Create an APB for the automation broker deployment #1

djzager · 2018-04-02T15:58:08Z

No description provided.

djzager · 2018-04-02T15:58:42Z

templates/broker-auth.clusterrole.yaml

+    resources: ["networkpolicies"]
+    verbs: ["create", "delete"]
+  - apiGroups: ["automationbroker.io"]
+    # attributeRestrictions: null


These aren't actually supported in the python-client. What happens if we don't specifically set them to null?

I don't think anything happens

- Only create the broker auth secret if basic auth is enabled - Flatten the variables in defaults to make it easy for a user to modify them - Use jinja templating more heavily in configmap - Push crd logic into it's own tasks file - Push variables the user shouldn't touch into vars/

djzager · 2018-04-04T19:00:31Z

templates/broker-auth.secret.yaml

+  name: {{ broker_name }}-auth-secret
+  namespace: {{ broker_namespace }}
+data:
+  username: {{ broker_basic_auth_username | b64encode }}


I figured @fabianvf would appreciate this.

djzager · 2018-04-06T17:18:10Z

Example run, in OpenShift:

docker run --rm --net=host -v $HOME/.kube:/opt/apb/.kube:z -u $UID \
docker.io/djzager/automation-broker-apb \
provision \
-e 'cluster=openshift' \
-e 'create_broker_namespace=true' \
-e 'broker_helm_enabled=true'

dymurray

Ran into an error testing with the readme instructions.

TASK [automation-broker-apb : Set broker deployment object state=present] ******
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Error parsing resource definition. Encountered spec_selector_app, which does not map to a parameter expected by the OpenShift Python module."}
        to retry, use: --limit @/opt/apb/actions/provision.retry

PLAY RECAP *********************************************************************

dymurray · 2018-04-06T17:39:06Z

README.md

+$ kubectl create namespace automation-broker
+$ kubectl create serviceaccount automation-broker-apb --namespace automation-broker
+$ kubectl create clusterrolebinding automation-broker-apb --clusterrole=cluster-admin --serviceaccount=automation-broker:automation-broker-apb
+$ kubectl run automation-broker-apb \


These commands worked with oc 👍

dymurray · 2018-04-06T18:07:53Z

Ah... my error was probably because I didn't set the cluster var. Retrying.

dymurray · 2018-04-06T18:25:04Z

changed: [localhost] => (item=broker.configmap.yaml)
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: TypeError: __init__() got an unexpected keyword argument 'apiGroups'
failed: [localhost] (item=broker-auth.clusterrole.yaml) => {"changed": false, "item": "broker-auth.clusterrole.yaml", "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_0SKNA_/ansible_module_k8s_raw.py\", line 163, in <module>\n    main()\n  File \"/tmp/ansible_0SKNA_/ansible_module_k8s_raw.py\", line 159, in main\n    KubernetesRawModule().execute_module()\n  File \"/tmp/ansible_0SKNA_/ansible_modlib.zip/ansible/module_utils/k8s/raw.py\", line 142, in execute_module\n  File \"/tmp/ansible_0SKNA_/ansible_modlib.zip/ansible/module_utils/k8s/helper.py\", line 136, in object_from_params\n  File \"/tmp/ansible_0SKNA_/ansible_modlib.zip/ansible/module_utils/k8s/helper.py\", line 293, in __set_obj_attribute\n  File \"/tmp/ansible_0SKNA_/ansible_modlib.zip/ansible/module_utils/k8s/helper.py\", line 483, in __compare_obj_list\nTypeError: __init__() got an unexpected keyword argument 'apiGroups'\n", "module_stdout": "", "msg": "MODULE FAILURE", "rc": 1}

djzager · 2018-04-06T20:42:33Z

There are a few issues with k8s that I need to work through. Specifically, creating the tls stuff.

djzager · 2018-04-09T20:34:50Z

@dymurray I think this is cleaned up. Let me know if you have any more issues. @rthallisey if you could have a look at this from the k8s perspective that would be really helpful.

rthallisey · 2018-04-10T19:32:22Z

tasks/kubernetes.yaml

+    -out /tmp/{{ broker_name }}-cert/cert.pem
+    -days 365
+    -subj "/CN={{ broker_name }}.{{ broker_name }}.svc"
+  when: cluster == 'kubernetes' and apb_action == 'provision'


fabianvf · 2018-04-10T20:33:59Z

tasks/kubernetes.yaml

+  file:
+    path: /tmp/{{ broker_name }}-cert
+    state: directory
+  when: cluster == 'kubernetes' and apb_action == 'provision'


I think it's cleaner to encapsulate tasks that share a condition in a block or import task. Also prevents you from missing a conditional update somewhere if something changes.

