010_add_default_admin_user.yaml

- name: Create admin with cluster admin privileges
  hosts: bastion
  gather_facts: no
  remote_user: root
  tasks:
    
    - name: Ensuring httpd-tools is present
      package:
        name: httpd-tools
        state: present
      become: true

    - name: Ensuring passlib is present
      pip:
        name: 
          - passlib
          - bcrypt
      become: true
      

    - name: Creating yaml configuration for htpasswd identity provider
      template:
        src: ../templates/htpasswd_provider.j2
        dest: "/root/install/htpasswd_provider.yaml"

    - template:
        src: ../templates/ocp_user_script.j2
        dest: /tmp/ocp_user.sh
        mode: +x
        
    - name: Creating oauth login url var
      set_fact:
        auth_url: oauth-openshift.apps.{{ ocp.cluster_name }}.{{ networking.domain_name }}
                
    #https://unix.stackexchange.com/questions/368123/how-to-extract-the-root-ca-and-subordinate-ca-from-a-certificate-chain-in-linux
    - name: Getting router certificates chain
      shell: >
                openssl s_client -showcerts -servername {{ auth_url }} 
                -connect {{ auth_url }}:443 < /dev/null 
                2>/dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="/tmp/cert"a".pem"; print >out}'
      
    - shell: cat /tmp/cert1.pem /tmp/cert2.pem > /tmp/login.pem
    
    - name: Copying certificate to trusted certificate directory
      copy:
        src: /tmp/login.pem
        dest: /etc/pki/ca-trust/source/anchors/login.pem
        remote_src: yes
      become: true

    - name: Trusting router certificate
      command: update-ca-trust  
      become: true

 
      
    - name: Creating htpasswd identiry and user
      command: /tmp/ocp_user.sh

    - name: Sleeping 30 seconds...
      command: sleep 30

    - name: Try to login with admin
      command: > 
               /usr/bin/oc login -u {{ ocp.user }} -p {{ ocp.pass }} 
               https://api.{{ ocp.cluster_name }}.{{ networking.domain_name }}:6443 --kubeconfig /root/install/auth/kubeconfig
      retries: 30
      register: command
      until: command.rc == 0