mirror of
https://github.com/ansible/awx-operator.git
synced 2026-03-26 21:33:14 +00:00
d64c34f8a4
Support external execution nodes - Allow receptor.conf to be editable at runtime - Create CA cert and key as a k8s secret - Create work signing RSA keypair as a k8s secret - Setup volume mounts for containers to have access to the needed Receptor keys / certs to facilitate generating the install bundle for a new execution node - added firewall rule, work signing and tls cert configuration to default receptor.conf The volume mount changes in this PR fulfill the following: - `receptor.conf` need to be shared between task container and ee container - **task** container writes the `receptor.conf` - **ee** consume the `receptor.conf` - receptor ca cert/key need to be mounted by both ee container and web container - **ee** container need the ca cert - **web** container will need the ca key to sign client cert for remote execution node - **web** container will need the ca cert to generate install bundle for remote execution node - receptor work private/public key need to be mounted by both ee container and web container - **ee** container need to private key to sign the work - **web** container need the public key to generate install bundle for remote execution node - **task** container need the private key to sign the work Signed-off-by: Hao Liu <haoli@redhat.com> Co-Authored-By: Seth Foster <fosterbseth@gmail.com> Co-Authored-By: Shane McDonald <me@shanemcd.com> Signed-off-by: Hao Liu <haoli@redhat.com> Co-authored-by: Shane McDonald <me@shanemcd.com> Co-authored-by: Seth Foster <fosterbseth@gmail.com>
26 lines
640 B
Docker
26 lines
640 B
Docker
FROM quay.io/operator-framework/ansible-operator:v1.22.2
|
|
|
|
USER 0
|
|
|
|
RUN dnf install -y openssl
|
|
|
|
USER 1001
|
|
|
|
ARG DEFAULT_AWX_VERSION
|
|
ARG OPERATOR_VERSION
|
|
ENV DEFAULT_AWX_VERSION=${DEFAULT_AWX_VERSION}
|
|
ENV OPERATOR_VERSION=${OPERATOR_VERSION}
|
|
|
|
COPY requirements.yml ${HOME}/requirements.yml
|
|
RUN ansible-galaxy collection install -r ${HOME}/requirements.yml \
|
|
&& chmod -R ug+rwx ${HOME}/.ansible
|
|
|
|
COPY watches.yaml ${HOME}/watches.yaml
|
|
COPY roles/ ${HOME}/roles/
|
|
COPY playbooks/ ${HOME}/playbooks/
|
|
|
|
ENTRYPOINT ["/tini", "--", "/usr/local/bin/ansible-operator", "run", \
|
|
"--watches-file=./watches.yaml", \
|
|
"--reconcile-period=0s" \
|
|
]
|