Skip to content

Commit 5c879e4

Browse files
vakwetuvakwetu
committed
Add playbooks for SKMO
Initial testing
1 parent 4944fff commit 5c879e4

File tree

3 files changed

+218
-0
lines changed

3 files changed

+218
-0
lines changed

‎playbooks/skmo/ensure-central-ca-bundle.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
- name: Ensure central control plane uses custom CA bundle
3+
hosts: localhost
4+
gather_facts: false
5+
vars:
6+
central_namespace: openstack
7+
controlplane_name: controlplane
8+
ca_bundle_secret_name: custom-ca-certs
9+
tasks:
10+
- name: Check current caBundleSecretName
11+
ansible.builtin.shell: |
12+
set -euo pipefail
13+
oc -n {{ central_namespace }} get osctlplane {{ controlplane_name }} \
14+
-o jsonpath='{.spec.tls.caBundleSecretName}'
15+
args:
16+
executable: /bin/bash
17+
register: ca_bundle_name
18+
changed_when: false
19+
failed_when: false
20+
21+
- name: Patch control plane to use custom CA bundle when unset
22+
ansible.builtin.shell: |
23+
set -euo pipefail
24+
oc -n {{ central_namespace }} patch osctlplane {{ controlplane_name }} \
25+
--type json -p '[{"op":"add","path":"/spec/tls","value":{}},{"op":"add","path":"/spec/tls/caBundleSecretName","value":"{{ ca_bundle_secret_name }}"}]'
26+
args:
27+
executable: /bin/bash
28+
when: ca_bundle_name.stdout | trim == ""

‎playbooks/skmo/prepare-leaf.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
- name: Prepare SKMO leaf prerequisites in regionZero
3+
hosts: localhost
4+
gather_facts: false
5+
vars:
6+
skmo_values_file: "{{ cifmw_architecture_repo }}/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml"
7+
osp_secrets_env_file: "{{ playbook_dir }}/../../lib/control-plane/base/osp-secrets.env"
8+
central_namespace: openstack
9+
leaf_namespace: openstack2
10+
leaf_secret_name: osp-secret
11+
central_rootca_secret: rootca-public
12+
tasks:
13+
- name: Load SKMO values
14+
ansible.builtin.set_fact:
15+
skmo_values: "{{ lookup('file', skmo_values_file) | from_yaml }}"
16+
17+
- name: Set SKMO leaf facts
18+
ansible.builtin.set_fact:
19+
leaf_region: "{{ skmo_values.data.leafRegion }}"
20+
leaf_admin_user: "{{ skmo_values.data.leafAdminUser }}"
21+
leaf_admin_project: "{{ skmo_values.data.leafAdminProject }}"
22+
leaf_admin_password_key: "{{ skmo_values.data.leafAdminPasswordKey }}"
23+
keystone_internal_url: "{{ skmo_values.data.keystoneInternalURL }}"
24+
keystone_public_url: "{{ skmo_values.data.keystonePublicURL }}"
25+
ca_bundle_secret_name: "{{ skmo_values.data.leafCaBundleSecretName }}"
26+
27+
- name: Ensure leaf osp-secret exists (pre-create from env file)
28+
ansible.builtin.shell: |
29+
set -euo pipefail
30+
if ! oc -n {{ leaf_namespace }} get secret {{ leaf_secret_name }} >/dev/null 2>&1; then
31+
oc -n {{ leaf_namespace }} create secret generic {{ leaf_secret_name }} \
32+
--from-env-file="{{ osp_secrets_env_file }}" \
33+
--dry-run=client -o yaml | oc apply -f -
34+
fi
35+
args:
36+
executable: /bin/bash
37+
38+
- name: Read leaf admin password from leaf secret
39+
ansible.builtin.shell: |
40+
set -euo pipefail
41+
oc -n {{ leaf_namespace }} get secret {{ leaf_secret_name }} \
42+
-o jsonpath='{.data.{{ leaf_admin_password_key }}}' | base64 -d
43+
args:
44+
executable: /bin/bash
45+
register: leaf_admin_password
46+
changed_when: false
47+
48+
- name: Ensure leaf region exists in central Keystone
49+
ansible.builtin.shell: |
50+
set -euo pipefail
51+
oc -n {{ central_namespace }} rsh openstackclient \
52+
openstack region show {{ leaf_region }} >/dev/null 2>&1 || \
53+
oc -n {{ central_namespace }} rsh openstackclient \
54+
openstack region create {{ leaf_region }}
55+
args:
56+
executable: /bin/bash
57+
58+
- name: Ensure keystone catalog endpoints exist for leaf region
59+
ansible.builtin.shell: |
60+
set -euo pipefail
61+
if ! oc -n {{ central_namespace }} rsh openstackclient \
62+
openstack endpoint list --service keystone --interface public --region {{ leaf_region }} \
63+
-f value -c ID | head -1 | grep -q .; then
64+
oc -n {{ central_namespace }} rsh openstackclient \
65+
openstack endpoint create --region {{ leaf_region }} identity public "{{ keystone_public_url }}"
66+
fi
67+
if ! oc -n {{ central_namespace }} rsh openstackclient \
68+
openstack endpoint list --service keystone --interface internal --region {{ leaf_region }} \
69+
-f value -c ID | head -1 | grep -q .; then
70+
oc -n {{ central_namespace }} rsh openstackclient \
71+
openstack endpoint create --region {{ leaf_region }} identity internal "{{ keystone_internal_url }}"
72+
fi
73+
args:
74+
executable: /bin/bash
75+
76+
- name: Ensure leaf admin project exists in central Keystone
77+
ansible.builtin.shell: |
78+
set -euo pipefail
79+
oc -n {{ central_namespace }} rsh openstackclient \
80+
openstack project show {{ leaf_admin_project }} >/dev/null 2>&1 || \
81+
oc -n {{ central_namespace }} rsh openstackclient \
82+
openstack project create {{ leaf_admin_project }}
83+
args:
84+
executable: /bin/bash
85+
86+
- name: Ensure leaf admin user exists and has admin role
87+
ansible.builtin.shell: |
88+
set -euo pipefail
89+
if ! oc -n {{ central_namespace }} rsh openstackclient \
90+
openstack user show {{ leaf_admin_user }} >/dev/null 2>&1; then
91+
oc -n {{ central_namespace }} rsh openstackclient \
92+
openstack user create --domain Default --password "{{ leaf_admin_password.stdout | trim }}" {{ leaf_admin_user }}
93+
fi
94+
oc -n {{ central_namespace }} rsh openstackclient \
95+
openstack role add --project {{ leaf_admin_project }} --user {{ leaf_admin_user }} admin
96+
args:
97+
executable: /bin/bash
98+
99+
- name: Create or append leaf CA bundle secret
100+
ansible.builtin.shell: |
101+
set -euo pipefail
102+
tmpdir="$(mktemp -d)"
103+
newkey="skmo-central-rootca.crt"
104+
export TMPDIR="${tmpdir}"
105+
106+
if oc -n {{ leaf_namespace }} get secret {{ ca_bundle_secret_name }} \
107+
>/dev/null 2>&1; then
108+
oc -n {{ leaf_namespace }} get secret {{ ca_bundle_secret_name }} \
109+
-o json | python - <<'PY'
110+
import base64
111+
import json
112+
import os
113+
import sys
114+
115+
tmpdir = os.environ.get("TMPDIR")
116+
data = json.load(sys.stdin).get("data", {})
117+
for key, value in data.items():
118+
path = os.path.join(tmpdir, key)
119+
with open(path, "wb") as f:
120+
f.write(base64.b64decode(value))
121+
PY
122+
fi
123+
124+
oc -n {{ central_namespace }} get secret {{ central_rootca_secret }} \
125+
-o jsonpath='{.data.tls\.crt}' | base64 -d \
126+
> "${tmpdir}/${newkey}"
127+
128+
oc -n {{ leaf_namespace }} create secret generic \
129+
{{ ca_bundle_secret_name }} \
130+
--from-file="${tmpdir}" \
131+
--dry-run=client -o yaml | oc apply -f -
132+
133+
rm -rf "${tmpdir}"
134+
args:
135+
executable: /bin/bash

