kayobe/ansible/kayobe-ansible-user.yml

104 lines
3.5 KiB
YAML

---
# NOTE(mgoddard): The bootstrap user may be used to create the kayobe user
# account and configure passwordless sudo. We can't assume that the bootstrap
# user account will exist after the initial bootstrapping, or that the
# current operator's key is authorised for the bootstrap user. We therefore
# attempt to access the kayobe user account via SSH, and only perform the
# bootstrap process if the account is inaccessible.
- name: Determine whether user bootstrapping is required
hosts: seed-hypervisor:seed:overcloud:infra-vms
gather_facts: false
tags:
- kayobe-ansible-user
tasks:
- name: Check whether the host is accessible via SSH
raw: hostname
ignore_unreachable: true
changed_when: false
check_mode: no
register: ssh_result
- name: Group hosts requiring kayobe user bootstrapping
group_by:
key: kayobe_user_bootstrap_required_{{ ssh_result.unreachable | default(false) }}
changed_when: false
- name: Display a message when bootstrapping is required
debug:
msg: >
Cannot access host via SSH using Kayobe Ansible user account -
attempting bootstrap
when: ssh_result.unreachable | default(false)
- name: Ensure python is installed
hosts: kayobe_user_bootstrap_required_True
gather_facts: no
vars:
ansible_user: "{{ bootstrap_user }}"
dnf_options:
- "-y"
- "{% if 'proxy' in dnf_config %}--setopt=proxy={{ dnf_config['proxy'] }}{% endif %}"
tags:
- ensure-python
tasks:
- name: Check if python is installed
raw: test -e /usr/bin/python3
changed_when: false
failed_when: false
register: check_python
# TODO(priteau): Support apt proxy
- name: Ensure python is installed
raw: "test -e /usr/bin/apt && (sudo apt -y update && sudo apt install -y python3-minimal) || (sudo dnf {{ dnf_options | select | join(' ') }} install python3)"
when: check_python.rc != 0
- name: Ensure the Kayobe Ansible user account exists
hosts: kayobe_user_bootstrap_required_True
gather_facts: false
tags:
- kayobe-ansible-user
vars:
ansible_user: "{{ bootstrap_user }}"
# We can't assume that a virtualenv exists at this point, so use the system
# python interpreter.
ansible_python_interpreter: /usr/bin/python3
roles:
- role: singleplatform-eng.users
groups_to_create: "{{ [{'name': 'docker'}] if 'docker' in group_names else [] }}"
users:
- username: "{{ kayobe_ansible_user }}"
name: Kayobe deployment user
groups: "{{ ['docker'] if 'docker' in group_names else [] }}"
append: True
ssh_key:
- "{{ lookup('file', ssh_public_key_path) }}"
become: True
post_tasks:
- name: Ensure the Kayobe Ansible user has passwordless sudo
copy:
content: "{{ kayobe_ansible_user }} ALL=(ALL) NOPASSWD: ALL"
dest: "/etc/sudoers.d/kayobe-ansible-user"
mode: 0440
become: True
- name: Verify that the Kayobe Ansible user account is accessible
hosts: seed-hypervisor:seed:overcloud:infra-vms
gather_facts: false
tags:
- kayobe-ansible-user
vars:
# We can't assume that a virtualenv exists at this point, so use the system
# python interpreter.
ansible_python_interpreter: /usr/bin/python3
tasks:
- name: Verify that a command can be executed
command: hostname
changed_when: false
- name: Verify that a command can be executed with become
command: hostname
changed_when: false
become: true