From 665979eab6e889c542a1f74b6896f5ada391034d Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 15:39:13 +0200 Subject: [PATCH 01/19] Add HCP workload --- .../ocp_workload_rhacm_hcp/defaults/main.yml | 88 ++++++ roles/ocp_workload_rhacm_hcp/meta/main.yml | 17 ++ roles/ocp_workload_rhacm_hcp/readme.adoc | 70 +++++ .../tasks/create_hypershift_cluster.yml | 121 ++++++++ .../tasks/get_cluster_credentials.yml | 106 +++++++ roles/ocp_workload_rhacm_hcp/tasks/main.yml | 11 + .../tasks/prep_aws_roles.yaml | 87 ++++++ .../tasks/remove_workload.yml | 50 +++ .../ocp_workload_rhacm_hcp/tasks/workload.yml | 286 ++++++++++++++++++ .../templates/awspolicy-hcp-cli-role.json.j2 | 130 ++++++++ .../templates/bucket-policy.json.j2 | 11 + .../hypershift-override-images.yaml.j2 | 16 + .../templates/klusterlet-addon-config.yaml.j2 | 22 ++ .../templates/managed-cluster.yaml.j2 | 23 ++ .../managedclusterset.yaml.j2 | 13 + .../managedclustersetbinding.yaml.j2 | 8 + .../namespace-submariner-broker.yaml.j2 | 5 + .../templates/rhdp/application.yaml.j2 | 14 + .../templates/rhdp/channel.yaml.j2 | 11 + .../templates/rhdp/clusterrolebinding.yaml.j2 | 16 + .../rhdp/managedclustersetbinding.yaml.j2 | 8 + .../rhdp/namespace-applications.yaml.j2 | 5 + .../templates/rhdp/namespace-channels.yaml.j2 | 5 + .../templates/rhdp/namespace-policies.yaml.j2 | 5 + .../templates/rhdp/placement.yaml.j2 | 16 + .../templates/rhdp/secret.yaml.j2 | 9 + .../templates/rhdp/subscription.yaml.j2 | 18 ++ .../templates/secret-aws-credentials.yaml.j2 | 23 ++ .../templates/secret-s3-credentials.yaml.j2 | 17 ++ .../templates/trust-relationship.json.j2 | 12 + 30 files changed, 1223 insertions(+) create mode 100644 roles/ocp_workload_rhacm_hcp/defaults/main.yml create mode 100644 roles/ocp_workload_rhacm_hcp/meta/main.yml create mode 100644 roles/ocp_workload_rhacm_hcp/readme.adoc create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/main.yml create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml create mode 100644 roles/ocp_workload_rhacm_hcp/tasks/workload.yml create mode 100644 roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml new file mode 100644 index 0000000..58554b8 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -0,0 +1,88 @@ +--- +# Minimum required RHACM version is 2.17 +ocp_workload_rhacm_hcp_s3_bucket_name: "oidc-storage-{{ guid }}" +ocp_workload_rhacm_hcp_s3_bucket_region: us-east-2 +ocp_workload_rhacm_key_pair_name: hypershift + +# Optionally deploy Hypershift cluster(s) +# Set to an empty array for none (default) +# Number of worker nodes created is the multiple of +# nodepool_replicas x zones +# E.g. 2 zones and 2 nodepool replicas = 4 worker nodes +# The following parameters are optional and will be set to the +# defaults as below: +# - control_plane_availability: SingleReplica +# - infra_availability: SingleReplica +# - network_type: OVNKubernetes +# - etcd_storage_class: gp3-csi +# - root_volume_type: gp3 +# - root_volume_size: 120 +# - zones: [] +# - labels: [] +ocp_workload_rhacm_hcp_deploy_clusters: [] + +# ocp_workload_rhacm_hcp_deploy_clusters: +# - name: development +# infra_id: dev-{{ guid }} +# ocp_release: 4.14.2 +# control_plane_availability: SingleReplica +# infra_availability: SingleReplica +# etcd_storage_class: gp3-csi +# nodepool_replicas: 1 +# worker_instance_type: m5.large +# root_volume_type: gp3 +# root_volume_size: 120 +# network_type: OVNKubernetes +# region: us-west-2 +# zones: # Optional, list zones to deploy into, each zone will get the same number of workers +# - us-west-2a +# labels: +# rhdp_type: sandbox +# rhdp_usage: development + +# - name: production +# infra_id: prod-{{ guid }} +# ocp_release: 4.13.11 +# control_plane_availability: HighlyAvailable +# infra_availability: HighlyAvailable +# etcd_storage_class: gp3-csi +# nodepool_replicas: 2 +# worker_instance_type: m5.large +# root_volume_type: gp3 +# root_volume_size: 120 +# network_type: OVNKubernetes +# region: us-west-2 +# zones: +# - us-west-2a +# - us-west-2b +# labels: +# rhdp_type: sandbox +# rhdp_usage: production + +############################################################################# +# Set up RHDP Policies +############################################################################# +# This next section is only to deploy a shared cluster for RHDP to deploy hosted clusters to +# using the workload ocp_workload_deploy_hosted_cluster +############################################################################# +ocp_workload_rhacm_hcp_rhdp_policies_setup: false +ocp_workload_rhacm_hcp_rhdp_policies_namespace: rhdp-policies +ocp_workload_rhacm_hcp_rhdp_applications_namespace: rhdp-applications +ocp_workload_rhacm_hcp_rhdp_channels_namespace: rhdp-channels +ocp_workload_rhacm_hcp_rhdp_policies_repository: https://github.com/rhpds/hypershift-policies.git +ocp_workload_rhacm_hcp_rhdp_policies_repository_branch: main +ocp_workload_rhacm_hcp_rhdp_policies_repository_path: "/" +ocp_workload_rhacm_hcp_rhdp_policies_admin_user: admin +ocp_workload_rhacm_hcp_rhdp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" + +############################################################################# +# Set up ManagedClusterSet for clusters with hosted control planes +############################################################################# +# This next section is only to group all managed clusters into a +# ManagedClusterSet. +# All clusters need to have the label: +# "cluster.open-cluster-management.io/clusterset:"" +# Workload ocp_workload_deploy_hosted_cluster to set that label. +############################################################################# +ocp_workload_rhacm_hcp_managed_cluster_set_setup: false +ocp_workload_rhacm_hcp_managed_cluster_set_name: hcp diff --git a/roles/ocp_workload_rhacm_hcp/meta/main.yml b/roles/ocp_workload_rhacm_hcp/meta/main.yml new file mode 100644 index 0000000..ded130b --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: ocp_workload_rhacm_hcp + author: Wolfgang Kulhanek (wkulhane@redhat.com) + description: | + Set up Hypershift on an existing RHACM installation. Minimum required RHACM version is 2.17 + license: MIT + min_ansible_version: 2.9 + platforms: [] + galaxy_tags: + - ocp + - openshift + - acm + - rhacm + - hypershift + - hcp +dependencies: [] diff --git a/roles/ocp_workload_rhacm_hcp/readme.adoc b/roles/ocp_workload_rhacm_hcp/readme.adoc new file mode 100644 index 0000000..3bdb48c --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/readme.adoc @@ -0,0 +1,70 @@ += ocp_workload_rhacm_hcp - Deploys RH ACM Hypershift + +== Role overview + +* This role installs Red Hat ACM Hypershift into an OpenShift Cluster - Red Had Advanced Cluster Manager 2.6+ must be installed previously. It consists of the following tasks files: +** Tasks: link:./tasks/pre_workload.yml[pre_workload.yml] - Sets up an environment for the workload deployment. +*** Debug task will print out: `pre_workload Tasks completed successfully.` + +** Tasks: link:./tasks/workload.yml[workload.yml] - Used to deploy ACM +*** This role deploys ACM (project) +*** Debug task will print out: `workload Tasks completed successfully.` + +** Tasks: link:./tasks/post_workload.yml[post_workload.yml] - Used to + configure the workload after deployment +*** This role doesn't do anything here +*** Debug task will print out: `post_workload Tasks completed successfully.` + +** Tasks: link:./tasks/remove_workload.yml[remove_workload.yml] - Used to + delete the workload +*** This role uninstalls ACM and related resources +*** Debug task will print out: `remove_workload Tasks completed successfully.` + +== Review the defaults variable file + +* This file link:./defaults/main.yml[./defaults/main.yml] contains all the variables you need to define to control the deployment of your workload. +* The variable *ocp_username* is mandatory to assign the workload to the correct OpenShift user. +* A variable *silent=True* can be passed to suppress debug messages. +* Other variables: +** *ocp_workload_rhacm_hcp_acm_project*: The name of the project where ACM is deployed. Default: `open-cluster-management` +** *ocp_workload_rhacm_hcp_acm_release*: ACM release to be deployed. Default: `release-1.0` +** *ocp_workload_rhacm_hcp_docker_registry*: ACM Container Registry. Default: `registry.access.redhat.com/rhacm1-tech-preview` + +* You can modify any of these default values by adding `-e "variable_name=variable_value"` to the command line + +=== Deploy a Workload with the `ocp-workload` playbook [Mostly for testing] + +---- +TARGET_HOST="bastion.na311.openshift.opentlc.com" +OCP_USERNAME="mavazque-redhat.com" +WORKLOAD="ocp_workload_rhacm_hcp" +GUID=1001 + +# a TARGET_HOST is specified in the command line, without using an inventory file +ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \ + -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \ + -e"ansible_user=ec2-user" \ + -e"ocp_username=${OCP_USERNAME}" \ + -e"ocp_workload=${WORKLOAD}" \ + -e"silent=False" \ + -e"guid=${GUID}" \ + -e"ACTION=create" +---- + +=== To Delete an environment + +---- +TARGET_HOST="bastion.na311.openshift.opentlc.com" +OCP_USERNAME="mavazque-redhat.com" +WORKLOAD="ocp_workload_rhacm_hcp" +GUID=1002 + +# a TARGET_HOST is specified in the command line, without using an inventory file +ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \ + -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \ + -e"ansible_user=ec2-user" \ + -e"ocp_username=${OCP_USERNAME}" \ + -e"ocp_workload=${WORKLOAD}" \ + -e"guid=${GUID}" \ + -e"ACTION=remove" +---- diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml new file mode 100644 index 0000000..82d5091 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -0,0 +1,121 @@ +--- +- name: Print debug statement + ansible.builtin.debug: + msg: "Creating cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}." + +- name: Wait for HostedCluster CRD to be registered + kubernetes.core.k8s_info: + api_version: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + name: hostedclusters.hypershift.openshift.io + register: r_crd + retries: 60 + delay: 30 + until: r_crd.resources | length | int > 0 + +- name: Include AWS Role Prep for OCP >= 4.17 + when: + - ocp4_installer_version is version('4.17', '>=') + include_tasks: prep_aws_roles.yaml + +- name: Ensure hosted cluster doesn't already exist + kubernetes.core.k8s_info: + api_version: hypershift.openshift.io/v1beta1 + kind: HostedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + namespace: local-cluster + register: r_hosted_cluster + +- name: Deploy hosted cluster (OCP >= 4.17) {{ _ocp_workload_rhacm_hcp_cluster_name }} + when: + - r_hosted_cluster.resources | length == 0 + - ocp4_installer_version is version('4.17', '>=') + block: + - name: Run hcp CLI to deploy hosted cluster (OCP >= 4.17) + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: >- + /usr/bin/hcp create cluster aws + --auto-repair + --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} + --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} + --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} + --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} + --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} + --name {{ _ocp_workload_rhacm_hcp_cluster_name }} + --namespace local-cluster + --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} + --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} + --region {{ _ocp_workload_rhacm_hcp_cluster_region }} + --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-multi + --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} + --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} + --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} + --role-arn "{{ r_role_arn.stdout }}" + --sts-creds /tmp/sts-creds.json + --pull-secret /tmp/pull_secret.json + --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}" + --endpoint-access=Public + --generate-ssh + register: r_hcp_create_cluster + retries: 5 + delay: 30 + until: r_hcp_create_cluster.rc == 0 + ignore_errors: true + + - name: Print hcp command output + ansible.builtin.debug: + msg: "{{ r_hcp_create_cluster.stdout }}" + + - name: Abort + when: r_hcp_create_cluster.rc > 0 + ansible.builtin.fail: + msg: "Cluster creation failed. Aborting." + +- name: Deploy hosted cluster (OCP <= 4.16) {{ _ocp_workload_rhacm_hcp_cluster_name }} + when: + - r_hosted_cluster.resources | length == 0 + - ocp4_installer_version is version('4.17', '<') + block: + - name: Run hcp CLI to deploy hosted cluster (OCP <= 4.16) + ansible.builtin.command: >- + /usr/bin/hcp create cluster aws + --name {{ _ocp_workload_rhacm_hcp_cluster_name }} + --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} + --region {{ _ocp_workload_rhacm_hcp_cluster_region }} + --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} + --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} + --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} + --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} + --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} + --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} + --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} + --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} + --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-x86_64 + --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} + --namespace local-cluster + --secret-creds aws-credentials + --auto-repair + register: r_hcp_create_cluster + ignore_errors: true + + - name: Print hcp command output + ansible.builtin.debug: + msg: "{{ r_hcp_create_cluster.stdout }}" + + - name: Abort + when: r_hcp_create_cluster.rc > 0 + ansible.builtin.fail: + msg: "Cluster creation failed. Aborting." + +- name: Create managed cluster to add cluster to ACM + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', 'managed-cluster.yaml.j2') | from_yaml }}" + +- name: Create klusterlet-addon-config to allow policy deployment + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', 'klusterlet-addon-config.yaml.j2') | from_yaml }}" diff --git a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml new file mode 100644 index 0000000..d3e5f99 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml @@ -0,0 +1,106 @@ +--- +- name: Get ManagedCluster + kubernetes.core.k8s_info: + api_version: cluster.open-cluster-management.io/v1 + kind: ManagedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + register: r_managed_cluster + retries: 120 + delay: 10 + until: + - r_managed_cluster.resources | length > 0 + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs is defined + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs | length > 0 + - r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url is defined + - r_managed_cluster.resources[0].status.clusterClaims is defined + - r_managed_cluster.resources[0] | to_json | from_json | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | length > 0 + +- name: Get ManagedCluster URLs + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cluster_api_url: >- + {{ r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url }} + _ocp_workload_rhacm_hcp_cluster_console_url: >- + {{ r_managed_cluster.resources[0] | to_json | from_json + | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | first }} + +- name: Get HostedCluster + kubernetes.core.k8s_info: + api_version: hypershift.openshift.io/v1beta1 + kind: HostedCluster + name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}" + namespace: local-cluster + register: r_hosted_cluster + retries: 120 + delay: 10 + until: + - r_hosted_cluster.resources[0].status.kubeadminPassword is defined + - r_hosted_cluster.resources[0].status.kubeadminPassword.name is defined + - r_hosted_cluster.resources[0].status.kubeadminPassword.name | length > 0 + - r_hosted_cluster.resources[0].status.kubeconfig is defined + - r_hosted_cluster.resources[0].status.kubeconfig.name is defined + - r_hosted_cluster.resources[0].status.kubeconfig.name | length > 0 + +- name: Get Secret names for credentials + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cluster_kubeadmin_password: >- + {{ r_hosted_cluster.resources[0].status.kubeadminPassword.name }} + _ocp_workload_rhacm_hcp_cluster_kubeconfig: >- + {{ r_hosted_cluster.resources[0].status.kubeconfig.name }} + +- name: Get kubeadmin password + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeadmin_password }}" + namespace: local-cluster + register: r_kubeadmin_password + retries: 60 + delay: 5 + until: + - r_kubeadmin_password is defined + - r_kubeadmin_password.resources | length > 0 + - r_kubeadmin_password.resources[0].data.password is defined + - r_kubeadmin_password.resources[0].data.password | length > 0 + +- name: Get kubeconfig + kubernetes.core.k8s_info: + api_version: v1 + kind: Secret + name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeconfig }}" + namespace: local-cluster + register: r_kubeconfig + retries: 60 + delay: 5 + until: + - r_kubeconfig is defined + - r_kubeconfig.resources | length > 0 + - r_kubeconfig.resources[0].data.kubeconfig is defined + - r_kubeconfig.resources[0].data.kubeconfig | length > 0 + +- name: Write kubeconfig file for student user + become: true + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeconfig" + content: "{{ r_kubeconfig.resources[0].data.kubeconfig | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: "0660" + +- name: Write kubeadmin password file for student user + become: true + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeadmin-password" + content: "{{ r_kubeadmin_password.resources[0].data.password | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: "0660" + +- name: "Save credentials for cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}" + agnosticd_user_info: + data: >- + {{ { + _ocp_workload_rhacm_hcp_cluster_name ~ '-kubeadmin-password': r_kubeadmin_password.resources[0].data.password | b64decode, + _ocp_workload_rhacm_hcp_cluster_name ~ '-admin-kubeconfig': r_kubeconfig.resources[0].data.kubeconfig | b64decode, + _ocp_workload_rhacm_hcp_cluster_name ~ '-api-url': _ocp_workload_rhacm_hcp_cluster_api_url, + _ocp_workload_rhacm_hcp_cluster_name ~ '-console-url': _ocp_workload_rhacm_hcp_cluster_console_url + } }} diff --git a/roles/ocp_workload_rhacm_hcp/tasks/main.yml b/roles/ocp_workload_rhacm_hcp/tasks/main.yml new file mode 100644 index 0000000..23308e3 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/main.yml @@ -0,0 +1,11 @@ +--- +# -------------------------------------------------- +# Do not modify this file +# -------------------------------------------------- +- name: Running workload provision tasks + when: ACTION == "provision" + ansible.builtin.include_tasks: workload.yml + +- name: Running workload removal tasks + when: ACTION == "destroy" + ansible.builtin.include_tasks: remove_workload.yml diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml new file mode 100644 index 0000000..ce1371e --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -0,0 +1,87 @@ +- name: Get ARN for hosted cluster user + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + cmd: >- + aws sts get-caller-identity --query "Arn" + register: r_arn + +- name: Debug r_arn + ansible.builtin.debug: + msg: "{{ r_arn.stdout }}" + +- name: Create trust-relationship.json + ansible.builtin.template: + src: trust-relationship.json.j2 + dest: /tmp/trust-relationship.json + mode: "0664" + +- name: Apply trust-relationship.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam create-role + --role-name hcp-cli-role + --assume-role-policy-document file://trust-relationship.json + --query "Role.Arn" + ignore_errors: true + +- name: Get trust-relationship.json Arn + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam get-role + --role-name hcp-cli-role + --query "Role.Arn" + register: r_role_arn + ignore_errors: true + +- name: Debug r_role_arn + ansible.builtin.debug: + msg: "{{ r_role_arn.stdout }}" + +- name: Create awspolicy-hcp-cli-role.json + ansible.builtin.template: + src: awspolicy-hcp-cli-role.json.j2 + dest: /tmp/awspolicy-hcp-cli-role.json + mode: "0664" + +- name: Apply awspolicy-hcp-cli-role.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam put-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json + --policy-document file://awspolicy-hcp-cli-role.json + ignore_errors: true + +- name: Get STS credentials + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.shell: + chdir: /tmp + cmd: >- + aws sts get-session-token --output json > sts-creds.json + register: r_sts + +- name: Write pull secret to a file + ansible.builtin.copy: + content: "{{ ocp4_pull_secret }}" + dest: /tmp/pull_secret.json diff --git a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml new file mode 100644 index 0000000..eb29e4f --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml @@ -0,0 +1,50 @@ +--- +# Implement your Workload removal tasks here +- name: Removing workload for user + ansible.builtin.debug: + msg: "Removing workload for user ocp_username = {{ ocp_username }} - not implemented" + +- name: Remove role-policy hcp-cli-role, trust-relationship.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam delete-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json + ignore_errors: true + +- name: Remove role hcp-cli-role + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam delete-role + --role-name hcp-cli-role + ignore_errors: true + +- name: Apply awspolicy-hcp-cli-role.json + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws iam delete-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json + --policy-document file://awspolicy-hcp-cli-role.json + ignore_errors: true + +# Leave this as the last task in the playbook. +- name: Remove_workload tasks complete + when: not silent|bool + ansible.builtin.debug: + msg: "Remove Workload tasks completed successfully." diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml new file mode 100644 index 0000000..7f8a88f --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -0,0 +1,286 @@ +--- +############################################################################# +# Prerequisite Checks +############################################################################# + +- name: Ensure RHACM MultiClusterHub is deployed + kubernetes.core.k8s_info: + api_version: "operator.open-cluster-management.io/v1" + kind: MultiClusterHub + name: multiclusterhub + namespace: open-cluster-management + register: r_rhacm_multiclusterhub + +- name: Assert that MultiClusterHub is available + ansible.builtin.assert: + that: + - r_rhacm_multiclusterhub.resources | length == 1 + - r_rhacm_multiclusterhub.resources[0].status.phase is defined + - r_rhacm_multiclusterhub.resources[0].status is defined + - r_rhacm_multiclusterhub.resources[0].status.phase == "Running" + # quiet: true + fail_msg: "MultiClusterHub not found on cluster. Can not continue." + success_msg: "MultiClusterHub found on cluster. Ready to set up Hypershift." + +- name: Assert that MultiClusterHub is version 2.17.0 or higher + ansible.builtin.assert: + that: "r_rhacm_multiclusterhub.resources[0].status.currentVersion is version('2.17.0', '>=')" + quiet: true + fail_msg: "MultiClusterHub not at version 2.17.0 or higher. Please upgrade your RHACM. Can not continue." + success_msg: "MultiClusterHub found on cluster in version 2.17.0 or higher. Ready to set up Hypershift." + +############################################################################# +# AWS S3 bucket setup +############################################################################# +- name: Create AWS S3 bucket + amazon.aws.s3_bucket: + # s3_bucket: + name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + state: present + aws_access_key: "{{ aws_access_key_id }}" + aws_secret_key: "{{ aws_secret_access_key }}" + public_access: + block_public_acls: false + block_public_policy: false + ignore_public_acls: true + restrict_public_buckets: false + +- name: Update s3 bucket + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + cmd: >- + aws s3api delete-public-access-block + --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + +- name: Copy policy file + ansible.builtin.template: + src: bucket-policy.json.j2 + dest: /tmp/bucket-policy.json + mode: ug=rw,o=r + +- name: Apply bucket policy + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: + chdir: /tmp + cmd: >- + aws s3api put-bucket-policy + --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + --policy file://bucket-policy.json + +- name: Remove temporary policy file + ansible.builtin.file: + state: absent + path: /tmp/bucket-policy.json + +############################################################################# +# Configure HyperShift +############################################################################# +- name: Create s3 credentials secret + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', 'secret-s3-credentials.yaml.j2') }}" + +- name: Generate an OpenSSH keypair for HyperShift + community.crypto.openssh_keypair: + path: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}" + register: r_hypershift_key + +- name: Read private key from filesystem + ansible.builtin.slurp: + src: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}" + register: r_hypershift_private_key + +- name: Read public key from filesystem + ansible.builtin.slurp: + src: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}.pub" + register: r_hypershift_public_key + +- name: Create hypershift aws credentials secret + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', 'secret-aws-credentials.yaml.j2') }}" + +############################################################################# +# Install HCP CLI +############################################################################# + +- name: Wait until HCP CLI download deployment is ready + kubernetes.core.k8s_info: + api_version: v1 + kind: Deployment + namespace: multicluster-engine + name: hcp-cli-download + register: r_hcp_cli_deployment + retries: 60 + delay: 30 + until: + - r_hcp_cli_deployment.resources | length | int > 0 + - r_hcp_cli_deployment.resources[0].status.readyReplicas is defined + - r_hcp_cli_deployment.resources[0].status.readyReplicas | int == r_hcp_cli_deployment.resources[0].spec.replicas | int + +- name: Get HCP CLI download URL + kubernetes.core.k8s_info: + api_version: console.openshift.io/v1 + kind: ConsoleCLIDownload + name: hcp-cli-download + register: r_hcp_cli_download + retries: 20 + delay: 10 + until: r_hcp_cli_download.resources | length > 0 + +- name: Set HCP CLI download URL + when: r_hcp_cli_download.resources | length > 0 + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cli_url: >- + {{ r_hcp_cli_download.resources[0] | to_json | from_json + | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} + +- name: Download HCP CLI + ansible.builtin.get_url: + url: "{{ _ocp_workload_rhacm_hcp_cli_url }}" + validate_certs: false + dest: /tmp/hcp.tar.gz + mode: "0660" + register: r_hcp_cli + until: r_hcp_cli is success + retries: 10 + delay: 10 + +- name: Install HCP CLI on bastion + become: true + ansible.builtin.unarchive: + src: /tmp/hcp.tar.gz + remote_src: true + dest: /usr/bin + mode: "0775" + owner: root + group: root + args: + creates: /usr/bin/hcp + +- name: Remove downloaded file + ansible.builtin.file: + state: absent + path: /tmp/hcp.tar.gz + +- name: Setup HCP CLI bash completion + become: true + ansible.builtin.shell: "/usr/bin/hcp completion bash >/etc/bash_completion.d/hcp" + args: + creates: /etc/bash_completion.d/hcp + +############################################################################# +# Set up RHDP Configuration +# Automatically configure newly deployed HCP clusters +############################################################################# + +- name: Set up RHDP Configuration + when: ocp_workload_rhacm_hcp_rhdp_policies_setup | bool + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', item) }}" + loop: + - rhdp/clusterrolebinding.yaml.j2 + - rhdp/namespace-channels.yaml.j2 + - rhdp/namespace-applications.yaml.j2 + - rhdp/namespace-policies.yaml.j2 + - rhdp/secret.yaml.j2 + - rhdp/channel.yaml.j2 + - rhdp/placement.yaml.j2 + - rhdp/subscription.yaml.j2 + - rhdp/application.yaml.j2 + - rhdp/managedclustersetbinding.yaml.j2 + +############################################################################# +# Set up ManagedClusterSet Policies +############################################################################# + +- name: Set up ManagedClusterSet + when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool + kubernetes.core.k8s: + state: present + definition: "{{ lookup('template', item) }}" + loop: + - managedclusterset/namespace-submariner-broker.yaml.j2 + - managedclusterset/managedclusterset.yaml.j2 + - managedclusterset/managedclustersetbinding.yaml.j2 + +############################################################################# +# Wait for ConfigMap kube-public/oidc-storage-provider-s3-config to be +# available before proceeding +############################################################################# + +- name: Wait for ConfigMap kube-public/oidc-storage-provider-s3-config + kubernetes.core.k8s_info: + api_version: v1 + kind: ConfigMap + name: oidc-storage-provider-s3-config + namespace: kube-public + register: r_oidc_configmap + until: + - r_oidc_configmap.resources is defined + - r_oidc_configmap.resources | length > 0 + retries: 60 + delay: 10 + +############################################################################# +# Deploy managed HyperShift clusters +############################################################################# + +- name: Deploy Hypershift clusters + when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 + ansible.builtin.include_tasks: create_hypershift_cluster.yml + vars: + _ocp_workload_rhacm_hcp_cluster_name: "{{ cluster.name }}" + _ocp_workload_rhacm_hcp_cluster_infra_id: "{{ cluster.infra_id }}" + _ocp_workload_rhacm_hcp_cluster_ocp_release: "{{ cluster.ocp_release }}" + _ocp_workload_rhacm_hcp_cluster_control_plane_availability: "{{ cluster.control_plane_availability | default('SingleReplica') }}" + _ocp_workload_rhacm_hcp_cluster_infra_availability: "{{ cluster.infra_availability | default('SingleReplica') }}" + _ocp_workload_rhacm_hcp_cluster_etc_storage_class: "{{ cluster.etcd_storage_class | default('gp3-csi') }}" + _ocp_workload_rhacm_hcp_cluster_nodepool_replicas: "{{ cluster.nodepool_replicas }}" + _ocp_workload_rhacm_hcp_cluster_worker_instance_type: "{{ cluster.worker_instance_type }}" + _ocp_workload_rhacm_hcp_cluster_root_volume_type: "{{ cluster.root_volume_type | default('gp3') }}" + _ocp_workload_rhacm_hcp_cluster_root_volume_size: "{{ cluster.root_volume_size | default('120') }}" + _ocp_workload_rhacm_hcp_cluster_network_type: "{{ cluster.network_type | default('OVNKubernetes') }}" + _ocp_workload_rhacm_hcp_cluster_region: "{{ cluster.region }}" + _ocp_workload_rhacm_hcp_cluster_zones: "{{ cluster.zones | default([]) }}" + _ocp_workload_rhacm_hcp_cluster_labels: "{{ cluster.labels | default([]) }}" + loop: "{{ ocp_workload_rhacm_hcp_deploy_clusters }}" + loop_control: + label: "{{ cluster.name }}" + loop_var: cluster + +############################################################################# +# AgnosticD User Data +############################################################################# + +- name: Save access information for all deployed clusters + when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 + ansible.builtin.include_tasks: + file: get_cluster_credentials.yml + vars: + _ocp_workload_rhacm_hcp_cluster_name: "{{ item.name }}" + loop: "{{ ocp_workload_rhacm_hcp_deploy_clusters }}" + loop_control: + label: "{{ item.name }}" + +- name: Save user data for S3 bucket + agnosticd_user_info: + data: + hypershift_s3_bucket_name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + hypershift_s3_region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + hypershift_s3_access_key_id: "{{ aws_access_key_id }}" + hypershift_s3_secret_access_key: "{{ aws_secret_access_key }}" + +# Leave this as the last task in the playbook. +- name: Workload tasks complete + when: not silent|bool + ansible.builtin.debug: + msg: "Workload Tasks completed successfully." diff --git a/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 new file mode 100644 index 0000000..6b6c7f3 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/awspolicy-hcp-cli-role.json.j2 @@ -0,0 +1,130 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "EC2", + "Effect": "Allow", + "Action": [ + "ec2:CreateDhcpOptions", + "ec2:DeleteSubnet", + "ec2:ReplaceRouteTableAssociation", + "ec2:DescribeAddresses", + "ec2:DescribeInstances", + "ec2:DeleteVpcEndpoints", + "ec2:CreateNatGateway", + "ec2:CreateVpc", + "ec2:DescribeDhcpOptions", + "ec2:AttachInternetGateway", + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:DeleteRouteTable", + "ec2:AssociateRouteTable", + "ec2:DescribeInternetGateways", + "ec2:DescribeAvailabilityZones", + "ec2:CreateRoute", + "ec2:CreateInternetGateway", + "ec2:RevokeSecurityGroupEgress", + "ec2:ModifyVpcAttribute", + "ec2:DeleteInternetGateway", + "ec2:DescribeVpcEndpointConnections", + "ec2:RejectVpcEndpointConnections", + "ec2:DescribeRouteTables", + "ec2:ReleaseAddress", + "ec2:AssociateDhcpOptions", + "ec2:TerminateInstances", + "ec2:CreateTags", + "ec2:DeleteRoute", + "ec2:CreateRouteTable", + "ec2:DetachInternetGateway", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeNatGateways", + "ec2:DisassociateRouteTable", + "ec2:AllocateAddress", + "ec2:DescribeSecurityGroups", + "ec2:RevokeSecurityGroupIngress", + "ec2:CreateVpcEndpoint", + "ec2:DescribeVpcs", + "ec2:DeleteSecurityGroup", + "ec2:DeleteDhcpOptions", + "ec2:DeleteNatGateway", + "ec2:DescribeVpcEndpoints", + "ec2:DeleteVpc", + "ec2:CreateSubnet", + "ec2:DescribeSubnets" + ], + "Resource": "*" + }, + { + "Sid": "ELB", + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DeleteTargetGroup" + ], + "Resource": "*" + }, + { + "Sid": "IAMPassRole", + "Effect": "Allow", + "Action": "iam:PassRole", + "Resource": "arn:*:iam::*:role/*-worker-role", + "Condition": { + "ForAnyValue:StringEqualsIfExists": { + "iam:PassedToService": "ec2.amazonaws.com" + } + } + }, + { + "Sid": "IAM", + "Effect": "Allow", + "Action": [ + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:GetRole", + "iam:UpdateAssumeRolePolicy", + "iam:GetInstanceProfile", + "iam:TagRole", + "iam:RemoveRoleFromInstanceProfile", + "iam:CreateRole", + "iam:DeleteRole", + "iam:PutRolePolicy", + "iam:AddRoleToInstanceProfile", + "iam:CreateOpenIDConnectProvider", + "iam:TagOpenIDConnectProvider", + "iam:ListOpenIDConnectProviders", + "iam:DeleteRolePolicy", + "iam:UpdateRole", + "iam:DeleteOpenIDConnectProvider", + "iam:GetRolePolicy" + ], + "Resource": "*" + }, + { + "Sid": "Route53", + "Effect": "Allow", + "Action": [ + "route53:ListHostedZonesByVPC", + "route53:CreateHostedZone", + "route53:ListHostedZones", + "route53:ChangeResourceRecordSets", + "route53:ListResourceRecordSets", + "route53:DeleteHostedZone", + "route53:AssociateVPCWithHostedZone", + "route53:ListHostedZonesByName" + ], + "Resource": "*" + }, + { + "Sid": "S3", + "Effect": "Allow", + "Action": [ + "s3:ListAllMyBuckets", + "s3:ListBucket", + "s3:DeleteObject", + "s3:DeleteBucket" + ], + "Resource": "*" + } + ] +} diff --git a/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 new file mode 100644 index 0000000..69f729a --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/bucket-policy.json.j2 @@ -0,0 +1,11 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": "*", + "Action": "s3:GetObject", + "Resource": "arn:aws:s3:::{{ ocp_workload_rhacm_hcp_s3_bucket_name }}/*" + } + ] +} diff --git a/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 new file mode 100644 index 0000000..5bf7851 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/hypershift-override-images.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: hypershift-override-images + namespace: local-cluster +data: + apiserver-network-proxy: {{ ocp_workload_rhacm_hcp_hcp_registry }}/apiserver-network-proxy-rhel8:{{ ocp_workload_rhacm_hcp_apiserver_network_proxy_image_tag }} + aws-encryption-provider: {{ ocp_workload_rhacm_hcp_hcp_registry }}/aws-encryption-provider-rhel8:{{ ocp_workload_rhacm_hcp_aws_encryption_provider_image_tag }} + cluster-api: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_image_tag }} + cluster-api-provider-agent: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-agent-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_agent_image_tag }} + cluster-api-provider-aws: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-aws-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_aws_image_tag }} + cluster-api-provider-azure: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-azure-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_azure_image_tag }} + cluster-api-provider-kubevirt: {{ ocp_workload_rhacm_hcp_hcp_registry }}/cluster-api-provider-kubevirt-rhel8:{{ ocp_workload_rhacm_hcp_cluster_api_provider_kubevirt_image_tag }} + hypershift-cli: {{ ocp_workload_rhacm_hcp_hcp_registry }}/hypershift-cli-rhel8:{{ ocp_workload_rhacm_hcp_hypershift_cli_image_tag }} + hypershift-operator: {{ ocp_workload_rhacm_hcp_hcp_registry }}/hypershift-rhel8-operator:{{ ocp_workload_rhacm_hcp_hypershift_operator_image_tag }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 new file mode 100644 index 0000000..af6ef73 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 @@ -0,0 +1,22 @@ +--- +apiVersion: agent.open-cluster-management.io/v1 +kind: KlusterletAddonConfig +metadata: + name: {{ _ocp_workload_rhacm_hcp_cluster_name }} + namespace: {{ _ocp_workload_rhacm_hcp_cluster_name }} +spec: + clusterName: {{ _ocp_workload_rhacm_hcp_cluster_name }} + clusterNamespace: {{ _ocp_workload_rhacm_hcp_cluster_name }} + clusterLabels: + cloud: auto-detect + vendor: auto-detect + applicationManager: + enabled: true + certPolicyController: + enabled: true + iamPolicyController: + enabled: true + policyController: + enabled: true + searchCollector: + enabled: true diff --git a/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 new file mode 100644 index 0000000..6b9cb1a --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managed-cluster.yaml.j2 @@ -0,0 +1,23 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1 +kind: ManagedCluster +metadata: + name: {{ _ocp_workload_rhacm_hcp_cluster_name }} + annotations: + import.open-cluster-management.io/hosting-cluster-name: local-cluster + import.open-cluster-management.io/klusterlet-deploy-mode: Hosted + open-cluster-management/created-via: AgnosticD + labels: + name: {{ _ocp_workload_rhacm_hcp_cluster_name }} + cloud: auto-detect + cluster.open-cluster-management.io/clusterset: default + vendor: OpenShift +{% if _ocp_workload_rhacm_hcp_cluster_labels | default("") | length > 0 %} + {{ _ocp_workload_rhacm_hcp_cluster_labels | to_nice_yaml | indent(4) }} +{% endif %} +{% if ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool %} + cluster.open-cluster-management.io/clusterset: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} +{% endif %} +spec: + hubAcceptsClient: true + leaseDurationSeconds: 60 diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 new file mode 100644 index 0000000..ce56d26 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclusterset.yaml.j2 @@ -0,0 +1,13 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSet +metadata: + annotations: + cluster.open-cluster-management.io/submariner-broker-ns: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker + finalizers: + - cluster.open-cluster-management.io/managedclusterset-clusterrole + - cluster.open-cluster-management.io/submariner-cleanup + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} +spec: + clusterSelector: + selectorType: ExclusiveClusterSetLabel diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 new file mode 100644 index 0000000..fce3984 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 @@ -0,0 +1,8 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSetBinding +metadata: + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace | default("rhdp-policies" ) }} +spec: + clusterSet: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 new file mode 100644 index 0000000..710e8de --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/namespace-submariner-broker.