Skip to content

Commit e7e73dd

Browse files
Yashansh-Sharma15Yashansh-Sharma15
committed
ocp_cso
Signed-off-by: Yashansh-Sharma15 <[email protected]>
1 parent df3c90f commit e7e73dd

File tree

8 files changed

+175
-0
lines changed

8 files changed

+175
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ This repository consists of additional ansible playbooks for the following:
5454
1. Deploy Openshift Data Foundation operator
5555
1. Enabling Kdump
5656
1. Enable Topology Manager on Power
57+
1. Deploy Container Security Operator
5758

5859
## Assumptions:
5960

‎examples/all.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,3 +570,10 @@ restricted_cpuv2: ""
570570
none_cpuv1: ""
571571
none_cpuv2: ""
572572

573+
#ocp-cso vars
574+
cso_enabled: false
575+
cso_namespace: ""
576+
cso_catalogsource_name: ""
577+
cso_catalogsource_image: ""
578+
cso_operator_channel :
579+

‎examples/ocp_cso_vars.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#ocp-cso vars
2+
3+
cso_enabled: false
4+
cso_namespace: "" #Nmaespace for cso-registry
5+
cso_catalogsource_name: "" # CatalogSource Name
6+
cso_catalogsource_image: "" # CatalogSource Image
7+
cso_operator_channel : # Version of CSO to be installed

‎playbooks/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,3 +166,6 @@
166166
- import_playbook: ocp-odf-operator.yml
167167
when: odf_enabled is defined and odf_enabled
168168

169+
- import_playbook: ocp-cso.yml
170+
when: cso_enabled is defined and cso_enabled
171+

‎playbooks/ocp-cso.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
- name: Automate Container Security Operator in OpenShift
3+
hosts: bastion
4+
roles:
5+
- ocp-cso

‎playbooks/roles/ocp-cso/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
Container Security Operator Automation
2+
=========
3+
4+
This playbook will:
5+
- Install CSO operator
6+
7+
Requirements
8+
------------
9+
10+
- Access to the cluster as a user with the cluster-admin role
11+
- The cluster is in a known good state, without any errors
12+
- OCP secret with name ***podman-secret*** in the default namespace which is used for global secret update and has following keys:
13+
***username***, ***password*** and ***registry***
14+
15+
16+
Role Variables
17+
--------------
18+
| Variable | Required | Default | Comments |
19+
|--------------------------------|----------|-------------|------------------------------------------------|
20+
| cso_enabled | no | false | Set it to true to run this playbook |
21+
| cso_namespace | no | "CSO-registry" | CSO namespace |
22+
| cso_catalogsource_name | no | | CSO Catalogsource Name |
23+
| cso_catalogsource_image | no | | CSO Catalogsource Image |
24+
| cso_operator_channel | no | | CSO operator Image |
25+
26+
27+
Example Playbook
28+
----------------
29+
30+
```
31+
- name: Deploy CSO operator in OpenShift
32+
include_role:
33+
name: ocp-cso
34+
```
35+
36+
License
37+
-------
38+
39+
See LICENCE.txt
40+
41+
Author Information
42+
------------------
43+
44+
[email protected]

‎playbooks/roles/ocp-cso/defaults/main.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#ocp-cso vars
2+
3+
cso_enabled: false
4+
cso_namespace: "quay-registry" #Nmaespace for container security operator
5+
cso_catalogsource_name: "CSO Custom CatalogSource" # CatalogSource Name
6+
cso_catalogsource_image: "" # CatalogSource Image
7+
cso_operator_channel : # Version of cso to be installed

‎playbooks/roles/ocp-cso/tasks/main.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# check if Cluster Health is good
2+
- name: Check if cluster operators and nodes are healthy
3+
include_role:
4+
name: check-cluster-health
5+
6+
- name: Check if cso_namespace is defined, and set default if not
7+
set_fact:
8+
cso_namespace: "{{ cso_namespace | default('quay-registry') }}" # Set default namespace if not defined
9+
10+
- name: Create a target namespace
11+
kubernetes.core.k8s:
12+
state: present
13+
definition:
14+
apiVersion: v1
15+
kind: Namespace
16+
metadata:
17+
name: "{{ cso_namespace }}"
18+
when: cso_namespace is defined
19+
20+
# Custom ImageContentSourcePolicy and CatalogSource
21+
- name: Create ImageContentSourcePolicy and CatalogSource
22+
block:
23+
- name: Include the global-secret-update role
24+
include_role:
25+
name: global-secret-update
26+
27+
- name: Include role to create ImageContentSourcePolicy and CatalogSource
28+
include_role:
29+
name: set-custom-catalogsource
30+
vars:
31+
custom_catalogsource_name: "{{ cso_catalogsource_name }}"
32+
custom_catalogsource_display_name: "Custom CSO CatalogSource"
33+
custom_catalogsource_image: "{{ cso_catalogsource_image }}"
34+
when: cso_catalogsource_image is defined or cso_catalogsource_image != '' and cso_catalogsource_image != None
35+
36+
- name: Use default CatalogSource if no custom image is provided
37+
set_fact:
38+
cso_catalogsource_name: "redhat-operators"
39+
when: cso_catalogsource_image is undefined or cso_catalogsource_image == '' or cso_catalogsource_image == None
40+
41+
- name: Verify creation of Catsrc
42+
shell: oc get catsrc -A | grep "{{ cso_catalogsource_name }}"
43+
register: catsrc
44+
until: catsrc.stdout|int == 0 and catsrc.stderr == ""
45+
retries: 10
46+
delay: 30
47+
48+
- name: Check if CSO CatalogSource exists and is READY
49+
shell: >
50+
oc get catalogsource {{ cso_catalogsource_name }} -n openshift-marketplace -o jsonpath='{.status.connectionState.lastObservedState}'
51+
register: cso_catsrc_check
52+
retries: 10
53+
delay: 15
54+
until: cso_catsrc_check.rc == 0
55+
changed_when: false
56+
failed_when: cso_catsrc_check.rc != 0
57+
58+
- name: Debug output for CSO CatalogSource check
59+
debug:
60+
msg: "CSO CatalogSource '{{ cso_catalogsource_name }}' is present and in Ready state."
61+
62+
- name: Create OperatorGroup for CSO
63+
k8s:
64+
state: present
65+
definition:
66+
apiVersion: operators.coreos.com/v1
67+
kind: OperatorGroup
68+
metadata:
69+
name: cso-operator-group
70+
namespace: "{{ cso_namespace }}"
71+
spec: {}
72+
73+
- name: Create CSO Operator Subscription
74+
k8s:
75+
state: present
76+
definition:
77+
apiVersion: operators.coreos.com/v1alpha1
78+
kind: Subscription
79+
metadata:
80+
name: cso-operator
81+
namespace: "{{ cso_namespace }}"
82+
spec:
83+
channel: "{{ cso_operator_channel }}"
84+
name: cso-operator
85+
source: "{{ cso_catalogsource_name }}"
86+
sourceNamespace: openshift-marketplace
87+
installPlanApproval: Automatic
88+
89+
- name: Check if cso Operator CSV is in 'Succeeded' phase
90+
shell: |
91+
oc get csv -n {{ cso_namespace }} --no-headers | grep cso-operator | grep Succeeded
92+
register: csv_status
93+
retries: 10
94+
delay: 30
95+
until: csv_status.stdout != "" and csv_status.stderr == ""
96+
failed_when: csv_status.rc != 0
97+
98+
- name: Debug cso operator CSV status
99+
debug:
100+
msg: "Container Security Operator CSV has successfully reached 'Succeeded' state."
101+

0 commit comments

Comments
 (0)