Skip to content

Commit 7e332f3

Browse files
cardoecardoe
authored
Merge pull request #806 from rackerlabs/ansible-start
feat: add ansible execution environment for playbooks
2 parents 6115d62 + 9d86d74 commit 7e332f3

21 files changed

+430
-94
lines changed

‎.ansible-lint

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
3+
exclude_paths:
4+
- ansible/.venv/

‎.github/workflows/containers.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@ on:
77
branches:
88
- main
99
paths:
10+
- "ansible/**"
1011
- "containers/**"
1112
- ".github/workflows/containers.yaml"
1213
- "python/**"
1314
pull_request:
1415
types: [opened, synchronize, reopened, closed]
1516
paths:
17+
- "ansible/**"
1618
- "containers/**"
1719
- ".github/workflows/containers.yaml"
1820
- "python/**"
@@ -123,6 +125,7 @@ jobs:
123125
container:
124126
- name: ironic-nautobot-client
125127
- name: nova-flavors
128+
- name: ansible
126129

127130
steps:
128131
- name: setup docker buildx
@@ -182,6 +185,7 @@ jobs:
182185
- dnsmasq
183186
- ironic-nautobot-client
184187
- nova-flavors
188+
- ansible
185189

186190
steps:
187191
- name: clean up PR container

‎.pre-commit-config.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,15 @@ repos:
4848
- id: ruff
4949
args: [--fix]
5050
- id: ruff-format
51+
- repo: https://github.com/ansible/ansible-lint
52+
rev: v25.1.2
53+
hooks:
54+
- id: ansible-lint
55+
entry: "sh -c 'cd ansible && python3 -m ansiblelint -v --force-color'"
56+
additional_dependencies:
57+
- ansible
58+
- jmespath
59+
files: '^ansible/.*$'
5160
- repo: https://github.com/python-poetry/poetry
5261
rev: '1.7.1'
5362
hooks:

‎ansible/playbooks/debug.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Debug
17+
hosts: localhost
18+
19+
roles:
20+
- role: debug

‎ansible/playbooks/keystone_bootstrap.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Keystone Bootstrap
17+
hosts: keystone
18+
connection: local
19+
20+
pre_tasks:
21+
- name: Fail if ENV variables are not set
22+
ansible.builtin.fail:
23+
msg: "Environment variable {{ item }} is not set. Exiting playbook."
24+
when: lookup('env', item) == ''
25+
loop:
26+
- OS_USERNAME
27+
- OS_DEFAULT_DOMAIN
28+
29+
roles:
30+
- role: keystone_bootstrap

‎ansible/requirements.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
ansible-core==2.18.4
2+
ansible-runner==2.4.0
3+
openstacksdk==4.3.0
4+
pynautobot==2.6.1
5+
jmespath==1.0.1
6+
# remove me after the inherited roles workaround can be dropped
7+
python-openstackclient

‎ansible/requirements.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
collections:
2+
- name: community.general
3+
version: "==10.5.0"
4+
- name: openstack.cloud
5+
version: "==2.4.1"
6+
- name: networktocode.nautobot
7+
version: "==5.6.0"

‎ansible/roles/debug/tasks/main.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Debug
17+
ansible.builtin.debug:
18+
msg: debug

‎ansible/roles/keystone_bootstrap/defaults/main.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
keystone_bootstrap_dex_url: "{{ dex_url | default('https://dex.' + lookup('ansible.builtin.env', 'DNS_ZONE', default='localnet')) }}"
3+
4+
keystone_bootstrap_groups:
5+
- name: ucadmin
6+
desc: 'Users Federated with Admin'
7+
roles:
8+
- member
9+
- admin
10+
- name: ucuser
11+
desc: 'Regular Federated Users'
12+
roles:
13+
- member
14+
- name: ucneteng
15+
desc: 'Federated Network Engineers'
16+
roles:
17+
- member
18+
- name: ucdctech
19+
desc: 'Federated DC Technicians'
20+
roles:
21+
- member

‎ansible/roles/keystone_bootstrap/tasks/baremetal.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Create 'infra' domain
17+
openstack.cloud.identity_domain:
18+
name: infra
19+
description: 'System Infra'
20+
state: present
21+
22+
- name: Create 'baremetal' project in 'infra' domain
23+
openstack.cloud.project:
24+
name: baremetal
25+
domain: infra
26+
description: 'Ironic Resources'
27+
state: present

‎ansible/roles/keystone_bootstrap/tasks/main.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
3+
- name: Admin needs admin role for default domain
4+
openstack.cloud.role_assignment:
5+
user: "{{ lookup('ansible.builtin.env', 'OS_USERNAME', default=Undefined) }}"
6+
domain: "{{ lookup('ansible.builtin.env', 'OS_DEFAULT_DOMAIN', default=Undefined) }}"
7+
role: admin
8+
state: present
9+
10+
- name: Define baremetal
11+
ansible.builtin.include_tasks: baremetal.yml
12+
13+
- name: Define SSO
14+
ansible.builtin.include_tasks: sso.yml
15+
16+
- name: Define misc keystone
17+
ansible.builtin.include_tasks: misc.yml