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 new file mode 100644 index 0000000..a6a45ef --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 @@ -0,0 +1,14 @@ +--- +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: rhdp-hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} +spec: + componentKinds: + - group: apps.open-cluster-management.io + kind: Subscription + descriptor: {} + selector: + matchLabels: + app: rhdp-hcp-configuration diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 new file mode 100644 index 0000000..49dae19 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 @@ -0,0 +1,11 @@ +--- +apiVersion: apps.open-cluster-management.io/v1 +kind: Channel +metadata: + name: rhdp-hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + annotations: + apps.open-cluster-management.io/reconcile-rate: medium +spec: + pathname: {{ ocp_workload_rhacm_hcp_rhdp_policies_repository }} + type: Git diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 new file mode 100644 index 0000000..17e6476 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: open-cluster-management:subscription-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: open-cluster-management:subscription-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: User + name: system:admin +- apiGroup: rbac.authorization.k8s.io + kind: User + name: {{ ocp_workload_rhacm_hcp_rhdp_policies_admin_user }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 new file mode 100644 index 0000000..fc012c1 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 @@ -0,0 +1,8 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta2 +kind: ManagedClusterSetBinding +metadata: + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + name: global +spec: + clusterSet: global diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 new file mode 100644 index 0000000..2914b18 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_rhdp_applications_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 new file mode 100644 index 0000000..e6eb92c --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_rhdp_channels_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 new file mode 100644 index 0000000..529ae22 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 new file mode 100644 index 0000000..3875f32 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta1 +kind: Placement +metadata: + name: rhdp-hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + labels: + app: rhdp-hcp-configuration +spec: + predicates: + - requiredClusterSelector: + labelSelector: + matchLabels: + local-cluster: 'true' + clusterSets: + - global diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 new file mode 100644 index 0000000..facde05 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aws-secret-access-key + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} +type: Opaque +data: + secret-access-key: {{ ocp_workload_rhacm_hcp_rhdp_policies_aws_secret_access_key | b64encode }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 new file mode 100644 index 0000000..81d1aa9 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 @@ -0,0 +1,18 @@ +--- +apiVersion: apps.open-cluster-management.io/v1 +kind: Subscription +metadata: + name: rhdp-hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + annotations: + apps.open-cluster-management.io/git-branch: {{ ocp_workload_rhacm_hcp_rhdp_policies_repository_branch }} + apps.open-cluster-management.io/git-path: "{{ ocp_workload_rhacm_hcp_rhdp_policies_repository_path }}" + apps.open-cluster-management.io/reconcile-option: merge + labels: + app: rhdp-hcp-configuration +spec: + channel: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }}/rhdp-hcp-configuration + placement: + placementRef: + kind: Placement + name: rhdp-hcp-configuration diff --git a/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 new file mode 100644 index 0000000..2b0ab44 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/secret-aws-credentials.yaml.j2 @@ -0,0 +1,23 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aws-credentials + namespace: local-cluster + labels: + cluster.open-cluster-management.io/credentials: "" + cluster.open-cluster-management.io/type: aws + cluster.open-cluster-management.io/backup: "true" +type: Opaque +data: + additionalTrustBundle: "" + aws_secret_access_key: {{ aws_secret_access_key | b64encode }} + aws_access_key_id: {{ aws_access_key_id | b64encode }} + baseDomain: {{ subdomain_base_suffix | regex_replace('^\.', '') | b64encode }} + httpProxy: "" + httpsProxy: "" + noProxy: "" + pullSecret: {{ (ocp4_pull_secret | to_json if ocp4_pull_secret is mapping else ocp4_pull_secret) | b64encode }} + .dockerconfigjson: {{ (ocp4_pull_secret | to_json if ocp4_pull_secret is mapping else ocp4_pull_secret) | b64encode }} + ssh-publickey: {{ r_hypershift_public_key.content }} + ssh-privatekey: {{ r_hypershift_private_key.content }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 new file mode 100644 index 0000000..a03db35 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/secret-s3-credentials.yaml.j2 @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: hypershift-operator-oidc-provider-s3-credentials + namespace: local-cluster + labels: + cluster.open-cluster-management.io/credentials: "" + cluster.open-cluster-management.io/type: awss3 + cluster.open-cluster-management.io/backup: "true" +stringData: + bucket: {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + region: {{ ocp_workload_rhacm_hcp_s3_bucket_region }} + credentials: |- + [default] + aws_access_key_id={{ aws_access_key_id }} + aws_secret_access_key={{ aws_secret_access_key }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 b/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 new file mode 100644 index 0000000..a4bd5e1 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/trust-relationship.json.j2 @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": {{ r_arn.stdout }} + }, + "Action": "sts:AssumeRole" + } + ] +} From 258c62e256fd9413973f925dbb670e732bf93b99 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 15:41:36 +0200 Subject: [PATCH 02/19] Fix user info --- roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml | 2 +- roles/ocp_workload_rhacm_hcp/tasks/workload.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml index d3e5f99..2a047d2 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml @@ -96,7 +96,7 @@ mode: "0660" - name: "Save credentials for cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}" - agnosticd_user_info: + agnosticd.core.agnosticd_user_info: data: >- {{ { _ocp_workload_rhacm_hcp_cluster_name ~ '-kubeadmin-password': r_kubeadmin_password.resources[0].data.password | b64decode, diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 7f8a88f..8b230fd 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -272,7 +272,7 @@ label: "{{ item.name }}" - name: Save user data for S3 bucket - agnosticd_user_info: + agnosticd.core.agnosticd_user_info: data: hypershift_s3_bucket_name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" hypershift_s3_region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" From 706188aa4d40b0b41a626b56d802f484c1f4cbeb Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 15:48:45 +0200 Subject: [PATCH 03/19] Fixes for EE --- .../tasks/remove_workload.yml | 11 -- .../ocp_workload_rhacm_hcp/tasks/workload.yml | 129 ++++++++---------- 2 files changed, 60 insertions(+), 80 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml index eb29e4f..fc0184f 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml @@ -1,9 +1,4 @@ --- -# Implement your Workload removal tasks here -- name: Removing workload for user - ansible.builtin.debug: - msg: "Removing workload for user ocp_username = {{ ocp_username }} - not implemented" - - name: Remove role-policy hcp-cli-role, trust-relationship.json environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" @@ -42,9 +37,3 @@ --policy-name trust-relationship.json --policy-document file://awspolicy-hcp-cli-role.json ignore_errors: true - -# Leave this as the last task in the playbook. -- name: Remove_workload tasks complete - when: not silent|bool - ansible.builtin.debug: - msg: "Remove Workload tasks completed successfully." diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 8b230fd..a9c453f 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -2,7 +2,6 @@ ############################################################################# # Prerequisite Checks ############################################################################# - - name: Ensure RHACM MultiClusterHub is deployed kubernetes.core.k8s_info: api_version: "operator.open-cluster-management.io/v1" @@ -85,32 +84,31 @@ - name: Create s3 credentials secret kubernetes.core.k8s: state: present - definition: "{{ lookup('template', 'secret-s3-credentials.yaml.j2') }}" + template: secret-s3-credentials.yaml.j2 - name: Generate an OpenSSH keypair for HyperShift community.crypto.openssh_keypair: - path: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}" + path: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}" register: r_hypershift_key - name: Read private key from filesystem ansible.builtin.slurp: - src: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}" + src: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}" register: r_hypershift_private_key - name: Read public key from filesystem ansible.builtin.slurp: - src: "~{{ ansible_user }}/.ssh/{{ ocp_workload_rhacm_key_pair_name }}.pub" + src: "/tmp/{{ ocp_workload_rhacm_key_pair_name }}.pub" register: r_hypershift_public_key - name: Create hypershift aws credentials secret kubernetes.core.k8s: state: present - definition: "{{ lookup('template', 'secret-aws-credentials.yaml.j2') }}" + template: secret-aws-credentials.yaml.j2 ############################################################################# # Install HCP CLI ############################################################################# - - name: Wait until HCP CLI download deployment is ready kubernetes.core.k8s_info: api_version: v1 @@ -125,67 +123,69 @@ - r_hcp_cli_deployment.resources[0].status.readyReplicas is defined - r_hcp_cli_deployment.resources[0].status.readyReplicas | int == r_hcp_cli_deployment.resources[0].spec.replicas | int -- name: Get HCP CLI download URL - kubernetes.core.k8s_info: - api_version: console.openshift.io/v1 - kind: ConsoleCLIDownload - name: hcp-cli-download - register: r_hcp_cli_download - retries: 20 - delay: 10 - until: r_hcp_cli_download.resources | length > 0 - -- name: Set HCP CLI download URL - when: r_hcp_cli_download.resources | length > 0 - ansible.builtin.set_fact: - _ocp_workload_rhacm_hcp_cli_url: >- - {{ r_hcp_cli_download.resources[0] | to_json | from_json - | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} - -- name: Download HCP CLI - ansible.builtin.get_url: - url: "{{ _ocp_workload_rhacm_hcp_cli_url }}" - validate_certs: false - dest: /tmp/hcp.tar.gz - mode: "0660" - register: r_hcp_cli - until: r_hcp_cli is success - retries: 10 - delay: 10 - -- name: Install HCP CLI on bastion - become: true - ansible.builtin.unarchive: - src: /tmp/hcp.tar.gz - remote_src: true - dest: /usr/bin - mode: "0775" - owner: root - group: root - args: - creates: /usr/bin/hcp - -- name: Remove downloaded file - ansible.builtin.file: - state: absent - path: /tmp/hcp.tar.gz - -- name: Setup HCP CLI bash completion - become: true - ansible.builtin.shell: "/usr/bin/hcp completion bash >/etc/bash_completion.d/hcp" - args: - creates: /etc/bash_completion.d/hcp +- name: Run on Bastion + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + block: + - name: Get HCP CLI download URL + kubernetes.core.k8s_info: + api_version: console.openshift.io/v1 + kind: ConsoleCLIDownload + name: hcp-cli-download + register: r_hcp_cli_download + retries: 20 + delay: 10 + until: r_hcp_cli_download.resources | length > 0 + + - name: Set HCP CLI download URL + when: r_hcp_cli_download.resources | length > 0 + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cli_url: >- + {{ r_hcp_cli_download.resources[0] | to_json | from_json + | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} + + - name: Download HCP CLI + ansible.builtin.get_url: + url: "{{ _ocp_workload_rhacm_hcp_cli_url }}" + validate_certs: false + dest: /tmp/hcp.tar.gz + mode: ug=rw,o=r + register: r_hcp_cli + until: r_hcp_cli is success + retries: 10 + delay: 10 + + - name: Install HCP CLI on bastion + become: true + ansible.builtin.unarchive: + src: /tmp/hcp.tar.gz + remote_src: true + dest: /usr/bin + mode: ug=rwx,o=rx + owner: root + group: root + args: + creates: /usr/bin/hcp + + - name: Remove downloaded file + ansible.builtin.file: + state: absent + path: /tmp/hcp.tar.gz + + - name: Setup HCP CLI bash completion + become: true + ansible.builtin.shell: "/usr/bin/hcp completion bash >/etc/bash_completion.d/hcp" + args: + creates: /etc/bash_completion.d/hcp ############################################################################# # Set up RHDP Configuration # Automatically configure newly deployed HCP clusters ############################################################################# - - name: Set up RHDP Configuration when: ocp_workload_rhacm_hcp_rhdp_policies_setup | bool kubernetes.core.k8s: state: present - definition: "{{ lookup('template', item) }}" + template: "{{ item }}" loop: - rhdp/clusterrolebinding.yaml.j2 - rhdp/namespace-channels.yaml.j2 @@ -206,7 +206,7 @@ when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool kubernetes.core.k8s: state: present - definition: "{{ lookup('template', item) }}" + template: "{{ item }}" loop: - managedclusterset/namespace-submariner-broker.yaml.j2 - managedclusterset/managedclusterset.yaml.j2 @@ -216,7 +216,6 @@ # Wait for ConfigMap kube-public/oidc-storage-provider-s3-config to be # available before proceeding ############################################################################# - - name: Wait for ConfigMap kube-public/oidc-storage-provider-s3-config kubernetes.core.k8s_info: api_version: v1 @@ -233,7 +232,6 @@ ############################################################################# # Deploy managed HyperShift clusters ############################################################################# - - name: Deploy Hypershift clusters when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 ansible.builtin.include_tasks: create_hypershift_cluster.yml @@ -260,7 +258,6 @@ ############################################################################# # AgnosticD User Data ############################################################################# - - name: Save access information for all deployed clusters when: ocp_workload_rhacm_hcp_deploy_clusters | length > 0 ansible.builtin.include_tasks: @@ -278,9 +275,3 @@ hypershift_s3_region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" hypershift_s3_access_key_id: "{{ aws_access_key_id }}" hypershift_s3_secret_access_key: "{{ aws_secret_access_key }}" - -# Leave this as the last task in the playbook. -- name: Workload tasks complete - when: not silent|bool - ansible.builtin.debug: - msg: "Workload Tasks completed successfully." From 84b2eccb31ca6920175d93810dc7578e633f5191 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 15:54:00 +0200 Subject: [PATCH 04/19] Modernize wait --- roles/ocp_workload_rhacm_hcp/tasks/workload.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index a9c453f..d8fa491 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -111,17 +111,16 @@ ############################################################################# - name: Wait until HCP CLI download deployment is ready kubernetes.core.k8s_info: - api_version: v1 + api_version: apps/v1 kind: Deployment namespace: multicluster-engine name: hcp-cli-download - register: r_hcp_cli_deployment - retries: 60 - delay: 30 - until: - - r_hcp_cli_deployment.resources | length | int > 0 - - r_hcp_cli_deployment.resources[0].status.readyReplicas is defined - - r_hcp_cli_deployment.resources[0].status.readyReplicas | int == r_hcp_cli_deployment.resources[0].spec.replicas | int + wait: true + wait_condition: + type: Available + status: "True" + wait_sleep: 30 + wait_timeout: 1800 - name: Run on Bastion delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" From 07cce6565558ff8bf088e4d504e704500808d159 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 15:59:23 +0200 Subject: [PATCH 05/19] Fix include --- .../tasks/create_hypershift_cluster.yml | 6 ++---- roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index 82d5091..c67c134 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -13,10 +13,8 @@ delay: 30 until: r_crd.resources | length | int > 0 -- name: Include AWS Role Prep for OCP >= 4.17 - when: - - ocp4_installer_version is version('4.17', '>=') - include_tasks: prep_aws_roles.yaml +- name: Include AWS Role Prep + ansible.builtin.include_tasks: prep_aws_roles.yaml - name: Ensure hosted cluster doesn't already exist kubernetes.core.k8s_info: diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml index ce1371e..cc19e61 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -16,7 +16,7 @@ ansible.builtin.template: src: trust-relationship.json.j2 dest: /tmp/trust-relationship.json - mode: "0664" + mode: ug=rw,o=r - name: Apply trust-relationship.json environment: From f9adcf473aa744f40d759aaac6da0eb7dc346f0a Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Mon, 20 Jul 2026 16:01:58 +0200 Subject: [PATCH 06/19] Fix hcp deploy --- .../tasks/create_hypershift_cluster.yml | 48 ++----------------- 1 file changed, 5 insertions(+), 43 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index c67c134..cf2cab5 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -24,12 +24,10 @@ namespace: local-cluster register: r_hosted_cluster -- name: Deploy hosted cluster (OCP >= 4.17) {{ _ocp_workload_rhacm_hcp_cluster_name }} - when: - - r_hosted_cluster.resources | length == 0 - - ocp4_installer_version is version('4.17', '>=') +- name: Deploy hosted cluster {{ _ocp_workload_rhacm_hcp_cluster_name }} + when: r_hosted_cluster.resources | length == 0 block: - - name: Run hcp CLI to deploy hosted cluster (OCP >= 4.17) + - name: Run hcp CLI to deploy hosted cluster environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" @@ -72,48 +70,12 @@ ansible.builtin.fail: msg: "Cluster creation failed. Aborting." -- name: Deploy hosted cluster (OCP <= 4.16) {{ _ocp_workload_rhacm_hcp_cluster_name }} - when: - - r_hosted_cluster.resources | length == 0 - - ocp4_installer_version is version('4.17', '<') - block: - - name: Run hcp CLI to deploy hosted cluster (OCP <= 4.16) - ansible.builtin.command: >- - /usr/bin/hcp create cluster aws - --name {{ _ocp_workload_rhacm_hcp_cluster_name }} - --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} - --region {{ _ocp_workload_rhacm_hcp_cluster_region }} - --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} - --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} - --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} - --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} - --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} - --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} - --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} - --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} - --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-x86_64 - --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} - --namespace local-cluster - --secret-creds aws-credentials - --auto-repair - register: r_hcp_create_cluster - ignore_errors: true - - - name: Print hcp command output - ansible.builtin.debug: - msg: "{{ r_hcp_create_cluster.stdout }}" - - - name: Abort - when: r_hcp_create_cluster.rc > 0 - ansible.builtin.fail: - msg: "Cluster creation failed. Aborting." - - name: Create managed cluster to add cluster to ACM kubernetes.core.k8s: state: present - definition: "{{ lookup('template', 'managed-cluster.yaml.j2') | from_yaml }}" + template: managed-cluster.yaml.j2 - name: Create klusterlet-addon-config to allow policy deployment kubernetes.core.k8s: state: present - definition: "{{ lookup('template', 'klusterlet-addon-config.yaml.j2') | from_yaml }}" + template: klusterlet-addon-config.yaml.j2 From d6da79ad9a54d0902462590a2b395d2b79b652dd Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 12:28:22 +0200 Subject: [PATCH 07/19] Fix bastion delegate --- .../ocp_workload_rhacm_hcp/tasks/workload.yml | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index d8fa491..280881d 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -122,26 +122,26 @@ wait_sleep: 30 wait_timeout: 1800 +- name: Get HCP CLI download URL + kubernetes.core.k8s_info: + api_version: console.openshift.io/v1 + kind: ConsoleCLIDownload + name: hcp-cli-download + register: r_hcp_cli_download + retries: 20 + delay: 10 + until: r_hcp_cli_download.resources | length > 0 + +- name: Set HCP CLI download URL + when: r_hcp_cli_download.resources | length > 0 + ansible.builtin.set_fact: + _ocp_workload_rhacm_hcp_cli_url: >- + {{ r_hcp_cli_download.resources[0] | to_json | from_json + | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} + - name: Run on Bastion delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" block: - - name: Get HCP CLI download URL - kubernetes.core.k8s_info: - api_version: console.openshift.io/v1 - kind: ConsoleCLIDownload - name: hcp-cli-download - register: r_hcp_cli_download - retries: 20 - delay: 10 - until: r_hcp_cli_download.resources | length > 0 - - - name: Set HCP CLI download URL - when: r_hcp_cli_download.resources | length > 0 - ansible.builtin.set_fact: - _ocp_workload_rhacm_hcp_cli_url: >- - {{ r_hcp_cli_download.resources[0] | to_json | from_json - | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} - - name: Download HCP CLI ansible.builtin.get_url: url: "{{ _ocp_workload_rhacm_hcp_cli_url }}" From 9fcb6a527960d5ea473e672d47b7c520a33c33ce Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 12:54:40 +0200 Subject: [PATCH 08/19] Fix calling hcp command --- .../tasks/create_hypershift_cluster.yml | 81 ++++++++++--------- 1 file changed, 41 insertions(+), 40 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index cf2cab5..afe63c4 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -27,48 +27,49 @@ - name: Deploy hosted cluster {{ _ocp_workload_rhacm_hcp_cluster_name }} when: r_hosted_cluster.resources | length == 0 block: - - name: Run hcp CLI to deploy hosted cluster - environment: - AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" - AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" - AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" - ansible.builtin.command: >- - /usr/bin/hcp create cluster aws - --auto-repair - --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} - --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} - --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} - --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} - --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} - --name {{ _ocp_workload_rhacm_hcp_cluster_name }} - --namespace local-cluster - --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} - --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} - --region {{ _ocp_workload_rhacm_hcp_cluster_region }} - --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-multi - --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} - --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} - --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} - --role-arn "{{ r_role_arn.stdout }}" - --sts-creds /tmp/sts-creds.json - --pull-secret /tmp/pull_secret.json - --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}" - --endpoint-access=Public - --generate-ssh - register: r_hcp_create_cluster - retries: 5 - delay: 30 - until: r_hcp_create_cluster.rc == 0 - ignore_errors: true + - name: Run hcp CLI to deploy hosted cluster + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" + AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + ansible.builtin.command: >- + /usr/bin/hcp create cluster aws + --auto-repair + --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }} + --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }} + --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }} + --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }} + --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }} + --name {{ _ocp_workload_rhacm_hcp_cluster_name }} + --namespace local-cluster + --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }} + --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }} + --region {{ _ocp_workload_rhacm_hcp_cluster_region }} + --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-multi + --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }} + --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }} + --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }} + --role-arn "{{ r_role_arn.stdout }}" + --sts-creds /tmp/sts-creds.json + --pull-secret /tmp/pull_secret.json + --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}" + --endpoint-access=Public + --generate-ssh + register: r_hcp_create_cluster + retries: 5 + delay: 30 + until: r_hcp_create_cluster.rc == 0 + ignore_errors: true - - name: Print hcp command output - ansible.builtin.debug: - msg: "{{ r_hcp_create_cluster.stdout }}" + - name: Print hcp command output + ansible.builtin.debug: + msg: "{{ r_hcp_create_cluster.stdout }}" - - name: Abort - when: r_hcp_create_cluster.rc > 0 - ansible.builtin.fail: - msg: "Cluster creation failed. Aborting." + - name: Abort + when: r_hcp_create_cluster.rc > 0 + ansible.builtin.fail: + msg: "Cluster creation failed. Aborting." - name: Create managed cluster to add cluster to ACM kubernetes.core.k8s: From 117e387589b598aecdf506a688c0ee937bd6645d Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 13:03:35 +0200 Subject: [PATCH 09/19] Write pull secret to bastion --- roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml | 6 +----- roles/ocp_workload_rhacm_hcp/tasks/workload.yml | 9 ++++++--- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml index cc19e61..b032aa7 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -1,3 +1,4 @@ +--- - name: Get ARN for hosted cluster user environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" @@ -80,8 +81,3 @@ cmd: >- aws sts get-session-token --output json > sts-creds.json register: r_sts - -- name: Write pull secret to a file - ansible.builtin.copy: - content: "{{ ocp4_pull_secret }}" - dest: /tmp/pull_secret.json diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 280881d..19af0bc 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -33,7 +33,6 @@ ############################################################################# - name: Create AWS S3 bucket amazon.aws.s3_bucket: - # s3_bucket: name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" state: present @@ -139,7 +138,7 @@ {{ r_hcp_cli_download.resources[0] | to_json | from_json | json_query("spec.links[?contains(href,'/linux/amd64')].href") | first }} -- name: Run on Bastion +- name: Install HCP CLI on Bastion delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" block: - name: Download HCP CLI @@ -176,6 +175,11 @@ args: creates: /etc/bash_completion.d/hcp + - name: Write pull secret to a file + ansible.builtin.copy: + content: "{{ ocp4_pull_secret }}" + dest: /tmp/pull_secret.json + ############################################################################# # Set up RHDP Configuration # Automatically configure newly deployed HCP clusters @@ -200,7 +204,6 @@ ############################################################################# # Set up ManagedClusterSet Policies ############################################################################# - - name: Set up ManagedClusterSet when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool kubernetes.core.k8s: From 253fea33552a5e8c3fc7eeb98ca7922b052905e8 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 14:02:45 +0200 Subject: [PATCH 10/19] Write sts creds to bastion --- .../ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml index b032aa7..b98dc9d 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -81,3 +81,15 @@ cmd: >- aws sts get-session-token --output json > sts-creds.json register: r_sts + +- name: Read STS credentials file + ansible.builtin.slurp: + src: /tmp/sts-creds.json + register: r_sts_creds + +- name: Copy STS credentials to bastion + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + ansible.builtin.copy: + content: "{{ r_sts_creds.content | b64decode }}" + dest: /tmp/sts-creds.json + mode: ug=rw,o=r From 6acb4f8af5b8f73839865f0922c1aa7c48f3736a Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 15:01:25 +0200 Subject: [PATCH 11/19] Fix setting up credentials --- .../tasks/get_cluster_credentials.yml | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml index 2a047d2..acd4327 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml @@ -77,23 +77,25 @@ - r_kubeconfig.resources[0].data.kubeconfig is defined - r_kubeconfig.resources[0].data.kubeconfig | length > 0 -- name: Write kubeconfig file for student user +- name: Set up bastion with credentials become: true - ansible.builtin.copy: - dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeconfig" - content: "{{ r_kubeconfig.resources[0].data.kubeconfig | b64decode }}" - owner: "{{ student_name | default('ec2-user') }}" - group: users - mode: "0660" + delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}" + block: + - name: Write kubeconfig file for student user + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeconfig" + content: "{{ r_kubeconfig.resources[0].data.kubeconfig | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: ug=rw,o=r -- name: Write kubeadmin password file for student user - become: true - ansible.builtin.copy: - dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeadmin-password" - content: "{{ r_kubeadmin_password.resources[0].data.password | b64decode }}" - owner: "{{ student_name | default('ec2-user') }}" - group: users - mode: "0660" + - name: Write kubeadmin password file for student user + ansible.builtin.copy: + dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeadmin-password" + content: "{{ r_kubeadmin_password.resources[0].data.password | b64decode }}" + owner: "{{ student_name | default('ec2-user') }}" + group: users + mode: ug=rw,o=r - name: "Save credentials for cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}" agnosticd.core.agnosticd_user_info: From bd31d85661c1acbd3cdd558013641110b2fcd1e4 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 15:14:22 +0200 Subject: [PATCH 12/19] Make policies generic --- .../ocp_workload_rhacm_hcp/defaults/main.yml | 24 ++++++++--------- .../ocp_workload_rhacm_hcp/tasks/workload.yml | 26 +++++++++---------- .../managedclustersetbinding.yaml.j2 | 2 +- .../{rhdp => policies}/application.yaml.j2 | 6 ++--- .../{rhdp => policies}/channel.yaml.j2 | 6 ++--- .../clusterrolebinding.yaml.j2 | 2 +- .../managedclustersetbinding.yaml.j2 | 2 +- .../policies/namespace-applications.yaml.j2 | 5 ++++ .../policies/namespace-channels.yaml.j2 | 5 ++++ .../policies/namespace-policies.yaml.j2 | 5 ++++ .../{rhdp => policies}/placement.yaml.j2 | 6 ++--- .../templates/policies/secret.yaml.j2 | 9 +++++++ .../{rhdp => policies}/subscription.yaml.j2 | 14 +++++----- .../rhdp/namespace-applications.yaml.j2 | 5 ---- .../templates/rhdp/namespace-channels.yaml.j2 | 5 ---- .../templates/rhdp/namespace-policies.yaml.j2 | 5 ---- .../templates/rhdp/secret.yaml.j2 | 9 ------- 17 files changed, 68 insertions(+), 68 deletions(-) rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/application.yaml.j2 (60%) rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/channel.yaml.j2 (50%) rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/clusterrolebinding.yaml.j2 (86%) rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/managedclustersetbinding.yaml.j2 (68%) create mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 create mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/placement.yaml.j2 (65%) create mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 rename roles/ocp_workload_rhacm_hcp/templates/{rhdp => policies}/subscription.yaml.j2 (50%) delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml index 58554b8..04639fa 100644 --- a/roles/ocp_workload_rhacm_hcp/defaults/main.yml +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -60,20 +60,20 @@ ocp_workload_rhacm_hcp_deploy_clusters: [] # rhdp_usage: production ############################################################################# -# Set up RHDP Policies +# Set up Policies ############################################################################# -# This next section is only to deploy a shared cluster for RHDP to deploy hosted clusters to -# using the workload ocp_workload_deploy_hosted_cluster +# Set up policies for all created clusters. ############################################################################# -ocp_workload_rhacm_hcp_rhdp_policies_setup: false -ocp_workload_rhacm_hcp_rhdp_policies_namespace: rhdp-policies -ocp_workload_rhacm_hcp_rhdp_applications_namespace: rhdp-applications -ocp_workload_rhacm_hcp_rhdp_channels_namespace: rhdp-channels -ocp_workload_rhacm_hcp_rhdp_policies_repository: https://github.com/rhpds/hypershift-policies.git -ocp_workload_rhacm_hcp_rhdp_policies_repository_branch: main -ocp_workload_rhacm_hcp_rhdp_policies_repository_path: "/" -ocp_workload_rhacm_hcp_rhdp_policies_admin_user: admin -ocp_workload_rhacm_hcp_rhdp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" +ocp_workload_rhacm_hcp_policies_setup: false +ocp_workload_rhacm_hcp_policies_namespace: hcp-policies +ocp_workload_rhacm_hcp_applications_namespace: hcp-applications +ocp_workload_rhacm_hcp_channels_namespace: hcp-channels + +ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git +ocp_workload_rhacm_hcp_policies_repository_branch: main +ocp_workload_rhacm_hcp_policies_repository_path: "/" +ocp_workload_rhacm_hcp_policies_admin_user: admin +ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" ############################################################################# # Set up ManagedClusterSet for clusters with hosted control planes diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 19af0bc..29561da 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -181,25 +181,25 @@ dest: /tmp/pull_secret.json ############################################################################# -# Set up RHDP Configuration +# Set up Policies # Automatically configure newly deployed HCP clusters ############################################################################# -- name: Set up RHDP Configuration - when: ocp_workload_rhacm_hcp_rhdp_policies_setup | bool +- name: Set up Policies + when: ocp_workload_rhacm_hcp_policies_setup | bool kubernetes.core.k8s: state: present template: "{{ item }}" loop: - - rhdp/clusterrolebinding.yaml.j2 - - rhdp/namespace-channels.yaml.j2 - - rhdp/namespace-applications.yaml.j2 - - rhdp/namespace-policies.yaml.j2 - - rhdp/secret.yaml.j2 - - rhdp/channel.yaml.j2 - - rhdp/placement.yaml.j2 - - rhdp/subscription.yaml.j2 - - rhdp/application.yaml.j2 - - rhdp/managedclustersetbinding.yaml.j2 + - policies/clusterrolebinding.yaml.j2 + - policies/namespace-channels.yaml.j2 + - policies/namespace-applications.yaml.j2 + - policies/namespace-policies.yaml.j2 + - policies/secret.yaml.j2 + - policies/channel.yaml.j2 + - policies/placement.yaml.j2 + - policies/subscription.yaml.j2 + - policies/application.yaml.j2 + - policies/managedclustersetbinding.yaml.j2 ############################################################################# # Set up ManagedClusterSet Policies diff --git a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 index fce3984..4b31886 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/managedclusterset/managedclustersetbinding.yaml.j2 @@ -3,6 +3,6 @@ apiVersion: cluster.open-cluster-management.io/v1beta2 kind: ManagedClusterSetBinding metadata: name: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace | default("rhdp-policies" ) }} + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} spec: clusterSet: {{ ocp_workload_rhacm_hcp_managed_cluster_set_name }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 similarity index 60% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 index a6a45ef..67bab5e 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/application.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 @@ -2,8 +2,8 @@ apiVersion: app.k8s.io/v1beta1 kind: Application metadata: - name: rhdp-hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + name: hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} spec: componentKinds: - group: apps.open-cluster-management.io @@ -11,4 +11,4 @@ spec: descriptor: {} selector: matchLabels: - app: rhdp-hcp-configuration + app: hcp-configuration diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 similarity index 50% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 index 49dae19..beea518 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/channel.