deploy.yaml

- name: Generate certificates for OSBS-Box
  hosts: osbs_box_host
  tags:
    - certificates

  tasks:
    - name: Make sure certificate directories exist
      file:
        path: "{{ item }}"
        state: directory
      loop:
        - "{{ certificates_dir }}"
        - "{{ koji_certs_dir }}"
        - "{{ registry_certs_dir }}"
        - "{{ cachito_certs_dir }}"

    - name: Generate certificates
      include_tasks: tasks/generate-certs.yaml


- name: Prepare for deployment of openshift applications
  hosts: osbs_box_host
  tags:
    - koji
    - cachito
    - registry
    - namespaces
    - buildroot
    # One tag for all openshift applications
    - openshift

  tasks:
    - name: Login as openshift admin
      command: oc login -u system:admin
      changed_when: true

    - name: Make "{{ openshift_user }}" an openshift cluster admin
      command: oc adm policy add-cluster-role-to-user
                  cluster-admin "{{ openshift_user }}"
      changed_when: true

    - name: Make sure directory for openshift files exists
      file:
        path: "{{ openshift_files }}"
        state: directory

    - name: Process parameters file and put it in openshift files dir
      template:
        src: openshift/params/osbs-box.env.j2
        dest: "{{ openshift_files }}/osbs-box.env"


- name: Run koji containers on openshift
  hosts: osbs_box_host
  gather_facts: false
  vars:
    # This is a constant, please do not override
    koji_components:
      - koji-volumes
      - koji-base
      - koji-client
      - koji-builder
      - koji-db
      - koji-hub
  tags:
    - koji
    - openshift

  tasks:
    - name: Create koji namespace in openshift
      command: oc create namespace "{{ koji_namespace }}"
      register: create_koji_namespace
      failed_when: create_koji_namespace.rc != 0
                   and "already exists" not in create_koji_namespace.stderr
      changed_when: create_koji_namespace.rc == 0

    - name: Create koji-certs secret in koji namespace
      shell:
        set -o pipefail;
        oc create secret generic koji-certs
            --from-file "{{ certificates_dir }}/osbs-box-ca.crt"
            --from-file "{{ koji_certs_dir }}/koji-hub.crt"
            --from-file "{{ koji_certs_dir }}/koji-hub.key"
            --from-file "{{ koji_certs_dir }}/kojiweb.pem"
            --from-file "{{ koji_certs_dir }}/kojibuilder.pem"
            --from-file "{{ koji_certs_dir }}/kojiadmin.pem"
            --from-file "{{ koji_certs_dir }}/kojiosbs.pem"
            --dry-run
            --output json |
        oc --namespace "{{ koji_namespace }}" replace --force -f -
      changed_when: true

    - name: Process koji config templates, output in openshift files dir
      template:
        src: "openshift/configs/{{ item }}.j2"
        dest: "{{ openshift_files }}/{{ item }}"
      loop:
        - koji-builder-osbs.conf
        - koji-hub-web.conf

    - name: Create kojiweb and osbs-client configmaps in koji namespace
      shell:
        set -o pipefail;
        oc create configmap "{{ item.name }}"
            --from-file "{{ item.dest }}={{ openshift_files }}/{{ item.src }}"
            --dry-run
            --output json |
        oc --namespace "{{ koji_namespace }}" replace --force -f -
      changed_when: true
      loop:
        - name: koji-builder-osbs
          src: koji-builder-osbs.conf
          dest: osbs.conf

        - name: koji-hub-web
          src: koji-hub-web.conf
          dest: web.conf

    - name: Copy openshift templates for koji components to openshift files dir
      copy:
        src: "openshift/templates/{{ item }}.yaml"
        dest: "{{ openshift_files }}/{{ item }}.yaml"
      loop:
        "{{ koji_components }}"

    - name: Create openshift resources for all koji components
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/{{ item }}.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ koji_namespace }}" apply -f -
      changed_when: true
      loop:
        "{{ koji_components }}"

    - name: Set up directories that will serve as backing storage for koji PVs
      file:
        path: "{{ item }}"
        state: directory
        setype: container_file_t
      loop:
        - "{{ koji_files_dir }}"
        - "{{ koji_db_data_dir }}"

    - name: Allow koji containers to run as any user
      command:
        oc --namespace "{{ koji_namespace }}" adm policy add-scc-to-user anyuid
           --serviceaccount default
      changed_when: true

    - name: Build (and automatically deploy) koji components
      command: oc --namespace "{{ koji_namespace }}" start-build koji-base
      changed_when: true


