Skip to content

Commit 7e69d5d

Browse files
MAHDTechMAHDTech
authored
Add user reset ability (#66)
* Add user reset functionality - Migrates playbook from agnosticd_labs - Rename playbook to manage-participants to match new naming convention - Utilise existing playbook passing 'absent' state to remove users - Update generateName field format in template - Adds SSH key field to inventory generation to be passed through to Ansible role - Adds git config params to inventory generation to be passed through to Ansible role - Allow IdM host URL override from resource-dispatcher for use when required such as in CodeReady Containers - Rename the role path to reflect the new path in infra-ansible Poolboy ResourceClaim updates - Re-use existing ResourceClaim for IdP tasks (requires babylon governor changes) - Add ResourceClaim state to template - Add ResourceClaim ignoreDifferences to Argo CD template * Prepare for launch
1 parent 952a6cc commit 7e69d5d

File tree

13 files changed

+462
-119
lines changed

13 files changed

+462
-119
lines changed

‎gitlab-to-argo/files/application_template.j2‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,14 @@ spec:
2020
prune: true
2121
selfHeal: true
2222
{% endif %}
23+
{% if ignoreDifferences is defined %}
24+
ignoreDifferences:
25+
{% for ignoreDifference in ignoreDifferences %}
26+
- group: {{ ignoreDifference.group }}
27+
kind: {{ ignoreDifference.kind }}
28+
jsonPointers:
29+
{% for jsonPointer in ignoreDifference.jsonPointers %}
30+
- {{ jsonPointer }}
31+
{% endfor %}
32+
{% endfor %}
33+
{% endif %}

‎gitlab-to-argo/site.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,13 @@
1212
file:
1313
path: output
1414
state: directory
15+
- name: Show Application Definitions
16+
template:
17+
src: files/application_template.j2
18+
dest: "output/{{ item.id }}.yml"
19+
loop: "{{ gitlab_groups.rest_output }}"
20+
diff: yes
21+
check_mode: yes
1522
- name: Write Application Definitions
1623
template:
1724
src: files/application_template.j2

‎inventory-generation/identity-management/main.yml‎

Lines changed: 147 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,131 +1,160 @@
11
---
2-
32
- name: Generate identity-management inventory based off of engagement.json
43
hosts: local
54
gather_facts: false
65
tasks:
6+
- name: "Fail If Working Directory Is Not Provided"
7+
fail:
8+
msg: "directory var needs to be provided in order to ensure a safe working directory"
9+
when:
10+
- directory is undefined or (directory | trim) == ""
711

