availability: "{{ cluster.infra_availability | default('SingleReplica') }}" + _ocp_workload_rhacm_hcp_cluster_etc_storage_class: "{{ cluster.etcd_storage_class | default('gp3-csi') }}" + _ocp_workload_rhacm_hcp_cluster_nodepool_replicas: "{{ cluster.nodepool_replicas }}" + _ocp_workload_rhacm_hcp_cluster_worker_instance_type: "{{ cluster.worker_instance_type }}" + _ocp_workload_rhacm_hcp_cluster_root_volume_type: "{{ cluster.root_volume_type | default('gp3') }}" + _ocp_workload_rhacm_hcp_cluster_root_volume_size: "{{ cluster.root_volume_size | default('120') }}" + _ocp_workload_rhacm_hcp_cluster_network_type: "{{ cluster.network_type | default('OVNKubernetes') }}" + _ocp_workload_rhacm_hcp_cluster_region: "{{ cluster.region }}" + _ocp_workload_rhacm_hcp_cluster_zones: "{{ cluster.zones | default([]) }}" + _ocp_workload_rhacm_hcp_cluster_labels: "{{ cluster.labels | default([]) }}" + loop: "{{ ocp_workload_rhacm_hcp_deploy_clusters }}" + loop_control: + label: "{{ cluster.name }}" + loop_var: cluster + +############################################################################# +# AgnosticD User Data +############################################################################# +- name: Save access information for all deployed clusters + when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 + ansible.builtin.include_tasks: + file: get_cluster_credentials.yml + vars: + _ocp_workload_rhacm_hcp_cluster_name: "{{ item.name }}" + loop: "{{ ocp_workload_rhacm_hcp_deploy_clusters }}" + loop_control: + label: "{{ item.name }}" + +- name: Save user data for S3 bucket + agnosticd.core.agnosticd_user_info: + data: + hypershift_s3_bucket_name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + hypershift_s3_region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + hypershift_s3_access_key_id: "{{ aws_access_key_id }}" + hypershift_s3_secret_access_key: "{{ aws_secret_access_key }}" diff --git a/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 new file mode 100644 index 0000000..6b6c7f3 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 @@ -0,0 +1,130 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "EC2", + "Effect": "Allow", + "Action": [ + "ec2:CreateDhcpOptions", + "ec2:DeleteSubnet", + "ec2:ReplaceRouteTableAssociation", + "ec2:DescribeAddresses", + "ec2:DescribeInstances", + "ec2:DeleteVpcEndpoints", + "ec2:CreateNatGateway", + "ec2:CreateVpc", + "ec2:DescribeDhcpOptions", + "ec2:AttachInternetGateway", + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:DeleteRouteTable", + "ec2:AssociateRouteTable", + "ec2:DescribeInternetGateways", + "ec2:DescribeAvailabilityZones", + "ec2:CreateRoute", + "ec2:CreateInternetGateway", + "ec2:RevokeSecurityGroupEgress", + "ec2:ModifyVpcAttribute", + "ec2:DeleteInternetGateway", + "ec2:DescribeVpcEndpointConnections", + "ec2:RejectVpcEndpointConnections", + "ec2:DescribeRouteTables", + "ec2:ReleaseAddress", + "ec2:AssociateDhcpOptions", + "ec2:TerminateInstances", + "ec2:CreateTags", + "ec2:DeleteRoute", + "ec2:CreateRouteTable", + "ec2:DetachInternetGateway", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeNatGateways", + "ec2:DisassociateRouteTable", + "ec2:AllocateAddress", + "ec2:DescribeSecurityGroups", + "ec2:RevokeSecurityGroupIngress", + "ec2:CreateVpcEndpoint", + "ec2:DescribeVpcs", + "ec2:DeleteSecurityGroup", + "ec2:DeleteDhcpOptions", + "ec2:DeleteNatGateway", + "ec2:DescribeVpcEndpoints", + "ec2:DeleteVpc", + "ec2:CreateSubnet", + "ec2:DescribeSubnets" + ], + "Resource": "*" + }, + { + "Sid": "ELB", + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DeleteTargetGroup" + ], + "Resource": "*" + }, + { + "Sid": "IAMPassRole", + "Effect": "Allow", + "Action": "iam:PassRole", + "Resource": "arn:*:iam::*:role/*-worker-role", + "Condition": { + "ForAnyValue:StringEqualsIfExists": { + "iam:PassedToService": "ec2.amazonaws.com" + } + } + }, + { + "Sid": "IAM", + "Effect": "Allow", + "Action": [ + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:GetRole", + "iam:UpdateAssumeRolePolicy", + "iam:GetInstanceProfile", + "iam:TagRole", + "iam:RemoveRoleFromInstanceProfile", + "iam:CreateRole", + "iam:DeleteRole", + "iam:PutRolePolicy", + "iam:AddRoleToInstanceProfile", + "iam:CreateOpenIDConnectProvider", + "iam:TagOpenIDConnectProvider", + "iam:ListOpenIDConnectProviders", + "iam:DeleteRolePolicy", + "iam:UpdateRole", + "iam:DeleteOpenIDConnectProvider", + "iam:GetRolePolicy" + ], + "Resource": "*" + }, + { + "Sid": "Route53", + "Effect": "Allow", + "Action": [ + "route53:ListHostedZonesByVPC", + "route53:CreateHostedZone", + "route53:ListHostedZones", + "route53:ChangeResourceRecordSets", + "route53:ListResourceRecordSets", + "route53:DeleteHostedZone", + "route53:AssociateVPCWithHostedZone", + "route53:ListHostedZonesByName" + ], + "Resource": "*" + }, + { + "Sid": "S3", + "Effect": "Allow", + "Action": [ + "s3:ListAllMyBuckets", + "s3:ListBucket", + "s3:DeleteObject", + "s3:DeleteBucket" + ], + "Resource": "*" + } + ] +} diff --git a/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 new file mode 100644 index 0000000..69f729a --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 @@ -0,0 +1,11 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": "*", + "Action": "s3:GetObject", + "Resource": "arn:aws:s3:::{{ ocp_workload_rhacm_hcp_s3_bucket_name }}/*" + } + ] +} diff --git a/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 new file mode 100644 index 0000000..5bf7851 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: hypershift-override-images + namespace: local-cluster +data: + apiserver-network-proxy: {{ ocp_workload_rhacm_hcp_hcp_registry }}/apiserver-network-proxy-rhel8:{{ ocp_workload_rhacm_hcp_apiserver_network_proxy_image_tag }} + aws-encryption-provider: {{ ocp_workload_rhacm_hcp_hcp_registry }}/aws-encryption-provider-rhel8:{{ ocp_workload_rhacm_hcp_aws_encryption_provider_image_tag }} + cluster-api: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_image_tag }} + cluster-api-provider-agent: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-agent-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_agent_image_tag }} + cluster-api-provider-aws: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-aws-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_aws_image_tag }} + cluster-api-provider-azure: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-azure-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_azure_image_tag }} + cluster-api-provider-kubevirt: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-kubevirt-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_kubevirt_image_tag }} + hypershift-cli: {{ ocp_workload_rhacm_hcp_hcp_registry }}/hypershift-cli-rhel8:{{ ocp_workload_rhacm_hcp_hypershift_cli_image_tag }} + hypershift-operator: {{ ocp_workload_rhacm_hcp_hcp_registry }}/hypershift-rhel8-operator:{{ ocp_workload_rhacm_hcp_hypershift_operator_image_tag }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 new file mode 100644 index 0000000..6b9cb1a --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 @@ -0,0 +1,23 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1 +kind: ManagedCluster +metadata: + name: {{ _ocp_workload_rhacm_hcp_cluster_name }} + annotations: + import.open-cluster-management.io/hosting-cluster-name: local-cluster + import.open-cluster-management.io/klusterlet-deploy-mode: Hosted + open-cluster-management/created-via: AgnosticD + labels: + name: {{ _ocp_workload_rhacm_hcp_cluster_name }} + cloud: auto-detect + cluster.open-cluster-management.io/clusterset: default + vendor: OpenShift +{% if _ocp_workload_rhacm_hcp_cluster_labels | default("") | length > 0 %} + {{ _ocp_workload_rhacm_hcp_cluster_labels | to_nice_yaml | indent(4) }} +{% endif %} +{% if ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool %} + cluster.open-cluster-management.io/clusterset: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} +{% endif %} +spec: + hubAcceptsClient: true + leaseDurationSeconds: 60 diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 new file mode 100644 index 0000000..ce56d26 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 @@ -0,0 +1,13 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSet +metadata: + annotations: + cluster.open-cluster-management.io/submariner-broker-ns: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker + finalizers: + - cluster.open-cluster-management.io/managedclusterset-clusterrole + - cluster.open-cluster-management.io/submariner-cleanup + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} +spec: + clusterSelector: + selectorType: ExclusiveClusterSetLabel diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 new file mode 100644 index 0000000..4b31886 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 @@ -0,0 +1,8 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSetBinding +metadata: + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} +spec: + clusterSet: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 new file mode 100644 index 0000000..710e8de --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 new file mode 100644 index 0000000..b7e64f7 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 @@ -0,0 +1,21 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: hcp-policies + namespace: openshift-gitops +spec: + project: default + source: + repoURL: {{ ocp_workload_rhacm_hcp_policies_repository }} + targetRevision: {{ ocp_workload_rhacm_hcp_policies_repository_branch }} + path: {{ ocp_workload_rhacm_hcp_policies_repository_path }} + destination: + server: https://kubernetes.default.svc + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=false diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 new file mode 100644 index 0000000..912e1d7 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 @@ -0,0 +1,8 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSetBinding +metadata: + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} + name: hcp +spec: + clusterSet: hcp diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 new file mode 100644 index 0000000..08ad833 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_policies_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 new file mode 100644 index 0000000..4de42c4 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aws-secret-access-key + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} +type: Opaque +data: + secret-access-key: {{ ocp_workload_rhacm_hcp_policies_aws_secret_access_key | b64encode }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 new file mode 100644 index 0000000..2b0ab44 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 @@ -0,0 +1,23 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aws-credentials + namespace: local-cluster + labels: + cluster.open-cluster-management.io/credentials: "" + cluster.open-cluster-management.io/type: aws + cluster.open-cluster-management.io/backup: "true" +type: Opaque +data: + additionalTrustBundle: "" + aws_secret_access_key: {{ aws_secret_access_key | b64encode }} + aws_access_key_id: {{ aws_access_key_id | b64encode }} + baseDomain: {{ subdomain_base_suffix | regex_replace('^\.', '') | b64encode }} + httpProxy: "" + httpsProxy: "" + noProxy: "" + pullSecret: {{ (ocp4_pull_secret | to_json if ocp4_pull_secret is mapping else ocp4_pull_secret) | b64encode }} + .dockerconfigjson: {{ (ocp4_pull_secret | to_json if ocp4_pull_secret is mapping else ocp4_pull_secret) | b64encode }} + ssh-publickey: {{ r_hypershift_public_key.content }} + ssh-privatekey: {{ r_hypershift_private_key.content }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 new file mode 100644 index 0000000..a03db35 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: hypershift-operator-oidc-provider-s3-credentials + namespace: local-cluster + labels: + cluster.open-cluster-management.io/credentials: "" + cluster.open-cluster-management.io/type: awss3 + cluster.open-cluster-management.io/backup: "true" +stringData: + bucket: {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + region: {{ ocp_workload_rhacm_hcp_s3_bucket_region }} + credentials: |- + [default] + aws_access_key_id={{ aws_access_key_id }} + aws_secret_access_key={{ aws_secret_access_key }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 new file mode 100644 index 0000000..a4bd5e1 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": {{ r_arn.stdout }} + }, + "Action": "sts:AssumeRole" + } + ] +}