32a82ea039
* Switch from python-ironic-inspector-client to openstacksdk in ironic-inspector-rules. This allows us to use clouds.yaml to provide credentials. * Enable authentication in Bifrost. Passwords are auto-generated by Bifrost, and stored files in /root/.config/bifrost/. This change depends on a Kolla Ansible patch that ensures that these credentials are persisted between recreations of the bifrost container. * Copy clouds.yaml and (if present) a CA certificate from the Bifrost container to the seed host, under the Kayobe Ansible user (stack). This allows us to use the credentials to register introspection rules. * This patch is needed by a Kolla Ansible patch that enables TLS in Bifrost, since we need the CA certificate on the host to register introspection rules when TLS is enabled. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/851837 Needed-By: https://review.opendev.org/c/openstack/kolla-ansible/+/851838 Story: 2010206 Task: 45930 Change-Id: I757f1bb72afb01a4f1689bed292f5b71b9048fa0
17 lines
724 B
YAML
17 lines
724 B
YAML
---
|
|
- name: Ensure introspection rules exist
|
|
vars:
|
|
ansible_python_interpreter: "{{ ironic_inspector_venv }}/bin/python"
|
|
os_ironic_inspector_rule:
|
|
auth_type: "{{ ironic_inspector_auth_type }}"
|
|
auth: "{{ ironic_inspector_auth }}"
|
|
cacert: "{{ ironic_inspector_cacert | default(omit, true) }}"
|
|
cloud: "{{ ironic_inspector_cloud | default(omit, true) }}"
|
|
interface: "{{ ironic_inspector_interface | default(omit, true) }}"
|
|
conditions: "{{ item.conditions }}"
|
|
actions: "{{ item.actions }}"
|
|
description: "{{ item.description | default(omit) }}"
|
|
uuid: "{{ item.uuid | default(item.description | to_uuid) | default(omit) }}"
|
|
state: present
|
|
with_items: "{{ ironic_inspector_rules }}"
|