Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,119 @@
+- name: Read current remote $HOME
+  become: true
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    state: present
+  register: user_registered
+  tags:
+    - k8s::users
+
+- name: Create required folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ folder }}"
+    state: directory
+    mode: "0750"
+    owner: "{{ item.username }}"
+  loop:
+    - "{{ user_registered.home }}/.kube"
+    - "{{ user_registered.home }}/.local/bin"
+  loop_control:
+    loop_var: folder
+  tags:
+    - k8s::users
+
+- name: Check if secret exists
+  ansible.builtin.shell: |
+    set -o pipefail
+    microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
+  args:
+    executable: /bin/bash
+  register: secret_exists
+  when: item.enabled
+  tags:
+    - k8s::users
+  changed_when: false
+
+- name: Configure user access
+  when: item.enabled and secret_exists.stdout != "0"
+  block:
+    - name: Get the secret name
+      ansible.builtin.shell: |
+        set -o pipefail
+        microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
+      args:
+        executable: /bin/bash
+      register: secret_name
+      when: item.enabled
+      tags:
+        - k8s::users
+      changed_when: false
+
+    - name: Describe the secret and extract the token
+      ansible.builtin.shell: |
+        set -o pipefail
+        microk8s.kubectl -n {{ item.namespace  | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
+      args:
+        executable: /bin/bash
+      register: token
+      when: item.enabled
+      tags:
+        - k8s::users
+      changed_when: false
+
+    - name: Read system kubeconfig
+      become: true
+      ansible.builtin.command: "microk8s config"
+      register: kubeconfig
+      tags:
+        - k8s::users
+      changed_when: false
+
+    - name: Set fact kubeconfig
+      ansible.builtin.set_fact:
+        kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
+      tags:
+        - k8s::users
+      changed_when: false
+
+    - name: Patch kubeconfig with user token
+      ansible.builtin.set_fact:
+        patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
+      vars:
+        new_kubeconfig:
+          contexts:
+            - context:
+                cluster: microk8s-cluster
+                user: "{{ item.username }}"
+              name: microk8s
+          users:
+            - name: "{{ item.username }}"
+              user:
+                token: "{{ token.stdout }}"
+      tags:
+        - k8s::users
+
+    - name: Check if a config already exists and its SHA1
+      become: true
+      ansible.builtin.stat:
+        path: "{{ user_registered.home }}/.kube/config"
+      register: kubeconfig_exists
+      tags:
+        - k8s::users
+
+    - name: Get new config SHA1
+      set_fact:
+        patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
+      tags:
+        - k8s::users
+
+    - name: Write kubeconfig
+      become: true
+      ansible.builtin.copy:
+        content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
+        dest: "{{ user_registered.home }}/.kube/config"
+        owner: "{{ item.username }}"
+        mode: "0600"
+      when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      tags:
+        - k8s::users