Add hcp workload

roles/ocp_workload_rhacm_hcp/defaults/main.yml

@@ -0,0 +1,84 @@
+---
+# Minimum required RHACM version is 2.17
+ocp_workload_rhacm_hcp_s3_bucket_name: "oidc-storage-{{ guid }}"
+ocp_workload_rhacm_hcp_s3_bucket_region: us-east-2
+ocp_workload_rhacm_key_pair_name: hypershift
+
+# Optionally deploy Hypershift cluster(s)
+# Set to an empty array for none (default)
+# Number of worker nodes created is the multiple of
+#   nodepool_replicas x zones
+#   E.g. 2 zones and 2 nodepool replicas = 4 worker nodes
+# The following parameters are optional and will be set to the
+# defaults as below:
+# - control_plane_availability: SingleReplica
+# - infra_availability: SingleReplica
+# - network_type: OVNKubernetes
+# - etcd_storage_class: gp3-csi
+# - root_volume_type: gp3
+# - root_volume_size: 120
+# - zones: []
+# - labels: []
+ocp_workload_rhacm_hcp_deploy_clusters: []
+
+# ocp_workload_rhacm_hcp_deploy_clusters:
+# - name: development
+#   infra_id: dev-{{ guid }}
+#   ocp_release: 4.14.2
+#   control_plane_availability: SingleReplica
+#   infra_availability: SingleReplica
+#   etcd_storage_class: gp3-csi
+#   nodepool_replicas: 1
+#   worker_instance_type: m5.large
+#   root_volume_type: gp3
+#   root_volume_size: 120
+#   network_type: OVNKubernetes
+#   region: us-west-2
+#   zones: # Optional, list zones to deploy into, each zone will get the same number of workers
+#   - us-west-2a
+#   labels:
+#     rhdp_type: sandbox
+#     rhdp_usage: development
+
+# - name: production
+#   infra_id: prod-{{ guid }}
+#   ocp_release: 4.13.11
+#   control_plane_availability: HighlyAvailable
+#   infra_availability: HighlyAvailable
+#   etcd_storage_class: gp3-csi
+#   nodepool_replicas: 2
+#   worker_instance_type: m5.large
+#   root_volume_type: gp3
+#   root_volume_size: 120
+#   network_type: OVNKubernetes
+#   region: us-west-2
+#   zones:
+#   - us-west-2a
+#   - us-west-2b
+#   labels:
+#     rhdp_type: sandbox
+#     rhdp_usage: production
+
+#############################################################################
+# Set up Policies
+#############################################################################
+# Set up policies for all created clusters.
+#############################################################################
+ocp_workload_rhacm_hcp_policies_setup: false
+ocp_workload_rhacm_hcp_policies_namespace: hcp-policies
+
+ocp_workload_rhacm_hcp_policies_repository: https://github.com/rhpds/hypershift-policies.git
+ocp_workload_rhacm_hcp_policies_repository_branch: main
+ocp_workload_rhacm_hcp_policies_repository_path: .
+ocp_workload_rhacm_hcp_policies_aws_secret_access_key: "{{ hostvars.localhost.route53user_secret_access_key }}"
+
+#############################################################################
+# Set up ManagedClusterSet for clusters with hosted control planes
+#############################################################################
+# This next section is only to group all managed clusters into a
+# ManagedClusterSet.
+# All clusters need to have the label:
+#   "cluster.open-cluster-management.io/clusterset:<ManagedClusterSet Name>""
+#############################################################################
+ocp_workload_rhacm_hcp_managed_cluster_set_setup: false
+ocp_workload_rhacm_hcp_managed_cluster_set_name: hcp

roles/ocp_workload_rhacm_hcp/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  role_name: ocp_workload_rhacm_hcp
+  author: Wolfgang Kulhanek (wkulhane@redhat.com)
+  description: |
+    Set up Hypershift on an existing RHACM installation. Minimum required RHACM version is 2.17
+  license: MIT
+  min_ansible_version: "2.9"
+  platforms: []
+  galaxy_tags:
+  - ocp
+  - openshift
+  - acm
+  - rhacm
+  - hypershift
+  - hcp
+dependencies: []

