Skip to content

Commit d6acd79

Browse files
hjensashjensas
committed
Add cifmw_ocp_agent_installer role
This is a port of the OCP Agent Installer role used in hotstack. I used Claude 4 Sonnet to rename all the variables, and removed some hotstack specific snapshot features. Follow up changes to integrate this with other ci-framework would follow, and that will most likely also mean edits to this role. Assisted-By: Claude Code/claude-sonnet-4 Signed-off-by: Harald Jensås <[email protected]>
1 parent 07f6a4f commit d6acd79

21 files changed

+862
-0
lines changed

‎roles/ocp_agent_installer/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# cifmw_ocp_agent_installer
2+
3+
> **NOTE**: This Work-in-Progress ...
4+
5+
6+
* Create PXE bootstrap-artifects using the OCP Agent Installer
7+
* Customizations:
8+
* Cnable iscsi
9+
* Enable multipath
10+
* Stand up cinder-volumes LVM
11+
* Extra config for OVN-Kubernetes
12+
* Etcd hardware speed (Slower)

‎roles/ocp_agent_installer/defaults/main.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
18+
# Can be one of ['pxe', 'iso']
19+
cifmw_ocp_agent_installer_bootstrap_assets: pxe
20+
cifmw_ocp_agent_installer_add_ingress_cert_to_ca_trust: true
21+
22+
cifmw_ocp_agent_installer_openshift_version: stable-4.18
23+
cifmw_ocp_agent_installer_mirror_url: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp
24+
cifmw_ocp_agent_installer_client_url: "{{ cifmw_ocp_agent_installer_mirror_url }}/{{ cifmw_ocp_agent_installer_openshift_version }}/openshift-client-linux.tar.gz"
25+
cifmw_ocp_agent_installer_installer_url: "{{ cifmw_ocp_agent_installer_mirror_url }}/{{ cifmw_ocp_agent_installer_openshift_version }}/openshift-install-linux.tar.gz"
26+
27+
cifmw_ocp_agent_installer_base_dir: "{{ cifmw_basedir | default(ansible_user_dir ~ '/ci-framework-data') }}/ocp-agent-installer"
28+
cifmw_ocp_agent_installer_bin_dir: "{{ ansible_user_dir }}/bin"
29+
cifmw_ocp_agent_installer_kube_config_dir: "{{ ansible_user_dir }}/.kube"
30+
cifmw_ocp_agent_installer_cluster_dir: "{{ cifmw_ocp_agent_installer_base_dir }}/ocp-cluster"
31+
cifmw_ocp_agent_installer_manifests_dir: "{{ cifmw_ocp_agent_installer_cluster_dir }}/openshift"
32+
cifmw_ocp_agent_installer_agent_installer_dir: "{{ cifmw_ocp_agent_installer_base_dir }}/agent-installer"
33+
cifmw_ocp_agent_installer_cluster_custom_config_dir: "{{ cifmw_ocp_agent_installer_base_dir }}/cluster-custom-config/"
34+
cifmw_ocp_agent_installer_butane_dir: "{{ cifmw_ocp_agent_installer_cluster_custom_config_dir }}/butane"
35+
cifmw_ocp_agent_installer_machine_configs_dir: "{{ cifmw_ocp_agent_installer_cluster_custom_config_dir }}/machine-configs"
36+
cifmw_ocp_agent_installer_config_assets_dir: "{{ cifmw_ocp_agent_installer_cluster_custom_config_dir }}/config-assets"
37+
38+
cifmw_ocp_agent_installer_boot_artifacts_dir: /var/www/html/boot-artifacts
39+
40+
cifmw_ocp_agent_installer_install_config:
41+
cifmw_ocp_agent_installer_agent_config:
42+
cifmw_ocp_agent_installer_pull_secret:
43+
44+
cifmw_ocp_agent_installer_cinder_volume_pvs: []
45+
cifmw_ocp_agent_installer_cinder_volume_roles:
46+
- master
47+
cifmw_ocp_agent_installer_enable_multipath: false
48+
cifmw_ocp_agent_installer_multipath_roles:
49+
- master
50+
cifmw_ocp_agent_installer_enable_iscsi: false
51+
cifmw_ocp_agent_installer_iscsi_roles:
52+
- master
53+
cifmw_ocp_agent_installer_disable_net_ifnames: true
54+
cifmw_ocp_agent_installer_net_ifnames_roles:
55+
- master
56+
57+
# OVN Configuration
58+
cifmw_ocp_agent_installer_enable_ovn_k8s_overrides: true
59+
cifmw_ocp_agent_installer_ovn_k8s_gateway_config_ip_forwarding: true
60+
cifmw_ocp_agent_installer_ovn_k8s_gateway_config_host_routing: false
61+
62+
# Etcd - set to true for controlPlaneHardwareSpeed = Slower
63+
# https://www.redhat.com/en/blog/introducing-selectable-profiles-for-etcd
64+
cifmw_ocp_agent_installer_enable_etcd_hardware_speed_slow: true
65+
66+
cifmw_ocp_agent_installer_enable_image_content_source_policy: false
67+
# To enable ImageContentSourcePolicy (ICSP), set this variable to contain the value
68+
# for the ICSP spec's repositoryDigestMirrors field.
69+
cifmw_ocp_agent_installer_image_content_source_policy_mirrors: []
70+
71+
cifmw_ocp_agent_installer_enable_additional_trusted_ca: false
72+
cifmw_ocp_agent_installer_ocp_additional_trusted_ca:
73+
- name: registry-proxy.engineering.redhat.com
74+
url: https://url.corp.redhat.com/hotstack-ca

