ocplabs-ocp-nodes-post-setup.yaml

- hosts: localhost 
  vars:
    users:
      - name: admin
        password: 'redhat2018!'
      - name: developer
        password: 'redhat2018!'      
  tasks:
  - name: create_htpasswd_users | Create Users via htpasswd
    htpasswd:
      path: "/etc/origin/master/htpasswd"
      create: yes
      name: "{{item.name}}"
      password: "{{item.password}}"
      owner: root
      group: root
      mode: 0640
      state: present
    with_items: "{{ users }}"
- hosts: masters
  tasks:
  - name: setup_dnsmasq_apps | Setup dnsmasq for .apps.* domain
    copy:
      src: ocplabs-dnsmasq.conf
      dest: /etc/dnsmasq.d/ocplabs.conf
      owner: root
      group: root
      mode: 0640
  - name: setup_dnsmasq_apps | Stop dnsmasq
    systemd:
      name: dnsmasq
      state: stopped
  - name: setup_dnsmasq_apps | Start dnsmasq
    systemd:
      name: dnsmasq
      state: started
  - name: setup_firewall_dnsmasq | Setup firewall for DNS-Masq (TCP)
    iptables:
      chain: INPUT
      protocol: tcp
      destination_port: 53
      jump: ACCEPT
  - name: setup_firewall_dnsmasq | Setup firewall for DNS-Masq (UDP)
    iptables:
      chain: INPUT
      protocol: udp
      destination_port: 53
      jump: ACCEPT
  - name: setup_firewall_dnsmasq | Save firewall for DNS-Masq
    shell: iptables-save > /etc/sysconfig/iptables
  - name: copy_htpasswd | Copy htpasswd
    copy:
      src: /etc/origin/master/htpasswd
      dest: /etc/origin/master/htpasswd
      owner: root
      group: root
      mode: 0640
  - name: setup_ocp_admin_roles | Login as system:admin
    shell: oc login -u system:admin -n default --config=/etc/origin/master/admin.kubeconfig
  - name: setup_ocp_admin_roles | Setup Admin roles for OCP (registry)
    shell: oc adm policy add-role-to-user system:registry admin --config=/etc/origin/master/admin.kubeconfig
  - name: setup_ocp_admin_roles | Setup Admin roles for OCP (admin for openshift namespace) 
    shell: oc adm policy add-role-to-user admin admin -n openshift --config=/etc/origin/master/admin.kubeconfig
  - name: setup_ocp_admin_roles | Setup Admin roles for OCP (image-builder)
    shell: oc adm policy add-role-to-user system:image-builder admin --config=/etc/origin/master/admin.kubeconfig
  - name: setup_ocp_admin_roles | Setup Admin roles for OCP (cluster-admin)
    shell: oc adm policy add-cluster-role-to-user cluster-admin admin --config=/etc/origin/master/admin.kubeconfig
  - name: update_image_streams | Update Image Streams
    shell: oc get is -n openshift --no-headers=true | awk '{print $1}' | xargs -I{} oc import-image {} -n openshift --all --insecure=true
    register: import_image_result
    until: import_image_result.rc == 0
    retries: 10
    delay: 1
    ignore_errors: yes
  - name: metrics_viewer | Create service account
    shell: oc create sa metrics-deployer -n openshift-infra --insecure-skip-tls-verify=true --config=/etc/origin/master/admin.kubeconfig
  - name: metrics_viewer | Add edit role
    shell: oc adm policy add-role-to-user edit system:serviceaccount:openshift-infra:metrics-deployer --insecure-skip-tls-verify=true --config=/etc/origin/master/admin.kubeconfig
  - name: metrics_viewer | Add cluster role
    shell: oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:openshift-infra:heapster --insecure-skip-tls-verify=true --config=/etc/origin/master/admin.kubeconfig
- hosts: masters:nodes
  tasks:
  - name: create_symlink_directory | Create directy for certificate symlink, workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1553838
    file:
      path: /etc/docker/certs.d/docker-registry.default.svc:5000
      state: directory
      recurse: yes
  - name: create_symlink | Create certificate symlink, workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1553838
    file:
      src: /etc/origin/node/client-ca.crt
      dest: /etc/docker/certs.d/docker-registry.default.svc:5000/node-client-ca.crt
      state: link