Yeah. I can definitely improve this file and the OpenShift file to encapsulate better.

I believe I fixed it with the latest commit @fabianvf let me know what you think.

fabianvf · 2018-04-11T16:56:26Z

tasks/generate_certificate.yaml

+            resource_name=broker_name + '-client'
+            ) | json_query('secrets') | first | json_query('name')
+        }}"
+  when: cluster == 'kubernetes'


not to nitpick, but for large blocks like these I like to put the when at the top (like after name), because the whitespace can be kind of hard to parse.

fabianvf · 2018-04-11T16:56:48Z

tasks/generate_certificate.yaml

+#    privatekey_path: /tmp/{{ broker_name }}-cert/key.pem
+#    subject: "/CN={{ broker_name }}.{{ broker_name }}.svc"
+#    provider: selfsigned
+- name: 'Create OpenSSL Cert for Broker'


just FYI I don't think the task name is displayed in the output for blocks.

That's what I get for trusting the example 😎 http://docs.ansible.com/ansible/latest/user_guide/playbooks_blocks.html#id1

fabianvf · 2018-04-11T16:58:13Z

templates/bundle.crd.yaml

@@ -0,0 +1,155 @@
+---


Since this isn't a template it might make more sense to put it in files/

fabianvf

Added some stylistic comments, but none of them are blockers or even very important.

Create an APB for the automation broker deployment

d609645

djzager commented Apr 2, 2018

View reviewed changes

djzager added 7 commits April 2, 2018 16:10

Add broker certificate authority for catalog

6e5ced8

Add custom resource definitions

65414e9

Fix broker configmap

d70c30b

Documentation and cleanup

04f3f36

Move helm runner away from private image

39c3583

Add a makefile

8a872ba

This was referenced Apr 4, 2018

APB should support etcd #2

Open

APB should support multiple registries of each type #3

Open

Add issue links

5837b92

djzager changed the title ~~[wip] Create an APB for the automation broker deployment~~ Create an APB for the automation broker deployment Apr 4, 2018

djzager commented Apr 4, 2018

View reviewed changes

djzager added 2 commits April 6, 2018 12:41

Optionally create namespace and wait for deployment to succeed

e32a368

Add the lookup queries for deployments

4307d23

dymurray reviewed Apr 6, 2018

View reviewed changes

djzager added 3 commits April 6, 2018 15:04

Only fail for servicecatalog on provision

69548de

Add an apb.yml, it's the right thing to do

336da3a

Waiting for deployment is too much trouble

904ddf4

Support kubernetes deployment

7511974

rthallisey reviewed Apr 10, 2018

View reviewed changes

rthallisey approved these changes Apr 10, 2018

View reviewed changes

fabianvf reviewed Apr 10, 2018

View reviewed changes

Clean up cert creation

87c7539

fabianvf reviewed Apr 11, 2018

View reviewed changes

templates/bundle.crd.yaml Outdated

@@ -0,0 +1,155 @@

---

Copy link

fabianvf Apr 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this isn't a template it might make more sense to put it in files/

fabianvf approved these changes Apr 11, 2018

View reviewed changes

Move non-templates to files. Cleanup blocks

d6fecd4

dymurray approved these changes Apr 11, 2018

View reviewed changes

djzager mentioned this pull request Apr 11, 2018

initial commit ansibleplaybookbundle/helm-ansible-base#1

Open

djzager merged commit b2f9d42 into automationbroker:master Apr 11, 2018

Create an APB for the automation broker deployment #1

Create an APB for the automation broker deployment #1

djzager commented Apr 2, 2018

djzager Apr 2, 2018

fabianvf Apr 11, 2018

djzager Apr 4, 2018

djzager commented Apr 6, 2018

dymurray left a comment

dymurray Apr 6, 2018

dymurray commented Apr 6, 2018

dymurray commented Apr 6, 2018

djzager commented Apr 6, 2018

djzager commented Apr 9, 2018

rthallisey Apr 10, 2018

fabianvf Apr 10, 2018

djzager Apr 11, 2018

djzager Apr 11, 2018

fabianvf Apr 11, 2018

fabianvf Apr 11, 2018

djzager Apr 11, 2018

fabianvf Apr 11, 2018

fabianvf left a comment

Create an APB for the automation broker deployment #1

Create an APB for the automation broker deployment #1

Conversation

djzager commented Apr 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

djzager commented Apr 6, 2018

dymurray left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dymurray commented Apr 6, 2018

dymurray commented Apr 6, 2018

djzager commented Apr 6, 2018

djzager commented Apr 9, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabianvf left a comment

Choose a reason for hiding this comment