Standardize openshift roles to OASIS

.github/workflows/linting.yml

@@ -37,4 +37,7 @@ jobs:
     - name: "Execute linting for Docker role"
       run: |
         cd ./linchpin/provision/roles/docker
+    - name: "Execute linting for Openshift role"
+      run: |
+        cd ./linchpin/provision/roles/openshift
         molecule lint -s delegated

linchpin/provision/roles/openshift/.ansible-lint

@@ -0,0 +1,3 @@
+skip_list:
+  - "204"  # disable LineTooLongRule
+  - "503"  # disable "Tasks run when changed should be handlers"

linchpin/provision/roles/openshift/.gitignore

@@ -0,0 +1,7 @@
+.*.swp
+.*.swo
+*.pyc
+*.pyo
+__pycache__/*
+molecule/*/junit.xml
+molecule/*/pytestdebug.log

linchpin/provision/roles/openshift/AUTHORS

@@ -0,0 +1 @@
+Ryan Cole <[email protected]>

linchpin/provision/roles/openshift/defaults/main.yml

@@ -0,0 +1,2 @@
+openshift_become: true
+openshift_become_user: root

linchpin/provision/roles/openshift/filter_plugins/add_res_data.py

@@ -0,0 +1 @@
+../../../filter_plugins/add_res_data.py

linchpin/provision/roles/openshift/filter_plugins/get_pod_status.py

@@ -0,0 +1 @@
+../../../filter_plugins/get_pod_status.py

linchpin/provision/roles/openshift/handlers/main.yml

@@ -0,0 +1 @@
+# Handlers for openshift

linchpin/provision/roles/openshift/library/auth_driver.py

@@ -0,0 +1 @@
+../../../library/auth_driver.py

linchpin/provision/roles/openshift/meta/main.yml

@@ -0,0 +1,19 @@
+galaxy_info:
+  author: Samvaran Rallabandi
+  description: openshift provisioning for LinchPin
+  company: Red Hat, Inc.
+  license: GPLv3
+  min_ansible_version: 2.8
+  platforms:
+    - name: EL
+      versions:
+        - 7
+        - 8
+    - name: Fedora
+      versions:
+        - 30
+        - 31
+  galaxy_tags:
+    - oasis
+    - linchpin
+    - openshift

linchpin/provision/roles/openshift/molecule/delegated/create.yml

@@ -0,0 +1,6 @@
+- name: Create
+  hosts: all
+  tasks:
+    - name: "Create molecule instances"
+      debug:
+        msg: "Creating..."

linchpin/provision/roles/openshift/molecule/delegated/destroy.yml

@@ -0,0 +1,7 @@
+- name: Destroy
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  roles:
+    - role: oasis_roles.molecule_docker_ci
+      molecule_docker_ci_state: absent

linchpin/provision/roles/openshift/molecule/delegated/molecule.yml

@@ -0,0 +1,40 @@
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/shared/requirements.yml
+driver:
+  name: delegated
+  options:
+    managed: false
+    ansible_connection_options:
+      ansible_connection: local
+lint:
+  name: yamllint
+  options:
+    config-file: tests/yamllint.yml
+platforms:
+  - name: openshift-delegated
+provisioner:
+  name: ansible
+  lint:
+    name: ansible-lint
+  playbooks:
+    prepare: ../shared/prepare.yml
+    converge: ../shared/playbook.yml
+    cleanup: ../shared/cleanup.yml
+  config_options:
+    defaults:
+      stdout_callback: yaml
+verifier:
+  name: testinfra
+  options:
+    # Add a -v so you see the individual test names,
+    # particularly useful with parameterized tests
+    v: true
+  lint:
+    name: flake8
+  # Using the shared directory is useful for sharing tests across scenarios,
+  # but is not a requirement. For scenario specific tests, add the appropriate
+  # file path to the test or test directory below
+  additional_files_or_dirs:
+    - ../../shared/tests

linchpin/provision/roles/openshift/molecule/delegated/tests/test_null.py

@@ -0,0 +1,8 @@
+# Without at least a file here, tests in the additional directory will not
+# get picked up. If you add actual tests to this directory, then you can
+# safely eliminate this file. Otherwise, it exists only to cause the tests in
+# shared/tests to be discovered.
+#
+# Most tests should be written in the shared/tests directory so that they can
+# be captured by all the scenarios. Only add tests here if there are tests
+# only relevant to a particular scenario

