generated from linux-system-roles/template
-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: support podman_credential_files
Feature: The parameter podman_credential_files is used to provide containers-auth.json files which allow authentication to registries. See README.md for more infomation. Reason: Users need a way to provide credential files for authenticating to private registries. Some operations may need to pull images from registries in an automated or unattended way, and cannot use `registry_username` and `registry_password`. Result: Users can provide registry credentials for automated and unattended operations. QE: The file tests_auth_and_security.yml has been extended to test this feature. Signed-off-by: Rich Megginson <[email protected]>
- Loading branch information
Showing
6 changed files
with
254 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| # SPDX-License-Identifier: MIT | ||
| --- | ||
| - name: Set user and group | ||
| set_fact: | ||
| __podman_credential_user: "{{ __podman_credential_item['run_as_user'] | ||
| if 'run_as_user' in __podman_credential_item else podman_run_as_user }}" | ||
| __podman_credential_group: "{{ __podman_credential_item['run_as_group'] | ||
| if 'run_as_group' in __podman_credential_item else podman_run_as_group }}" | ||
|
|
||
| # NOTE: Sets __podman_group that we use below | ||
| - name: Check user and group information | ||
| include_tasks: handle_user_group.yml | ||
| vars: | ||
| __podman_user: "{{ __podman_credential_user }}" | ||
| __podman_spec_item: "{{ __podman_credential_item }}" | ||
|
|
||
| - name: Set credential variables | ||
| set_fact: | ||
| __podman_credential_str: "{{ __podman_credential_item['file_content'] | ||
| if 'file_content' in __podman_credential_item | ||
| else lookup('template', __podman_credential_item['template_src']) | ||
| if 'template_src' in __podman_credential_item | ||
| else none }}" | ||
| __podman_credential_file_src: "{{ __podman_credential_item['file_src'] | ||
| if 'file_src' in __podman_credential_item | ||
| else none }}" | ||
| __podman_credential_file: "{{ __authdir ~ 'auth.json' | ||
| if not 'file' in __podman_credential_item | ||
| else __authdir ~ __podman_credential_item['file'] | ||
| if not __podman_credential_item['file'] is abs | ||
| else __podman_credential_item['file'] }}" | ||
| __podman_credential_mode: "{{ __podman_credential_item['mode'] | ||
| if 'mode' in __podman_credential_item else '0600' }}" | ||
| __podman_credential_state: "{{ __podman_credential_item['state'] | ||
| if 'state' in __podman_credential_item else 'present' }}" | ||
| vars: | ||
| __authdir: "{{ | ||
| ansible_facts['getent_passwd'][__podman_credential_user][4] ~ | ||
| '/.config/containers/' }}" | ||
| no_log: true | ||
|
|
||
| - name: Handle state present | ||
| when: __podman_credential_state == "present" | ||
| block: | ||
| - name: Ensure the credentials directory is present | ||
| file: | ||
| path: "{{ __podman_credential_file | dirname }}" | ||
| state: directory | ||
| owner: "{{ __podman_credential_user }}" | ||
| group: "{{ __podman_group }}" | ||
| mode: "0700" | ||
|
|
||
| - name: Ensure credential file is copied | ||
| copy: | ||
| src: "{{ __podman_credential_file_src }}" | ||
| dest: "{{ __podman_credential_file }}" | ||
| owner: "{{ __podman_credential_user }}" | ||
| group: "{{ __podman_group }}" | ||
| mode: "{{ __podman_credential_mode }}" | ||
| when: __podman_credential_file_src | length > 0 | ||
| no_log: true | ||
|
|
||
| - name: Ensure credential file content is present | ||
| copy: | ||
| content: "{{ __podman_credential_str }}" | ||
| dest: "{{ __podman_credential_file }}" | ||
| owner: "{{ __podman_credential_user }}" | ||
| group: "{{ __podman_group }}" | ||
| mode: "{{ __podman_credential_mode }}" | ||
| when: | ||
| - __podman_credential_str | length > 0 | ||
| - not __podman_credential_file_src | ||
| no_log: true | ||
|
|
||
| - name: Handle state absent | ||
| when: __podman_credential_state == "absent" | ||
| block: | ||
| - name: Ensure credential file is absent | ||
| file: | ||
| path: "{{ __podman_credential_file }}" | ||
| state: absent | ||
| no_log: true | ||
|
|
||
| - name: Find files in credentials directory | ||
| find: | ||
| path: "{{ __podman_credential_file | dirname }}" | ||
| file_type: any | ||
| hidden: true | ||
| register: __credential_dir_files | ||
| no_log: true | ||
|
|
||
| - name: Ensure the credentials directory is absent if empty | ||
| file: | ||
| path: "{{ __podman_credential_file | dirname }}" | ||
| state: absent | ||
| when: __credential_dir_files.matched == 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters