Skip to content

Commit

Permalink
[tmp] Skip setting up registry access temperarily
Browse files Browse the repository at this point in the history
We're installing bundles from the local registry, which does't require credentials to be set-up.
since the tags can't be skipped from import_role, the tasks have been temperorily removed.

Eventually, the configure credentials tasks will be separated into a different tasks and disabled with a var
so they can be skipped if we're deploying bundles from a local registry, from a zuul content provider registry,
or if the registry access is already configured (e.g. by zuul) or configuration is not required
  • Loading branch information
elfiesmelfie committed Jun 29, 2023
1 parent c432e8c commit 74b2eb0
Showing 1 changed file with 85 additions and 84 deletions.
169 changes: 85 additions & 84 deletions build/stf-run-ci/tasks/setup_stf_from_bundles.yml
Original file line number Diff line number Diff line change
@@ -1,87 +1,88 @@
- block:
- name: Get existing Pull Secret from openshift config
k8s_info:
api_version: v1
kind: Secret
namespace: openshift-config
name: pull-secret
register: pull_secret

- debug:
msg: "{{ pull_secret }}"

- name: Decode docker config json
set_fact:
dockerconfigjson: "{{ pull_secret.resources[0].data['.dockerconfigjson'] | b64decode }}"

- name: Merge registry creds into auth section of docker config
set_fact:
new_dockerauths: "{{ dockerconfigjson['auths'] | default({}) | combine( {
pull_secret_registry:{
'auth': (pull_secret_user ~ ':' ~ pull_secret_pass) | b64encode
}
}) }}"

- name: Create new docker config
set_fact:
new_dockerconfigjson: "{{ dockerconfigjson | combine({'auths': new_dockerauths}) }}"

- name: Create Pull Secret for bundle registry access (in the local namespace)
k8s:
state: present
definition:
apiVersion: v1
kind: Secret
type: kubernetes.io/dockerconfigjson
metadata:
name: pull-secret
namespace: "{{ namespace }}"
data:
.dockerconfigjson: "{{ new_dockerconfigjson | tojson | b64encode }}"

- name: Create Pull Secret for bundle registry access (in the global namespace)
k8s:
state: present
definition:
apiVersion: v1
kind: Secret
type: kubernetes.io/dockerconfigjson
metadata:
name: pull-secret
namespace: openshift-config
data:
.dockerconfigjson: "{{ new_dockerconfigjson | tojson | b64encode }}"

tags:
- bundle_registry_auth

- name: Create registry CA Cert
k8s:
state: present
definition:
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: registry-tls-ca
namespace: "{{ namespace }}"
data:
cert.pem: "{{ lookup('file', 'CA.pem') | b64encode }}"
tags:
- bundle_registry_tls_ca

- name: Patch the default service account to use our pull secret
kubernetes.core.k8s_json_patch:
kind: ServiceAccount
namespace: "{{ namespace }}"
name: default
patch:
- op: add
path: /imagePullSecrets
value:
- name: pull-secret
tags:
- bundle_registry_tls_ca
## This block is run with the tag bundle_registry_auth, when is that needed?
#- block:
# - name: Get existing Pull Secret from openshift config
# k8s_info:
# api_version: v1
# kind: Secret
# namespace: openshift-config
# name: pull-secret
# register: pull_secret
#
# - debug:
# msg: "{{ pull_secret }}"
#
# - name: Decode docker config json
# set_fact:
# dockerconfigjson: "{{ pull_secret.resources[0].data['.dockerconfigjson'] | b64decode }}"
#
# - name: Merge registry creds into auth section of docker config
# set_fact:
# new_dockerauths: "{{ dockerconfigjson['auths'] | default({}) | combine( {
# pull_secret_registry:{
# 'auth': (pull_secret_user ~ ':' ~ pull_secret_pass) | b64encode
# }
# }) }}"
#
# - name: Create new docker config
# set_fact:
# new_dockerconfigjson: "{{ dockerconfigjson | combine({'auths': new_dockerauths}) }}"
#
# - name: Create Pull Secret for bundle registry access (in the local namespace)
# k8s:
# state: present
# definition:
# apiVersion: v1
# kind: Secret
# type: kubernetes.io/dockerconfigjson
# metadata:
# name: pull-secret
# namespace: "{{ namespace }}"
# data:
# .dockerconfigjson: "{{ new_dockerconfigjson | tojson | b64encode }}"
#
# - name: Create Pull Secret for bundle registry access (in the global namespace)
# k8s:
# state: present
# definition:
# apiVersion: v1
# kind: Secret
# type: kubernetes.io/dockerconfigjson
# metadata:
# name: pull-secret
# namespace: openshift-config
# data:
# .dockerconfigjson: "{{ new_dockerconfigjson | tojson | b64encode }}"
#
# tags:
# - bundle_registry_auth
#
#- name: Create registry CA Cert
# k8s:
# state: present
# definition:
# apiVersion: v1
# kind: Secret
# type: Opaque
# metadata:
# name: registry-tls-ca
# namespace: "{{ namespace }}"
# data:
# cert.pem: "{{ lookup('file', 'CA.pem') | b64encode }}"
# tags:
# - bundle_registry_tls_ca
#
#- name: Patch the default service account to use our pull secret
# kubernetes.core.k8s_json_patch:
# kind: ServiceAccount
# namespace: "{{ namespace }}"
# name: default
# patch:
# - op: add
# path: /imagePullSecrets
# value:
# - name: pull-secret
# tags:
# - bundle_registry_tls_ca

- name: Deploy SGO via OLM bundle
shell:
Expand Down

0 comments on commit 74b2eb0

Please sign in to comment.