8-
- name: "Fail If Working Directory Is Not Provided"
9-
fail:
10-
msg: "directory var needs to be provided in order to ensure a safe working directory"
11-
when:
12-
- directory is undefined or (directory | trim) == ""
13-
14-
- name: "Fail If Governor Type Is Not Provided"
15-
fail:
16-
msg: "governor_type and governor_spec vars need to be provided in order to indicate babylon workflow"
17-
when:
18-
- (governor_type is undefined or (governor_type | trim) == "") or (governor_spec is undefined or (governor_spec | trim) == "")
19-
20-
- name: Generate Timestamp
21-
set_fact:
22-
inv_ts: " {{ lookup('pipe','date +%Y%m%d%H%M%S') }}"
23-
24-
- name: Read Engagement Data
25-
include_vars:
26-
file: "{{ directory }}/engagement.json"
27-
28-
- name: Read Credentials
29-
include_vars:
30-
file: "{{ directory }}/{{ config_dir }}/{{ item }}"
31-
loop:
32-
- "ocp-admin-credentials.json"
33-
- "ocp-ldap-sa-credentials.json"
34-
35-
- name: "Add users to inventory"
36-
set_fact:
37-
users: "{{ (users | default([])) + [ { 'first_name': (item.first_name | trim), 'last_name': (item.last_name | trim), 'email': (item.email | trim) , 'user_name': (item.email.split('@')[0] | trim) } ] }}"
38-
loop: "{{ engagement_users }}"
39-
40-
- name: "Add LDAP Service Account"
41-
set_fact:
42-
users: "{{ (users | default([])) + [ { 'first_name': 'LDAP', 'last_name': 'SA', 'email': '[email protected]', 'user_name': ocp_ldap_sa_username, 'generate_password': false, 'password': ocp_ldap_sa_password } ] }}"
43-
44-
- name: "Get Unique Groups"
45-
set_fact:
46-
unique_groups: "{{ engagement_users | json_query('[].role') | unique }}"
47-
48-
- name: "Set Group Membership"
49-
set_fact:
50-
usrgrp: "{{ (usrgrp | default([])) + [ {'name': item, 'members': (engagement_users | selectattr('role','equalto',item) | map(attribute='email') | map('regex_replace','@.*','') | list) } ] }}"
51-
loop: "{{ unique_groups }}"
52-
53-
- name: Add LDAP Groups Grouping
54-
set_fact:
55-
usrgrp: "{{ (usrgrp | default([])) + [ {'name': 'ldap-members', 'childgroups': unique_groups } ] }}"
56-
57-
- name: "Set List of Mail CC"
58-
set_fact:
59-
cc_list: "{{ ', '.join(( '{{ engagement_lead_email }}', '{{ technical_lead_email }}' )) }}"
60-
61-
#####################################################################################################################
62-
# Right now, the only supported configuration is a list of one hosting environment.
63-
# In the near future, this should be updated to support more than one, and this comment (and the code below)
64-
# should be updated to support this. For now, this checking is just looking for more than zero hosting environments,
65-
# but will default to use the value(s) from the first one.
66-
67-
- block:
68-
- name: "Set IDM facts"
69-
set_fact:
70-
ipa_host: "{{ 'ipa.apps.' + (hosting_environments[0].ocp_sub_domain | lower) + '.' + engagement_region | default('dev') + '-1.' + ocp_base_url }}"
71-
ipa_admin_user: "{{ ocp_admin_username }}"
72-
ipa_admin_password: "{{ ocp_admin_password }}"
73-
ipa_validate_certs: "{{ ipa_validate_certs | default(true) }}"
12+
- name: "Fail If Governor Type Is Not Provided"
13+
fail:
14+
msg: "governor_type and governor_spec vars need to be provided in order to indicate babylon workflow"
15+
when:
16+
- (governor_type is undefined or (governor_type | trim) == "") or (governor_spec is undefined or (governor_spec | trim) == "")
7417

75-
- name: "Assemble inventory"
18+
- name: Generate Timestamp
7619
set_fact:
77-
claim_content:
78-
env_end_date: "{{ (archive_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
79-
end_date: "{{ (end_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
80-
start_date: "{{ (start_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
81-
customer_name: "{{ customer_name }}"
82-
project_name: "{{ project_name }}"
83-
ipa_validate_certs: "{{ ipa_validate_certs }}"
84-
ipa_host: "{{ ipa_host }}"
85-
ipa_admin_user: "{{ ipa_admin_user }}"
86-
ipa_admin_password: "{{ ipa_admin_password }}"
87-
list_of_mail_cc: "{{ cc_list }}"
88-
lodestar_identities:
89-
users: "{{ users }}"
90-
groups: "{{ usrgrp }}"
91-
92-
- name: "Check For Existing Inventory File"
93-
stat:
94-
path: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
95-
register: existing_inv
96-
97-
- name: "Pull existing inventory vars"
20+
inv_ts: "{{ lookup('pipe','date +%Y%m%d%H%M%S') }}"
21+
22+
- name: Read Engagement Data
9823
include_vars:
99-
file: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
100-
name: existing_inv_contents
101-
when:
102-
- existing_inv.stat.exists
24+
file: "{{ directory }}/engagement.json"
25+
26+
- name: Read Credentials
27+
include_vars:
28+
file: "{{ directory }}/{{ config_dir }}/{{ item }}"
29+
loop:
30+
- "ocp-admin-credentials.json"
31+
- "ocp-ldap-sa-credentials.json"
32+
33+
- name: "Add users to inventory"
34+
set_fact:
35+
users: "{{ (users | default([])) + [ { 'first_name': (item.first_name | trim), 'last_name': (item.last_name | trim), 'email': (item.email | trim) , 'user_name': (item.email.split('@')[0] | trim) } ] }}"
36+
loop: "{{ engagement_users }}"
37+
38+
- name: "Add LDAP Service Account"
39+
set_fact:
40+
users: "{{ (users | default([])) + [ { 'first_name': 'LDAP', 'last_name': 'SA', 'email': '[email protected]', 'user_name': ocp_ldap_sa_username, 'generate_password': false, 'password': ocp_ldap_sa_password } ] }}"
41+
42+
- name: "Get Unique Groups"
43+
set_fact:
44+
unique_groups: "{{ engagement_users | json_query('[].role') | unique }}"
10345

