- Updated to use SA and non-admin user

  (i.e. latest squonk templates)

Author: Alan Christie

openshift/ansible/README.md

@@ -13,7 +13,7 @@ Before running the playbook: -
 1.  You have installed Ansible (any version from 2.5)
 1.  The `oc` command-set is available to you as a user
 1.  An OpenShift cluster has been installed
-1.  There is an `admin` user known to the cluster
+1.  There is a suitable user known to the cluster
 1.  You have setup your own `setenv.sh`
     (typically in Squonk's `openshift/templates`)
     and you have run `source setenv.sh` using it.

openshift/ansible/group_vars/all.yaml

@@ -1,9 +1,10 @@
 ---
 
-oc_admin: "{{ ansible_env.OC_ADMIN }}"
-oc_admin_password: "{{ ansible_env.OC_ADMIN_PASSWORD }}"
+oc_user: "{{ ansible_env.OC_USER }}"
+oc_user_password: "{{ ansible_env.OC_USER_PASSWORD }}"
 oc_master_hostname: "{{ ansible_env.OC_MASTER_HOSTNAME }}"
 oc_project: "{{ ansible_env.OC_PROJECT }}"
+oc_project_sa: "{{ ansible_env.OC_PROJECT_SA }}"
 oc_pipelines_sd_poster_image_tag: "{{ ansible_env.OC_PIPELINES_SD_POSTER_IMAGE_TAG }}"
 
 # Various retry timeouts (seconds)...

openshift/ansible/roles/pipelines/tasks/main.yaml

@@ -4,8 +4,8 @@
 # and then remove any existing poster job
 # before deploying a new one (and waiting for completion).
 
-- name: Login (admin)
-  shell: oc login {{ oc_master_hostname }} -u {{ oc_admin }} -p {{ oc_admin_password }}
+- name: Login (user)
+  shell: oc login {{ oc_master_hostname }} -u {{ oc_user }} -p {{ oc_user_password }}
   changed_when: False
 
 - name: Move to Squonk Project
@@ -25,6 +25,7 @@
   shell: >
     oc process
     -f {{ role_path }}/{{ t_dir }}/post-service-descriptors.yaml
+    -p POSTER_SA={{ oc_project_sa }}
     -p POSTER_IMAGE_TAG={{ oc_pipelines_sd_poster_image_tag }}
     | oc create -f -
 

openshift/templates/post-service-descriptors.yaml

@@ -19,6 +19,8 @@ parameters:
 
 - name: POSTER_IMAGE_TAG
   value: latest
+- name: POSTER_SA
+  value: squonk
 
 objects:
 
@@ -29,6 +31,7 @@ objects:
   spec:
     template:
       spec:
+        serviceAccountName: ${POSTER_SA}
 
         initContainers:
         - image: yauritux/busybox-curl