summaryrefslogtreecommitdiffstats
path: root/ansible/roles
diff options
context:
space:
mode:
authorMichal Ptacek <m.ptacek@partner.samsung.com>2019-04-24 14:20:09 +0000
committerGerrit Code Review <gerrit@onap.org>2019-04-24 14:20:09 +0000
commit323cc24087033d2d63c3da4802771c32f18be504 (patch)
treea77fa9d590b574d9a10a350f1f948817a6a61868 /ansible/roles
parente307e97ba9c0163b34d91d55cfca51c63848fd83 (diff)
parent3a6558a1af5ba14bc6614d94f768dd1a1fc86d9b (diff)
Merge changes from topic 'rancher_api'
* changes: Add support for resetting the admin password Add support for rancher authentication Refactor rancher1_api module Add support for rancher 1.6 API
Diffstat (limited to 'ansible/roles')
-rw-r--r--ansible/roles/rancher/defaults/main.yml27
-rw-r--r--ansible/roles/rancher/tasks/rancher_server.yml54
2 files changed, 81 insertions, 0 deletions
diff --git a/ansible/roles/rancher/defaults/main.yml b/ansible/roles/rancher/defaults/main.yml
index 6ab52e64..6d354e6e 100644
--- a/ansible/roles/rancher/defaults/main.yml
+++ b/ansible/roles/rancher/defaults/main.yml
@@ -4,3 +4,30 @@ rancher_remove_other_env: true
rancher_redeploy_k8s_env: true
rancher_cluster_health_state: healthy
rancher_cluster_health_check_retries: 30
+rancher:
+ # The following variables can be set via the UI under advanced/settings.
+ # All of these affect tables in the cattle db and are uninteresting
+ # to the user (they serve the internal logic of the cattle), but
+ # they can eat a lot of space when a deployment is busy or faulty.
+ #
+ # Audit-Log is the only user-facing option here and it is represented
+ # in the UI.
+ #
+ # Auto-purge deleted entries from most tables after this long (seconds)
+ main_tables_purge_after_seconds: 28800 # 8 hours
+ # Auto-purge Event entries after this long (seconds)
+ events_purge_after_seconds: 28800 # 8 hours
+ # Auto-purge Service Log entries after this long (seconds)
+ service_log_purge_after_seconds: 86400 # 1 day
+ # Auto-purge Audit Log entries after this long (seconds)
+ audit_log_purge_after_seconds: 2592000 # 30 days
+
+ # By default we don't enable local authentication (mainly due to
+ # to the fact that rancher_k8s_environment.py would have to be
+ # rewritten completely)
+ # But if you don't need to run rancher_kubernetes playbook more
+ # than once (you should not have to under the terms of a regular
+ # installation), then you can safely enable it.
+ auth_enabled: false
+ # Set this password for the rancher admin account:
+ admin_password: "admin"
diff --git a/ansible/roles/rancher/tasks/rancher_server.yml b/ansible/roles/rancher/tasks/rancher_server.yml
index e1eb5a5d..4cda3722 100644
--- a/ansible/roles/rancher/tasks/rancher_server.yml
+++ b/ansible/roles/rancher/tasks/rancher_server.yml
@@ -32,6 +32,14 @@
delay: 5
until: env.data is defined
+# There is a lack of idempotency in the previous task and so there are new api
+# key-pairs created with each run.
+#
+# ToDo: fix idempotency of rancher role
+#
+# Anyway as rke will be default k8s orchestrator in Dublin, it's supposed to be
+# low prio topic. The following tasks dealing with the API are ignoring this problem
+# and they simply use the new created API key-pair, which is set as a fact here:
- name: Set apikey values
set_fact:
k8s_env_id: "{{ env.data.environment.id }}"
@@ -39,3 +47,49 @@
key_private: "{{ env.data.apikey.private }}"
rancher_agent_image: "{{ env.data.registration_tokens.image }}"
rancher_agent_reg_url: "{{ env.data.registration_tokens.reg_url }}"
+
+# By default disabled - when enabled this playbook cannot be run more than once.
+- name: Setup rancher admin password and enable authentication
+ rancher1_api:
+ server: "{{ rancher_server_url }}"
+ account_key: "{{ key_public }}:{{ key_private }}"
+ mode: access_control
+ data:
+ account_id: 1a1 # default rancher admin account
+ password: "{{ rancher.admin_password }}"
+ when: "rancher.auth_enabled is defined and rancher.auth_enabled"
+
+- name: Configure the size of the rancher cattle db and logs
+ block:
+ - name: Main tables
+ rancher1_api:
+ server: "{{ rancher_server_url }}"
+ account_key: "{{ key_public }}:{{ key_private }}"
+ mode: settings
+ data:
+ option: main_tables.purge.after.seconds
+ value: "{{ rancher.main_tables_purge_after_seconds }}"
+ - name: Events
+ rancher1_api:
+ server: "{{ rancher_server_url }}"
+ account_key: "{{ key_public }}:{{ key_private }}"
+ mode: settings
+ data:
+ option: events.purge.after.seconds
+ value: "{{ rancher.events_purge_after_seconds }}"
+ - name: Service log
+ rancher1_api:
+ server: "{{ rancher_server_url }}"
+ account_key: "{{ key_public }}:{{ key_private }}"
+ mode: settings
+ data:
+ option: service_log.purge.after.seconds
+ value: "{{ rancher.service_log_purge_after_seconds }}"
+ - name: Audit log
+ rancher1_api:
+ server: "{{ rancher_server_url }}"
+ account_key: "{{ key_public }}:{{ key_private }}"
+ mode: settings
+ data:
+ option: audit_log.purge.after.seconds
+ value: "{{ rancher.audit_log_purge_after_seconds }}"