feat: add supabase deployer

2026-04-12 20:07:05 -04:00
parent df1dd39197
commit 5fe7b4edeb
8 changed files with 973 additions and 26 deletions
--- a/playbooks/deploy_openshift.yml
+++ b/playbooks/deploy_openshift.yml
@@ -333,29 +333,86 @@
    - never
    - sno_deploy_service_accounts

-  roles:
-    - role: ocp_service_account
-      ocp_service_account_name: aap-deployer
-      ocp_service_account_namespace: aap
-      ocp_service_account_cluster_role_rules:
-        - apiGroups: [""]
-          resources: ["namespaces"]
-          verbs: ["get", "list", "create", "patch"]
-        - apiGroups: [""]
-          resources: ["secrets"]
-          verbs: ["get", "list", "watch", "create", "patch"]
-        - apiGroups: [""]
-          resources: ["serviceaccounts"]
-          verbs: ["get", "list", "watch"]
-        - apiGroups: ["apps"]
-          resources: ["deployments"]
-          verbs: ["get", "list", "watch"]
-        - apiGroups: ["operators.coreos.com"]
-          resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
-          verbs: ["get", "list", "create", "patch", "watch"]
-        - apiGroups: ["apiextensions.k8s.io"]
-          resources: ["customresourcedefinitions"]
-          verbs: ["get", "list", "watch"]
-        - apiGroups: ["aap.ansible.com"]
-          resources: ["ansibleautomationplatforms"]
-          verbs: ["get", "list", "create", "patch", "watch"]
+  tasks:
+    # ---- supabase-deployer ----
+    - name: Provision supabase-deployer ServiceAccount
+      ansible.builtin.include_role:
+        name: ocp_service_account
+      vars:
+        ocp_service_account_name: supabase-deployer
+        ocp_service_account_namespace: supabase
+        ocp_service_account_cluster_role_rules:
+          - apiGroups: [""]
+            resources: ["namespaces"]
+            verbs: ["get", "list", "create", "patch", "delete"]
+          - apiGroups: [""]
+            resources: ["secrets", "configmaps", "services", "serviceaccounts",
+                        "persistentvolumeclaims", "pods", "endpoints"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+          - apiGroups: ["apps"]
+            resources: ["deployments", "statefulsets", "replicasets"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+          - apiGroups: ["rbac.authorization.k8s.io"]
+            resources: ["clusterroles", "clusterrolebindings", "roles", "rolebindings"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "escalate", "bind"]
+          - apiGroups: ["security.openshift.io"]
+            resources: ["securitycontextconstraints"]
+            verbs: ["get", "list", "use"]
+          - apiGroups: ["route.openshift.io"]
+            resources: ["routes", "routes/custom-host"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+          - apiGroups: ["cert-manager.io"]
+            resources: ["certificates", "clusterissuers", "issuers"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+          - apiGroups: ["networking.k8s.io"]
+            resources: ["ingresses"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+          - apiGroups: ["storage.k8s.io"]
+            resources: ["storageclasses"]
+            verbs: ["get", "list", "watch"]
+
+    - name: Store supabase-deployer token in Vault
+      community.hashi_vault.vault_kv2_write:
+        path: toallab/supabase-deployer
+        engine_mount_point: kv
+        data:
+          token: "{{ __ocp_service_account_token }}"
+      no_log: true
+
+    # ---- aap-deployer ----
+    - name: Provision aap-deployer ServiceAccount
+      ansible.builtin.include_role:
+        name: ocp_service_account
+      vars:
+        ocp_service_account_name: aap-deployer
+        ocp_service_account_namespace: aap
+        ocp_service_account_cluster_role_rules:
+          - apiGroups: [""]
+            resources: ["namespaces"]
+            verbs: ["get", "list", "create", "patch"]
+          - apiGroups: [""]
+            resources: ["secrets"]
+            verbs: ["get", "list", "watch", "create", "patch"]
+          - apiGroups: [""]
+            resources: ["serviceaccounts"]
+            verbs: ["get", "list", "watch"]
+          - apiGroups: ["apps"]
+            resources: ["deployments"]
+            verbs: ["get", "list", "watch"]
+          - apiGroups: ["operators.coreos.com"]
+            resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
+            verbs: ["get", "list", "create", "patch", "watch"]
+          - apiGroups: ["apiextensions.k8s.io"]
+            resources: ["customresourcedefinitions"]
+            verbs: ["get", "list", "watch"]
+          - apiGroups: ["aap.ansible.com"]
+            resources: ["ansibleautomationplatforms"]
+            verbs: ["get", "list", "create", "patch", "watch"]
+
+    - name: Store aap-deployer token in Vault
+      community.hashi_vault.vault_kv2_write:
+        path: toallab/aap-deployer
+        engine_mount_point: kv
+        data:
+          token: "{{ __ocp_service_account_token }}"
+      no_log: true