| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970 |
- ---
- - name: Check efs current replica count
- command: >
- {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig get dc provisioners-efs
- -o jsonpath='{.spec.replicas}' -n {{openshift_provisioners_project}}
- register: efs_replica_count
- when: not ansible_check_mode
- ignore_errors: yes
- changed_when: no
- - name: Generate efs PersistentVolumeClaim
- template: src=pvc.j2 dest={{mktemp.stdout}}/templates/{{obj_name}}-pvc.yaml
- vars:
- obj_name: "provisioners-efs"
- size: "1Mi"
- access_modes:
- - "ReadWriteMany"
- pv_selector:
- provisioners-efs: efs
- check_mode: no
- changed_when: no
- - name: Generate efs PersistentVolume
- template: src=pv.j2 dest={{mktemp.stdout}}/templates/{{obj_name}}-pv.yaml
- vars:
- obj_name: "provisioners-efs"
- size: "1Mi"
- access_modes:
- - "ReadWriteMany"
- labels:
- provisioners-efs: efs
- volume_plugin: "nfs"
- volume_source:
- - {key: "server", value: "{{openshift_provisioners_efs_fsid}}.efs.{{openshift_provisioners_efs_region}}.amazonaws.com"}
- - {key: "path", value: "{{openshift_provisioners_efs_path}}"}
- claim_name: "provisioners-efs"
- check_mode: no
- changed_when: no
- - name: Generate efs DeploymentConfig
- template:
- src: efs.j2
- dest: "{{ mktemp.stdout }}/templates/{{deploy_name}}-dc.yaml"
- vars:
- name: efs
- deploy_name: "provisioners-efs"
- deploy_serviceAccount: "provisioners-efs"
- replica_count: "{{efs_replica_count.stdout | default(0)}}"
- node_selector: "{{openshift_provisioners_efs_nodeselector | default('') }}"
- claim_name: "provisioners-efs"
- check_mode: no
- changed_when: false
- # anyuid in order to run as root & chgrp shares with allocated gids
- - name: "Check efs anyuid permissions"
- command: >
- {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig
- get scc/anyuid -o jsonpath='{.users}'
- register: efs_anyuid
- check_mode: no
- changed_when: no
- - name: "Set anyuid permissions for efs"
- command: >
- {{ openshift.common.admin_binary}} --config={{ mktemp.stdout }}/admin.kubeconfig policy
- add-scc-to-user anyuid system:serviceaccount:{{openshift_provisioners_project}}:provisioners-efs
- register: efs_output
- failed_when: efs_output.rc == 1 and 'exists' not in efs_output.stderr
- check_mode: no
- when: efs_anyuid.stdout.find("system:serviceaccount:{{openshift_provisioners_project}}:provisioners-efs") == -1
|
