From e6ea6839a8f657c1266c25ba4aba43c837329fa3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Dulko?= <mdulko@redhat.com>
Date: Wed, 5 Apr 2017 14:24:24 +0200
Subject: Initial Kuryr support

This commit enables deploying Kuryr networking on top of OpenShift in
containers. kuryr-controller is a Deployment and kuryr-cni is deployed
as DaemonSet (container will drop all CNI configuration files).

Co-Authored-By: Antoni Segura Puimedon <celebdor@gmail.com>
---
 roles/kuryr/tasks/master.yaml         | 52 +++++++++++++++++++++++++++++++++++
 roles/kuryr/tasks/node.yaml           | 48 ++++++++++++++++++++++++++++++++
 roles/kuryr/tasks/serviceaccount.yaml | 31 +++++++++++++++++++++
 3 files changed, 131 insertions(+)
 create mode 100644 roles/kuryr/tasks/master.yaml
 create mode 100644 roles/kuryr/tasks/node.yaml
 create mode 100644 roles/kuryr/tasks/serviceaccount.yaml

(limited to 'roles/kuryr/tasks')

diff --git a/roles/kuryr/tasks/master.yaml b/roles/kuryr/tasks/master.yaml
new file mode 100644
index 000000000..55ab16f74
--- /dev/null
+++ b/roles/kuryr/tasks/master.yaml
@@ -0,0 +1,52 @@
+---
+- name: Perform OpenShit ServiceAccount config
+  include: serviceaccount.yaml
+
+- name: Create kuryr manifests tempdir
+  command: mktemp -d
+  register: manifests_tmpdir
+
+- name: Create kuryr ConfigMap manifest
+  become: yes
+  template:
+    src: configmap.yaml.j2
+    dest: "{{ manifests_tmpdir.stdout }}/configmap.yaml"
+
+- name: Create kuryr-controller Deployment manifest
+  become: yes
+  template:
+    src: controller-deployment.yaml.j2
+    dest: "{{ manifests_tmpdir.stdout }}/controller-deployment.yaml"
+
+- name: Create kuryr-cni DaemonSet manifest
+  become: yes
+  template:
+    src: cni-daemonset.yaml.j2
+    dest: "{{ manifests_tmpdir.stdout }}/cni-daemonset.yaml"
+
+- name: Apply ConfigMap manifest
+  oc_obj:
+    state: present
+    kind: ConfigMap
+    name: "kuryr-config"
+    namespace: "{{ kuryr_namespace }}"
+    files:
+    - "{{ manifests_tmpdir.stdout }}/configmap.yaml"
+
+- name: Apply Controller Deployment manifest
+  oc_obj:
+    state: present
+    kind: Deployment
+    name: "kuryr-controller"
+    namespace: "{{ kuryr_namespace }}"
+    files:
+    - "{{ manifests_tmpdir.stdout }}/controller-deployment.yaml"
+
+- name: Apply kuryr-cni DaemonSet manifest
+  oc_obj:
+    state: present
+    kind: DaemonSet
+    name: "kuryr-cni-ds"
+    namespace: "{{ kuryr_namespace }}"
+    files:
+    - "{{ manifests_tmpdir.stdout }}/cni-daemonset.yaml"
diff --git a/roles/kuryr/tasks/node.yaml b/roles/kuryr/tasks/node.yaml
new file mode 100644
index 000000000..ffe814713
--- /dev/null
+++ b/roles/kuryr/tasks/node.yaml
@@ -0,0 +1,48 @@
+---
+- name: Create CNI bin directory
+  file:
+    state: directory
+    path: "{{ cni_bin_dir }}"
+    mode: 0755
+    owner: root
+    group: root
+    recurse: yes
+
+- name: Create CNI extraction tempdir
+  command: mktemp -d
+  register: cni_tmpdir
+
+- name: Download CNI
+  get_url:
+    url: "{{ cni_bin_url }}"
+    checksum: "sha1:{{ cni_bin_checksum }}"
+    mode: 0644
+    dest: "{{ cni_tmpdir.stdout }}"
+  register: downloaded_tarball
+
+- name: Extract CNI
+  become: yes
+  unarchive:
+    remote_src: True
+    src: "{{ downloaded_tarball.dest }}"
+    dest: "{{ cni_bin_dir }}"
+  when: downloaded_tarball.changed
+
+- name: Ensure CNI net.d exists
+  file:
+    path: /etc/cni/net.d
+    recurse: yes
+    state: directory
+
+- name: Configure OpenShift node with disabled service proxy
+  lineinfile:
+    dest: "/etc/sysconfig/{{ openshift.common.service_type }}-node"
+    regexp: '^OPTIONS="?(.*?)"?$'
+    backrefs: yes
+    backup: yes
+    line: 'OPTIONS="\1 --disable dns,proxy,plugins"'
+
+- name: force node restart to disable the proxy
+  service:
+    name: "{{ openshift.common.service_type }}-node"
+    state: restarted
diff --git a/roles/kuryr/tasks/serviceaccount.yaml b/roles/kuryr/tasks/serviceaccount.yaml
new file mode 100644
index 000000000..088f13091
--- /dev/null
+++ b/roles/kuryr/tasks/serviceaccount.yaml
@@ -0,0 +1,31 @@
+---
+- name: Create Controller service account
+  oc_serviceaccount:
+    name: kuryr-controller
+    namespace: "{{ kuryr_namespace }}"
+  register: saout
+
+- name: Create a role for the Kuryr
+  oc_clusterrole: "{{ kuryr_clusterrole }}"
+
+- name: Fetch the created Kuryr controller cluster role
+  oc_clusterrole:
+    name: kuryrctl
+    state: list
+  register: crout
+
+- name: Grant Kuryr the privileged security context constraints
+  oc_adm_policy_user:
+    user: "system:serviceaccount:{{ kuryr_namespace }}:{{ saout.results.results.0.metadata.name }}"
+    namespace: "{{ kuryr_namespace }}"
+    resource_kind: scc
+    resource_name: privileged
+    state: present
+
+- name: Assign role to Kuryr service account
+  oc_adm_policy_user:
+    user: "system:serviceaccount:{{ kuryr_namespace }}:{{ saout.results.results.0.metadata.name }}"
+    namespace: "{{ kuryr_namespace }}"
+    resource_kind: cluster-role
+    resource_name: "{{ crout.results.results.metadata.name }}"
+    state: present
-- 
cgit v1.2.1