linchpin/provision/roles/openshift/molecule/shared/cleanup.yml

@@ -0,0 +1,22 @@
+- name: unregister systems
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: wait for host
+      wait_for_connection:
+        timeout: 1
+      register: waiting
+      ignore_errors: true
+
+    - block:
+        - name: fetch facts
+          setup: {}
+
+        - name: do unregistration
+          include_role:
+            name: oasis_roles.rhsm
+          when: ansible_distribution == 'RedHat'
+      when: waiting is success
+  vars:
+    rhsm_unregister: true
+    rhsm_username: "{{ omit }}"

linchpin/provision/roles/openshift/molecule/shared/playbook.yml

@@ -0,0 +1,5 @@
+- name: converge
+  hosts: all
+  roles:
+    - role: openshift
+  post_tasks: []

linchpin/provision/roles/openshift/molecule/shared/prepare.yml

@@ -0,0 +1,15 @@
+- name: register RHSM
+  hosts: all
+  roles:
+    - role: oasis_roles.rhsm
+      when: ansible_distribution == 'RedHat'
+  vars:
+    rhsm_username: "{{ lookup('env', 'OASIS_RHSM_USERNAME') }}"
+    rhsm_password: "{{ lookup('env', 'OASIS_RHSM_PASSWORD') }}"
+    rhsm_server_hostname: "{{ lookup('env', 'OASIS_RHSM_SERVER_HOSTNAME') }}"
+    rhsm_pool_ids: "{{ lookup('env', 'OASIS_RHSM_POOL_IDS') }}"
+    rhsm_repositories:
+      enabled:
+        - rhel-7-server-rpms
+        - rhel-7-server-extras-rpms
+        - rhel-7-server-optional-rpms

linchpin/provision/roles/openshift/molecule/shared/requirements.yml

@@ -0,0 +1,2 @@
+- oasis_roles.rhsm
+- oasis_roles.molecule_docker_ci

linchpin/provision/roles/openshift/tasks/main.yml

@@ -1,11 +1,11 @@
----
 # This playbook will provision OpenShift resources
-
 - name: allocate openshift output variables
   set_fact:
     topology_outputs_openshift_resources: []
 
 - name: "Initiating Provision/Teardown of openstack resource group"
-  include: provision_resource_group.yml res_grp={{ item }}
+  include_tasks: provision_resource_group.yml
+  vars:
+    res_grp: "{{ item }}"
   with_items:
     - "{{ resources }}"

linchpin/provision/roles/openshift/tasks/provision_openshift.yml

@@ -1,4 +1,3 @@
----
 - name: create resource definition
   k8s:
     # if the host is not mentioned it takes value from K8S_AUTH_HOST env var
@@ -20,7 +19,7 @@
     verify_ssl: "{{ auth_var['verify_ssl'] | default('no') }}"
     password: "{{ auth_var['password'] | default(omit) }}"
     username: "{{ auth_var['username'] | default(omit) }}"
-    ssl_ca_cert: "{{ auth_var['ssl_ca_cert'] | default(omit) }}" 
+    ssl_ca_cert: "{{ auth_var['ssl_ca_cert'] | default(omit) }}"
   register: res_def_output
 
 - name: create resource definition with validation
@@ -44,7 +43,7 @@
     verify_ssl: "{{ auth_var['verify_ssl'] | default('no') }}"
     password: "{{ auth_var['password'] | default(omit) }}"
     username: "{{ auth_var['username'] | default(omit) }}"
-    ssl_ca_cert: "{{ auth_var['ssl_ca_cert'] | default(omit) }}" 
+    ssl_ca_cert: "{{ auth_var['ssl_ca_cert'] | default(omit) }}"
     validate:
       fail_on_error: "{{ res_def['validate'] | default('yes') }}"
       strict: "{{ res_def['strict'] | default('yes') }}"
@@ -53,7 +52,7 @@
 
 
 - name: Wait for the deployment to happen
-  pause: 
+  pause:
     seconds: "{{ res_def['timeout'] | default(10) }}"
 
 - name: List all the pods
@@ -67,11 +66,11 @@
     ssl_ca_cert: "{{ auth_var['ssl_ca_cert'] | default(omit) }}"
     namespace: "{{ auth_var['namespace'] | default(omit) }}"
     kind: Pod
-    verify_ssl: no
+    verify_ssl: false
   register: pod_list
 
 - name: setfact for pod output
-  set_fact: 
+  set_fact:
     pod_output: "{{ pod_list | get_pod_status(res_def_output) |default('') }}"
   when: state == "present" and res_def_output["result"]["kind"] == "Pod"
 
@@ -82,23 +81,28 @@
 
 - name: fail when pod_output is failure
   fail:
-    msg: "Multiple pods in pending/failure state please adjust the timeout value and retry"
-  when: state == "present" and pod_output == 'Failure' 
+    msg: "Multiple pods in pending/failure\
+          state please adjust the timeout value and retry"
+  when: state == "present" and pod_output == 'Failure'
 
