run_openstack_setup.yml

---
# Copyright Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

- name: Link kubeconfg for comparability
  ansible.builtin.copy:
    src: "{{ ansible_user_dir }}/.crc/machines/crc/kubeconfig"
    dest: "{{ ansible_user_dir }}/.kube/config"
    mode: "0640"
  when: cifmw_federation_deploy_type == "crc"

- name: Check if federation domain already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack domain show {{ cifmw_federation_keystone_domain }} -f value -c id
  register: _federation_domain_check
  failed_when: false
  changed_when: false

- name: Run federation create domain
  when: _federation_domain_check.rc != 0
  vars:
    _osp_cmd: "openstack domain create {{ cifmw_federation_keystone_domain }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml

- name: Check if federation identity provider already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack identity provider show {{ cifmw_federation_IdpName }} -f value -c id
  register: _federation_idp_check
  failed_when: false
  changed_when: false

- name: Run federation identity provider create
  when: _federation_idp_check.rc != 0
  vars:
    _osp_cmd: "openstack identity provider create
      --remote-id {{ cifmw_federation_remote_id }}
      --domain {{ cifmw_federation_keystone_domain }}
      {{ cifmw_federation_IdpName }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml

- name: Read federation rules json template
  ansible.builtin.template:
    src: rules.json.j2
    dest: "{{ [ ansible_user_dir, 'ci-framework-data', 'tmp', cifmw_federation_rules_file ] | path_join }}"
    mode: "0644"

- name: Copy federation rules json file into pod
  kubernetes.core.k8s_cp:
    namespace: "{{ cifmw_federation_run_osp_cmd_namespace }}"
    pod: openstackclient
    remote_path: "/home/cloud-admin/{{ cifmw_federation_rules_file }}"
    local_path: "{{ [ ansible_user_dir, 'ci-framework-data', 'tmp', cifmw_federation_rules_file ] | path_join }}"

- name: Check if federation group already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack group show --domain {{ cifmw_federation_keystone_domain }}
      {{ cifmw_federation_group_name }} -f value -c id
  register: _federation_group_check
  failed_when: false
  changed_when: false

- name: Run federation group create
  when: _federation_group_check.rc != 0
  vars:
    _osp_cmd: "openstack group create
      --domain {{ cifmw_federation_keystone_domain }}
      {{ cifmw_federation_group_name }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml

- name: Check if federation project already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack project show --domain {{ cifmw_federation_keystone_domain }}
      {{ cifmw_federation_project_name }} -f value -c id
  register: _federation_project_check
  failed_when: false
  changed_when: false

- name: Run federation project create
  when: _federation_project_check.rc != 0
  vars:
    _osp_cmd: "openstack project create
      --domain {{ cifmw_federation_keystone_domain }}
      {{ cifmw_federation_project_name }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml

- name: Check if federation mapping already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack mapping show {{ cifmw_federation_mapping_name }} -f value -c id
  register: _federation_mapping_check
  failed_when: false
  changed_when: false

- name: Run federation mapping create
  when: _federation_mapping_check.rc != 0
  vars:
    _osp_cmd: "openstack mapping create
      --rules {{ cifmw_federation_rules_file }}
      {{ cifmw_federation_mapping_name }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml

- name: Run federation role add (safe to repeat - role add is idempotent)
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack role add
      --group {{ cifmw_federation_group_name }}
      --group-domain {{ cifmw_federation_keystone_domain }}
      --project {{ cifmw_federation_project_name }}
      --project-domain {{ cifmw_federation_keystone_domain }}
      member
  failed_when: false
  changed_when: true

- name: Check if federation protocol already exists
  environment:
    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
    PATH: "{{ cifmw_path }}"
  ansible.builtin.command:
    cmd: >-
      oc exec -n {{ cifmw_federation_run_osp_cmd_namespace }} -t openstackclient --
      openstack federation protocol show openid
      --identity-provider {{ cifmw_federation_IdpName }} -f value -c id
  register: _federation_protocol_check
  failed_when: false
  changed_when: false

- name: Run federation protocol create
  when: _federation_protocol_check.rc != 0
  vars:
    _osp_cmd: "openstack federation protocol create openid
      --mapping {{ cifmw_federation_mapping_name }}
      --identity-provider {{ cifmw_federation_IdpName }}"
  ansible.builtin.include_tasks: run_osp_cmd.yml