diff options
| author | Eric Wolinetz <ewolinet@redhat.com> | 2017-03-06 17:02:02 -0600 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-03-06 17:02:02 -0600 |
| commit | f017f5afc88e65ce57751c6e6ac99cb9094eb716 (patch) | |
| tree | 3a29e613b076347cd14d9045f6dd51a58402b323 /playbooks | |
| parent | 3e1557ad8074195f0c11a6c2f3932840d10a7924 (diff) | |
| parent | 352917ae21424ba518d0fe4513dcc540c7698ae4 (diff) | |
| download | openshift-f017f5afc88e65ce57751c6e6ac99cb9094eb716.tar.gz openshift-f017f5afc88e65ce57751c6e6ac99cb9094eb716.tar.bz2 openshift-f017f5afc88e65ce57751c6e6ac99cb9094eb716.tar.xz openshift-f017f5afc88e65ce57751c6e6ac99cb9094eb716.zip | |
Merge pull request #3517 from ewolinetz/idempotency_role_bindings
Adding changed_whens for role, rolebinding, and scc reconciliation ba…
Diffstat (limited to 'playbooks')
| -rw-r--r-- | playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml index fd01a6625..babb7191d 100644 --- a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml +++ b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml @@ -173,7 +173,11 @@ - name: Reconcile Cluster Roles command: > {{ openshift.common.client_binary }} adm --config={{ openshift.common.config_base }}/master/admin.kubeconfig - policy reconcile-cluster-roles --additive-only=true --confirm + policy reconcile-cluster-roles --additive-only=true --confirm -o name + register: reconcile_cluster_role_result + changed_when: + - reconcile_cluster_role_result.stdout != '' + - reconcile_cluster_role_result.rc == 0 run_once: true - name: Reconcile Cluster Role Bindings @@ -184,19 +188,31 @@ --exclude-groups=system:authenticated:oauth --exclude-groups=system:unauthenticated --exclude-users=system:anonymous - --additive-only=true --confirm + --additive-only=true --confirm -o name when: origin_reconcile_bindings | bool or ent_reconcile_bindings | bool + register: reconcile_bindings_result + changed_when: + - reconcile_bindings_result.stdout != '' + - reconcile_bindings_result.rc == 0 run_once: true - name: Reconcile Jenkins Pipeline Role Bindings command: > - {{ openshift.common.client_binary }} adm --config={{ openshift.common.config_base }}/master/admin.kubeconfig policy reconcile-cluster-role-bindings system:build-strategy-jenkinspipeline --confirm + {{ openshift.common.client_binary }} adm --config={{ openshift.common.config_base }}/master/admin.kubeconfig policy reconcile-cluster-role-bindings system:build-strategy-jenkinspipeline --confirm -o name run_once: true + register: reconcile_jenkins_role_binding_result + changed_when: + - reconcile_jenkins_role_binding_result.stdout != '' + - reconcile_jenkins_role_binding_result.rc == 0 when: openshift.common.version_gte_3_4_or_1_4 | bool - name: Reconcile Security Context Constraints command: > - {{ openshift.common.client_binary }} adm policy reconcile-sccs --confirm --additive-only=true + {{ openshift.common.client_binary }} adm policy reconcile-sccs --confirm --additive-only=true -o name + register: reconcile_scc_result + changed_when: + - reconcile_scc_result.stdout != '' + - reconcile_scc_result.rc == 0 run_once: true - set_fact: |