Skip to content

Commit bc48ac6

Browse files
Alex-WelshAlex-Welsh
committed
adding roles for users, groups and rbac-cg
1 parent 16a9d6c commit bc48ac6

File tree

16 files changed

+586
-0
lines changed

16 files changed

+586
-0
lines changed

‎roles/pulp_content_guard_rbac/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
pulp_content_guard_rbac
2+
================
3+
4+
This role creates and deletes Pulp RBAC content guards using the Pulp API
5+
6+
Role variables
7+
--------------
8+
9+
* `pulp_url`: URL of Pulp server. Default is `https://localhost:8080`
10+
* `pulp_admin_username`: Username used to access Pulp server. Default is `admin`
11+
* `pulp_admin_password`: Password used to access Pulp server. Default is unset
12+
* `pulp_content_guards_rbac_present`: List of groups to be present. Default is an empty list.
13+
* `pulp_content_guards_rbac_absent`: List of groups to be absent. Default is an empty list.
14+
15+
Note: The groups associated with specified content guards are evauluated against the user's current list of content guards, and their respective groups, returned from the Pulp server API. Removing a group from the list of groups defined in `pulp_content_guards_rbac_present[*].download_groups` will result in the group being removed from that content guard, and adding a group will result in the group being added to that content guard. Adding an empty `download_groups:` for a content guard will result in all groups being removed for that content guard.
16+
17+
Example playbook
18+
----------------
19+
20+
```
21+
---
22+
- name: Create and delete Pulp RBAC content guards
23+
gather_facts: True
24+
hosts: localhost
25+
roles:
26+
- role: stackhpc.pulp.pulp_content_guard_rbac
27+
pulp_url: https://pulp.example.com
28+
pulp_admin_username: admin
29+
pulp_admin_password: "{{ secrets_pulp_admin_password }}"
30+
pulp_content_guards_rbac_present:
31+
- name: content-guard-1
32+
download_groups:
33+
- existing-group-1
34+
- existing-group-2
35+
- name: content-guard-2
36+
download_groups:
37+
- existing-group-3
38+
pulp_content_guards_rbac_absent:
39+
- content-guard-3
40+
- content-guard-4
41+
```

‎roles/pulp_content_guard_rbac/defaults/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
pulp_url: https://localhost:8080
3+
pulp_admin_username: admin
4+
pulp_admin_password:
5+
pulp_validate_certs: true
6+
7+
pulp_content_guards_rbac_present: []
8+
pulp_content_guards_rbac_absent: []

‎roles/pulp_content_guard_rbac/tasks/main.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
3+
- name: Get RBAC content guard list
4+
uri:
5+
url: "{{ pulp_rbac_cg_url }}"
6+
user: "{{ pulp_admin_username }}"
7+
password: "{{ pulp_admin_password }}"
8+
method: GET
9+
status_code: 200
10+
force_basic_auth: true
11+
no_log: true
12+
register: rbac_cg_list_result
13+
14+
- name: Set fact cgnames
15+
set_fact:
16+
cgnames: "{{ (cgnames | default([])) + [item.name] }}"
17+
with_items: "{{ rbac_cg_list_result.json.results }}"
18+
19+
- name: Create RBAC content guards
20+
uri:
21+
url: "{{ pulp_rbac_cg_url }}"
22+
user: "{{ pulp_admin_username }}"
23+
password: "{{ pulp_admin_password }}"
24+
force_basic_auth: true
25+
method: POST
26+
status_code: 201
27+
body:
28+
name: "{{ item.name }}"
29+
body_format: form-urlencoded
30+
loop: "{{ pulp_content_guards_rbac_present | default([], true) }}"
31+
loop_control:
32+
label: "{{ item.name }}"
33+
no_log: true
34+
register: result
35+
when: item.name not in cgnames
36+
changed_when: result.status == 201
37+
38+
- name: Add or remove group(s) from content guard
39+
include_tasks: rbac_group/add_or_remove_groups.yml
40+
loop: "{{ pulp_content_guards_rbac_present | default([], true) }}"
41+
loop_control:
42+
loop_var: content_guard
43+
44+
- name: Initialise hrefs
45+
set_fact:
46+
hrefs: []
47+
48+
- name: Set fact hrefs
49+
set_fact:
50+
hrefs: "{{ (hrefs | default([])) + [item.pulp_href] }}"
51+
when: item.name in (pulp_content_guards_rbac_absent | default([], true))
52+
with_items: "{{ rbac_cg_list_result.json.results }}"
53+
54+
- name: Delete RBAC content guards
55+
uri:
56+
url: "{{ pulp_url }}{{ item }}"
57+
user: "{{ pulp_admin_username }}"
58+
password: "{{ pulp_admin_password }}"
59+
force_basic_auth: true
60+
method: DELETE
61+
status_code: 204
62+
body_format: form-urlencoded
63+
loop: "{{ hrefs | default([]) }}"
64+
loop_control:
65+
label: "{{ item }}"
66+
no_log: true
67+
register: result
68+
changed_when: result.status == 204

