mirror of
https://github.com/openshift/community.okd.git
synced 2026-07-28 02:14:31 +00:00
* Upgrade Ansible and OKD versions for CI * Use ubi9 and fix sanity * Use correct pip install * Try using quotes * Ensure python3.9 * Upgrade ansible and molecule versions * Remove DeploymentConfig DeploymentConfigs are deprecated and seem to now be causing idempotence problems. Replacing them with Deployments fixes it. * Attempt to fix ldap integration tests Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Move sanity and unit tests to GH actions Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Firt round of sanity fixes Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add kubernetes.core collection as sanity requirement Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add ignore-2.16.txt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Attempt to fix units Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add ignore-2.17 Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Attempt to fix unit tests Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add pytest-ansible to test-requirements.txt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add changelog fragment Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add workflow for ansible-lint Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Apply black Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Fix linters Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add # fmt: skip Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Yet another round of linting Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Yet another round of linting Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Remove setup.cfg Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Revert #fmt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Use ansible-core 2.14 Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Cleanup ansible-lint ignores Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Try using service instead of pod IP * Fix typo * Actually use the correct port * See if NetworkPolicy is preventing connection * using Pod internal IP * fix adm prune auth roles syntax * adding some retry steps * fix: openshift_builds target * add flag --force-with-deps when building downstream collection * Remove yamllint from tox linters, bump minimum python supported version to 3.9, Remove support for ansible-core < 2.14 --------- Signed-off-by: Alina Buzachis <abuzachis@redhat.com> Co-authored-by: Mike Graves <mgraves@redhat.com> Co-authored-by: Alina Buzachis <abuzachis@redhat.com>
This commit is contained in:
Bikouo Aubin
GitHub
@@ -1,293 +1,294 @@
|
||||
---
|
||||
- block:
|
||||
- set_fact:
|
||||
test_sa: "clusterrole-sa"
|
||||
test_ns: "clusterrole-ns"
|
||||
- set_fact:
|
||||
test_sa: "clusterrole-sa"
|
||||
test_ns: "clusterrole-ns"
|
||||
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ test_ns }}"
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ test_ns }}"
|
||||
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ test_sa }}"
|
||||
register: result
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ test_sa }}"
|
||||
register: result
|
||||
- set_fact:
|
||||
secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
|
||||
|
||||
- set_fact:
|
||||
secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: _secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
|
||||
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: _secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in _secret.resources[0]['data']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in _secret.resources[0]['data']"
|
||||
- name: list Node should failed (forbidden user)
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Node should failed (forbidden user)
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- set_fact:
|
||||
test_labels:
|
||||
phase: dev
|
||||
cluster_roles:
|
||||
- name: pod-manager
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "authorization.openshift.io/v1"
|
||||
- name: node-manager
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "rbac.authorization.k8s.io/v1"
|
||||
|
||||
- set_fact:
|
||||
test_labels:
|
||||
phase: dev
|
||||
cluster_roles:
|
||||
- name: pod-manager
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "authorization.openshift.io/v1"
|
||||
- name: node-manager
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "rbac.authorization.k8s.io/v1"
|
||||
|
||||
- name: Create cluster roles
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRole
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ test_labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: "{{ item.resources }}"
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: '{{ cluster_roles }}'
|
||||
|
||||
- name: Create Role Binding (namespaced)
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ cluster_roles[0].name }}-binding"
|
||||
namespace: "{{ test_ns }}"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
- name: Create cluster roles
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRole
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
apiGroup: ""
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ test_labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: "{{ item.resources }}"
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: '{{ cluster_roles }}'
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- name: Create Role Binding (namespaced)
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ cluster_roles[0].name }}-binding"
|
||||
namespace: "{{ test_ns }}"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
apiGroup: ""
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- name: Create Cluster role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: "{{ item.api_version_binding }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-binding"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ item.name }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ cluster_roles }}"
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: list Pod for all namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
no_log: true
|
||||
- name: Create Cluster role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: "{{ item.api_version_binding }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-binding"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ item.name }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ cluster_roles }}"
|
||||
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- name: list Pod for all namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
no_log: true
|
||||
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: Prune clusterroles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
register: check
|
||||
check_mode: true
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: validate clusterrole binding candidates for prune
|
||||
assert:
|
||||
that:
|
||||
- '"{{ item.name }}-binding" in check.cluster_role_binding'
|
||||
- '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
|
||||
with_items: "{{ cluster_roles }}"
|
||||
- name: Prune clusterroles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
register: check
|
||||
check_mode: true
|
||||
|
||||
- name: Prune Cluster Role for managing Pod
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
- name: validate clusterrole binding candidates for prune
|
||||
assert:
|
||||
that:
|
||||
- '"{{ item.name }}-binding" in check.cluster_role_binding'
|
||||
- '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
|
||||
with_items: "{{ cluster_roles }}"
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
- name: Prune Cluster Role for managing Pod
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- name: Prune clusterroles (remaining)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: list Node using ServiceAccount should fail
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- name: Prune clusterroles (remaining)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
- name: list Node using ServiceAccount should fail
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
|
||||
always:
|
||||
- name: Ensure namespace is deleted
|
||||
|
||||
@@ -1,335 +1,336 @@
|
||||
---
|
||||
- block:
|
||||
- set_fact:
|
||||
test_ns: "prune-roles"
|
||||
sa_name: "roles-sa"
|
||||
pod_name: "pod-prune"
|
||||
role_definition:
|
||||
- name: pod-list
|
||||
labels:
|
||||
action: list
|
||||
verbs:
|
||||
- list
|
||||
role_binding:
|
||||
api_version: rbac.authorization.k8s.io/v1
|
||||
- name: pod-create
|
||||
labels:
|
||||
action: create
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
role_binding:
|
||||
api_version: authorization.openshift.io/v1
|
||||
- name: pod-delete
|
||||
labels:
|
||||
action: delete
|
||||
verbs:
|
||||
- delete
|
||||
role_binding:
|
||||
api_version: rbac.authorization.k8s.io/v1
|
||||
- set_fact:
|
||||
test_ns: "prune-roles"
|
||||
sa_name: "roles-sa"
|
||||
pod_name: "pod-prune"
|
||||
role_definition:
|
||||
- name: pod-list
|
||||
labels:
|
||||
action: list
|
||||
verbs:
|
||||
- list
|
||||
role_binding:
|
||||
api_version: rbac.authorization.k8s.io/v1
|
||||
- name: pod-create
|
||||
labels:
|
||||
action: create
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
role_binding:
|
||||
api_version: authorization.openshift.io/v1
|
||||
- name: pod-delete
|
||||
labels:
|
||||
action: delete
|
||||
verbs:
|
||||
- delete
|
||||
role_binding:
|
||||
api_version: rbac.authorization.k8s.io/v1
|
||||
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ test_ns }}'
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ test_ns }}'
|
||||
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: '{{ sa_name }}'
|
||||
namespace: '{{ test_ns }}'
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: '{{ sa_name }}'
|
||||
namespace: '{{ test_ns }}'
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ sa_name }}'
|
||||
register: sa_out
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ sa_name }}'
|
||||
register: sa_out
|
||||
- set_fact:
|
||||
secret_token: "{{ sa_out.resources[0]['secrets'][0]['name'] }}"
|
||||
|
||||
- set_fact:
|
||||
secret_token: "{{ sa_out.resources[0]['secrets'][0]['name'] }}"
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: r_secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']") or ("'token' in r_secret.resources[0]['data']")
|
||||
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: r_secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']") or ("'token' in r_secret.resources[0]['data']")
|
||||
- set_fact:
|
||||
api_token: "{{ r_secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ r_secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ r_secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in r_secret.resources[0]['data']"
|
||||
- set_fact:
|
||||
api_token: "{{ r_secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in r_secret.resources[0]['data']"
|
||||
|
||||
- name: list resources using service account
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: '{{ api_token }}'
|
||||
host: '{{ cluster_host }}'
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: '{{ test_ns }}'
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list resources using service account
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: '{{ api_token }}'
|
||||
host: '{{ cluster_host }}'
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: '{{ test_ns }}'
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create a role to manage Pod from namespace "{{ test_ns }}"
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ item.labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: "{{ role_definition }}"
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- name: Create Role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "{{ item.role_binding.api_version }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-bind"
|
||||
namespace: "{{ test_ns }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ sa_name }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
- name: Create a role to manage Pod from namespace "{{ test_ns }}"
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: Role
|
||||
name: "{{ item.name }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ role_definition }}"
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ item.labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: "{{ role_definition }}"
|
||||
|
||||
- name: Create Pod should succeed
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
- name: Create Role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "{{ item.role_binding.api_version }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-bind"
|
||||
namespace: "{{ test_ns }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ sa_name }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: "{{ item.name }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ role_definition }}"
|
||||
|
||||
- name: Create Pod should succeed
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
|
||||
- name: assert pod creation succeed
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
register: result
|
||||
|
||||
- name: assert pod creation succeed
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
- name: assert user is still authorize to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
- name: Prune auth roles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
register: check
|
||||
check_mode: true
|
||||
|
||||
- name: assert user is still authorize to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
- name: validate that list role binding are candidates for prune
|
||||
assert:
|
||||
that: '"{{ test_ns }}/{{ item.name }}-bind" in check.role_binding'
|
||||
with_items: "{{ role_definition }}"
|
||||
|
||||
- name: Prune auth roles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
register: check
|
||||
check_mode: true
|
||||
- name: Prune resource using label_selectors option
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
label_selectors:
|
||||
- action=delete
|
||||
register: prune
|
||||
|
||||
- name: validate that list role binding are candidates for prune
|
||||
assert:
|
||||
that: '"{{ test_ns }}/{{ item.name }}-bind" in check.role_binding'
|
||||
with_items: "{{ role_definition }}"
|
||||
- name: assert that role binding 'delete' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[2].name }}-bind" in check.role_binding'
|
||||
|
||||
- name: Prune resource using label_selectors option
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
label_selectors:
|
||||
- action=delete
|
||||
register: prune
|
||||
|
||||
- name: assert that role binding 'delete' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[2].name }}-bind" in check.role_binding'
|
||||
|
||||
- name: assert that user could not delete pod anymore
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
state: absent
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
name: "{{ pod_name }}"
|
||||
register: result
|
||||
ignore_errors: true
|
||||
|
||||
- name: assert pod deletion failed due to forbidden user
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
|
||||
- name: assert user is still able to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: Create Pod should succeed
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
- name: assert that user could not delete pod anymore
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
state: absent
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}-1"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
name: "{{ pod_name }}"
|
||||
register: result
|
||||
ignore_errors: true
|
||||
|
||||
- name: assert user is still authorize to create pod
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
- name: assert pod deletion failed due to forbidden user
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
|
||||
- name: Prune role using name
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ role_definition[1].name }}"
|
||||
register: prune
|
||||
|
||||
- name: assert that role binding 'create' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[1].name }}-bind" in check.role_binding'
|
||||
|
||||
- name: Create Pod (should failed)
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}-2"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
ignore_errors: true
|
||||
register: result
|
||||
|
||||
- name: assert user is not authorize to create pod anymore
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
- name: assert user is still able to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
- name: Create Pod should succeed
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}-1"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
|
||||
- name: assert user is still able to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
- name: assert user is still authorize to create pod
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: Prune all role for namespace (neither name nor label_selectors are specified)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
register: prune
|
||||
- name: Prune role using name
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ role_definition[1].name }}"
|
||||
register: prune
|
||||
|
||||
- name: assert that role binding 'list' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[0].name }}-bind" in check.role_binding'
|
||||
- name: assert that role binding 'create' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[1].name }}-bind" in check.role_binding'
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
ignore_errors: true
|
||||
- name: Create Pod (should failed)
|
||||
kubernetes.core.k8s:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
definition:
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ pod_name }}-2"
|
||||
spec:
|
||||
containers:
|
||||
- name: python
|
||||
image: python:3.7-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true; do echo $(date); sleep 15; done
|
||||
imagePullPolicy: IfNotPresent
|
||||
register: result
|
||||
ignore_errors: true
|
||||
|
||||
- name: assert user is not authorize to list pod anymore
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
- name: assert user is not authorize to create pod anymore
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
|
||||
- name: assert user is still able to list pods
|
||||
assert:
|
||||
that:
|
||||
- result is successful
|
||||
|
||||
- name: Prune all role for namespace (neither name nor label_selectors are specified)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: roles
|
||||
namespace: "{{ test_ns }}"
|
||||
register: prune
|
||||
|
||||
- name: assert that role binding 'list' was pruned
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- '"{{ test_ns }}/{{ role_definition[0].name }}-bind" in check.role_binding'
|
||||
|
||||
- name: List Pod
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
namespace: "{{ test_ns }}"
|
||||
kind: Pod
|
||||
register: result
|
||||
ignore_errors: true
|
||||
|
||||
- name: assert user is not authorize to list pod anymore
|
||||
assert:
|
||||
that:
|
||||
- '"forbidden: User" in error.msg'
|
||||
|
||||
always:
|
||||
- name: Ensure namespace is deleted
|
||||
|
||||
@@ -1,255 +1,255 @@
|
||||
---
|
||||
- name: Prune deployments
|
||||
block:
|
||||
- set_fact:
|
||||
dc_name: "hello"
|
||||
deployment_ns: "prune-deployments"
|
||||
deployment_ns_2: "prune-deployments-2"
|
||||
|
||||
- set_fact:
|
||||
dc_name: "hello"
|
||||
deployment_ns: "prune-deployments"
|
||||
deployment_ns_2: "prune-deployments-2"
|
||||
|
||||
- name: Ensure namespace
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ deployment_ns }}'
|
||||
- name: Ensure namespace
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ deployment_ns }}'
|
||||
|
||||
- name: Create deployment config
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}'
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
- name: Create deployment config
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
name: '{{ dc_name }}'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
|
||||
- name: prune deployments (no candidate DeploymentConfig)
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: test_prune
|
||||
- name: prune deployments (no candidate DeploymentConfig)
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: test_prune
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- test_prune is not changed
|
||||
- test_prune.replication_controllers | length == 0
|
||||
- assert:
|
||||
that:
|
||||
- test_prune is not changed
|
||||
- test_prune.replication_controllers | length == 0
|
||||
|
||||
- name: Update DeploymentConfig - set replicas to 0
|
||||
community.okd.k8s:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: "apps.openshift.io/v1"
|
||||
metadata:
|
||||
name: "{{ dc_name }}"
|
||||
spec:
|
||||
replicas: 0
|
||||
selector:
|
||||
- name: Update DeploymentConfig - set replicas to 0
|
||||
community.okd.k8s:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: "apps.openshift.io/v1"
|
||||
metadata:
|
||||
name: "{{ dc_name }}"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: "{{ dc_name }}"
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
spec:
|
||||
replicas: 0
|
||||
selector:
|
||||
name: "{{ dc_name }}"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: "{{ dc_name }}"
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
|
||||
- name: Wait for ReplicationController candidate for pruning
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: result
|
||||
retries: 10
|
||||
delay: 30
|
||||
until:
|
||||
- result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
|
||||
- name: Wait for ReplicationController candidate for pruning
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: result
|
||||
retries: 10
|
||||
delay: 30
|
||||
until:
|
||||
- result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
|
||||
|
||||
- name: Prune deployments - should delete 1 ReplicationController
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
check_mode: yes
|
||||
register: test_prune
|
||||
- name: Prune deployments - should delete 1 ReplicationController
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns }}"
|
||||
check_mode: yes
|
||||
register: test_prune
|
||||
|
||||
- name: Read ReplicationController
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: replications
|
||||
- name: Read ReplicationController
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: replications
|
||||
|
||||
- name: Assert that Replication controller was not deleted
|
||||
assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
- 'replications.resources.0.metadata.name is match("{{ dc_name }}-*")'
|
||||
- name: Assert that Replication controller was not deleted
|
||||
assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
- 'replications.resources.0.metadata.name is match("{{ dc_name }}-*")'
|
||||
|
||||
- name: Assure that candidate ReplicationController was found for pruning
|
||||
assert:
|
||||
that:
|
||||
- test_prune is changed
|
||||
- test_prune.replication_controllers | length == 1
|
||||
- test_prune.replication_controllers.0.metadata.name == replications.resources.0.metadata.name
|
||||
- test_prune.replication_controllers.0.metadata.namespace == replications.resources.0.metadata.namespace
|
||||
- name: Assure that candidate ReplicationController was found for pruning
|
||||
assert:
|
||||
that:
|
||||
- test_prune is changed
|
||||
- test_prune.replication_controllers | length == 1
|
||||
- test_prune.replication_controllers.0.metadata.name == replications.resources.0.metadata.name
|
||||
- test_prune.replication_controllers.0.metadata.namespace == replications.resources.0.metadata.namespace
|
||||
|
||||
- name: Prune deployments - keep younger than 45min (check_mode)
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
keep_younger_than: 45
|
||||
namespace: "{{ deployment_ns }}"
|
||||
check_mode: true
|
||||
register: keep_younger
|
||||
- name: Prune deployments - keep younger than 45min (check_mode)
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
keep_younger_than: 45
|
||||
namespace: "{{ deployment_ns }}"
|
||||
check_mode: true
|
||||
register: keep_younger
|
||||
|
||||
- name: assert no candidate was found
|
||||
assert:
|
||||
that:
|
||||
- keep_younger is not changed
|
||||
- keep_younger.replication_controllers == []
|
||||
- name: assert no candidate was found
|
||||
assert:
|
||||
that:
|
||||
- keep_younger is not changed
|
||||
- keep_younger.replication_controllers == []
|
||||
|
||||
- name: Ensure second namespace is created
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ deployment_ns_2 }}'
|
||||
- name: Ensure second namespace is created
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ deployment_ns_2 }}'
|
||||
|
||||
- name: Create deployment config from 2nd namespace
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns_2 }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
- name: Create deployment config from 2nd namespace
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns_2 }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}2'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
name: '{{ dc_name }}2'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
|
||||
- name: Stop deployment config - replicas = 0
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns_2 }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
replicas: 0
|
||||
selector:
|
||||
- name: Stop deployment config - replicas = 0
|
||||
community.okd.k8s:
|
||||
namespace: '{{ deployment_ns_2 }}'
|
||||
definition:
|
||||
kind: DeploymentConfig
|
||||
apiVersion: apps.openshift.io/v1
|
||||
metadata:
|
||||
name: '{{ dc_name }}2'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
spec:
|
||||
replicas: 0
|
||||
selector:
|
||||
name: '{{ dc_name }}2'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: '{{ dc_name }}2'
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-openshift
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: python:3.7-alpine
|
||||
command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
|
||||
wait: yes
|
||||
|
||||
- name: Wait for ReplicationController candidate for pruning
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: result
|
||||
retries: 10
|
||||
delay: 30
|
||||
until:
|
||||
- result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
|
||||
- name: Wait for ReplicationController candidate for pruning
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: result
|
||||
retries: 10
|
||||
delay: 30
|
||||
until:
|
||||
- result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
|
||||
|
||||
# Prune from one namespace should not have any effect on others namespaces
|
||||
- name: Prune deployments from 2nd namespace
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
check_mode: yes
|
||||
register: test_prune
|
||||
# Prune from one namespace should not have any effect on others namespaces
|
||||
- name: Prune deployments from 2nd namespace
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
check_mode: yes
|
||||
register: test_prune
|
||||
|
||||
- name: Assure that candidate ReplicationController was found for pruning
|
||||
assert:
|
||||
that:
|
||||
- test_prune is changed
|
||||
- test_prune.replication_controllers | length == 1
|
||||
- "test_prune.replication_controllers.0.metadata.namespace == deployment_ns_2"
|
||||
- name: Assure that candidate ReplicationController was found for pruning
|
||||
assert:
|
||||
that:
|
||||
- test_prune is changed
|
||||
- test_prune.replication_controllers | length == 1
|
||||
- "test_prune.replication_controllers.0.metadata.namespace == deployment_ns_2"
|
||||
|
||||
# Prune without namespace option
|
||||
- name: Prune from all namespace should update more deployments
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
check_mode: yes
|
||||
register: no_namespace_prune
|
||||
# Prune without namespace option
|
||||
- name: Prune from all namespace should update more deployments
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
check_mode: yes
|
||||
register: no_namespace_prune
|
||||
|
||||
- name: Assure multiple ReplicationController were found for pruning
|
||||
assert:
|
||||
that:
|
||||
- no_namespace_prune is changed
|
||||
- no_namespace_prune.replication_controllers | length == 2
|
||||
|
||||
# Execute Prune from 2nd namespace
|
||||
- name: Read ReplicationController before Prune operation
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: replications
|
||||
- name: Assure multiple ReplicationController were found for pruning
|
||||
assert:
|
||||
that:
|
||||
- no_namespace_prune is changed
|
||||
- no_namespace_prune.replication_controllers | length == 2
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
# Execute Prune from 2nd namespace
|
||||
- name: Read ReplicationController before Prune operation
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: replications
|
||||
|
||||
- name: Prune DeploymentConfig from 2nd namespace
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: _prune
|
||||
- assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
|
||||
- name: Assert DeploymentConfig was deleted
|
||||
assert:
|
||||
that:
|
||||
- _prune is changed
|
||||
- _prune.replication_controllers | length == 1
|
||||
- _prune.replication_controllers.0.details.name == replications.resources.0.metadata.name
|
||||
- name: Prune DeploymentConfig from 2nd namespace
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
namespace: "{{ deployment_ns_2 }}"
|
||||
register: _prune
|
||||
|
||||
# Execute Prune without namespace option
|
||||
- name: Read ReplicationController before Prune operation
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: replications
|
||||
- name: Assert DeploymentConfig was deleted
|
||||
assert:
|
||||
that:
|
||||
- _prune is changed
|
||||
- _prune.replication_controllers | length == 1
|
||||
- _prune.replication_controllers.0.details.name == replications.resources.0.metadata.name
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
# Execute Prune without namespace option
|
||||
- name: Read ReplicationController before Prune operation
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ReplicationController
|
||||
namespace: "{{ deployment_ns }}"
|
||||
register: replications
|
||||
|
||||
- name: Prune from all namespace should update more deployments
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
register: _prune
|
||||
- assert:
|
||||
that:
|
||||
- replications.resources | length == 1
|
||||
|
||||
- name: Assure multiple ReplicationController were found for pruning
|
||||
assert:
|
||||
that:
|
||||
- _prune is changed
|
||||
- _prune.replication_controllers | length > 0
|
||||
- name: Prune from all namespace should update more deployments
|
||||
community.okd.openshift_adm_prune_deployments:
|
||||
register: _prune
|
||||
|
||||
- name: Assure multiple ReplicationController were found for pruning
|
||||
assert:
|
||||
that:
|
||||
- _prune is changed
|
||||
- _prune.replication_controllers | length > 0
|
||||
|
||||
always:
|
||||
- name: Delete 1st namespace
|
||||
|
||||
@@ -1,240 +1,245 @@
|
||||
---
|
||||
- block:
|
||||
- set_fact:
|
||||
build_ns: "builds"
|
||||
build_config: "start-build"
|
||||
is_name: "ruby"
|
||||
prune_build: "prune-build"
|
||||
- set_fact:
|
||||
build_ns: "builds"
|
||||
build_config: "start-build"
|
||||
is_name: "ruby"
|
||||
prune_build: "prune-build"
|
||||
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ build_ns }}"
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ build_ns }}"
|
||||
|
||||
- name: Create ImageStream
|
||||
community.okd.k8s:
|
||||
namespace: "{{ build_ns }}"
|
||||
definition:
|
||||
apiVersion: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
metadata:
|
||||
name: "{{ is_name }}"
|
||||
spec:
|
||||
lookupPolicy:
|
||||
local: false
|
||||
tags: []
|
||||
- name: Create ImageStream
|
||||
community.okd.k8s:
|
||||
namespace: "{{ build_ns }}"
|
||||
definition:
|
||||
apiVersion: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
metadata:
|
||||
name: "{{ is_name }}"
|
||||
spec:
|
||||
lookupPolicy:
|
||||
local: false
|
||||
tags: []
|
||||
|
||||
- name: Create build configuration
|
||||
community.okd.k8s:
|
||||
namespace: "{{ build_ns }}"
|
||||
definition:
|
||||
kind: BuildConfig
|
||||
apiVersion: build.openshift.io/v1
|
||||
metadata:
|
||||
name: "{{ build_config }}"
|
||||
spec:
|
||||
source:
|
||||
dockerfile: |
|
||||
FROM openshift/ruby-22-centos7
|
||||
RUN sleep 60s
|
||||
USER ansible
|
||||
strategy:
|
||||
type: Docker
|
||||
output:
|
||||
to:
|
||||
kind: "ImageStreamTag"
|
||||
name: "{{ is_name }}:latest"
|
||||
- name: Create build configuration
|
||||
community.okd.k8s:
|
||||
namespace: "{{ build_ns }}"
|
||||
definition:
|
||||
kind: BuildConfig
|
||||
apiVersion: build.openshift.io/v1
|
||||
metadata:
|
||||
name: "{{ build_config }}"
|
||||
spec:
|
||||
source:
|
||||
dockerfile: |
|
||||
FROM openshift/ruby-22-centos7
|
||||
RUN sleep 60s
|
||||
USER ansible
|
||||
strategy:
|
||||
type: Docker
|
||||
output:
|
||||
to:
|
||||
kind: "ImageStreamTag"
|
||||
name: "{{ is_name }}:latest"
|
||||
|
||||
- name: Start Build from Build configuration
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_config_name: "{{ build_config }}"
|
||||
register: new_build
|
||||
- name: Start Build from Build configuration
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_config_name: "{{ build_config }}"
|
||||
register: new_build
|
||||
|
||||
- name: Assert that a build has been created
|
||||
assert:
|
||||
that:
|
||||
- new_build is changed
|
||||
- new_build.builds.0.metadata.name == "{{ build_config }}-1"
|
||||
- name: Assert that a build has been created
|
||||
assert:
|
||||
that:
|
||||
- new_build is changed
|
||||
- new_build.builds.0.metadata.name == "{{ build_config }}-1"
|
||||
|
||||
- name: Start a new Build from previous Build
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_name: "{{ new_build.builds.0.metadata.name }}"
|
||||
register: rerun_build
|
||||
- name: Start a new Build from previous Build
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_name: "{{ new_build.builds.0.metadata.name }}"
|
||||
register: rerun_build
|
||||
|
||||
- name: Assert that another build has been created
|
||||
assert:
|
||||
that:
|
||||
- rerun_build is changed
|
||||
- rerun_build.builds.0.metadata.name == "{{ build_config }}-2"
|
||||
- name: Assert that another build has been created
|
||||
assert:
|
||||
that:
|
||||
- rerun_build is changed
|
||||
- rerun_build.builds.0.metadata.name == "{{ build_config }}-2"
|
||||
|
||||
- name: Cancel first build created
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_name: "{{ build_config }}-1"
|
||||
state: cancelled
|
||||
wait: yes
|
||||
register: cancel
|
||||
- name: Cancel first build created
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_name: "{{ build_config }}-1"
|
||||
state: cancelled
|
||||
wait: yes
|
||||
register: cancel
|
||||
|
||||
- name: Assert that the Build was cancelled
|
||||
assert:
|
||||
that:
|
||||
- cancel is changed
|
||||
- cancel.builds | length == 1
|
||||
- cancel.builds.0.metadata.name == "{{ build_config }}-1"
|
||||
- cancel.builds.0.metadata.namespace == "{{ build_ns }}"
|
||||
- cancel.builds.0.status.cancelled
|
||||
- name: Assert that the Build was cancelled
|
||||
assert:
|
||||
that:
|
||||
- cancel is changed
|
||||
- cancel.builds | length == 1
|
||||
- cancel.builds.0.metadata.name == "{{ build_config }}-1"
|
||||
- cancel.builds.0.metadata.namespace == "{{ build_ns }}"
|
||||
- '"cancelled" in cancel.builds.0.status'
|
||||
- cancel.builds.0.status.cancelled
|
||||
|
||||
- name: Get Build info
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ cancel.builds.0.metadata.name }}"
|
||||
register: build
|
||||
- name: Get info for 1st Build
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ cancel.builds.0.metadata.name }}"
|
||||
register: build
|
||||
|
||||
- name: Assert that build phase is cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- build.resources.0.status.cancelled
|
||||
- build.resources.0.status.phase == 'Cancelled'
|
||||
- name: Assert that build phase is cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- '"cancelled" in build.resources.0.status'
|
||||
- build.resources.0.status.cancelled
|
||||
- build.resources.0.status.phase == 'Cancelled'
|
||||
|
||||
- name: Cancel and restart Build using build config name
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_config_name: "{{ build_config }}"
|
||||
state: restarted
|
||||
build_phases:
|
||||
- Running
|
||||
- New
|
||||
register: restart
|
||||
- name: Cancel and restart Build using build config name
|
||||
community.okd.openshift_build:
|
||||
namespace: "{{ build_ns }}"
|
||||
build_config_name: "{{ build_config }}"
|
||||
state: restarted
|
||||
build_phases:
|
||||
- Pending
|
||||
- Running
|
||||
- New
|
||||
register: restart
|
||||
|
||||
- name: assert that new build was created
|
||||
assert:
|
||||
that:
|
||||
- restart is changed
|
||||
- restart.builds | length == 1
|
||||
- 'restart.builds.0.metadata.name == "{{ build_config }}-3"'
|
||||
|
||||
- name: Get Build 2 info
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ build_config }}-2"
|
||||
register: build
|
||||
- name: assert that new build was created
|
||||
assert:
|
||||
that:
|
||||
- restart is changed
|
||||
- restart.builds | length == 1
|
||||
- 'restart.builds.0.metadata.name == "{{ build_config }}-3"'
|
||||
|
||||
- name: Assert that build phase is cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- build.resources.0.status.cancelled
|
||||
- build.resources.0.status.phase == 'Cancelled'
|
||||
- name: Get info for 2nd Build
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ build_config }}-2"
|
||||
register: build
|
||||
|
||||
- name: Get Build info
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ build_config }}-3"
|
||||
register: build
|
||||
- name: Assert that build phase is cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- '"cancelled" in build.resources.0.status'
|
||||
- build.resources.0.status.cancelled
|
||||
- build.resources.0.status.phase == 'Cancelled'
|
||||
|
||||
- name: Assert that Build is not cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- '"cancelled" not in build.resources.0.status'
|
||||
- "build.resources.0.status.phase in ('New', 'Pending', 'Running')"
|
||||
- name: Get info for 3rd build
|
||||
kubernetes.core.k8s_info:
|
||||
version: build.openshift.io/v1
|
||||
kind: Build
|
||||
namespace: "{{ build_ns }}"
|
||||
name: "{{ build_config }}-3"
|
||||
register: build
|
||||
|
||||
- name: Prune Builds keep younger than 30min
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
keep_younger_than: 30
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune
|
||||
check_mode: yes
|
||||
- name: Assert that Build is not cancelled
|
||||
assert:
|
||||
that:
|
||||
- build.resources | length == 1
|
||||
- '"cancelled" not in build.resources.0.status'
|
||||
- "build.resources.0.status.phase in ('New', 'Pending', 'Running')"
|
||||
|
||||
- name: Assert that no Builds were found
|
||||
assert:
|
||||
that:
|
||||
- not prune.changed
|
||||
- prune.builds | length == 0
|
||||
- name: Prune Builds keep younger than 30min
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
keep_younger_than: 30
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune
|
||||
check_mode: yes
|
||||
|
||||
- name: Prune Builds without namespace
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
register: prune_without_ns
|
||||
check_mode: yes
|
||||
- name: Assert that no Builds were found
|
||||
assert:
|
||||
that:
|
||||
- not prune.changed
|
||||
- prune.builds | length == 0
|
||||
|
||||
- name: Assert that completed build are candidate for prune
|
||||
assert:
|
||||
that:
|
||||
- prune_without_ns is changed
|
||||
- prune_without_ns.builds | length > 0
|
||||
- '"{{ build_config }}-1" in build_names'
|
||||
- '"{{ build_config }}-2" in build_names'
|
||||
vars:
|
||||
build_names: '{{ prune_without_ns.builds | map(attribute="metadata") | flatten | map(attribute="name") | list }}'
|
||||
- name: Prune Builds without namespace
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
register: prune_without_ns
|
||||
check_mode: yes
|
||||
|
||||
- name: Prune Builds using namespace
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune_with_ns
|
||||
check_mode: yes
|
||||
- name: Assert that completed build are candidate for prune
|
||||
assert:
|
||||
that:
|
||||
- prune_without_ns is changed
|
||||
- prune_without_ns.builds | length > 0
|
||||
- '"{{ build_config }}-1" in build_names'
|
||||
- '"{{ build_config }}-2" in build_names'
|
||||
vars:
|
||||
build_names: '{{ prune_without_ns.builds | map(attribute="metadata") | flatten | map(attribute="name") | list }}'
|
||||
|
||||
- name: Assert that prune operation found the completed build
|
||||
assert:
|
||||
that:
|
||||
- prune_with_ns is changed
|
||||
- prune_with_ns.builds | length == 2
|
||||
- name: Prune Builds using namespace
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune_with_ns
|
||||
check_mode: yes
|
||||
|
||||
- name: Check Build before prune
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-1"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
- name: Assert that prune operation found the completed build
|
||||
assert:
|
||||
that:
|
||||
- prune_with_ns is changed
|
||||
- prune_with_ns.builds | length == 2
|
||||
|
||||
- name: Validate that any previous build operation executed with check_mode did not deleted the build
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- name: Check Build before prune
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-1"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
|
||||
- name: Execute prune operation
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune
|
||||
- name: Validate that any previous build operation executed with check_mode did not deleted the build
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
|
||||
- name: assert prune is changed
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
- name: Execute prune operation
|
||||
community.okd.openshift_adm_prune_builds:
|
||||
namespace: "{{ build_ns }}"
|
||||
register: prune
|
||||
|
||||
- name: Check Build
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-1"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
- name: assert prune is changed
|
||||
assert:
|
||||
that:
|
||||
- prune is changed
|
||||
|
||||
- name: Assert that the Build does not exist anymore
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 0
|
||||
- name: Check Build
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-1"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
|
||||
- name: Check Build
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-2"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
- name: Assert that the Build does not exist anymore
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 0
|
||||
|
||||
- name: Assert that the Build does not exist anymore
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 0
|
||||
- name: Check Build
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Build
|
||||
api_version: build.openshift.io/v1
|
||||
name: "{{ build_config }}-2"
|
||||
namespace: "{{ build_ns }}"
|
||||
register: resource
|
||||
|
||||
- name: Assert that the Build does not exist anymore
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 0
|
||||
|
||||
always:
|
||||
- name: Ensure namespace is deleted
|
||||
|
||||
@@ -1,174 +1,175 @@
|
||||
---
|
||||
- name: Openshift import image testing
|
||||
block:
|
||||
|
||||
- set_fact:
|
||||
test_ns: "import-images"
|
||||
- set_fact:
|
||||
test_ns: "import-images"
|
||||
|
||||
- name: Ensure namespace
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ test_ns }}'
|
||||
- name: Ensure namespace
|
||||
community.okd.k8s:
|
||||
kind: Namespace
|
||||
name: '{{ test_ns }}'
|
||||
|
||||
- name: Import image using tag (should import latest tag only)
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
check_mode: yes
|
||||
register: import_tag
|
||||
- name: Import image using tag (should import latest tag only)
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
check_mode: yes
|
||||
register: import_tag
|
||||
|
||||
- name: Assert only latest was imported
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
- import_tag.result | length == 1
|
||||
- import_tag.result.0.spec.import
|
||||
- import_tag.result.0.spec.images.0.from.kind == "DockerImage"
|
||||
- import_tag.result.0.spec.images.0.from.name == "ansible/awx"
|
||||
- name: Assert only latest was imported
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
- import_tag.result | length == 1
|
||||
- import_tag.result.0.spec.import
|
||||
- import_tag.result.0.spec.images.0.from.kind == "DockerImage"
|
||||
- import_tag.result.0.spec.images.0.from.name == "ansible/awx"
|
||||
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: assert that image stream is not created when using check_mode=yes
|
||||
assert:
|
||||
that:
|
||||
- resource.resources == []
|
||||
|
||||
- name: Import image using tag (should import latest tag only)
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
register: import_tag
|
||||
|
||||
- name: Assert only latest was imported
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: assert that image stream contains only tag latest
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags.0.tag == 'latest'
|
||||
|
||||
- name: Import once again the latest tag
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
register: import_tag
|
||||
|
||||
- name: assert change was performed
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
version: image.openshift.io/v1
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: assert that image stream still contains unique tag
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags.0.tag == 'latest'
|
||||
|
||||
- name: Import another tags
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx:17.1.0"
|
||||
register: import_another_tag
|
||||
ignore_errors: yes
|
||||
|
||||
- name: assert that another tag was imported
|
||||
assert:
|
||||
that:
|
||||
- import_another_tag is failed
|
||||
- '"the tag 17.1.0 does not exist on the image stream" in import_another_tag.msg'
|
||||
|
||||
- name: Create simple ImageStream (without docker external container)
|
||||
community.okd.k8s:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "local-is"
|
||||
definition:
|
||||
apiVersion: image.openshift.io/v1
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
spec:
|
||||
lookupPolicy:
|
||||
local: false
|
||||
tags: []
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: Import all tag for image stream not pointing on external container image should failed
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "local-is"
|
||||
all: true
|
||||
register: error_tag
|
||||
ignore_errors: true
|
||||
check_mode: yes
|
||||
- name: assert that image stream is not created when using check_mode=yes
|
||||
assert:
|
||||
that:
|
||||
- resource.resources == []
|
||||
|
||||
- name: Assert module cannot import from non-existing tag from ImageStream
|
||||
assert:
|
||||
that:
|
||||
- error_tag is failed
|
||||
- 'error_tag.msg == "image stream {{ test_ns }}/local-is does not have tags pointing to external container images"'
|
||||
- name: Import image using tag (should import latest tag only)
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
register: import_tag
|
||||
|
||||
- name: import all tags for container image ibmcom/pause and specific tag for redhat/ubi8-micro
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name:
|
||||
- "ibmcom/pause"
|
||||
- "redhat/ubi8-micro:8.5-437"
|
||||
all: true
|
||||
register: multiple_import
|
||||
- name: Assert only latest was imported
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
|
||||
- name: Assert that import succeed
|
||||
assert:
|
||||
that:
|
||||
- multiple_import is changed
|
||||
- multiple_import.result | length == 2
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: Read ibmcom/pause ImageStream
|
||||
kubernetes.core.k8s_info:
|
||||
version: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: pause
|
||||
register: pause
|
||||
- name: assert that image stream contains only tag latest
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags.0.tag == 'latest'
|
||||
|
||||
- name: assert that ibmcom/pause has multiple tags
|
||||
assert:
|
||||
that:
|
||||
- pause.resources | length == 1
|
||||
- pause.resources.0.status.tags | length > 1
|
||||
- name: Import once again the latest tag
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx"
|
||||
register: import_tag
|
||||
|
||||
- name: Read redhat/ubi8-micro ImageStream
|
||||
kubernetes.core.k8s_info:
|
||||
version: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: ubi8-micro
|
||||
register: resource
|
||||
- name: assert change was performed
|
||||
assert:
|
||||
that:
|
||||
- import_tag is changed
|
||||
|
||||
- name: assert that redhat/ubi8-micro has only one tag
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags | length == 1
|
||||
- 'resource.resources.0.status.tags.0.tag == "8.5-437"'
|
||||
- name: check image stream
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ImageStream
|
||||
version: image.openshift.io/v1
|
||||
namespace: "{{ test_ns }}"
|
||||
name: awx
|
||||
register: resource
|
||||
|
||||
- name: assert that image stream still contains unique tag
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags.0.tag == 'latest'
|
||||
|
||||
- name: Import another tags
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "ansible/awx:17.1.0"
|
||||
register: import_another_tag
|
||||
ignore_errors: yes
|
||||
|
||||
- name: assert that another tag was imported
|
||||
assert:
|
||||
that:
|
||||
- import_another_tag is failed
|
||||
- '"the tag 17.1.0 does not exist on the image stream" in import_another_tag.msg'
|
||||
|
||||
- name: Create simple ImageStream (without docker external container)
|
||||
community.okd.k8s:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "local-is"
|
||||
definition:
|
||||
apiVersion: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
spec:
|
||||
lookupPolicy:
|
||||
local: false
|
||||
tags: []
|
||||
|
||||
- name: Import all tag for image stream not pointing on external container image should failed
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "local-is"
|
||||
all: true
|
||||
register: error_tag
|
||||
ignore_errors: true
|
||||
check_mode: yes
|
||||
|
||||
- name: Assert module cannot import from non-existing tag from ImageStream
|
||||
assert:
|
||||
that:
|
||||
- error_tag is failed
|
||||
- 'error_tag.msg == "image stream {{ test_ns }}/local-is does not have tags pointing to external container images"'
|
||||
|
||||
- name: import all tags for container image ibmcom/pause and specific tag for redhat/ubi8-micro
|
||||
community.okd.openshift_import_image:
|
||||
namespace: "{{ test_ns }}"
|
||||
name:
|
||||
- "ibmcom/pause"
|
||||
- "redhat/ubi8-micro:8.5-437"
|
||||
all: true
|
||||
register: multiple_import
|
||||
|
||||
- name: Assert that import succeed
|
||||
assert:
|
||||
that:
|
||||
- multiple_import is changed
|
||||
- multiple_import.result | length == 2
|
||||
|
||||
- name: Read ibmcom/pause ImageStream
|
||||
kubernetes.core.k8s_info:
|
||||
version: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: pause
|
||||
register: pause
|
||||
|
||||
- name: assert that ibmcom/pause has multiple tags
|
||||
assert:
|
||||
that:
|
||||
- pause.resources | length == 1
|
||||
- pause.resources.0.status.tags | length > 1
|
||||
|
||||
- name: Read redhat/ubi8-micro ImageStream
|
||||
kubernetes.core.k8s_info:
|
||||
version: image.openshift.io/v1
|
||||
kind: ImageStream
|
||||
namespace: "{{ test_ns }}"
|
||||
name: ubi8-micro
|
||||
register: resource
|
||||
|
||||
- name: assert that redhat/ubi8-micro has only one tag
|
||||
assert:
|
||||
that:
|
||||
- resource.resources | length == 1
|
||||
- resource.resources.0.status.tags | length == 1
|
||||
- 'resource.resources.0.status.tags.0.tag == "8.5-437"'
|
||||
|
||||
always:
|
||||
- name: Delete testing namespace
|
||||
|
||||
@@ -38,12 +38,12 @@
|
||||
name: "{{ pod_name }}"
|
||||
spec:
|
||||
containers:
|
||||
- name: test-container
|
||||
image: "{{ prune_registry }}/{{ prune_ns }}/{{ container.name }}:latest"
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true;do date;sleep 5; done
|
||||
- name: test-container
|
||||
image: "{{ prune_registry }}/{{ prune_ns }}/{{ container.name }}:latest"
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- while true;do date;sleep 5; done
|
||||
|
||||
- name: Create limit range for images size
|
||||
community.okd.k8s:
|
||||
@@ -57,7 +57,7 @@
|
||||
- type: openshift.io/Image
|
||||
max:
|
||||
storage: 1Gi
|
||||
|
||||
|
||||
- name: Prune images from namespace
|
||||
community.okd.openshift_adm_prune_images:
|
||||
registry_url: "{{ prune_registry }}"
|
||||
|
||||
@@ -19,10 +19,10 @@
|
||||
app: hello-kubernetes
|
||||
spec:
|
||||
containers:
|
||||
- name: hello-kubernetes
|
||||
image: docker.io/openshift/hello-openshift
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
- name: hello-kubernetes
|
||||
image: docker.io/openshift/hello-openshift
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
- name: Create Service
|
||||
community.okd.k8s:
|
||||
@@ -35,8 +35,8 @@
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: hello-kubernetes
|
||||
|
||||
|
||||
Reference in New Issue
Block a user