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 @@ -2,10 +2,10 @@ apiVersion: apps.open-cluster-management.io/v1 kind: Channel metadata: - name: rhdp-hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + name: hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} annotations: apps.open-cluster-management.io/reconcile-rate: medium spec: - pathname: {{ ocp_workload_rhacm_hcp_rhdp_policies_repository }} + pathname: {{ ocp_workload_rhacm_hcp_policies_repository }} type: Git diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 similarity index 86% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 index 17e6476..547c784 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/clusterrolebinding.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 @@ -13,4 +13,4 @@ subjects: name: system:admin - apiGroup: rbac.authorization.k8s.io kind: User - name: {{ ocp_workload_rhacm_hcp_rhdp_policies_admin_user }} + name: {{ ocp_workload_rhacm_hcp_policies_admin_user }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 similarity index 68% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 index fc012c1..cba6337 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/managedclustersetbinding.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 @@ -2,7 +2,7 @@ apiVersion: cluster.open-cluster-management.io/v1beta2 kind: ManagedClusterSetBinding metadata: - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} name: global spec: clusterSet: global diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 new file mode 100644 index 0000000..e4e55c0 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_applications_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 new file mode 100644 index 0000000..e43a736 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_channels_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 new file mode 100644 index 0000000..08ad833 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-policies.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ ocp_workload_rhacm_hcp_policies_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 similarity index 65% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 index 3875f32..ce35dfc 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/placement.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 @@ -2,10 +2,10 @@ apiVersion: cluster.open-cluster-management.io/v1beta1 kind: Placement metadata: - name: rhdp-hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + name: hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} labels: - app: rhdp-hcp-configuration + app: hcp-configuration spec: predicates: - requiredClusterSelector: diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 new file mode 100644 index 0000000..4de42c4 --- /dev/null +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/secret.yaml.j2 @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aws-secret-access-key + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} +type: Opaque +data: + secret-access-key: {{ ocp_workload_rhacm_hcp_policies_aws_secret_access_key | b64encode }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 similarity index 50% rename from roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 rename to roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 index 81d1aa9..4ebbc4f 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/subscription.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 @@ -2,17 +2,17 @@ apiVersion: apps.open-cluster-management.io/v1 kind: Subscription metadata: - name: rhdp-hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} + name: hcp-configuration + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} annotations: - apps.open-cluster-management.io/git-branch: {{ ocp_workload_rhacm_hcp_rhdp_policies_repository_branch }} - apps.open-cluster-management.io/git-path: "{{ ocp_workload_rhacm_hcp_rhdp_policies_repository_path }}" + apps.open-cluster-management.io/git-branch: {{ ocp_workload_rhacm_hcp_policies_repository_branch }} + apps.open-cluster-management.io/git-path: "{{ ocp_workload_rhacm_hcp_policies_repository_path }}" apps.open-cluster-management.io/reconcile-option: merge labels: - app: rhdp-hcp-configuration + app: hcp-configuration spec: - channel: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }}/rhdp-hcp-configuration + channel: {{ ocp_workload_rhacm_hcp_policies_namespace }}/hcp-configuration placement: placementRef: kind: Placement - name: rhdp-hcp-configuration + name: hcp-configuration diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 deleted file mode 100644 index 2914b18..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-applications.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ ocp_workload_rhacm_hcp_rhdp_applications_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 deleted file mode 100644 index e6eb92c..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-channels.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ ocp_workload_rhacm_hcp_rhdp_channels_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 deleted file mode 100644 index 529ae22..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/namespace-policies.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 deleted file mode 100644 index facde05..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/rhdp/secret.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -metadata: - name: aws-secret-access-key - namespace: {{ ocp_workload_rhacm_hcp_rhdp_policies_namespace }} -type: Opaque -data: - secret-access-key: {{ ocp_workload_rhacm_hcp_rhdp_policies_aws_secret_access_key | b64encode }} From f08d0eb0d29c4c21e64089e2e9eecdfd9ecef625 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 16:39:11 +0200 Subject: [PATCH 13/19] Modernize ocp_workload_rhacm_hcp for RHACM 2.12+ Replace legacy Channel/Subscription policy deployment with ArgoCD Application. Remove deprecated KlusterletAddonConfig. Fix teardown to properly clean up K8s resources and S3 bucket. Remove unused namespaces and variables. --- .../ocp_workload_rhacm_hcp/defaults/main.yml | 4 - .../tasks/create_hypershift_cluster.yml | 4 - .../tasks/remove_workload.yml | 106 +++++++++++++----- .../ocp_workload_rhacm_hcp/tasks/workload.yml | 8 +- .../templates/klusterlet-addon-config.yaml.j2 | 22 ---- .../templates/policies/application.yaml.j2 | 27 +++-- .../templates/policies/channel.yaml.j2 | 11 -- .../policies/clusterrolebinding.yaml.j2 | 16 --- .../policies/managedclustersetbinding.yaml.j2 | 4 +- .../policies/namespace-applications.yaml.j2 | 5 - .../policies/namespace-channels.yaml.j2 | 5 - .../templates/policies/placement.yaml.j2 | 16 --- .../templates/policies/subscription.yaml.j2 | 18 --- 13 files changed, 101 insertions(+), 145 deletions(-) delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 delete mode 100644 roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml index 04639fa..6f07600 100644 --- a/roles/ocp_workload_rhacm_hcp/defaults/main.yml +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -66,13 +66,9 @@ ocp_workload_rhacm_hcp_deploy_clusters: [] ############################################################################# ocp_workload_rhacm_hcp_policies_setup: false ocp_workload_rhacm_hcp_policies_namespace: hcp-policies -ocp_workload_rhacm_hcp_applications_namespace: hcp-applications -ocp_workload_rhacm_hcp_channels_namespace: hcp-channels ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git ocp_workload_rhacm_hcp_policies_repository_branch: main -ocp_workload_rhacm_hcp_policies_repository_path: "/" -ocp_workload_rhacm_hcp_policies_admin_user: admin ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" ############################################################################# diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index afe63c4..84bceda 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -76,7 +76,3 @@ state: present template: managed-cluster.yaml.j2 -- name: Create klusterlet-addon-config to allow policy deployment - kubernetes.core.k8s: - state: present - template: klusterlet-addon-config.yaml.j2 diff --git a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml index fc0184f..9292174 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml @@ -1,39 +1,95 @@ --- -- name: Remove role-policy hcp-cli-role, trust-relationship.json - environment: - AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" - AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" - AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" - ansible.builtin.command: - chdir: /tmp - cmd: >- - aws iam delete-role-policy - --role-name hcp-cli-role - --policy-name trust-relationship.json +############################################################################# +# Remove RHACM Policies (ArgoCD Application + supporting resources) +############################################################################# +- name: Remove ArgoCD Application for policies + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: argoproj.io/v1alpha1 + kind: Application + name: hcp-policies + namespace: openshift-gitops + state: absent + ignore_errors: true + +- name: Remove ManagedClusterSetBinding + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSetBinding + name: hcp + namespace: "{{ ocp_workload_rhacm_hcp_policies_namespace }}" + state: absent ignore_errors: true -- name: Remove role hcp-cli-role +- name: Remove policies namespace + when: ocp_workload_rhacm_hcp_policies_setup | bool + kubernetes.core.k8s: + api_version: v1 + kind: Namespace + name: "{{ ocp_workload_rhacm_hcp_policies_namespace }}" + state: absent + ignore_errors: true + +############################################################################# +# Remove ManagedClusterSet +############################################################################# +- name: Remove ManagedClusterSet resources + when: ocp_workload_rhacm_hcp_managed_cluster_set_setup | bool + kubernetes.core.k8s: + api_version: "{{ item.api_version }}" + kind: "{{ item.kind }}" + name: "{{ item.name }}" + namespace: "{{ item.namespace | default(omit) }}" + state: absent + loop: + - api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSetBinding + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}" + namespace: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker" + - api_version: cluster.open-cluster-management.io/v1beta2 + kind: ManagedClusterSet + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}" + - api_version: v1 + kind: Namespace + name: "{{ ocp_workload_rhacm_hcp_managed_cluster_set_name }}-broker" + loop_control: + label: "{{ item.kind }}/{{ item.name }}" + ignore_errors: true + +############################################################################# +# Remove AWS IAM resources +############################################################################# +- name: Delete IAM inline policy from hcp-cli-role environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" - ansible.builtin.command: - chdir: /tmp - cmd: >- - aws iam delete-role - --role-name hcp-cli-role + ansible.builtin.command: >- + aws iam delete-role-policy + --role-name hcp-cli-role + --policy-name trust-relationship.json ignore_errors: true -- name: Apply awspolicy-hcp-cli-role.json +- name: Delete IAM role hcp-cli-role environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}" AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" - ansible.builtin.command: - chdir: /tmp - cmd: >- - aws iam delete-role-policy - --role-name hcp-cli-role - --policy-name trust-relationship.json - --policy-document file://awspolicy-hcp-cli-role.json + ansible.builtin.command: >- + aws iam delete-role + --role-name hcp-cli-role + ignore_errors: true + +############################################################################# +# Remove S3 bucket +############################################################################# +- name: Delete S3 bucket + amazon.aws.s3_bucket: + name: "{{ ocp_workload_rhacm_hcp_s3_bucket_name }}" + region: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}" + state: absent + force: true + aws_access_key: "{{ aws_access_key_id }}" + aws_secret_key: "{{ aws_secret_access_key }}" ignore_errors: true diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 29561da..0c03616 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -190,16 +190,10 @@ state: present template: "{{ item }}" loop: - - policies/clusterrolebinding.yaml.j2 - - policies/namespace-channels.yaml.j2 - - policies/namespace-applications.yaml.j2 - policies/namespace-policies.yaml.j2 + - policies/managedclustersetbinding.yaml.j2 - policies/secret.yaml.j2 - - policies/channel.yaml.j2 - - policies/placement.yaml.j2 - - policies/subscription.yaml.j2 - policies/application.yaml.j2 - - policies/managedclustersetbinding.yaml.j2 ############################################################################# # Set up ManagedClusterSet Policies diff --git a/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 deleted file mode 100644 index af6ef73..