‎roles/pulp_content_guard_rbac/tasks/rbac_group/add_or_remove_groups.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
3+
- name: Initialise facts
4+
set_fact:
5+
new_groups: []
6+
current_groups: []
7+
8+
- name: Get RBAC content guard list
9+
uri:
10+
url: "{{ pulp_rbac_cg_url }}"
11+
user: "{{ pulp_admin_username }}"
12+
password: "{{ pulp_admin_password }}"
13+
method: GET
14+
status_code: 200
15+
force_basic_auth: true
16+
no_log: true
17+
register: rbac_cg_list_result
18+
19+
- name: Set fact new groups names
20+
set_fact:
21+
new_groups: "{{ (new_groups | default([])) + [item] }}"
22+
with_items: "{{ content_guard.download_groups | default([]) }}"
23+
24+
- name: get current groups associated with content guard
25+
vars:
26+
url_query: "[?name=='{{ content_guard.name }}'].groups"
27+
set_fact:
28+
current_groups_full: "{{ rbac_cg_list_result.json.results | json_query(url_query) | first | default([]) }}"
29+
30+
- name: Set fact current groups names
31+
set_fact:
32+
current_groups: "{{ (current_groups | default([])) + [item.name] }}"
33+
with_items: "{{ current_groups_full }}"
34+
35+
- name: Add groups to RBAC content guards
36+
vars:
37+
url_query: "[?name=='{{ content_guard.name }}'].pulp_href"
38+
uri:
39+
url: "{{ pulp_url }}{{ rbac_cg_list_result.json.results | json_query(url_query) | first }}add_role/"
40+
user: "{{ pulp_admin_username }}"
41+
password: "{{ pulp_admin_password }}"
42+
force_basic_auth: true
43+
method: POST
44+
status_code: 201
45+
body:
46+
groups: "{{ item }}"
47+
role: core.rbaccontentguard_downloader
48+
body_format: form-urlencoded
49+
loop: "{{ new_groups }}"
50+
loop_control:
51+
label: "{{ item }}"
52+
# no_log: true
53+
register: result
54+
when: item not in current_groups
55+
changed_when: result.status == 201
56+
57+
- name: Remove groups from RBAC content guards
58+
vars:
59+
url_query: "[?name=='{{ content_guard.name }}'].pulp_href"
60+
uri:
61+
url: "{{ pulp_url }}{{ rbac_cg_list_result.json.results | json_query(url_query) | first }}remove_role/"
62+
user: "{{ pulp_admin_username }}"
63+
password: "{{ pulp_admin_password }}"
64+
force_basic_auth: true
65+
method: POST
66+
status_code: 201
67+
body:
68+
groups: "{{ item }}"
69+
role: core.rbaccontentguard_downloader
70+
body_format: form-urlencoded
71+
loop: "{{ current_groups }}"
72+
loop_control:
73+
label: "{{ item }}"
74+
no_log: true
75+
register: result
76+
when: item not in new_groups
77+
changed_when: result.status == 201

‎roles/pulp_content_guard_rbac/vars/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
pulp_rbac_cg_url: "{{ pulp_url }}/pulp/api/v3/contentguards/core/rbac/"

‎roles/pulp_group/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
pulp_group
2+
================
3+
4+
This role creates and deletes Pulp groups using the Pulp API.
5+
6+
To add users to groups or add groups to content guards, use the pulp_user and pulp_content_guard_rbac roles respectively.
7+
8+
Role variables
9+
--------------
10+
11+
* `pulp_url`: URL of Pulp server. Default is `https://localhost:8080`
12+
* `pulp_admin_username`: Username used to access Pulp server. Default is `admin`
13+
* `pulp_admin_password`: Password used to access Pulp server. Default is unset
14+
* `pulp_groups_present`: List of groups to be present. Default is an empty list.
15+
* `pulp_groups_absent`: List of groups to be absent. Default is an empty list.
16+
17+
18+
19+
Example playbook
20+
----------------
21+
22+
```
23+
---
24+
- name: Create and delete groups
25+
gather_facts: True
26+
hosts: localhost
27+
roles:
28+
- role: stackhpc.pulp.pulp_group
29+
pulp_url: https://pulp.example.com
30+
pulp_admin_username: admin
31+
pulp_admin_password: "{{ secrets_pulp_admin_password }}"
32+
pulp_groups_present:
33+
- example-group-1
34+
- example-group-2
35+
pulp_groups_absent:
36+
- example-group-3
37+
```

‎roles/pulp_group/defaults/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
pulp_url: https://localhost:8080
3+
pulp_admin_username: admin
4+
pulp_admin_password:
5+
pulp_validate_certs: true
6+
7+
pulp_groups_present: []
8+
pulp_groups_absent: []

‎roles/pulp_group/tasks/main.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
3+
- name: Get group list
4+
uri:
5+
url: "{{ pulp_group_url }}"
6+
user: "{{ pulp_admin_username }}"
7+
password: "{{ pulp_admin_password }}"
8+
method: GET
9+
status_code: 200
10+
force_basic_auth: true
11+
no_log: true
12+
register: groups_list_result
13+
14+
- name: Set fact groupnames
15+
set_fact:
16+
groupnames: "{{ (groupnames | default([])) + [item.name] }}"
17+
with_items: "{{ groups_list_result.json.results }}"
18+
19+
- name: Create groups
20+
uri:
21+
url: "{{ pulp_group_url }}"
22+
user: "{{ pulp_admin_username }}"
23+
password: "{{ pulp_admin_password }}"
24+
force_basic_auth: true
25+
method: POST
26+
status_code: 201
27+
body:
28+
name: "{{ item }}"
29+
body_format: form-urlencoded
30+
loop: "{{ pulp_groups_present | default([], true) }}"
31+
no_log: true
32+
register: result
33+
when:
34+
- item not in groupnames
35+
changed_when: result.status == 201
36+
37+
- name: Initialise hrefs
38+
set_fact:
39+
hrefs: []
40+
41+
- name: Set fact hrefs
42+
set_fact:
43+
hrefs: "{{ (hrefs|default([])) + [item.pulp_href] }}"
44+
when: item.name in (pulp_groups_absent | default([], true))
45+
with_items: "{{ groups_list_result.json.results }}"
46+
47+
- name: Remove groups
48+
uri:
49+
url: "{{ pulp_url }}{{ item }}"
50+
user: "{{ pulp_admin_username }}"
51+
password: "{{ pulp_admin_password }}"
52+
force_basic_auth: true
53+
method: DELETE
54+
status_code: 204
55+
body_format: form-urlencoded
56+
loop: "{{ hrefs | default([]) }}"
57+
loop_control:
58+
label: "{{ item }}"
59+
no_log: true
60+
register: result
61+
changed_when: result.status == 204

‎roles/pulp_group/vars/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
pulp_group_url: "{{ pulp_url }}/pulp/api/v3/groups/"

‎roles/pulp_user/README.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
pulp_user
2+
================
3+
4+
This role creates and deletes Pulp users using the Pulp API.
5+
6+
Role variables
7+
--------------
8+
9+
* `pulp_url`: URL of Pulp server. Default is `https://localhost:8080`
10+
* `pulp_admin_username`: Username used to access Pulp server. Default is `admin`
11+
* `pulp_admin_password`: Password used to access Pulp server. Default is unset
12+
* `pulp_users_present`: List of users to be present. Default is an empty list.
13+
* `pulp_users_absent`: List of users to be absent. Default is an empty list.
14+
15+
Note: User groups are evaluated against the user's current list of groups returned from the Pulp server API. Removing a group from the list of groups defined in `pulp_users_present[*].groups` will result in the user being removed from that group, and adding a group will result in the user being added to that group. Adding an empty `groups:` for a user will result in that user being removed from all groups.
16+
17+
Example playbook
18+
----------------
19+
20+
```
21+
---
22+
- name: Create and delete users
23+
gather_facts: True
24+
hosts: localhost
25+
roles:
26+
- role: stackhpc.pulp.pulp_user
27+
pulp_url: https://pulp.example.com
28+
pulp_admin_username: admin
29+
pulp_admin_password: "{{ secrets_pulp_admin_password }}"
30+
pulp_users_present:
31+
- username: example-user-1
32+
password: correct horse battery staple
33+
groups:
34+
- existing.container.namespace.consumers.one
35+
- existing.container.namespace.consumers.two
36+
- username: example-user-2
37+
password: germany ansible rain farmer
38+
groups:
39+
- existing.container.namespace.consumers.one
40+
pulp_users_absent:
41+
- example-user-3
42+
```

0 commit comments

Comments
 (0)