988a822259
Adds support for Podman as an alternative container engine. This builds on the support added in kolla-ansible in the 2023.2 cycle. Change-Id: I2c6befbdda7e684228065103feea7250a0ea3826
113 lines
4.0 KiB
YAML
113 lines
4.0 KiB
YAML
---
|
|
# NOTE(mgoddard): The bootstrap user may be used to create the kayobe user
|
|
# account and configure passwordless sudo. We can't assume that the bootstrap
|
|
# user account will exist after the initial bootstrapping, or that the
|
|
# current operator's key is authorised for the bootstrap user. We therefore
|
|
# attempt to access the kayobe user account via SSH, and only perform the
|
|
# bootstrap process if the account is inaccessible.
|
|
|
|
- name: Determine whether user bootstrapping is required
|
|
hosts: seed-hypervisor:seed:overcloud:infra-vms
|
|
gather_facts: false
|
|
max_fail_percentage: >-
|
|
{{ kayobe_ansible_user_max_fail_percentage |
|
|
default(host_configure_max_fail_percentage) |
|
|
default(kayobe_max_fail_percentage) |
|
|
default(100) }}
|
|
tags:
|
|
- kayobe-ansible-user
|
|
tasks:
|
|
- name: Check whether the host is accessible via SSH
|
|
raw: hostname
|
|
ignore_unreachable: true
|
|
changed_when: false
|
|
check_mode: no
|
|
register: ssh_result
|
|
|
|
- name: Group hosts requiring kayobe user bootstrapping
|
|
group_by:
|
|
key: kayobe_user_bootstrap_required_{{ ssh_result.unreachable | default(false) }}
|
|
changed_when: false
|
|
|
|
- name: Display a message when bootstrapping is required
|
|
debug:
|
|
msg: >
|
|
Cannot access host via SSH using Kayobe Ansible user account -
|
|
attempting bootstrap
|
|
when: ssh_result.unreachable | default(false)
|
|
|
|
- name: Ensure python is installed and the Kayobe Ansible user account exists
|
|
hosts: kayobe_user_bootstrap_required_True
|
|
gather_facts: no
|
|
max_fail_percentage: >-
|
|
{{ kayobe_ansible_user_max_fail_percentage |
|
|
default(host_configure_max_fail_percentage) |
|
|
default(kayobe_max_fail_percentage) |
|
|
default(100) }}
|
|
vars:
|
|
ansible_user: "{{ bootstrap_user }}"
|
|
# We can't assume that a virtualenv exists at this point, so use the system
|
|
# python interpreter.
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
dnf_options:
|
|
- "-y"
|
|
- "{% if 'proxy' in dnf_config %}--setopt=proxy={{ dnf_config['proxy'] }}{% endif %}"
|
|
tags:
|
|
- kayobe-ansible-user
|
|
- ensure-python
|
|
tasks:
|
|
- name: Check if python is installed
|
|
raw: test -e /usr/bin/python3
|
|
changed_when: false
|
|
failed_when: false
|
|
register: check_python
|
|
|
|
# TODO(priteau): Support apt proxy
|
|
- name: Ensure python is installed
|
|
raw: "test -e /usr/bin/apt && (sudo apt -y update && sudo apt install -y python3-minimal) || (sudo dnf {{ dnf_options | select | join(' ') }} install python3)"
|
|
when: check_python.rc != 0
|
|
|
|
- import_role:
|
|
name: singleplatform-eng.users
|
|
vars:
|
|
groups_to_create: "{{ [{'name': 'docker'}] if 'container-engine' in group_names and container_engine == 'docker' else [] }}"
|
|
users:
|
|
- username: "{{ kayobe_ansible_user }}"
|
|
name: Kayobe deployment user
|
|
groups: "{{ ['docker'] if 'container-engine' in group_names and container_engine == 'docker' else [] }}"
|
|
append: True
|
|
ssh_key:
|
|
- "{{ lookup('file', ssh_public_key_path) }}"
|
|
become: True
|
|
|
|
- name: Ensure the Kayobe Ansible user has passwordless sudo
|
|
copy:
|
|
content: "{{ kayobe_ansible_user }} ALL=(ALL) NOPASSWD: ALL"
|
|
dest: "/etc/sudoers.d/kayobe-ansible-user"
|
|
mode: 0440
|
|
become: True
|
|
|
|
- name: Verify that the Kayobe Ansible user account is accessible
|
|
hosts: seed-hypervisor:seed:overcloud:infra-vms
|
|
gather_facts: false
|
|
max_fail_percentage: >-
|
|
{{ kayobe_ansible_user_max_fail_percentage |
|
|
default(host_configure_max_fail_percentage) |
|
|
default(kayobe_max_fail_percentage) |
|
|
default(100) }}
|
|
tags:
|
|
- kayobe-ansible-user
|
|
vars:
|
|
# We can't assume that a virtualenv exists at this point, so use the system
|
|
# python interpreter.
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
tasks:
|
|
- name: Verify that a command can be executed
|
|
command: hostname
|
|
changed_when: false
|
|
|
|
- name: Verify that a command can be executed with become
|
|
command: hostname
|
|
changed_when: false
|
|
become: true
|