‎playbooks/skmo/trust-leaf-ca.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
- name: Trust SKMO leaf CA in central region
3+
hosts: localhost
4+
gather_facts: false
5+
vars:
6+
skmo_values_file: "{{ cifmw_architecture_repo }}/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml"
7+
central_namespace: openstack
8+
leaf_namespace: openstack2
9+
leaf_rootca_secret: rootca-public
10+
tasks:
11+
- name: Load SKMO values
12+
ansible.builtin.set_fact:
13+
skmo_values: "{{ lookup('file', skmo_values_file) | from_yaml }}"
14+
15+
- name: Set central CA bundle secret name
16+
ansible.builtin.set_fact:
17+
central_ca_bundle_secret_name: "{{ skmo_values.data.centralCaBundleSecretName }}"
18+
19+
- name: Create or append central CA bundle secret
20+
ansible.builtin.shell: |
21+
set -euo pipefail
22+
tmpdir="$(mktemp -d)"
23+
newkey="skmo-leaf-rootca.crt"
24+
export TMPDIR="${tmpdir}"
25+
26+
if oc -n {{ central_namespace }} get secret \
27+
{{ central_ca_bundle_secret_name }} >/dev/null 2>&1; then
28+
oc -n {{ central_namespace }} get secret \
29+
{{ central_ca_bundle_secret_name }} -o json | python - <<'PY'
30+
import base64
31+
import json
32+
import os
33+
import sys
34+
35+
tmpdir = os.environ.get("TMPDIR")
36+
data = json.load(sys.stdin).get("data", {})
37+
for key, value in data.items():
38+
path = os.path.join(tmpdir, key)
39+
with open(path, "wb") as f:
40+
f.write(base64.b64decode(value))
41+
PY
42+
fi
43+
44+
oc -n {{ leaf_namespace }} get secret {{ leaf_rootca_secret }} \
45+
-o jsonpath='{.data.tls\.crt}' | base64 -d \
46+
> "${tmpdir}/${newkey}"
47+
48+
oc -n {{ central_namespace }} create secret generic \
49+
{{ central_ca_bundle_secret_name }} \
50+
--from-file="${tmpdir}" \
51+
--dry-run=client -o yaml | oc apply -f -
52+
53+
rm -rf "${tmpdir}"
54+
args:
55+
executable: /bin/bash

0 commit comments

Comments
 (0)