|
@@ -11,7 +11,8 @@ Note: If your GCE project does not show a Service Account under <Project>/APIs &
|
|
|
|
|
|
Convert a GCE service key into a pem (for ansible)
|
|
Convert a GCE service key into a pem (for ansible)
|
|
--------------------------------------------------
|
|
--------------------------------------------------
|
|
-1. The gce service key looks something like this: os302gce-ef83bd90f261.p12
|
|
|
|
|
|
+1. mkdir -p ~/.gce
|
|
|
|
+1. The gce service key looks something like this: projectname-ef83bd90f261.p12
|
|
.. the ef83bd90f261 part is the public hash
|
|
.. the ef83bd90f261 part is the public hash
|
|
1. Be in the same directory as the p12 key file.
|
|
1. Be in the same directory as the p12 key file.
|
|
1. The commands below should be copy / paste-able
|
|
1. The commands below should be copy / paste-able
|
|
@@ -21,18 +22,32 @@ Convert a GCE service key into a pem (for ansible)
|
|
export GCE_KEY_HASH=ef83bd90f261
|
|
export GCE_KEY_HASH=ef83bd90f261
|
|
|
|
|
|
# Convert the service key (note: 'notasecret' is literally what we want here)
|
|
# Convert the service key (note: 'notasecret' is literally what we want here)
|
|
- openssl pkcs12 -in os302gce-${GCE_KEY_HASH}.p12 -passin pass:notasecret -nodes -nocerts | openssl rsa -out os302gce-${GCE_KEY_HASH}.pem
|
|
|
|
|
|
+ openssl pkcs12 -in projectname-${GCE_KEY_HASH}.p12 -passin pass:notasecret -nodes -nocerts | openssl rsa -out projectname-${GCE_KEY_HASH}.pem
|
|
|
|
|
|
- # Move the converted service key to the .ssh dir
|
|
|
|
- mv os302gce-${GCE_KEY_HASH}.pem ~/.ssh
|
|
|
|
|
|
+ # Move the converted service key to the .gce dir
|
|
|
|
+ mv projectname-${GCE_KEY_HASH}.pem ~/.gce
|
|
|
|
|
|
# Set a sym link so it is easy to reference
|
|
# Set a sym link so it is easy to reference
|
|
- ln -s ~/.ssh/os302gce-${GCE_KEY_HASH}.pem ~/.ssh/os302gce_priv_key.pem
|
|
|
|
|
|
+ ln -s ~/.gce/projectname-${GCE_KEY_HASH}.pem ~/.gce/projectname_priv_key.pem
|
|
```
|
|
```
|
|
|
|
|
|
-1. Once this is done, put the original service key file (os302gce-ef83bd90f261.p12) somewhere safe, or delete it (your call, I don not know what else we will use it for, and we can always regen it if needed).
|
|
|
|
|
|
+1. Once this is done, put the original service key file (projectname-ef83bd90f261.p12) somewhere safe, or delete it (your call, I don not know what else we will use it for, and we can always regen it if needed).
|
|
|
|
|
|
|
|
|
|
|
|
+Create a secrets.py file for GCE
|
|
|
|
+--------------------------------
|
|
|
|
+1. vi ~/.gce/secrets.py
|
|
|
|
+1. make the contents look like this:
|
|
|
|
+```
|
|
|
|
+ GCE_PARAMS = ('long...@developer.gserviceaccount.com', '/full/path/to/projectname_priv_key.pem')
|
|
|
|
+ GCE_KEYWORD_PARAMS = {'project': 'my_project_id'}
|
|
|
|
+```
|
|
|
|
+1. Setup a sym link so that gce.py will pick it up (must be in same dir as gce.py)
|
|
|
|
+```
|
|
|
|
+ cd openshift-online-ansible/inventory/gce
|
|
|
|
+ ln -s ~/.gce/secrets.py secrets.py
|
|
|
|
+```
|
|
|
|
+
|
|
|
|
|
|
Install Dependencies
|
|
Install Dependencies
|
|
--------------------
|
|
--------------------
|