104-
- name: "Diff existing vars with new inventory"
46+
- name: "Set Group Membership"
10547
set_fact:
106-
inv_has_diff: true
48+
usrgrp: "{{ (usrgrp | default([])) + [ {'name': item, 'members': (engagement_users | selectattr('role','equalto',item) | map(attribute='email') | map('regex_replace','@.*','') | list) } ] }}"
49+
loop: "{{ unique_groups }}"
50+
51+
- name: Add LDAP Groups Grouping
52+
set_fact:
53+
usrgrp: "{{ (usrgrp | default([])) + [ {'name': 'ldap-members', 'childgroups': unique_groups } ] }}"
54+
55+
- name: "Set List of Mail CC"
56+
set_fact:
57+
cc_list: "{{ ', '.join(( '{{ engagement_lead_email }}', '{{ technical_lead_email }}' )) }}"
58+
59+
- name: "Check for Job queue"
60+
ansible.builtin.stat:
61+
path: "{{ directory }}/queue"
62+
register: job_queue
63+
ignore_errors: True
64+
65+
- name: "Process Job queue"
66+
include: "queue/main.yml"
10767
when:
108-
- existing_inv.stat.exists
109-
- existing_inv_contents is defined
110-
- existing_inv_contents != (claim_content | from_yaml)
111-
112-
- name: "Write inventory to file"
113-
copy:
114-
content: "{{ claim_content | to_nice_yaml(indent=2) }}"
115-
dest: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
116-
117-
- name: "Create hosts file"
118-
copy:
119-
content: "[identity-hosts]\nlocalhost"
120-
dest: "{{ directory }}/iac/inventories/identity-management/inventory/hosts"
121-
122-
- name: "Create ResourceClaim"
123-
copy:
124-
content: "{{ lookup('template', inventory_dir + '/../files/templates/resourceclaim.yaml.j2') }}"
125-
dest: "{{ directory }}/ocp-init/id-mgmt-{{ inv_ts | trim }}.yaml"
68+
- job_queue.stat.isdir is defined
69+
70+
- name: "Set repository information"
71+
set_fact:
72+
repository_url: "{{ url | default(omit) }}"
73+
repository_ssh_key: "{{ lookup('file', ssh_key_data_path, lstrip=False, rstrip=False) | default(omit) }}"
74+
repository_username: "{{ username if username is defined else omit }}"
75+
repository_password: "{{ password if password is defined else omit }}"
76+
77+
#####################################################################################################################
78+
# Right now, the only supported configuration is a list of one hosting environment.
79+
# In the near future, this should be updated to support more than one, and this comment (and the code below)
80+
# should be updated to support this. For now, this checking is just looking for more than zero hosting environments,
81+
# but will default to use the value(s) from the first one.
82+
83+
- block:
84+
- name: "Set Identity Provider facts"
85+
set_fact:
86+
idp_type: "{{ idp_type | default('idm') }}"
87+
ipa_host: "{{ idp_host_url if idp_host_url is defined else 'ipa.apps.' + (hosting_environments[0].ocp_sub_domain | lower) + '.' + engagement_region | default('dev') + '-1.' + ocp_base_url }}"
88+
ipa_admin_user: "{{ ocp_admin_username }}"
89+
ipa_admin_password: "{{ ocp_admin_password }}"
90+
ipa_validate_certs: "{{ ipa_validate_certs | default(true) }}"
91+
92+
- name: "Assemble inventory"
93+
set_fact:
94+
claim_content:
95+
env_end_date: "{{ (archive_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
96+
end_date: "{{ (end_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
97+
start_date: "{{ (start_date | regex_replace('^(.*)T.*$', '\\1') | to_datetime('%Y-%m-%d')).strftime('%d %b %Y') }}"
98+
customer_name: "{{ customer_name }}"
99+
project_name: "{{ project_name }}"
100+
ipa_validate_certs: "{{ ipa_validate_certs }}"
101+
ipa_host: "{{ ipa_host }}"
102+
ipa_admin_user: "{{ ipa_admin_user }}"
103+
ipa_admin_password: "{{ ipa_admin_password }}"
104+
list_of_mail_cc: "{{ cc_list }}"
105+
lodestar_identities:
106+
users: "{{ users }}"
107+
groups: "{{ usrgrp }}"
108+
lodestar_identities_remove:
109+
users: "{{ users_remove | default([]) }}"
110+
repository:
111+
url: "{{ repository_url if repository_url is defined else omit }}"
112+
ssh_key: "{{ ( repository_ssh_key | to_nice_yaml( default_style='>-', indent=4, width=5000 ) | trim) if repository_ssh_key is defined else omit }}"
113+
username: "{{ repository_username if repository_username is defined else omit }}"
114+
password: "{{ repository_password if repository_password is defined else omit }}"
115+
git:
116+
name: "{{ git.name if git.name is defined else omit }}"
117+
username: "{{ git.username if git.username is defined else omit }}"
118+
email: "{{ git.email if git.email is defined else omit }}"
119+
message: "{{ git.message if git.message is defined else omit }}"
120+
121+
- name: "Check For Existing Inventory File"
122+
stat:
123+
path: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
124+
register: existing_inv
125+
126+
- name: "Pull existing inventory vars"
127+
include_vars:
128+
file: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
129+
name: existing_inv_contents
130+
when:
131+
- existing_inv.stat.exists
132+
133+
- name: "Diff existing vars with new inventory"
134+
set_fact:
135+
inv_has_diff: true
136+
when:
137+
- existing_inv.stat.exists
138+
- existing_inv_contents is defined
139+
- existing_inv_contents != (claim_content | from_yaml)
140+
141+
- name: "Write inventory to file"
142+
copy:
143+
content: "{{ claim_content | to_nice_yaml(indent=2) }}"
144+
dest: "{{ directory }}/iac/inventories/identity-management/inventory/group_vars/all.yml"
145+
146+
- name: "Create hosts file"
147+
copy:
148+
content: "[identity-hosts]\nlocalhost"
149+
dest: "{{ directory }}/iac/inventories/identity-management/inventory/hosts"
150+
151+
- name: "Create ResourceClaim"
152+
copy:
153+
content: "{{ lookup('template', inventory_dir + '/../files/templates/resourceclaim.yaml.j2') }}"
154+
dest: "{{ directory }}/ocp-init/id-mgmt.yaml"
155+
when:
156+
- ( inv_has_diff is defined and inv_has_diff == true ) or ( not existing_inv.stat.exists )
126157
when:
127-
- (inv_has_diff is defined and inv_has_diff is true) or not existing_inv.stat.exists
128-
when:
129-
- hosting_environments is defined
130-
- hosting_environments|length > 0
131-
- hosting_environments[0].ocp_sub_domain is defined
158+
- hosting_environments is defined
159+
- hosting_environments|length > 0
160+
- hosting_environments[0].ocp_sub_domain is defined

‎inventory-generation/identity-management/queue/main.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
- name: Determine Job types to process
3+
block:
4+
- name: Check for User Management Jobs
5+
find:
6+
paths: "{{ directory }}/queue"
7+
patterns: "user-management-*.json"
8+
register: jobs_user_management
9+
when:
10+
- job_queue.stat.path is defined
11+
12+
- name: Process Job types
13+
block:
14+
- name: Process User Management Jobs
15+
include: "user-management.yml"
16+
with_items: "{{ jobs_user_management.files }}"
17+
loop_control:
18+
loop_var: job
19+
when:
20+
- jobs_user_management is defined

‎inventory-generation/identity-management/queue/user-management.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
- name: "Read User Management Job: {{ job.path | basename }}"
3+
include_vars:
4+
file: "{{ job.path }}"
5+
6+
- name: "Display User Management Job Details"
7+
debug:
8+
msg:
9+
- "Adding the follow user details to the removal list"
10+
- "User ID: {{ uuid }}"
11+
- "First Name: {{ first_name }}"
12+
- "Last Name: {{ last_name }}"
13+
- "Email: {{ email }}"
14+
- "Role: {{ role }}"
15+
- "State: absent"
16+
17+
- name: "Add User to removal queue"
18+
set_fact:
19+
users_remove: "{{ (users_remove | default([])) + [ { 'first_name': (first_name | trim), 'last_name': (last_name | trim), 'email': (email | trim) , 'user_name': (email.split('@')[0] | trim), 'state': 'absent' } ] }}"

‎inventory-generation/tower_jobs_launch/main.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
delete_missing_items: false
2121
ansible_tower:
2222
url: '{{ ansible_tower_url }}'
23+
validate_certs: '{{ validate_tower_certs | default(true) }}'
2324
admin_user: '{{ ansible_tower_admin_username }}'
2425
admin_password: '{{ ansible_tower_admin_password }}'
2526
credentials:

0 commit comments

Comments
 (0)