feat: add supabase deployer
This commit is contained in:
@@ -333,29 +333,86 @@
|
||||
- never
|
||||
- sno_deploy_service_accounts
|
||||
|
||||
roles:
|
||||
- role: ocp_service_account
|
||||
ocp_service_account_name: aap-deployer
|
||||
ocp_service_account_namespace: aap
|
||||
ocp_service_account_cluster_role_rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["operators.coreos.com"]
|
||||
resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["aap.ansible.com"]
|
||||
resources: ["ansibleautomationplatforms"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
tasks:
|
||||
# ---- supabase-deployer ----
|
||||
- name: Provision supabase-deployer ServiceAccount
|
||||
ansible.builtin.include_role:
|
||||
name: ocp_service_account
|
||||
vars:
|
||||
ocp_service_account_name: supabase-deployer
|
||||
ocp_service_account_namespace: supabase
|
||||
ocp_service_account_cluster_role_rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "create", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets", "configmaps", "services", "serviceaccounts",
|
||||
"persistentvolumeclaims", "pods", "endpoints"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "replicasets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["clusterroles", "clusterrolebindings", "roles", "rolebindings"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "escalate", "bind"]
|
||||
- apiGroups: ["security.openshift.io"]
|
||||
resources: ["securitycontextconstraints"]
|
||||
verbs: ["get", "list", "use"]
|
||||
- apiGroups: ["route.openshift.io"]
|
||||
resources: ["routes", "routes/custom-host"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
- name: Store supabase-deployer token in Vault
|
||||
community.hashi_vault.vault_kv2_write:
|
||||
path: toallab/supabase-deployer
|
||||
engine_mount_point: kv
|
||||
data:
|
||||
token: "{{ __ocp_service_account_token }}"
|
||||
no_log: true
|
||||
|
||||
# ---- aap-deployer ----
|
||||
- name: Provision aap-deployer ServiceAccount
|
||||
ansible.builtin.include_role:
|
||||
name: ocp_service_account
|
||||
vars:
|
||||
ocp_service_account_name: aap-deployer
|
||||
ocp_service_account_namespace: aap
|
||||
ocp_service_account_cluster_role_rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["operators.coreos.com"]
|
||||
resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["aap.ansible.com"]
|
||||
resources: ["ansibleautomationplatforms"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
|
||||
- name: Store aap-deployer token in Vault
|
||||
community.hashi_vault.vault_kv2_write:
|
||||
path: toallab/aap-deployer
|
||||
engine_mount_point: kv
|
||||
data:
|
||||
token: "{{ __ocp_service_account_token }}"
|
||||
no_log: true
|
||||
|
||||
44
playbooks/deploy_supabase.yml
Normal file
44
playbooks/deploy_supabase.yml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Deploy Supabase on OpenShift (SNO) via the supabase-community Helm chart.
|
||||
#
|
||||
# Chart: https://github.com/supabase-community/supabase-kubernetes
|
||||
#
|
||||
# Prerequisites:
|
||||
# - cert-manager installed (deploy_openshift.yml --tags sno_deploy_certmanager)
|
||||
# - NFS StorageClass available (deploy_openshift.yml --tags sno_deploy_nfs)
|
||||
# - supabase-deployer ServiceAccount provisioned and token saved to 1Password:
|
||||
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
# - vault_supabase_deployer_token set in host_vars (see hashivault_secrets.yml)
|
||||
#
|
||||
# All Supabase secrets (JWT, DB password, etc.) are auto-generated on first run
|
||||
# and stored in Vault at supabase_vault_path. No manual secret setup required.
|
||||
#
|
||||
# Usage:
|
||||
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout
|
||||
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_chart_version=0.0.9
|
||||
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_db_storage_size=20Gi
|
||||
|
||||
- name: Deploy Supabase on OpenShift
|
||||
hosts: sno.openshift.toal.ca
|
||||
gather_facts: false
|
||||
connection: local
|
||||
|
||||
environment:
|
||||
K8S_AUTH_HOST: "{{ supabase_k8s_api_url }}"
|
||||
K8S_AUTH_API_KEY: "{{ vault_supabase_deployer_token }}"
|
||||
K8S_AUTH_VERIFY_SSL: "false"
|
||||
|
||||
pre_tasks:
|
||||
- name: Verify supabase-deployer token is available
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- vault_supabase_deployer_token is defined
|
||||
- vault_supabase_deployer_token | length > 0
|
||||
fail_msg: >-
|
||||
vault_supabase_deployer_token is not set.
|
||||
Provision the ServiceAccount with:
|
||||
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
Then save the displayed token to 1Password and reference it as vault_supabase_deployer_token.
|
||||
|
||||
roles:
|
||||
- role: supabase
|
||||
Reference in New Issue
Block a user