roles/ocp_workload_rhacm_hcp/readme.adoc

@@ -0,0 +1,70 @@
+= ocp_workload_rhacm_hcp - Deploys RH ACM Hypershift
+
+== Role overview
+
+* This role installs Red Hat ACM Hypershift into an OpenShift Cluster - Red Had Advanced Cluster Manager 2.6+ must be installed previously. It consists of the following tasks files:
+** Tasks: link:./tasks/pre_workload.yml[pre_workload.yml] - Sets up an environment for the workload deployment.
+*** Debug task will print out: `pre_workload Tasks completed successfully.`
+
+** Tasks: link:./tasks/workload.yml[workload.yml] - Used to deploy ACM
+*** This role deploys ACM (project)
+*** Debug task will print out: `workload Tasks completed successfully.`
+
+** Tasks: link:./tasks/post_workload.yml[post_workload.yml] - Used to
+ configure the workload after deployment
+*** This role doesn't do anything here
+*** Debug task will print out: `post_workload Tasks completed successfully.`
+
+** Tasks: link:./tasks/remove_workload.yml[remove_workload.yml] - Used to
+ delete the workload
+*** This role uninstalls ACM and related resources
+*** Debug task will print out: `remove_workload Tasks completed successfully.`
+
+== Review the defaults variable file
+
+* This file link:./defaults/main.yml[./defaults/main.yml] contains all the variables you need to define to control the deployment of your workload.
+* The variable *ocp_username* is mandatory to assign the workload to the correct OpenShift user.
+* A variable *silent=True* can be passed to suppress debug messages.
+* Other variables:
+** *ocp_workload_rhacm_hcp_acm_project*: The name of the project where ACM is deployed. Default: `open-cluster-management`
+** *ocp_workload_rhacm_hcp_acm_release*: ACM release to be deployed. Default: `release-1.0`
+** *ocp_workload_rhacm_hcp_docker_registry*: ACM Container Registry. Default: `registry.access.redhat.com/rhacm1-tech-preview`
+
+* You can modify any of these default values by adding `-e "variable_name=variable_value"` to the command line
+
+=== Deploy a Workload with the `ocp-workload` playbook [Mostly for testing]
+
+----
+TARGET_HOST="bastion.na311.openshift.opentlc.com"
+OCP_USERNAME="mavazque-redhat.com"
+WORKLOAD="ocp_workload_rhacm_hcp"
+GUID=1001
+
+# a TARGET_HOST is specified in the command line, without using an inventory file
+ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \
+    -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \
+    -e"ansible_user=ec2-user" \
+    -e"ocp_username=${OCP_USERNAME}" \
+    -e"ocp_workload=${WORKLOAD}" \
+    -e"silent=False" \
+    -e"guid=${GUID}" \
+    -e"ACTION=create"
+----
+
+=== To Delete an environment
+
+----
+TARGET_HOST="bastion.na311.openshift.opentlc.com"
+OCP_USERNAME="mavazque-redhat.com"
+WORKLOAD="ocp_workload_rhacm_hcp"
+GUID=1002
+
+# a TARGET_HOST is specified in the command line, without using an inventory file
+ansible-playbook -i ${TARGET_HOST}, ./configs/ocp-workloads/ocp-workload.yml \
+    -e"ansible_ssh_private_key_file=~/.ssh/keytoyourhost.pem" \
+    -e"ansible_user=ec2-user" \
+    -e"ocp_username=${OCP_USERNAME}" \
+    -e"ocp_workload=${WORKLOAD}" \
+    -e"guid=${GUID}" \
+    -e"ACTION=remove"
+----

roles/ocp_workload_rhacm_hcp/tasks/create_hypershift_cluster.yml

@@ -0,0 +1,78 @@
+---
+- name: Print debug statement
+  ansible.builtin.debug:
+    msg: "Creating cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}."
+
+- name: Wait for HostedCluster CRD to be registered
+  kubernetes.core.k8s_info:
+    api_version: apiextensions.k8s.io/v1
+    kind: CustomResourceDefinition
+    name: hostedclusters.hypershift.openshift.io
+  register: r_crd
+  retries: 60
+  delay: 30
+  until: r_crd.resources | length | int > 0
+
+- name: Include AWS Role Prep
+  ansible.builtin.include_tasks: prep_aws_roles.yaml
+
+- name: Ensure hosted cluster doesn't already exist
+  kubernetes.core.k8s_info:
+    api_version: hypershift.openshift.io/v1beta1
+    kind: HostedCluster
+    name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}"
+    namespace: local-cluster
+  register: r_hosted_cluster
+
+- name: Deploy hosted cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}
+  when: r_hosted_cluster.resources | length == 0
+  block:
+  - name: Run hcp CLI to deploy hosted cluster
+    delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
+    environment:
+      AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}"
+      AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}"
+      AWS_REGION: "{{ ocp_workload_rhacm_hcp_s3_bucket_region }}"
+    ansible.builtin.command: >-
+      /usr/bin/hcp create cluster aws
+        --auto-repair
+        --control-plane-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_control_plane_availability }}
+        --etcd-storage-class {{ _ocp_workload_rhacm_hcp_cluster_etc_storage_class }}
+        --infra-availability-policy {{ _ocp_workload_rhacm_hcp_cluster_infra_availability }}
+        --infra-id {{ _ocp_workload_rhacm_hcp_cluster_infra_id }}
+        --instance-type {{ _ocp_workload_rhacm_hcp_cluster_worker_instance_type }}
+        --name {{ _ocp_workload_rhacm_hcp_cluster_name }}
+        --namespace local-cluster
+        --network-type {{ _ocp_workload_rhacm_hcp_cluster_network_type }}
+        --node-pool-replicas {{ _ocp_workload_rhacm_hcp_cluster_nodepool_replicas }}
+        --region {{ _ocp_workload_rhacm_hcp_cluster_region }}
+        --release-image quay.io/openshift-release-dev/ocp-release:{{ _ocp_workload_rhacm_hcp_cluster_ocp_release }}-multi
+        --root-volume-size {{ _ocp_workload_rhacm_hcp_cluster_root_volume_size }}
+        --root-volume-type {{ _ocp_workload_rhacm_hcp_cluster_root_volume_type }}
+        --zones {{ _ocp_workload_rhacm_hcp_cluster_zones | join(',') }}
+        --role-arn "{{ r_role_arn.stdout }}"
+        --sts-creds /tmp/sts-creds.json
+        --pull-secret /tmp/pull_secret.json
+        --base-domain "{{ subdomain_base_suffix | regex_replace('^\.', '') }}"
+        --endpoint-access=Public
+    changed_when: true
+        --generate-ssh
+    register: r_hcp_create_cluster
+    retries: 5
+    delay: 30
+    until: r_hcp_create_cluster.rc == 0
+    ignore_errors: true
+
+  - name: Print hcp command output
+    ansible.builtin.debug:
+      msg: "{{ r_hcp_create_cluster.stdout }}"
+
+  - name: Abort
+    when: r_hcp_create_cluster.rc > 0
+    ansible.builtin.fail:
+      msg: "Cluster creation failed. Aborting."
+
+- name: Create managed cluster to add cluster to ACM
+  kubernetes.core.k8s:
+    state: present
+    template: managed-cluster.yaml.j2

