deploy.yaml

- name: Generate certificates for OSBS-Box
  hosts: osbs_box_host
  tags:
    - certificates

  tasks:
    - name: Make sure certificate directories exist
      file:
        path: "{{ item }}"
        state: directory
      loop:
        - "{{ certificates_dir }}"
        - "{{ koji_certs_dir }}"
        - "{{ registry_certs_dir }}"

    - name: Generate certificates
      include_tasks: tasks/generate-certs.yaml


- name: Prepare for deployment of openshift applications
  hosts: osbs_box_host
  tags:
    - koji
    - registry
    - namespaces
    - buildroot
    # One tag for all openshift applications
    - openshift

  tasks:
    - name: Login as openshift admin
      command: oc login -u system:admin
      changed_when: true

    - name: Make "{{ openshift_user }}" an openshift cluster admin
      command: oc adm policy add-cluster-role-to-user
                  cluster-admin "{{ openshift_user }}"
      changed_when: true

    - name: Make sure directory for openshift files exists
      file:
        path: "{{ openshift_files }}"
        state: directory

    - name: Process parameters file and put it in openshift files dir
      template:
        src: openshift/params/osbs-box.env.j2
        dest: "{{ openshift_files }}/osbs-box.env"


- name: Create all projects (namespaces)
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - namespaces
    - openshift
  tasks:
    - name: Create the project
      command: oc create namespace "{{ item }}"
      register: create_namespace
      failed_when: create_namespace.rc != 0
                  and "already exists" not in create_namespace.stderr
      changed_when: create_namespace.rc == 0
      loop:
        - "{{ koji_namespace }}"
        - "{{ registry_namespace }}"
        - "{{ orchestrator_namespace }}"
        - "{{ worker_namespace }}"


- name: Set up dockerhub pull secret
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - pull_secret

  tasks:
    - name: Create dockerhub pull secret
      no_log: true
      shell:
        set -o pipefail;
        oc create secret docker-registry dockerhub
          --docker-server=docker.io
          --docker-username="{{ docker_id }}"
          --docker-password="{{ docker_password }}"
          --docker-email="{{ docker_email }}"
          --dry-run
          --output json |
        oc --namespace "{{ item }}" replace --force -f -
      loop:
        - "{{ registry_namespace }}"
        - "{{ koji_namespace }}"
        - "{{ orchestrator_namespace }}"
        - "{{ worker_namespace }}"
      changed_when: true

    - name: Link dockerhub pull secret to builder service account
      tags: link_pull_secret
      command: oc --namespace "{{ item }}" secrets link builder dockerhub --for=pull
      loop:
        - "{{ registry_namespace }}"
        - "{{ koji_namespace }}"
        - "{{ orchestrator_namespace }}"
        - "{{ worker_namespace }}"
      changed_when: true


- name: Run koji containers on openshift
  hosts: osbs_box_host
  gather_facts: false
  vars:
    # This is a constant, please do not override
    koji_components:
      - koji-volumes
      - koji-base
      - koji-client
      - koji-builder
      - koji-db
      - koji-hub
  tags:
    - koji
    - openshift

  tasks:
    - name: Create koji-certs secret in koji namespace
      shell:
        set -o pipefail;
        oc create secret generic koji-certs
            --from-file "{{ certificates_dir }}/osbs-box-ca.crt"
            --from-file "{{ koji_certs_dir }}/koji-hub.crt"
            --from-file "{{ koji_certs_dir }}/koji-hub.key"
            --from-file "{{ koji_certs_dir }}/kojiweb.pem"
            --from-file "{{ koji_certs_dir }}/kojibuilder.pem"
            --from-file "{{ koji_certs_dir }}/kojiadmin.pem"
            --from-file "{{ koji_certs_dir }}/kojiosbs.pem"
            --dry-run
            --output json |
        oc --namespace "{{ koji_namespace }}" replace --force -f -
      changed_when: true

    - name: Process koji config templates, output in openshift files dir
      template:
        src: "openshift/configs/{{ item }}.j2"
        dest: "{{ openshift_files }}/{{ item }}"
      loop:
        - koji-builder-osbs.conf
        - koji-hub-web.conf

    - name: Create kojiweb and osbs-client configmaps in koji namespace
      shell:
        set -o pipefail;
        oc create configmap "{{ item.name }}"
            --from-file "{{ item.dest }}={{ openshift_files }}/{{ item.src }}"
            --dry-run
            --output json |
        oc --namespace "{{ koji_namespace }}" replace --force -f -
      changed_when: true
      loop:
        - name: koji-builder-osbs
          src: koji-builder-osbs.conf
          dest: osbs.conf

        - name: koji-hub-web
          src: koji-hub-web.conf
          dest: web.conf

    - name: Copy openshift templates for koji components to openshift files dir
      copy:
        src: "openshift/templates/{{ item }}.yaml"
        dest: "{{ openshift_files }}/{{ item }}.yaml"
      loop:
        "{{ koji_components }}"

    - name: Create openshift resources for all koji components
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/{{ item }}.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ koji_namespace }}" apply -f -
      changed_when: true
      loop:
        "{{ koji_components }}"

    - name: Set up directories that will serve as backing storage for koji PVs
      file:
        path: "{{ item }}"
        state: directory
        setype: container_file_t
      loop:
        - "{{ koji_files_dir }}"
        - "{{ koji_db_data_dir }}"