‎roles/ocp_agent_installer/files/additional-trusted-ca-config-image.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: config.openshift.io/v1
3+
kind: Image
4+
metadata:
5+
name: cluster
6+
spec:
7+
additionalTrustedCA:
8+
name: hotstack-additional-trusted-ca

‎roles/ocp_agent_installer/files/etcd-config.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: operator.openshift.io/v1
3+
kind: Etcd
4+
metadata:
5+
name: cluster
6+
spec:
7+
controlPlaneHardwareSpeed: Slower
8+
managementState: Managed

‎roles/ocp_agent_installer/meta/main.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.

‎roles/ocp_agent_installer/tasks/additional_ca.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Assert
18+
ansible.builtin.assert:
19+
that:
20+
- ca.name is defined
21+
- ca.name | length > 0
22+
- ca.url is defined or ca.data is defined
23+
- (
24+
ca.url | length > 0 or
25+
ca.data | length > 0
26+
)
27+
28+
- name: Download the CA bundle if url
29+
when: ca.url is defined
30+
ansible.builtin.uri:
31+
url: "{{ ca.url }}"
32+
method: get
33+
return_content: true
34+
validate_certs: false
35+
register: __get_ca_from_url_result
36+
ignore_errors: true
37+
38+
- name: Append to _ocp_additional_trusted_ca_map
39+
when: (
40+
ca.data is defined or
41+
(
42+
ca.url is defined and
43+
not __get_ca_from_url_result.failed
44+
)
45+
)
46+
ansible.builtin.set_fact:
47+
_ocp_additional_trusted_ca_map: >-
48+
{{
49+
_ocp_additional_trusted_ca_map |
50+
combine(
51+
{ca.name: ca.data | default(__get_ca_from_url_result.content)}
52+
)
53+
}}

‎roles/ocp_agent_installer/tasks/config_assets.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Template ovn-k8s customization
18+
when: cifmw_ocp_agent_installer_enable_ovn_k8s_overrides | bool
19+
ansible.builtin.template:
20+
src: ovn-k8s-config.j2
21+
dest: >-
22+
{{
23+
[
24+
cifmw_ocp_agent_installer_config_assets_dir,
25+
'ovn_k8s_config.yaml'
26+
] | ansible.builtin.path_join
27+
}}
28+
mode: '0644'
29+
30+
- name: Copy Etcd customization
31+
when: cifmw_ocp_agent_installer_enable_etcd_hardware_speed_slow | bool
32+
ansible.builtin.copy:
33+
src: etcd-config.yaml
34+
dest: >-
35+
{{
36+
[
37+
cifmw_ocp_agent_installer_config_assets_dir,
38+
'95-etcd_config.yaml'
39+
] | ansible.builtin.path_join
40+
}}
41+
mode: '0644'
42+
43+
- name: Template ImageContentSourcePolicy customization
44+
when: cifmw_ocp_agent_installer_enable_image_content_source_policy | bool
45+
ansible.builtin.template:
46+
src: image-content-source-policy.yaml.j2
47+
dest: >-
48+
{{
49+
[
50+
cifmw_ocp_agent_installer_config_assets_dir,
51+
'95-image-content-source-policy.yaml'
52+
] | ansible.builtin.path_join
53+
}}
54+
mode: '0644'
55+
56+
- name: Additional trusted CA
57+
when:
58+
- cifmw_ocp_agent_installer_enable_additional_trusted_ca | bool
59+
- cifmw_ocp_agent_installer_ocp_additional_trusted_ca is defined
60+
- cifmw_ocp_agent_installer_ocp_additional_trusted_ca | length > 0
61+
block:
62+
- name: Initialize _ocp_additional_trusted_ca_map fact
63+
ansible.builtin.set_fact:
64+
_ocp_additional_trusted_ca_map: {}
65+
66+
- name: Append to _ocp_additional_trusted_ca_map fact
67+
ansible.builtin.include_tasks: additional_ca.yml
68+
loop: "{{ cifmw_ocp_agent_installer_ocp_additional_trusted_ca }}"
69+
loop_control:
70+
loop_var: ca
71+
72+
- name: Template additional CA config map
73+
ansible.builtin.template:
74+
src: additional-trusted-ca-config-map.yaml.j2
75+
dest: >-
76+
{{
77+
[
78+
cifmw_ocp_agent_installer_config_assets_dir,
79+
'93-additional-ca-config-map.yaml'
80+
] | ansible.builtin.path_join
81+
}}
82+
mode: '0644'
83+
84+
- name: Copy additional CA config image
85+
ansible.builtin.copy:
86+
src: additional-trusted-ca-config-image.yaml
87+
dest: >-
88+
{{
89+
[
90+
cifmw_ocp_agent_installer_config_assets_dir,
91+
'94-additional-ca-config-image.yaml'
92+
] | ansible.builtin.path_join
93+
}}
94+
mode: '0644'