- name: Run registry container on openshift
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - registry
    - openshift

  tasks:
    - name: Create registry namespace in openshift
      command: oc create namespace "{{ registry_namespace }}"
      register: create_registry_namespace
      failed_when: create_registry_namespace.rc != 0
                   and "already exists" not in create_registry_namespace.stderr
      changed_when: create_registry_namespace.rc == 0

    - name: Create registry-cert secret in openshift
      shell:
        set -o pipefail;
        oc create secret generic registry-cert
            --from-file "{{ registry_certs_dir }}/osbs-registry.crt"
            --from-file "{{ registry_certs_dir }}/osbs-registry.key"
            --dry-run
            --output json |
        oc --namespace "{{ registry_namespace }}" replace --force -f -
      changed_when: true

    - name: Set up directory for registry PV storage
      file:
        path: "{{ registry_data_dir }}"
        state: directory
        setype: container_file_t

    - name: Allow registry container to run as any user
      command:
        oc --namespace "{{ registry_namespace }}" adm policy add-scc-to-user
           anyuid --serviceaccount default
      changed_when: true

    - name: Copy osbs-registry template to openshift files dir
      copy:
        src: openshift/templates/osbs-registry.yaml
        dest: "{{ openshift_files }}/osbs-registry.yaml"

    - name: Deploy osbs-registry
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/osbs-registry.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ registry_namespace }}" apply -f -
      changed_when: true


- name: Set up OSBS orchestrator and worker namespaces
  hosts: osbs_box_host
  gather_facts: false
  vars:
    # This is a constant, please do not override
    namespaces:
      - "{{ orchestrator_namespace }}"
      - "{{ worker_namespace }}"
  tags:
    - namespaces
    - openshift

  tasks:
    - name: Create orchestrator and worker namespaces in openshift
      command: oc create namespace "{{ item }}"
      register: create_namespace
      failed_when: create_namespace.rc != 0
                   and "already exists" not in create_namespace.stderr
      changed_when: create_namespace.rc == 0
      loop:
        "{{ namespaces }}"

    - name: Create kojisecret in orchestrator and worker namespaces
      shell:
        set -o pipefail;
        oc create secret generic kojisecret
            --from-file "cert={{ koji_certs_dir }}/kojiosbs.pem"
            --from-file "ca={{ certificates_dir }}/osbs-box-ca.crt"
            --from-file "serverca={{ certificates_dir }}/osbs-box-ca.crt"
            --dry-run
            --output json |
        oc --namespace "{{ item }}" replace --force -f -
      changed_when: true
      loop:
        "{{ namespaces }}"

    - name: Query openshift for osbs-registry IP
      command: oc --namespace "{{ registry_namespace }}" get svc osbs-registry
                  --output 'jsonpath={ .spec.clusterIP }'
      register: registry_ip_query
      changed_when: false

    - name: Set registry_ip fact (needed for orchestrator config templates)
      set_fact:
        registry_ip: "{{ registry_ip_query.stdout }}"

    - name: Process orchestrator config templates, output in openshift files dir
      template:
        src: "openshift/configs/{{ item }}.j2"
        dest: "{{ openshift_files }}/{{ item }}"
      loop:
        - reactor-config-map.yaml
        - client-config-secret.conf

    - name: Create reactor-config-map in orchestrator namespace
      shell:
        set -o pipefail;
        oc create configmap reactor-config-map
          --from-file "config.yaml={{ openshift_files }}/reactor-config-map.yaml"
          --dry-run
          --output json |
        oc --namespace "{{ orchestrator_namespace }}" replace --force -f -
      changed_when: true

    - name: Create client-config-secret in orchestrator namespace
      shell:
        set -o pipefail;
        oc create secret generic client-config-secret
          --from-file "osbs.conf={{ openshift_files }}/client-config-secret.conf"
          --dry-run
          --output json |
        oc --namespace "{{ orchestrator_namespace }}" replace --force -f -
      changed_when: true

    - name: Add necessary roles to builder serviceaccounts
      command: oc --namespace "{{ item.0 }}" adm policy
                  add-role-to-user "{{ item.1 }}" -z builder
      changed_when: true
      loop:
        "{{ namespaces | product(roles) | list }}"
      vars:
        roles:
          - "edit"
          - "system:build-strategy-custom"


- name: Build OSBS buildroot
  hosts: osbs_box_host
  gather_facts: false
  tags:
    - buildroot
    - openshift

  tasks:
    - name: Copy osbs-buildroot template to openshift files dir
      copy:
        src: openshift/templates/osbs-buildroot.yaml
        dest: "{{ openshift_files }}/osbs-buildroot.yaml"