‎ansible/roles/keystone_bootstrap/tasks/misc.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Create 'argoworkflow' user
17+
openstack.cloud.identity_user:
18+
name: argoworkflow
19+
password: demo
20+
domain: infra
21+
state: present
22+
23+
- name: Set 'argoworkflow' role
24+
openstack.cloud.role_assignment:
25+
domain: infra
26+
user: argoworkflow
27+
project: baremetal
28+
role: admin
29+
state: present
30+
31+
- name: Create 'monitoring' user
32+
openstack.cloud.identity_user:
33+
name: monitoring
34+
password: monitoring_demo
35+
domain: infra
36+
state: present
37+
38+
- name: Set 'monitoring' role
39+
openstack.cloud.role_assignment:
40+
domain: infra
41+
user: monitoring
42+
project: baremetal
43+
role: admin
44+
state: present
45+
46+
- name: Create 'flavorsync' user
47+
openstack.cloud.identity_user:
48+
name: flavorsync
49+
password: abcd1234
50+
domain: service
51+
state: present
52+
register: _flavor_sync_user
53+
54+
- name: Create 'flavorsync' role
55+
openstack.cloud.identity_role:
56+
name: flavorsync
57+
state: present
58+
59+
- name: Set 'flavorsync' role
60+
openstack.cloud.role_assignment:
61+
user: "{{ _flavor_sync_user.user.id }}"
62+
domain: default
63+
role: flavorsync
64+
state: present

‎ansible/roles/keystone_bootstrap/tasks/sso.yml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Create 'sso' domain
17+
openstack.cloud.identity_domain:
18+
name: sso
19+
description: 'SSO to dex'
20+
state: present
21+
register: _domain_sso
22+
23+
- name: Display 'sso' configuration
24+
ansible.builtin.debug:
25+
var: keystone_bootstrap_dex_url
26+
27+
- name: Create 'sso' identity provider
28+
openstack.cloud.federation_idp:
29+
name: sso
30+
domain_id: "{{ _domain_sso.domain.id }}"
31+
description: 'Identity Provider to dex'
32+
remote_ids:
33+
- "{{ keystone_bootstrap_dex_url }}"
34+
35+
- name: Create sso mapping
36+
openstack.cloud.federation_mapping:
37+
name: sso_mapping
38+
rules:
39+
- local:
40+
- user:
41+
id: '{0}'
42+
name: '{1}'
43+
email: '{2}'
44+
groups: '{3}'
45+
domain:
46+
id: "{{ _domain_sso.domain.id }}"
47+
remote:
48+
- type: HTTP_OIDC_SUB
49+
- type: REMOTE_USER
50+
- type: HTTP_OIDC_EMAIL
51+
- type: HTTP_OIDC_GROUPS
52+
53+
- name: Create openid protocol
54+
openstack.cloud.keystone_federation_protocol:
55+
name: openid
56+
idp: sso
57+
mapping: sso_mapping
58+
59+
- name: Create federated group mappings
60+
ansible.builtin.include_tasks: sso_member_groups.yml
61+
loop: "{{ keystone_bootstrap_groups }}"
62+
63+
- name: Grant admin for groups
64+
ansible.builtin.include_tasks: sso_role_admin.yml
65+
loop:
66+
- ucadmin

‎ansible/roles/keystone_bootstrap/tasks/sso_member_groups.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
16+
- name: Create group
17+
openstack.cloud.identity_group:
18+
name: "{{ item.name }}"
19+
domain_id: "{{ _domain_sso.domain.id }}"
20+
description: "{{ item.desc }}"
21+
state: present
22+
register: _group
23+
24+
# role assignment module is lacking inherited and cross domain assignments
25+
- name: Assign member access
26+
ansible.builtin.command: openstack role add --group "{{ _group.group.id }}" --domain default --inherited member
27+
when: dont_set_roles is not defined
28+
changed_when: false

‎ansible/roles/keystone_bootstrap/tasks/sso_role_admin.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
# Copyright (c) 2025 Rackspace Technology, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
5+
# not use this file except in compliance with the License. You may obtain
6+
# a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
# License for the specific language governing permissions and limitations
14+
# under the License.
15+
#
16+
- name: Find group
17+
openstack.cloud.identity_group_info:
18+
name: "{{ item }}"
19+
domain: "{{ _domain_sso.domain.id }}"
20+
21+
# role assignment module is lacking inherited and cross domain assignments
22+
- name: Assign member access
23+
ansible.builtin.command: openstack role add --group "{{ _group.group.id }}" --domain default --inherited admin
24+
when: dont_set_roles is not defined
25+
changed_when: false
26+
27+
# role assignment module is lacking inherited and cross domain assignments
28+
- name: Assign member access
29+
ansible.builtin.command: openstack role add --group "{{ _group.group.id }}" --domain infra --inherited admin
30+
when: dont_set_roles is not defined
31+
changed_when: false

0 commit comments

Comments
 (0)