Jelajahi Sumber

Bug 1274201 - Fixing non-root installations if using a local connection

Previously we were writing out a inventory like this:

~~~
[OSEv3:children]
masters
nodes

[OSEv3:vars]
ansible_ssh_user=root
deployment_type=openshift-enterprise
ansible_connection=local

[masters]
ose3-master.example.com  openshift_hostname=ose3-master.example.com

[nodes]
ose3-master.example.com  openshift_hostname=ose3-master.example.com
ose3-node1.example.com  openshift_hostname=ose3-node1.example.com
ose3-node2.example.com  openshift_hostname=ose3-node2.example.com
~~~

The problem with that is now all the hosts are consider local connections.  In
addition our sudo check wasn't working as expected.  We would check that we
have sudo, but the playbooks were not running with root privileges.  When
gathering facts you'd hit:

~~~
__main__.OpenShiftFactsFileWriteError: Could not create fact file: /etc/ansible/facts.d/openshift.fact, error: [Errno 13] Permission denied: '/etc/ansible/facts.d/openshift.fact'
~~~

Instead the test for locale connections needs to be per host.  Anytime we're not running as root we need `ansible_become` set:

~~~
ose3-master.example.com  openshift_hostname=ose3-master.example.com ansible_connection=local ansible_become=true
~~~
Brenton Leanhardt 9 tahun lalu
induk
melakukan
cfca7b9f78
1 mengubah file dengan 11 tambahan dan 9 penghapusan
  1. 11 9
      utils/src/ooinstall/openshift_ansible.py

+ 11 - 9
utils/src/ooinstall/openshift_ansible.py

@@ -18,7 +18,6 @@ def set_config(cfg):
 def generate_inventory(hosts):
 def generate_inventory(hosts):
     global CFG
     global CFG
 
 
-    installer_host = socket.gethostname()
     base_inventory_path = CFG.settings['ansible_inventory_path']
     base_inventory_path = CFG.settings['ansible_inventory_path']
     base_inventory = open(base_inventory_path, 'w')
     base_inventory = open(base_inventory_path, 'w')
     base_inventory.write('\n[OSEv3:children]\nmasters\nnodes\n')
     base_inventory.write('\n[OSEv3:children]\nmasters\nnodes\n')
@@ -44,14 +43,6 @@ def generate_inventory(hosts):
     if 'OO_INSTALL_STAGE_REGISTRY' in os.environ:
     if 'OO_INSTALL_STAGE_REGISTRY' in os.environ:
         base_inventory.write('oreg_url=registry.access.stage.redhat.com/openshift3/ose-${component}:${version}\n')
         base_inventory.write('oreg_url=registry.access.stage.redhat.com/openshift3/ose-${component}:${version}\n')
 
 
-    if any(host.hostname == installer_host or host.public_hostname == installer_host
-            for host in hosts):
-        no_pwd_sudo = subprocess.call(['sudo', '-v', '-n'])
-        if no_pwd_sudo == 1:
-            print 'The atomic-openshift-installer requires sudo access without a password.'
-            sys.exit(1)
-        base_inventory.write("ansible_connection=local\n")
-
     base_inventory.write('\n[masters]\n')
     base_inventory.write('\n[masters]\n')
     masters = (host for host in hosts if host.master)
     masters = (host for host in hosts if host.master)
     for master in masters:
     for master in masters:
@@ -72,6 +63,7 @@ def generate_inventory(hosts):
 
 
 def write_host(host, inventory, scheduleable=True):
 def write_host(host, inventory, scheduleable=True):
     global CFG
     global CFG
+
     facts = ''
     facts = ''
     if host.ip:
     if host.ip:
         facts += ' openshift_ip={}'.format(host.ip)
         facts += ' openshift_ip={}'.format(host.ip)
@@ -85,6 +77,16 @@ def write_host(host, inventory, scheduleable=True):
     # Technically only nodes will ever need this.
     # Technically only nodes will ever need this.
     if not scheduleable:
     if not scheduleable:
         facts += ' openshift_scheduleable=False'
         facts += ' openshift_scheduleable=False'
+    installer_host = socket.gethostname()
+    if host.hostname == installer_host or host.public_hostname == installer_host:
+        facts += ' ansible_connection=local'
+        if os.geteuid() != 0:
+            no_pwd_sudo = subprocess.call(['sudo', '-v', '-n'])
+            if no_pwd_sudo == 1:
+                print 'The atomic-openshift-installer requires sudo access without a password.'
+                sys.exit(1)
+            facts += ' ansible_become=true'
+
     inventory.write('{} {}\n'.format(host, facts))
     inventory.write('{} {}\n'.format(host, facts))