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/klusterlet-addon-config.yaml.j2 +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: agent.open-cluster-management.io/v1 -kind: KlusterletAddonConfig -metadata: - name: {{ _ocp_workload_rhacm_hcp_cluster_name }} - namespace: {{ _ocp_workload_rhacm_hcp_cluster_name }} -spec: - clusterName: {{ _ocp_workload_rhacm_hcp_cluster_name }} - clusterNamespace: {{ _ocp_workload_rhacm_hcp_cluster_name }} - clusterLabels: - cloud: auto-detect - vendor: auto-detect - applicationManager: - enabled: true - certPolicyController: - enabled: true - iamPolicyController: - enabled: true - policyController: - enabled: true - searchCollector: - enabled: true diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 index 67bab5e..2e734bf 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 @@ -1,14 +1,21 @@ --- -apiVersion: app.k8s.io/v1beta1 +apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} + name: hcp-policies + namespace: openshift-gitops spec: - componentKinds: - - group: apps.open-cluster-management.io - kind: Subscription - descriptor: {} - selector: - matchLabels: - app: hcp-configuration + project: default + source: + repoURL: {{ ocp_workload_rhacm_hcp_policies_repository }} + targetRevision: {{ ocp_workload_rhacm_hcp_policies_repository_branch }} + path: policies + destination: + server: https://kubernetes.default.svc + namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=false diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 deleted file mode 100644 index beea518..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/channel.yaml.j2 +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: apps.open-cluster-management.io/v1 -kind: Channel -metadata: - name: hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} - annotations: - apps.open-cluster-management.io/reconcile-rate: medium -spec: - pathname: {{ ocp_workload_rhacm_hcp_policies_repository }} - type: Git diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 deleted file mode 100644 index 547c784..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/clusterrolebinding.yaml.j2 +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: open-cluster-management:subscription-admin -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: open-cluster-management:subscription-admin -subjects: -- apiGroup: rbac.authorization.k8s.io - kind: User - name: system:admin -- apiGroup: rbac.authorization.k8s.io - kind: User - name: {{ ocp_workload_rhacm_hcp_policies_admin_user }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 index cba6337..912e1d7 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/managedclustersetbinding.yaml.j2 @@ -3,6 +3,6 @@ apiVersion: cluster.open-cluster-management.io/v1beta2 kind: ManagedClusterSetBinding metadata: namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} - name: global + name: hcp spec: - clusterSet: global + clusterSet: hcp diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 deleted file mode 100644 index e4e55c0..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-applications.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ ocp_workload_rhacm_hcp_applications_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 deleted file mode 100644 index e43a736..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/namespace-channels.yaml.j2 +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ ocp_workload_rhacm_hcp_channels_namespace }} diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 deleted file mode 100644 index ce35dfc..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/placement.yaml.j2 +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: cluster.open-cluster-management.io/v1beta1 -kind: Placement -metadata: - name: hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} - labels: - app: hcp-configuration -spec: - predicates: - - requiredClusterSelector: - labelSelector: - matchLabels: - local-cluster: 'true' - clusterSets: - - global diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 deleted file mode 100644 index 4ebbc4f..0000000 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/subscription.yaml.j2 +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: apps.open-cluster-management.io/v1 -kind: Subscription -metadata: - name: hcp-configuration - namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} - annotations: - apps.open-cluster-management.io/git-branch: {{ ocp_workload_rhacm_hcp_policies_repository_branch }} - apps.open-cluster-management.io/git-path: "{{ ocp_workload_rhacm_hcp_policies_repository_path }}" - apps.open-cluster-management.io/reconcile-option: merge - labels: - app: hcp-configuration -spec: - channel: {{ ocp_workload_rhacm_hcp_policies_namespace }}/hcp-configuration - placement: - placementRef: - kind: Placement - name: hcp-configuration From 9369382ffb0a1e35586722a3ede9f9dd2d9480a2 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 16:57:42 +0200 Subject: [PATCH 14/19] Update policies path --- roles/ocp_workload_rhacm_hcp/defaults/main.yml | 1 + .../templates/policies/application.yaml.j2 | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml index 6f07600..d01c53c 100644 --- a/roles/ocp_workload_rhacm_hcp/defaults/main.yml +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -69,6 +69,7 @@ ocp_workload_rhacm_hcp_policies_namespace: hcp-policies ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git ocp_workload_rhacm_hcp_policies_repository_branch: main +ocp_workload_rhacm_hcp_policies_repository_path: / ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" ############################################################################# diff --git a/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 index 2e734bf..b7e64f7 100644 --- a/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 +++ b/roles/ocp_workload_rhacm_hcp/templates/policies/application.yaml.j2 @@ -9,7 +9,7 @@ spec: source: repoURL: {{ ocp_workload_rhacm_hcp_policies_repository }} targetRevision: {{ ocp_workload_rhacm_hcp_policies_repository_branch }} - path: policies + path: {{ ocp_workload_rhacm_hcp_policies_repository_path }} destination: server: https://kubernetes.default.svc namespace: {{ ocp_workload_rhacm_hcp_policies_namespace }} From 069d8540eebcf7bea820d9cd83d44ecb1d2768a2 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Tue, 21 Jul 2026 17:05:23 +0200 Subject: [PATCH 15/19] Fix repo path default --- roles/ocp_workload_rhacm_hcp/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml index d01c53c..63f2f0a 100644 --- a/roles/ocp_workload_rhacm_hcp/defaults/main.yml +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -69,7 +69,7 @@ ocp_workload_rhacm_hcp_policies_namespace: hcp-policies ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git ocp_workload_rhacm_hcp_policies_repository_branch: main -ocp_workload_rhacm_hcp_policies_repository_path: / +ocp_workload_rhacm_hcp_policies_repository_path: . ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}" ############################################################################# From 476b573170e7533e8c5ee8fbc76d78aabe831086 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Wed, 22 Jul 2026 17:09:27 +0200 Subject: [PATCH 16/19] Update comment --- roles/ocp_workload_rhacm_hcp/defaults/main.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/ocp_workload_rhacm_hcp/defaults/main.yml b/roles/ocp_workload_rhacm_hcp/defaults/main.yml index 63f2f0a..ddc852b 100644 --- a/roles/ocp_workload_rhacm_hcp/defaults/main.yml +++ b/roles/ocp_workload_rhacm_hcp/defaults/main.yml @@ -79,7 +79,6 @@ ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.ro # ManagedClusterSet. # All clusters need to have the label: # "cluster.open-cluster-management.io/clusterset:"" -# Workload ocp_workload_deploy_hosted_cluster to set that label. ############################################################################# ocp_workload_rhacm_hcp_managed_cluster_set_setup: false ocp_workload_rhacm_hcp_managed_cluster_set_name: hcp From 202301a6408fce35955b759057ae7cc079e3167b Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Wed, 22 Jul 2026 17:15:59 +0200 Subject: [PATCH 17/19] Fix meta/main.yml --- roles/ocp_workload_rhacm_hcp/meta/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/ocp_workload_rhacm_hcp/meta/main.yml b/roles/ocp_workload_rhacm_hcp/meta/main.yml index ded130b..0c370c5 100644 --- a/roles/ocp_workload_rhacm_hcp/meta/main.yml +++ b/roles/ocp_workload_rhacm_hcp/meta/main.yml @@ -5,7 +5,7 @@ galaxy_info: description: | Set up Hypershift on an existing RHACM installation. Minimum required RHACM version is 2.17 license: MIT - min_ansible_version: 2.9 + min_ansible_version: "2.9" platforms: [] galaxy_tags: - ocp From db84977fab32ca7ecf5d75a441f893df6883e722 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Wed, 22 Jul 2026 17:17:40 +0200 Subject: [PATCH 18/19] Fix lint errors --- roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml | 1 - roles/ocp_workload_rhacm_hcp/tasks/workload.yml | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index 84bceda..c8b26a3 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -75,4 +75,3 @@ kubernetes.core.k8s: state: present template: managed-cluster.yaml.j2 - diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index 0c03616..fe56314 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -179,6 +179,7 @@ ansible.builtin.copy: content: "{{ ocp4_pull_secret }}" dest: /tmp/pull_secret.json + mode: ug=rw,o=r ############################################################################# # Set up Policies From 3443e3616298ee7dab3a9a6cbe77f92598295580 Mon Sep 17 00:00:00 2001 From: Wolfgang Kulhanek Date: Wed, 22 Jul 2026 17:21:51 +0200 Subject: [PATCH 19/19] Added changed_when to satisfy lint --- .../tasks/create_hypershift_cluster.yml | 1 + roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml | 5 +++++ roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml | 2 ++ roles/ocp_workload_rhacm_hcp/tasks/workload.yml | 2 ++ 4 files changed, 10 insertions(+) diff --git a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml index c8b26a3..d298626 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml @@ -55,6 +55,7 @@ --pull-secret /tmp/pull_secret.json --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}" --endpoint-access=Public + changed_when: true --generate-ssh register: r_hcp_create_cluster retries: 5 diff --git a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml index b98dc9d..3e63422 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml +++ b/roles/ocp_workload_rhacm_hcp/tasks/prep_aws_roles.yaml @@ -8,6 +8,7 @@ cmd: >- aws sts get-caller-identity --query "Arn" register: r_arn + changed_when: false - name: Debug r_arn ansible.builtin.debug: @@ -31,6 +32,7 @@ --role-name hcp-cli-role --assume-role-policy-document file://trust-relationship.json --query "Role.Arn" + changed_when: true ignore_errors: true - name: Get trust-relationship.json Arn @@ -45,6 +47,7 @@ --role-name hcp-cli-role --query "Role.Arn" register: r_role_arn + changed_when: false ignore_errors: true - name: Debug r_role_arn @@ -69,6 +72,7 @@ --role-name hcp-cli-role --policy-name trust-relationship.json --policy-document file://awspolicy-hcp-cli-role.json + changed_when: true ignore_errors: true - name: Get STS credentials @@ -81,6 +85,7 @@ cmd: >- aws sts get-session-token --output json > sts-creds.json register: r_sts + changed_when: true - name: Read STS credentials file ansible.builtin.slurp: diff --git a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml index 9292174..3f0c8c7 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/remove_workload.yml @@ -69,6 +69,7 @@ aws iam delete-role-policy --role-name hcp-cli-role --policy-name trust-relationship.json + changed_when: true ignore_errors: true - name: Delete IAM role hcp-cli-role @@ -79,6 +80,7 @@ ansible.builtin.command: >- aws iam delete-role --role-name hcp-cli-role + changed_when: true ignore_errors: true ############################################################################# diff --git a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml index fe56314..6f9f748 100644 --- a/roles/ocp_workload_rhacm_hcp/tasks/workload.yml +++ b/roles/ocp_workload_rhacm_hcp/tasks/workload.yml @@ -53,6 +53,7 @@ cmd: >- aws s3api delete-public-access-block --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} + changed_when: true - name: Copy policy file ansible.builtin.template: @@ -71,6 +72,7 @@ aws s3api put-bucket-policy --bucket {{ ocp_workload_rhacm_hcp_s3_bucket_name }} --policy file://bucket-policy.json + changed_when: true - name: Remove temporary policy file ansible.builtin.file: