mirror of
https://github.com/ansible-collections/kubernetes.core.git
synced 2026-03-26 21:33:02 +00:00
39b6c43ab7
add support for user impersonation for k8s modules SUMMARY k8s module should not allow user to perform operation using impersonation as describe here https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation This pull request closes #40 ISSUE TYPE Feature Pull Request COMPONENT NAME ADDITIONAL INFORMATION Reviewed-by: Mike Graves <mgraves@redhat.com> Reviewed-by: Abhijeet Kasurde <None> Reviewed-by: None <None>
309 lines
6.6 KiB
YAML
309 lines
6.6 KiB
YAML
---
|
|
- name: Converge
|
|
hosts: localhost
|
|
connection: local
|
|
|
|
collections:
|
|
- kubernetes.core
|
|
|
|
vars_files:
|
|
- vars/main.yml
|
|
|
|
tasks:
|
|
- name: Verify cluster is working.
|
|
k8s_info:
|
|
namespace: kube-system
|
|
kind: Pod
|
|
register: pod_list
|
|
|
|
- name: Verify cluster has more than 5 pods running.
|
|
assert:
|
|
that: (pod_list.resources | count) > 5
|
|
|
|
- name: Include access_review.yml
|
|
include_tasks:
|
|
file: tasks/access_review.yml
|
|
apply:
|
|
tags: [ access_review, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include append_hash.yml
|
|
include_tasks:
|
|
file: tasks/append_hash.yml
|
|
apply:
|
|
tags: [ append_hash, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include apply.yml
|
|
include_tasks:
|
|
file: tasks/apply.yml
|
|
apply:
|
|
tags: [ apply, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include cluster_info.yml
|
|
include_tasks:
|
|
file: tasks/cluster_info.yml
|
|
apply:
|
|
tags: [ cluster_info, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include crd.yml
|
|
include_tasks:
|
|
file: tasks/crd.yml
|
|
apply:
|
|
tags: [ crd, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include delete.yml
|
|
include_tasks:
|
|
file: tasks/delete.yml
|
|
apply:
|
|
tags: [ delete, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include exec.yml
|
|
include_tasks:
|
|
file: tasks/exec.yml
|
|
apply:
|
|
tags: [ exec, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include full.yml
|
|
include_tasks:
|
|
file: tasks/full.yml
|
|
apply:
|
|
tags: [ full, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include gc.yml
|
|
include_tasks:
|
|
file: tasks/gc.yml
|
|
apply:
|
|
tags: [ gc, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include info.yml
|
|
include_tasks:
|
|
file: tasks/info.yml
|
|
apply:
|
|
tags: [ info, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include json_patch.yml
|
|
include_tasks:
|
|
file: tasks/json_patch.yml
|
|
apply:
|
|
tags: [ json_patch, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include lists.yml
|
|
include_tasks:
|
|
file: tasks/lists.yml
|
|
apply:
|
|
tags: [ lists, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include log.yml
|
|
include_tasks:
|
|
file: tasks/log.yml
|
|
apply:
|
|
tags: [ log, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include rollback.yml
|
|
include_tasks:
|
|
file: tasks/rollback.yml
|
|
apply:
|
|
tags: [ rollback, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include scale.yml
|
|
include_tasks:
|
|
file: tasks/scale.yml
|
|
apply:
|
|
tags: [ scale, k8s ]
|
|
tags:
|
|
- always
|
|
- name: Include template.yml
|
|
include_tasks:
|
|
file: tasks/template.yml
|
|
apply:
|
|
tags: [ template, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include validate.yml
|
|
include_tasks:
|
|
file: tasks/validate.yml
|
|
apply:
|
|
tags: [ validate, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include waiter.yml
|
|
include_tasks:
|
|
file: tasks/waiter.yml
|
|
apply:
|
|
tags: [ waiter, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include merge_type.yml
|
|
include_tasks:
|
|
file: tasks/merge_type.yml
|
|
apply:
|
|
tags: [ merge_type, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include patched.yml
|
|
include_tasks:
|
|
file: tasks/patched.yml
|
|
apply:
|
|
tags: [ patched, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include lookup_k8s.yml
|
|
include_tasks:
|
|
file: tasks/lookup_k8s.yml
|
|
apply:
|
|
tags: [ lookup_k8s, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include label_selectors.yml
|
|
include_tasks:
|
|
file: tasks/label_selectors.yml
|
|
apply:
|
|
tags: [ label_selectors, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include diff.yml
|
|
include_tasks:
|
|
file: tasks/diff.yml
|
|
apply:
|
|
tags: [ diff, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include lookup_kustomize.yml
|
|
include_tasks:
|
|
file: tasks/lookup_kustomize.yml
|
|
apply:
|
|
tags: [ lookup_kustomize, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include generate_name.yml
|
|
include_tasks:
|
|
file: tasks/generate_name.yml
|
|
apply:
|
|
tags: [ generate_name, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
- name: Include user_impersonation.yml
|
|
include_tasks:
|
|
file: tasks/user_impersonation.yml
|
|
apply:
|
|
tags: [ user_impersonation, k8s ]
|
|
tags:
|
|
- always
|
|
|
|
roles:
|
|
- role: helm
|
|
tags:
|
|
- helm
|
|
|
|
- role: k8scopy
|
|
tags:
|
|
- copy
|
|
- k8s
|
|
|
|
post_tasks:
|
|
- name: Ensure namespace exists
|
|
k8s:
|
|
api_version: v1
|
|
kind: Namespace
|
|
name: inventory
|
|
|
|
- name: Add a deployment
|
|
k8s:
|
|
definition:
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: inventory
|
|
namespace: inventory
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: "{{ k8s_pod_name }}"
|
|
template: "{{ k8s_pod_template }}"
|
|
wait: yes
|
|
wait_timeout: 120
|
|
vars:
|
|
k8s_pod_name: inventory
|
|
k8s_pod_image: python
|
|
k8s_pod_command:
|
|
- python
|
|
- '-m'
|
|
- http.server
|
|
k8s_pod_env:
|
|
- name: TEST
|
|
value: test
|
|
|
|
- meta: refresh_inventory
|
|
|
|
- name: Verify inventory and connection plugins
|
|
hosts: namespace_inventory_pods
|
|
gather_facts: no
|
|
|
|
vars:
|
|
file_content: |
|
|
Hello world
|
|
|
|
tasks:
|
|
- name: End play if host not running (TODO should we not add these to the inventory?)
|
|
meta: end_host
|
|
when: pod_phase != "Running"
|
|
|
|
- debug: var=hostvars
|
|
- setup:
|
|
|
|
- debug: var=ansible_facts
|
|
|
|
- name: Assert the TEST environment variable was retrieved
|
|
assert:
|
|
that: ansible_facts.env.TEST == 'test'
|
|
|
|
- name: Copy a file into the host
|
|
copy:
|
|
content: '{{ file_content }}'
|
|
dest: /tmp/test_file
|
|
|
|
- name: Retrieve the file from the host
|
|
slurp:
|
|
src: /tmp/test_file
|
|
register: slurped_file
|
|
|
|
- name: Assert the file content matches expectations
|
|
assert:
|
|
that: (slurped_file.content|b64decode) == file_content
|
|
|
|
- name: Delete inventory namespace
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: no
|
|
tasks:
|
|
- name: Remove inventory namespace
|
|
k8s:
|
|
api_version: v1
|
|
kind: Namespace
|
|
name: inventory
|
|
state: absent
|