‎roles/ocp_agent_installer/tasks/ingress_cert.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Extract ingress CA cert
18+
register: _ingress_cert
19+
ansible.builtin.shell: |
20+
POD_NAME=$({{ cifmw_ocp_agent_installer_bin_dir }}/oc get pods -n openshift-authentication -o jsonpath='{.items[0].metadata.name}')
21+
{{ cifmw_ocp_agent_installer_bin_dir }}/oc rsh -n openshift-authentication $POD_NAME \
22+
cat /run/secrets/kubernetes.io/serviceaccount/ca.crt
23+
retries: 10
24+
delay: 10
25+
until: _ingress_cert.rc == 0
26+
27+
- name: Write ingress cert to ca-trust
28+
become: true
29+
ansible.builtin.copy:
30+
content: "{{ _ingress_cert.stdout }}"
31+
dest: /etc/pki/ca-trust/source/anchors/ingress-ca.crt
32+
owner: root
33+
group: root
34+
mode: '0644'
35+
36+
- name: Update CA trust
37+
become: true
38+
ansible.builtin.command:
39+
cmd: update-ca-trust

‎roles/ocp_agent_installer/tasks/install_client.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Download the client
18+
ansible.builtin.get_url:
19+
url: "{{ cifmw_ocp_agent_installer_client_url }}"
20+
dest: >-
21+
{{
22+
[
23+
cifmw_ocp_agent_installer_agent_installer_dir,
24+
'openshift-client-linux.tar.gz'
25+
] | ansible.builtin.path_join
26+
}}
27+
mode: '0644'
28+
29+
- name: Extract client to /home/zuul/bin
30+
ansible.builtin.unarchive:
31+
src: >-
32+
{{
33+
[
34+
cifmw_ocp_agent_installer_agent_installer_dir,
35+
'openshift-client-linux.tar.gz'
36+
] | ansible.builtin.path_join
37+
}}
38+
dest: "{{ cifmw_ocp_agent_installer_bin_dir }}"
39+
remote_src: true
40+
creates: "{{ cifmw_ocp_agent_installer_bin_dir }}/oc"
41+
42+
- name: Configure bash completion
43+
become: true
44+
ansible.builtin.shell: |
45+
{{ cifmw_ocp_agent_installer_bin_dir }}/oc completion bash > /etc/bash_completion.d/oc_bash_completion
46+
args:
47+
creates: /etc/bash_completion.d/oc_bash_completion

‎roles/ocp_agent_installer/tasks/install_installer.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Download the installer
18+
ansible.builtin.get_url:
19+
url: "{{ cifmw_ocp_agent_installer_installer_url }}"
20+
dest: >-
21+
{{
22+
[
23+
cifmw_ocp_agent_installer_agent_installer_dir,
24+
'openshift-install-linux.tar.gz'
25+
] | ansible.builtin.path_join
26+
}}
27+
mode: '0644'
28+
29+
- name: Extract installer to /home/zuul/bin
30+
ansible.builtin.unarchive:
31+
src: >-
32+
{{
33+
[
34+
cifmw_ocp_agent_installer_agent_installer_dir,
35+
'openshift-install-linux.tar.gz'
36+
] | ansible.builtin.path_join
37+
}}
38+
dest: "{{ cifmw_ocp_agent_installer_bin_dir }}"
39+
remote_src: true
40+
creates: "{{ cifmw_ocp_agent_installer_bin_dir }}/openshift-install"

0 commit comments

Comments
 (0)