roles/ocp_workload_rhacm_hcp/tasks/get_cluster_credentials.yml

@@ -0,0 +1,108 @@
+---
+- name: Get ManagedCluster
+  kubernetes.core.k8s_info:
+    api_version: cluster.open-cluster-management.io/v1
+    kind: ManagedCluster
+    name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}"
+  register: r_managed_cluster
+  retries: 120
+  delay: 10
+  until:
+  - r_managed_cluster.resources | length > 0
+  - r_managed_cluster.resources[0].spec.managedClusterClientConfigs is defined
+  - r_managed_cluster.resources[0].spec.managedClusterClientConfigs | length > 0
+  - r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url is defined
+  - r_managed_cluster.resources[0].status.clusterClaims is defined
+  - r_managed_cluster.resources[0] | to_json | from_json | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | length > 0
+
+- name: Get ManagedCluster URLs
+  ansible.builtin.set_fact:
+    _ocp_workload_rhacm_hcp_cluster_api_url: >-
+      {{ r_managed_cluster.resources[0].spec.managedClusterClientConfigs[0].url }}
+    _ocp_workload_rhacm_hcp_cluster_console_url: >-
+      {{ r_managed_cluster.resources[0] | to_json | from_json
+       | json_query("status.clusterClaims[?contains(name,'consoleurl')].value") | first }}
+
+- name: Get HostedCluster
+  kubernetes.core.k8s_info:
+    api_version: hypershift.openshift.io/v1beta1
+    kind: HostedCluster
+    name: "{{ _ocp_workload_rhacm_hcp_cluster_name }}"
+    namespace: local-cluster
+  register: r_hosted_cluster
+  retries: 120
+  delay: 10
+  until:
+  - r_hosted_cluster.resources[0].status.kubeadminPassword is defined
+  - r_hosted_cluster.resources[0].status.kubeadminPassword.name is defined
+  - r_hosted_cluster.resources[0].status.kubeadminPassword.name | length > 0
+  - r_hosted_cluster.resources[0].status.kubeconfig is defined
+  - r_hosted_cluster.resources[0].status.kubeconfig.name is defined
+  - r_hosted_cluster.resources[0].status.kubeconfig.name | length > 0
+
+- name: Get Secret names for credentials
+  ansible.builtin.set_fact:
+    _ocp_workload_rhacm_hcp_cluster_kubeadmin_password: >-
+      {{ r_hosted_cluster.resources[0].status.kubeadminPassword.name }}
+    _ocp_workload_rhacm_hcp_cluster_kubeconfig: >-
+      {{ r_hosted_cluster.resources[0].status.kubeconfig.name }}
+
+- name: Get kubeadmin password
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeadmin_password }}"
+    namespace: local-cluster
+  register: r_kubeadmin_password
+  retries: 60
+  delay: 5
+  until:
+  - r_kubeadmin_password is defined
+  - r_kubeadmin_password.resources | length > 0
+  - r_kubeadmin_password.resources[0].data.password is defined
+  - r_kubeadmin_password.resources[0].data.password | length > 0
+
+- name: Get kubeconfig
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    name: "{{ _ocp_workload_rhacm_hcp_cluster_kubeconfig }}"
+    namespace: local-cluster
+  register: r_kubeconfig
+  retries: 60
+  delay: 5
+  until:
+  - r_kubeconfig is defined
+  - r_kubeconfig.resources | length > 0
+  - r_kubeconfig.resources[0].data.kubeconfig is defined
+  - r_kubeconfig.resources[0].data.kubeconfig | length > 0
+
+- name: Set up bastion with credentials
+  become: true
+  delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
+  block:
+  - name: Write kubeconfig file for student user
+    ansible.builtin.copy:
+      dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeconfig"
+      content: "{{ r_kubeconfig.resources[0].data.kubeconfig | b64decode }}"
+      owner: "{{ student_name | default('ec2-user') }}"
+      group: users
+      mode: ug=rw,o=r
+
+  - name: Write kubeadmin password file for student user
+    ansible.builtin.copy:
+      dest: "/home/{{ student_name | default('ec2-user') }}/.kube/{{ _ocp_workload_rhacm_hcp_cluster_name }}.kubeadmin-password"
+      content: "{{ r_kubeadmin_password.resources[0].data.password | b64decode }}"
+      owner: "{{ student_name | default('ec2-user') }}"
+      group: users
+      mode: ug=rw,o=r
+
+- name: "Save credentials for cluster {{ _ocp_workload_rhacm_hcp_cluster_name }}"
+  agnosticd.core.agnosticd_user_info:
+    data: >-
+      {{ {
+        _ocp_workload_rhacm_hcp_cluster_name ~ '-kubeadmin-password': r_kubeadmin_password.resources[0].data.password | b64decode,
+        _ocp_workload_rhacm_hcp_cluster_name ~ '-admin-kubeconfig': r_kubeconfig.resources[0].data.kubeconfig | b64decode,
+        _ocp_workload_rhacm_hcp_cluster_name ~ '-api-url': _ocp_workload_rhacm_hcp_cluster_api_url,
+        _ocp_workload_rhacm_hcp_cluster_name ~ '-console-url': _ocp_workload_rhacm_hcp_cluster_console_url
+      } }}

roles/ocp_workload_rhacm_hcp/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+# --------------------------------------------------
+# Do not modify this file
+# --------------------------------------------------
+- name: Running workload provision tasks
+  when: ACTION == "provision"
+  ansible.builtin.include_tasks: workload.yml
+
+- name: Running workload removal tasks
+  when: ACTION == "destroy"
+  ansible.builtin.include_tasks: remove_workload.yml