blob: 4432856bbf4b49876e1926547e5f5390cdce2354 [file] [log] [blame]
okozachenko1203d8d2aa12022-10-22 00:55:14 +11001# Copyright (c) 2022 VEXXHOST, Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License"); you may
4# not use this file except in compliance with the License. You may obtain
5# a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12# License for the specific language governing permissions and limitations
13# under the License.
14
Mohammed Naser0a13cee2023-03-02 11:28:29 +010015- name: Generate resources
16 ansible.builtin.import_tasks:
17 file: generate_resources.yml
okozachenko1203d8d2aa12022-10-22 00:55:14 +110018
Mohammed Naserc5824202022-11-12 17:17:02 +000019- name: Create CAs & Issuers
20 kubernetes.core.k8s:
21 state: present
22 definition:
23 - apiVersion: cert-manager.io/v1
24 kind: Certificate
25 metadata:
26 name: "{{ item }}-ca"
27 namespace: openstack
28 spec:
29 isCA: true
Mohammed Naser0a13cee2023-03-02 11:28:29 +010030 commonName: "{{ octavia_tls_server_common_name if item == 'octavia-server' else octavia_tls_client_common_name }}"
Mohammed Naserc5824202022-11-12 17:17:02 +000031 secretName: "{{ item }}-ca"
Giovanni Tirloni295808a2024-02-26 20:45:29 -030032 duration: 87600h0m0s
33 renewBefore: 720h0m0s
Mohammed Naser0a13cee2023-03-02 11:28:29 +010034 privateKey: "{{ private_key | from_yaml }}"
Mohammed Naserc5824202022-11-12 17:17:02 +000035 issuerRef:
36 name: self-signed
Mohammed Naserbb89a842022-11-14 19:49:36 +000037 kind: ClusterIssuer
Mohammed Naserc5824202022-11-12 17:17:02 +000038 group: cert-manager.io
okozachenko1203d8d2aa12022-10-22 00:55:14 +110039
Mohammed Naserc5824202022-11-12 17:17:02 +000040 - apiVersion: cert-manager.io/v1
41 kind: Issuer
42 metadata:
43 name: "{{ item }}"
44 namespace: openstack
45 spec:
46 ca:
47 secretName: "{{ item }}-ca"
Mohammed Naser0a13cee2023-03-02 11:28:29 +010048 vars:
49 # NOTE(mnaser): Unfortuantely, Ansible renders all variables as strings so
50 # we do this workaround to make sure the size is an integer.
51 private_key: |
52 algorithm: "{{ octavia_tls_server_private_key_algorithm if item == 'octavia-server' else octavia_tls_client_private_key_algorithm }}"
53 size: {{ octavia_tls_server_private_key_size if item == 'octavia-server' else octavia_tls_client_private_key_size }}
Mohammed Naserc5824202022-11-12 17:17:02 +000054 loop:
55 - octavia-client
56 - octavia-server
okozachenko1203d8d2aa12022-10-22 00:55:14 +110057
Mohammed Naserc5824202022-11-12 17:17:02 +000058- name: Create certificate for Octavia clients
59 kubernetes.core.k8s:
60 state: present
61 definition:
62 apiVersion: cert-manager.io/v1
63 kind: Certificate
64 metadata:
65 name: octavia-client-certs
66 namespace: openstack
67 spec:
Mohammed Naser0a13cee2023-03-02 11:28:29 +010068 commonName: "{{ octavia_tls_client_common_name }}"
Mohammed Naserc5824202022-11-12 17:17:02 +000069 secretName: octavia-client-certs
70 additionalOutputFormats:
71 - type: CombinedPEM
Giovanni Tirloni295808a2024-02-26 20:45:29 -030072 duration: 87600h0m0s
73 renewBefore: 720h0m0s
Mohammed Naser0a13cee2023-03-02 11:28:29 +010074 privateKey: "{{ private_key | from_yaml }}"
Mohammed Naserc5824202022-11-12 17:17:02 +000075 issuerRef:
76 name: octavia-client
77 kind: Issuer
78 group: cert-manager.io
Mohammed Naser0a13cee2023-03-02 11:28:29 +010079 vars:
80 # NOTE(mnaser): Unfortuantely, Ansible renders all variables as strings so
81 # we do this workaround to make sure the size is an integer.
82 private_key: |
83 algorithm: "{{ octavia_tls_client_private_key_algorithm }}"
84 size: {{ octavia_tls_client_private_key_size }}
okozachenko1203d8d2aa12022-10-22 00:55:14 +110085
86- name: Create admin compute quotaset
87 openstack.cloud.quota:
88 cloud: atmosphere
89 # NOTE(okozachenko): It uses project name instead of id.
90 name: admin
91 instances: -1
92 cores: -1
93 ram: -1
Mohammed Naser9c8115d2023-02-07 22:06:48 +000094 volumes: -1
95 gigabytes: -1
Mohammed Nasere7d66242023-03-09 08:17:24 +000096 security_group: -1
97 security_group_rule: -1
okozachenko1203d8d2aa12022-10-22 00:55:14 +110098
99- name: Deploy Helm chart
guilhermesteinmuller9b173d22023-01-24 19:15:17 +0000100 run_once: true
101 kubernetes.core.helm:
Mohammed Naser2145fc32023-01-29 23:23:03 +0000102 name: "{{ octavia_helm_release_name }}"
103 chart_ref: "{{ octavia_helm_chart_ref }}"
104 release_namespace: "{{ octavia_helm_release_namespace }}"
guilhermesteinmuller9b173d22023-01-24 19:15:17 +0000105 create_namespace: true
Austin Talbot78a774a2024-09-25 10:15:36 -0600106 kubeconfig: "{{ octavia_helm_kubeconfig }}"
Mohammed Naser2145fc32023-01-29 23:23:03 +0000107 values: "{{ _octavia_helm_values | combine(octavia_helm_values, recursive=True) }}"
okozachenko1203d8d2aa12022-10-22 00:55:14 +1100108
Mohammed Naserf641f862023-02-16 19:04:57 +0000109- name: Add implied roles
Mohammed Naser24abccb2023-01-29 22:50:42 +0000110 run_once: true
111 ansible.builtin.shell: |
Tadas Sutkaitis7a286582024-05-01 02:12:08 +0300112 set -o posix
113 source /etc/profile.d/atmosphere.sh
Mohammed Naser24abccb2023-01-29 22:50:42 +0000114 openstack implied role create \
Mohammed Naserf641f862023-02-16 19:04:57 +0000115 --implied-role {{ item.implies }} \
116 {{ item.role }}
Tadas Sutkaitis7a286582024-05-01 02:12:08 +0300117 args:
118 executable: /bin/bash
Mohammed Naserf641f862023-02-16 19:04:57 +0000119 loop:
120 - role: member
121 implies: load-balancer_member
122 - role: reader
123 implies: load-balancer_observer
Mohammed Naser24abccb2023-01-29 22:50:42 +0000124 environment:
125 OS_CLOUD: atmosphere
Mohammed Naser2145fc32023-01-29 23:23:03 +0000126 register: _octavia_implied_role_create
127 changed_when: _octavia_implied_role_create.rc == 0
128 failed_when: _octavia_implied_role_create.rc != 0 and 'Duplicate entry.' not in _octavia_implied_role_create.stderr
Mohammed Naser72708702024-06-20 00:07:56 -0400129 retries: 10
130 delay: 1
131 until: _octavia_implied_role_create.rc == 0 or 'Duplicate entry.' in _octavia_implied_role_create.stderr
Mohammed Naser24abccb2023-01-29 22:50:42 +0000132
okozachenko1203d8d2aa12022-10-22 00:55:14 +1100133- name: Create Ingress
134 ansible.builtin.include_role:
135 name: openstack_helm_ingress
136 vars:
137 openstack_helm_ingress_endpoint: load_balancer
138 openstack_helm_ingress_service_name: octavia-api
139 openstack_helm_ingress_service_port: 9876
Mohammed Naser2145fc32023-01-29 23:23:03 +0000140 openstack_helm_ingress_annotations: "{{ octavia_ingress_annotations }}"
Mohammed Naserc139abc2025-02-05 14:03:20 -0500141 openstack_helm_ingress_class_name: "{{ octavia_ingress_class_name }}"