 - name: add output to topology
   set_fact:
-    topology_outputs_openshift_resources: "{{ topology_outputs_openshift_resources + [pod_output] }}"
+    topology_outputs_openshift_resources:
+      "{{ topology_outputs_openshift_resources + [pod_output] }}"
   when:
-    - state == "present" 
+    - state == "present"
     - res_def_output["result"]["kind"] == "Pod"
 
 - name: add output to topology
   set_fact:
-    topology_outputs_openshift_resources: "{{ topology_outputs_openshift_resources + [res_def_output] }}"
+    topology_outputs_openshift_resources:
+      "{{ topology_outputs_openshift_resources + [res_def_output] }}"
   when:
-    - state == "present" 
+    - state == "present"
     - res_def_output["result"]["kind"] != "Pod"
-    
+
 - name: "Add type to resource"
   set_fact:
-    topology_outputs_openshift_resources: "{{ topology_outputs_openshift_resources | add_res_data(res_grp_type, res_def['role']) }}"
+    topology_outputs_openshift_resources:
+      "{{ topology_outputs_openshift_resources |
+          add_res_data(res_grp_type, res_def['role']) }}"

linchpin/provision/roles/openshift/tasks/provision_res_defs.yml

@@ -1,6 +1,5 @@
----
 - name: "provision/teardown resources }}"
-  # The following include might change to role if 
+  # The following include might change to role if
   # multiple openshift resources come in
   #include: "provision_{{ res_def['role'] }}.yml"
-  include: "provision_openshift.yml"
+  include_tasks: "provision_openshift.yml"

linchpin/provision/roles/openshift/tasks/provision_resource_group.yml

@@ -1,4 +1,3 @@
----
 - name: "Unset the authvar from previous run"
   set_fact:
     auth_var: ""
@@ -23,7 +22,9 @@
 - name: "set default_cred_filename when res_grp[credentials] is defined"
   set_fact:
     cred_filename: "{{ res_grp['credentials']['filename'] }}"
-  when: res_grp['credentials'] is defined and res_grp['credentials']['filename'] is defined
+  when:
+    - res_grp['credentials'] is defined
+    - res_grp['credentials']['filename'] is defined
 
 - name: debug to checkout workspace env var
   debug:
@@ -42,24 +43,35 @@
   register: auth_var_out
   ignore_errors: true
   no_log: "{{ not auth_debug }}"
-  when: res_grp['credentials'] is defined and res_grp['credentials']['filename'] is defined
+  when:
+    - res_grp['credentials'] is defined
+    - res_grp['credentials']['filename'] is defined
 
 - name: "set auth_var"
   set_fact:
     auth_var: "{{ auth_var_out['output'][cred_profile] }}"
   ignore_errors: true
   no_log: "{{ not auth_debug }}"
-  when: auth_var_out['output'] is defined and res_grp['credentials'] is defined and res_grp['credentials']['filename'] is defined
+  when:
+    - auth_var_out['output'] is defined
+    - res_grp['credentials'] is defined
+    - res_grp['credentials']['filename'] is defined
 
 - name: "set auth_var when filename is not defined"
   set_fact:
     auth_var: "{{ res_grp['credentials'] }}"
-  when: res_grp['credentials'] is defined and res_grp['credentials']['filename'] is not defined
+  when:
+    - res_grp['credentials'] is defined
+    - res_grp['credentials']['filename'] is not defined
   ignore_errors: true
 
 - debug: var=auth_var_out
 - name: "Initiating Provision/Teardown of openshift resource group"
-  include: provision_res_defs.yml res_def={{ res_item.0 }} res_grp_name={{ res_item.1 }} res_grp_type={{ res_item.2 }}
+  include_tasks: provision_res_defs.yml
+  vars:
+    res_def: "{{ res_item.0 }}"
+    res_grp_name: "{{ res_item.1 }}"
+    res_grp_type: "{{ res_item.2 }}"
   with_nested:
     - "{{ res_grp['resource_definitions'] }}"
     - "{{ res_grp['resource_group_name'] }}"

linchpin/provision/roles/openshift/tests/yamllint.yml

@@ -0,0 +1,10 @@
+extends: default
+
+rules:
+  line-length:
+    level: error
+  document-start:
+    present: false
+    level: error
+  comments:
+    require-starting-space: false

linchpin/provision/roles/openshift/vars/main.yml

@@ -0,0 +1 @@
+# Vars for openshift