mirror of
https://github.com/openshift/community.okd.git
synced 2026-07-30 19:34:32 +00:00
* Upgrade Ansible and OKD versions for CI * Use ubi9 and fix sanity * Use correct pip install * Try using quotes * Ensure python3.9 * Upgrade ansible and molecule versions * Remove DeploymentConfig DeploymentConfigs are deprecated and seem to now be causing idempotence problems. Replacing them with Deployments fixes it. * Attempt to fix ldap integration tests Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Move sanity and unit tests to GH actions Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Firt round of sanity fixes Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add kubernetes.core collection as sanity requirement Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add ignore-2.16.txt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Attempt to fix units Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add ignore-2.17 Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Attempt to fix unit tests Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add pytest-ansible to test-requirements.txt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add changelog fragment Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add workflow for ansible-lint Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Apply black Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Fix linters Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Add # fmt: skip Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Yet another round of linting Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Yet another round of linting Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Remove setup.cfg Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Revert #fmt Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Use ansible-core 2.14 Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Cleanup ansible-lint ignores Signed-off-by: Alina Buzachis <abuzachis@redhat.com> * Try using service instead of pod IP * Fix typo * Actually use the correct port * See if NetworkPolicy is preventing connection * using Pod internal IP * fix adm prune auth roles syntax * adding some retry steps * fix: openshift_builds target * add flag --force-with-deps when building downstream collection * Remove yamllint from tox linters, bump minimum python supported version to 3.9, Remove support for ansible-core < 2.14 --------- Signed-off-by: Alina Buzachis <abuzachis@redhat.com> Co-authored-by: Mike Graves <mgraves@redhat.com> Co-authored-by: Alina Buzachis <abuzachis@redhat.com>
This commit is contained in:
Bikouo Aubin
GitHub
@@ -1,293 +1,294 @@
|
||||
---
|
||||
- block:
|
||||
- set_fact:
|
||||
test_sa: "clusterrole-sa"
|
||||
test_ns: "clusterrole-ns"
|
||||
- set_fact:
|
||||
test_sa: "clusterrole-sa"
|
||||
test_ns: "clusterrole-ns"
|
||||
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ test_ns }}"
|
||||
- name: Ensure namespace
|
||||
kubernetes.core.k8s:
|
||||
kind: Namespace
|
||||
name: "{{ test_ns }}"
|
||||
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
- name: Get cluster information
|
||||
kubernetes.core.k8s_cluster_info:
|
||||
register: cluster_info
|
||||
no_log: true
|
||||
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
- set_fact:
|
||||
cluster_host: "{{ cluster_info['connection']['host'] }}"
|
||||
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
- name: Create Service account
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ test_sa }}"
|
||||
register: result
|
||||
|
||||
- name: Read Service Account
|
||||
kubernetes.core.k8s_info:
|
||||
kind: ServiceAccount
|
||||
namespace: "{{ test_ns }}"
|
||||
name: "{{ test_sa }}"
|
||||
register: result
|
||||
- set_fact:
|
||||
secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
|
||||
|
||||
- set_fact:
|
||||
secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: _secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
|
||||
|
||||
- name: Get secret details
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: '{{ test_ns }}'
|
||||
name: '{{ secret_token }}'
|
||||
register: _secret
|
||||
retries: 10
|
||||
delay: 10
|
||||
until:
|
||||
- ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
|
||||
when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in _secret.resources[0]['data']"
|
||||
|
||||
- set_fact:
|
||||
api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
|
||||
when: "'token' in _secret.resources[0]['data']"
|
||||
- name: list Node should failed (forbidden user)
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Node should failed (forbidden user)
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- set_fact:
|
||||
test_labels:
|
||||
phase: dev
|
||||
cluster_roles:
|
||||
- name: pod-manager
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "authorization.openshift.io/v1"
|
||||
- name: node-manager
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "rbac.authorization.k8s.io/v1"
|
||||
|
||||
- set_fact:
|
||||
test_labels:
|
||||
phase: dev
|
||||
cluster_roles:
|
||||
- name: pod-manager
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "authorization.openshift.io/v1"
|
||||
- name: node-manager
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
api_version_binding: "rbac.authorization.k8s.io/v1"
|
||||
|
||||
- name: Create cluster roles
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRole
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ test_labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: "{{ item.resources }}"
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: '{{ cluster_roles }}'
|
||||
|
||||
- name: Create Role Binding (namespaced)
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ cluster_roles[0].name }}-binding"
|
||||
namespace: "{{ test_ns }}"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
- name: Create cluster roles
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRole
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
apiGroup: ""
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ item.name }}"
|
||||
labels: "{{ test_labels }}"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: "{{ item.resources }}"
|
||||
verbs: "{{ item.verbs }}"
|
||||
with_items: '{{ cluster_roles }}'
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- name: Create Role Binding (namespaced)
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: RoleBinding
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
metadata:
|
||||
name: "{{ cluster_roles[0].name }}-binding"
|
||||
namespace: "{{ test_ns }}"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
apiGroup: ""
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- name: Create Cluster role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: "{{ item.api_version_binding }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-binding"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ item.name }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ cluster_roles }}"
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: list Pod for all namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
no_log: true
|
||||
- name: Create Cluster role Binding
|
||||
kubernetes.core.k8s:
|
||||
definition:
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: "{{ item.api_version_binding }}"
|
||||
metadata:
|
||||
name: "{{ item.name }}-binding"
|
||||
labels: "{{ test_labels }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "{{ test_sa }}"
|
||||
namespace: "{{ test_ns }}"
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: "{{ item.name }}"
|
||||
apiGroup: ""
|
||||
with_items: "{{ cluster_roles }}"
|
||||
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- name: list Pod for all namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
no_log: true
|
||||
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- name: list Pod for test namespace should succeed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: Prune clusterroles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
register: check
|
||||
check_mode: true
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: validate clusterrole binding candidates for prune
|
||||
assert:
|
||||
that:
|
||||
- '"{{ item.name }}-binding" in check.cluster_role_binding'
|
||||
- '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
|
||||
with_items: "{{ cluster_roles }}"
|
||||
- name: Prune clusterroles (check mode)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
register: check
|
||||
check_mode: true
|
||||
|
||||
- name: Prune Cluster Role for managing Pod
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
- name: validate clusterrole binding candidates for prune
|
||||
assert:
|
||||
that:
|
||||
- '"{{ item.name }}-binding" in check.cluster_role_binding'
|
||||
- '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
|
||||
with_items: "{{ cluster_roles }}"
|
||||
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
- name: Prune Cluster Role for managing Pod
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
name: "{{ cluster_roles[0].name }}"
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for all namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
- name: list Pod for test namespace should failed
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Pod
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
no_log: true
|
||||
ignore_errors: true
|
||||
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
- assert:
|
||||
that:
|
||||
- '"pods is forbidden: User" in error.msg'
|
||||
|
||||
- name: Prune clusterroles (remaining)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
- name: list Node using ServiceAccount
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
no_log: true
|
||||
|
||||
- name: list Node using ServiceAccount should fail
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
- name: Prune clusterroles (remaining)
|
||||
community.okd.openshift_adm_prune_auth:
|
||||
resource: clusterroles
|
||||
label_selectors:
|
||||
- phase=dev
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
- name: list Node using ServiceAccount should fail
|
||||
kubernetes.core.k8s_info:
|
||||
api_key: "{{ api_token }}"
|
||||
host: "{{ cluster_host }}"
|
||||
validate_certs: no
|
||||
kind: Node
|
||||
namespace: "{{ test_ns }}"
|
||||
register: error
|
||||
ignore_errors: true
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- '"nodes is forbidden: User" in error.msg'
|
||||
|
||||
always:
|
||||
- name: Ensure namespace is deleted
|
||||
|
||||
Reference in New Issue
Block a user