Enable IAM roles for EC2s in AWS #10224

mazzystr · 2018-09-25T14:51:28Z

Enable IAM roles for EC2s in AWS. Iam roles are now created during prerequisites play. Build_node_group moved away iam role creation to iam role query. Ec2 and Auto Scale Group instance_profile keys updated to suit.

Set openshift_aws_create_iam_role: True
Update openshift_aws_master_instance_config, openshift_aws_node_group_config, openshift_aws_launch_config_iam_roles as needed.
Execute the following plays...

ansible-playbook -i hosts openshift-cluster/prerequisites.yml -e @provisioning_vars.yml
ansible-playbook -i hosts openshift-cluster/provision_install.yml -e @provisioning_vars.yml

Resolves Bugzilla 1630319 and 1632843

mazzystr · 2018-09-25T14:56:04Z

Prerequisites

PLAY [Create iam role] ******************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [localhost]

TASK [include_role : openshift_aws] *****************************************************************************************************

TASK [openshift_aws : Create an iam role] ***********************************************************************************************
changed: [localhost] => (item=master)
changed: [localhost] => (item=compute)
changed: [localhost] => (item=infra)

TASK [openshift_aws : create an iam policy] *********************************************************************************************
changed: [localhost] => (item=master)
changed: [localhost] => (item=compute)
changed: [localhost] => (item=infra)

Provision_install (masters)

.....
TASK [openshift_aws : fetch the iam role] ***********************************************************************************************
ok: [localhost]

TASK [openshift_aws : create instance(s)] ***********************************************************************************************
changed: [localhost] => (item=subnet-090cc29c98a4208dd)
.....

Provision_install (compute)

.....
TASK [openshift_aws : fetch the iam role] ***********************************************************************************************
ok: [localhost]

TASK [openshift_aws : Set scale group instances autonaming] *****************************************************************************
skipping: [localhost]

TASK [openshift_aws : include_tasks] ****************************************************************************************************
included: /home/ccallega/git/openshift-ansible/roles/openshift_aws/tasks/launch_config.yml for localhost

TASK [openshift_aws : fetch the security groups for launch config] **********************************************************************
ok: [localhost]

TASK [openshift_aws : fail] *************************************************************************************************************
skipping: [localhost]

TASK [openshift_aws : Create the node scale group launch config] ************************************************************************
changed: [localhost]
.....

Provision_install (infra)

.....
TASK [openshift_aws : fetch the iam role] ***********************************************************************************************
ok: [localhost]

TASK [openshift_aws : Set scale group instances autonaming] *****************************************************************************
skipping: [localhost]

TASK [openshift_aws : include_tasks] ****************************************************************************************************
included: /home/ccallega/git/openshift-ansible/roles/openshift_aws/tasks/launch_config.yml for localhost

TASK [openshift_aws : fetch the security groups for launch config] **********************************************************************
ok: [localhost]

TASK [openshift_aws : fail] *************************************************************************************************************
skipping: [localhost]

TASK [openshift_aws : Create the node scale group launch config] ************************************************************************
changed: [localhost]
.....

michaelgugino · 2018-09-25T15:03:25Z

roles/openshift_aws/defaults/main.yml

-  iam_role: "{{ openshift_aws_iam_master_role_name | default(openshift_aws_iam_role_name) }}"
-  policy_name: "{{ openshift_aws_iam_master_role_policy_name | default(openshift_aws_iam_role_policy_name) }}"
-  policy_json: "{{ openshift_aws_iam_master_role_policy_json | default(openshift_aws_iam_role_policy_json) }}"
+  iam_role: "{{ openshift_aws_launch_config_iam_roles['master'].name  | default(openshift_aws_iam_role_name) }}"


Remove default from these.

michaelgugino · 2018-09-25T15:04:24Z

roles/openshift_aws/defaults/main.yml

@@ -333,6 +327,20 @@ openshift_aws_launch_config_security_groups:
  - "{{ openshift_aws_clusterid }}_infra"  # node type sg
  - "{{ openshift_aws_clusterid }}_infra_k8s"  # node type sg k8s

+openshift_aws_launch_config_iam_roles:
+  master:
+    name: "{{ openshift_aws_clusterid }}-iam_master"


name: "{{ openshift_aws_iam_master_role_name | default(openshift_aws_clusterid ~ '-iam_master') }}"

Do this for the others as well.

michaelgugino

/lgtm

openshift-ci-robot · 2018-09-25T16:00:56Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mazzystr, michaelgugino

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~playbooks/aws/OWNERS~~ [michaelgugino]
~~roles/openshift_aws/OWNERS~~ [michaelgugino]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2018-09-25T18:56:20Z

/retest

Please review the full test history for this PR and help us cut down flakes.

mwoodson · 2018-10-19T21:45:50Z

/cherrypick release-3.11

sdodson · 2018-10-22T17:41:33Z

/cherrypick release-3.11

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 25, 2018

openshift-ci-robot requested review from michaelgugino and sdodson September 25, 2018 14:51

michaelgugino suggested changes Sep 25, 2018

View reviewed changes

mazzystr force-pushed the use_iam_roles branch from 71422d2 to 646d0da Compare September 25, 2018 15:36

mazzystr mentioned this pull request Sep 25, 2018

openshift_aws: added iam_role support for provisioning masters #10201

Closed

Enable IAM roles for EC2s in AWS

13732b1

mazzystr force-pushed the use_iam_roles branch from eacec89 to 13732b1 Compare September 25, 2018 15:56

michaelgugino approved these changes Sep 25, 2018

View reviewed changes

openshift-ci-robot assigned michaelgugino Sep 25, 2018

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 25, 2018

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 25, 2018

openshift-merge-robot merged commit ca962ff into openshift:master Sep 25, 2018

mwoodson mentioned this pull request Oct 22, 2018

cherry-picking openshift-aws code that is in master into release-3.11. #10474

Merged

Enable IAM roles for EC2s in AWS #10224

Enable IAM roles for EC2s in AWS #10224

mazzystr commented Sep 25, 2018 •

edited

mazzystr commented Sep 25, 2018

michaelgugino Sep 25, 2018

michaelgugino Sep 25, 2018

michaelgugino left a comment

openshift-ci-robot commented Sep 25, 2018

openshift-bot commented Sep 25, 2018

mwoodson commented Oct 19, 2018

sdodson commented Oct 22, 2018

Enable IAM roles for EC2s in AWS #10224

Enable IAM roles for EC2s in AWS #10224

Conversation

mazzystr commented Sep 25, 2018 • edited

mazzystr commented Sep 25, 2018

Prerequisites

Provision_install (masters)

Provision_install (compute)

Provision_install (infra)

michaelgugino Sep 25, 2018

Choose a reason for hiding this comment

michaelgugino Sep 25, 2018

Choose a reason for hiding this comment

michaelgugino left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Sep 25, 2018

openshift-bot commented Sep 25, 2018

mwoodson commented Oct 19, 2018

sdodson commented Oct 22, 2018

mazzystr commented Sep 25, 2018 •

edited