    - name: Allow koji containers to run as any user
      command:
        oc --namespace "{{ koji_namespace }}" adm policy add-scc-to-user anyuid
           --serviceaccount default
      changed_when: true

    - name: Build (and automatically deploy) koji components
      command: oc --namespace "{{ koji_namespace }}" start-build koji-base
      changed_when: true


- name: Run registry container on openshift
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - registry
    - openshift

  tasks:
    - name: Create registry-cert secret in openshift
      shell:
        set -o pipefail;
        oc create secret generic registry-cert
            --from-file "{{ registry_certs_dir }}/osbs-registry.crt"
            --from-file "{{ registry_certs_dir }}/osbs-registry.key"
            --dry-run
            --output json |
        oc --namespace "{{ registry_namespace }}" replace --force -f -
      changed_when: true

    - name: Set up directory for registry PV storage
      file:
        path: "{{ registry_data_dir }}"
        state: directory
        setype: container_file_t

    - name: Allow registry container to run as any user
      command:
        oc --namespace "{{ registry_namespace }}" adm policy add-scc-to-user
           anyuid --serviceaccount default
      changed_when: true

    - name: Copy osbs-registry template to openshift files dir
      copy:
        src: openshift/templates/osbs-registry.yaml
        dest: "{{ openshift_files }}/osbs-registry.yaml"

    - name: Deploy osbs-registry
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/osbs-registry.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ registry_namespace }}" apply -f -;
        oc --namespace "{{ registry_namespace }}" rollout status dc/osbs-registry --watch=true
      changed_when: true

    - name: Completely remove dockerhub pull secret from osbs-registry project
      shell:
        set -o pipefail;
        oc --namespace "{{ registry_namespace }}" secrets unlink builder dockerhub;
        oc --namespace "{{ registry_namespace }}" delete secret dockerhub;
        oc --namespace "{{ registry_namespace }}" patch dc osbs-registry --type json -p '[{ "op":"remove", "path":"/spec/template/spec/imagePullSecrets" }]'
      changed_when: true


- name: Set up OSBS orchestrator and worker projects
  hosts: osbs_box_host
  gather_facts: false
  vars:
    # This is a constant, please do not override
    projects:
      - "{{ orchestrator_namespace }}"
      - "{{ worker_namespace }}"
  tags:
    - osbs
    - openshift

  tasks:
    - name: Create kojisecret in orchestrator and worker projects
      shell:
        set -o pipefail;
        oc create secret generic kojisecret
            --from-file "cert={{ koji_certs_dir }}/kojiosbs.pem"
            --from-file "ca={{ certificates_dir }}/osbs-box-ca.crt"
            --from-file "serverca={{ certificates_dir }}/osbs-box-ca.crt"
            --dry-run
            --output json |
        oc --namespace "{{ item }}" replace --force -f -
      changed_when: true
      loop:
        "{{ projects }}"

    - name: Query openshift for osbs-registry IP
      command: oc --namespace "{{ registry_namespace }}" get svc osbs-registry
                  --output 'jsonpath={ .spec.clusterIP }'
      register: registry_ip_query
      changed_when: false

    - name: Set registry_ip fact (needed for orchestrator config templates)
      set_fact:
        registry_ip: "{{ registry_ip_query.stdout }}"

    - name: Process orchestrator config templates, output in openshift files dir
      template:
        src: "openshift/configs/{{ item }}.j2"
        dest: "{{ openshift_files }}/{{ item }}"
      loop:
        - reactor-config-map.yaml
        - client-config-secret.conf

    - name: Create reactor-config-map in orchestrator namespace
      shell:
        set -o pipefail;
        oc create configmap reactor-config-map
          --from-file "config.yaml={{ openshift_files }}/reactor-config-map.yaml"
          --dry-run
          --output json |
        oc --namespace "{{ orchestrator_namespace }}" replace --force -f -
      changed_when: true

    - name: Create client-config-secret in orchestrator namespace
      shell:
        set -o pipefail;
        oc create secret generic client-config-secret
          --from-file "osbs.conf={{ openshift_files }}/client-config-secret.conf"
          --dry-run
          --output json |
        oc --namespace "{{ orchestrator_namespace }}" replace --force -f -
      changed_when: true

    - name: Add necessary roles to builder serviceaccounts
      command: oc --namespace "{{ item.0 }}" adm policy
                  add-role-to-user "{{ item.1 }}" -z builder
      changed_when: true
      loop:
        "{{ projects | product(roles) | list }}"
      vars:
        roles:
          - "edit"
          - "system:build-strategy-custom"


- name: Build OSBS buildroot
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - buildroot
    - openshift

  tasks:
    - name: Copy osbs-buildroot template to openshift files dir
      copy:
        src: openshift/templates/osbs-buildroot.yaml
        dest: "{{ openshift_files }}/osbs-buildroot.yaml"

    - name: Create openshift resources for osbs-buildroot
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/osbs-buildroot.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ orchestrator_namespace }}" apply -f -
      changed_when: true

    - name: Build osbs-buildroot
      command: oc --namespace "{{ orchestrator_namespace }}"
                  start-build osbs-buildroot
      changed_when: true