summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJose A. Rivera <jarrpa@redhat.com>2017-09-29 22:45:10 -0500
committerJose A. Rivera <jarrpa@redhat.com>2017-09-29 22:45:10 -0500
commit4ab3e20e333d107163abe2a3c88f2aecae3fd77e (patch)
treece693d062a3b4b8e8936b779522bcb5dc546ce25
parent1cd0a0c1165a4f274b30d7570f2e3ab2009e0046 (diff)
downloadopenshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.gz
openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.bz2
openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.xz
openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.zip
GlusterFS: make ServiceAccounts privileged when either glusterfs or heketi is native
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
-rw-r--r--roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml11
-rw-r--r--roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml10
2 files changed, 11 insertions, 10 deletions
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
index 3f6dab78b..51724f979 100644
--- a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
+++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
@@ -18,6 +18,17 @@
node_selector: "{% if glusterfs_use_default_selector %}{{ omit }}{% endif %}"
when: glusterfs_is_native or glusterfs_heketi_is_native or glusterfs_storageclass
+- name: Add namespace service accounts to privileged SCC
+ oc_adm_policy_user:
+ user: "system:serviceaccount:{{ glusterfs_namespace }}:{{ item }}"
+ resource_kind: scc
+ resource_name: privileged
+ state: present
+ with_items:
+ - 'default'
+ - 'router'
+ when: glusterfs_is_native or glusterfs_heketi_is_native
+
- name: Delete pre-existing heketi resources
oc_obj:
namespace: "{{ glusterfs_namespace }}"
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
index 8c3e31fc9..932d06038 100644
--- a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
+++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
@@ -55,16 +55,6 @@
- glusterfs_wipe
- item.stdout_lines | count > 0
-- name: Add service accounts to privileged SCC
- oc_adm_policy_user:
- user: "system:serviceaccount:{{ glusterfs_namespace }}:{{ item }}"
- resource_kind: scc
- resource_name: privileged
- state: present
- with_items:
- - 'default'
- - 'router'
-
- name: Label GlusterFS nodes
oc_label:
name: "{{ hostvars[item].openshift.node.nodename }}"