    - name: Create openshift resources for osbs-buildroot
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/osbs-buildroot.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ orchestrator_namespace }}" apply -f -
      changed_when: true

    - name: Build osbs-buildroot
      command: oc --namespace "{{ orchestrator_namespace }}"
                  start-build osbs-buildroot
      changed_when: true


- name: Run cachito containers on openshift
  hosts: osbs_box_host
  gather_facts: false
  vars:
    # This is a constant, please do not override
    cachito_components:
      - cachito-volumes
      - cachito-api
      - cachito-worker
      - cachito-rabbitmq
      - cachito-athens
  tags:
    - cachito
    - openshift

  tasks:
    - name: Create cachito namespace in openshift
      command: oc create namespace "{{ cachito_namespace }}"
      register: create_cachito_namespace
      failed_when: create_cachito_namespace.rc != 0
                   and "already exists" not in create_cachito_namespace.stderr
      changed_when: create_cachito_namespace.rc == 0

    - name: Create cachito-certs secret in cachito namespace
      shell:
        set -o pipefail;
        oc create secret generic cachito-certs
            --from-file "{{ certificates_dir }}/osbs-box-ca.crt"
            --from-file "{{ cachito_certs_dir }}/cachito-api.crt"
            --from-file "{{ cachito_certs_dir }}/cachito-api.key"
            --from-file "{{ cachito_certs_dir }}/cachito-api.pem"
            --from-file "{{ cachito_certs_dir }}/cachito-worker.crt"
            --from-file "{{ cachito_certs_dir }}/cachito-worker.key"
            --from-file "{{ cachito_certs_dir }}/cachito-worker.pem"
            --dry-run
            --output json |
        oc --namespace "{{ cachito_namespace }}" replace --force -f -
      changed_when: true

    - name: Create cachito-ca secret in cachito namespace
      shell:
        set -o pipefail;
        oc create secret generic cachito-ca
            --from-file "{{ certificates_dir }}/osbs-box-ca.crt"
            --dry-run
            --output json |
        oc --namespace "{{ cachito_namespace }}" replace --force -f -
      changed_when: true

    - name: Process cachito config templates, output in openshift files dir
      template:
        src: "openshift/configs/{{ item }}.j2"
        dest: "{{ openshift_files }}/{{ item }}"
      loop:
        - cachito-api-config.py
        - cachito-api-celery.py
        - cachito-worker-celery.py

    - name: Create cachito configmaps in cachito namespace
      shell:
        set -o pipefail;
        oc create configmap "{{ item.name }}"
            --from-file "{{ item.dest }}={{ openshift_files }}/{{ item.src }}"
            --dry-run
            --output json |
        oc --namespace "{{ cachito_namespace }}" replace --force -f -
      changed_when: true
      loop:
        - name: cachito-api-config
          src: cachito-api-config.py
          dest: settings.py
        - name: cachito-api-celery
          src: cachito-api-celery.py
          dest: celery.py
        - name: cachito-worker-celery
          src: cachito-worker-celery.py
          dest: celery.py

    - name: Copy openshift templates for cachito components to openshift files dir
      copy:
        src: "openshift/templates/{{ item }}.yaml"
        dest: "{{ openshift_files }}/{{ item }}.yaml"
      loop:
        "{{ cachito_components }}"

    - name: Create openshift resources for all cachito components
      shell:
        set -o pipefail;
        oc process -f "{{ openshift_files }}/{{ item }}.yaml"
                   --param-file "{{ openshift_files }}/osbs-box.env"
                   --ignore-unknown-parameters |
        oc --namespace "{{ cachito_namespace }}" apply -f -
      changed_when: true
      loop:
        "{{ cachito_components }}"

    - name: Set up directories that will serve as backing storage for cachito PVs
      file:
        path: "{{ item }}"
        state: directory
        setype: container_file_t
      loop:
        - "{{ cachito_archives_dir }}"
        - "{{ cachito_athens_dir }}"

    - name: Allow cachito containers to run as any user
      command:
        oc --namespace "{{ cachito_namespace }}" adm policy add-scc-to-user anyuid
           --serviceaccount default
      changed_when: true

    - name: Build (and automatically deploy) cachito cachito-api
      command: oc --namespace "{{ cachito_namespace }}" start-build cachito-api
      changed_when: true

    - name: Build (and automatically deploy) cachito cachito-worker
      command: oc --namespace "{{ cachito_namespace }}" start-build cachito-worker
      changed_when: true