362 lines
11 KiB
YAML
362 lines
11 KiB
YAML
---
|
|
# ------------------------------------------------------------------
|
|
# User Workload Monitoring (MaaS reports Degraded without it)
|
|
# ------------------------------------------------------------------
|
|
- name: Read cluster monitoring config
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: ConfigMap
|
|
namespace: openshift-monitoring
|
|
name: cluster-monitoring-config
|
|
register: __rhoai_maas_cmo
|
|
|
|
- name: Resolve cluster monitoring config
|
|
ansible.builtin.set_fact:
|
|
__rhoai_maas_cmo_config: >-
|
|
{{ ((__rhoai_maas_cmo.resources[0].data['config.yaml'] | default('{}')) if __rhoai_maas_cmo.resources else '{}')
|
|
| from_yaml | default({}, true) }}
|
|
|
|
- name: Enable User Workload Monitoring
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cluster-monitoring-config
|
|
namespace: openshift-monitoring
|
|
data:
|
|
config.yaml: "{{ __rhoai_maas_cmo_config | combine({'enableUserWorkload': true}) | to_nice_yaml }}"
|
|
when: not (__rhoai_maas_cmo_config.enableUserWorkload | default(false) | bool)
|
|
|
|
# ------------------------------------------------------------------
|
|
# Gateway API: GatewayClass, Gateway, passthrough Route
|
|
# ------------------------------------------------------------------
|
|
- name: Read cluster ingress domain
|
|
kubernetes.core.k8s_info:
|
|
api_version: config.openshift.io/v1
|
|
kind: Ingress
|
|
name: cluster
|
|
register: __rhoai_maas_ingress
|
|
when: rhoai_maas_hostname | length == 0
|
|
|
|
- name: Resolve MaaS hostname
|
|
ansible.builtin.set_fact:
|
|
__rhoai_maas_hostname: >-
|
|
{{ rhoai_maas_hostname if rhoai_maas_hostname | length > 0
|
|
else 'maas.' ~ __rhoai_maas_ingress.resources[0].spec.domain }}
|
|
|
|
- name: Create MaaS gateway certificate
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: "{{ __rhoai_maas_gateway_name }}-cert"
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
spec:
|
|
secretName: "{{ rhoai_maas_gateway_cert_secret }}"
|
|
issuerRef:
|
|
name: "{{ rhoai_maas_gateway_cert_issuer }}"
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- "{{ __rhoai_maas_hostname }}"
|
|
duration: 2160h
|
|
renewBefore: 720h
|
|
when: rhoai_maas_gateway_cert_issuer | length > 0
|
|
|
|
- name: Wait for MaaS gateway certificate to be issued
|
|
kubernetes.core.k8s_info:
|
|
api_version: cert-manager.io/v1
|
|
kind: Certificate
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
name: "{{ __rhoai_maas_gateway_name }}-cert"
|
|
register: __rhoai_maas_gw_cert
|
|
until: >-
|
|
(__rhoai_maas_gw_cert.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
|
|
retries: 30
|
|
delay: 10
|
|
when: rhoai_maas_gateway_cert_issuer | length > 0
|
|
|
|
# Creating the GatewayClass makes the ingress operator install Service Mesh 3 (Istio)
|
|
- name: Create openshift-default GatewayClass
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: GatewayClass
|
|
metadata:
|
|
name: openshift-default
|
|
spec:
|
|
controllerName: openshift.io/gateway-controller/v1
|
|
|
|
- name: Wait for GatewayClass to be accepted
|
|
kubernetes.core.k8s_info:
|
|
api_version: gateway.networking.k8s.io/v1
|
|
kind: GatewayClass
|
|
name: openshift-default
|
|
register: __rhoai_maas_gwc
|
|
until: >-
|
|
__rhoai_maas_gwc.resources | length > 0 and
|
|
(__rhoai_maas_gwc.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Accepted') | selectattr('status', 'equalto', 'True') | list | length) > 0
|
|
retries: "{{ __rhoai_maas_wait_retries }}"
|
|
delay: 10
|
|
|
|
- name: Create Gateway deployment options
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: maas-gateway-options
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
data:
|
|
deployment: |
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: istio-proxy
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
|
|
- name: Create MaaS Gateway
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: "{{ __rhoai_maas_gateway_name }}"
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
annotations:
|
|
opendatahub.io/managed: "false"
|
|
security.opendatahub.io/authorino-tls-bootstrap: "true"
|
|
networking.istio.io/service-type: "{{ rhoai_maas_gateway_service_type }}"
|
|
spec:
|
|
gatewayClassName: openshift-default
|
|
infrastructure:
|
|
parametersRef:
|
|
group: ""
|
|
kind: ConfigMap
|
|
name: maas-gateway-options
|
|
listeners:
|
|
- name: http
|
|
hostname: "{{ __rhoai_maas_hostname }}"
|
|
port: 80
|
|
protocol: HTTP
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
maas.opendatahub.io/gateway-access: "true"
|
|
- name: https
|
|
hostname: "{{ __rhoai_maas_hostname }}"
|
|
port: 443
|
|
protocol: HTTPS
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
maas.opendatahub.io/gateway-access: "true"
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: "{{ rhoai_maas_gateway_cert_secret }}"
|
|
|
|
- name: Wait for MaaS Gateway to be programmed
|
|
kubernetes.core.k8s_info:
|
|
api_version: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
name: "{{ __rhoai_maas_gateway_name }}"
|
|
register: __rhoai_maas_gw
|
|
until: >-
|
|
(__rhoai_maas_gw.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Programmed') | selectattr('status', 'equalto', 'True') | list | length) > 0
|
|
retries: "{{ __rhoai_maas_wait_retries }}"
|
|
delay: 10
|
|
|
|
- name: Expose MaaS Gateway through the default router
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: route.openshift.io/v1
|
|
kind: Route
|
|
metadata:
|
|
name: "{{ __rhoai_maas_gateway_name }}-https"
|
|
namespace: "{{ __rhoai_maas_gateway_namespace }}"
|
|
spec:
|
|
host: "{{ __rhoai_maas_hostname }}"
|
|
port:
|
|
targetPort: https
|
|
tls:
|
|
termination: passthrough
|
|
insecureEdgeTerminationPolicy: Redirect
|
|
to:
|
|
kind: Service
|
|
name: "{{ __rhoai_maas_gateway_service }}"
|
|
weight: 100
|
|
when: rhoai_maas_gateway_create_route | bool
|
|
|
|
# ------------------------------------------------------------------
|
|
# Kuadrant (Authorino + Limitador) and Authorino TLS
|
|
# ------------------------------------------------------------------
|
|
- name: Create kuadrant-system namespace
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: kuadrant-system
|
|
|
|
- name: Create Kuadrant instance
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: kuadrant.io/v1beta1
|
|
kind: Kuadrant
|
|
metadata:
|
|
name: kuadrant
|
|
namespace: kuadrant-system
|
|
spec:
|
|
observability:
|
|
enable: true
|
|
|
|
# The Kuadrant operator only detects the Gateway API provider (Istio) at startup.
|
|
# RHCL is installed before the GatewayClass provisions Istio, so on a fresh
|
|
# install Kuadrant reports MissingDependency until the operator pod restarts.
|
|
- name: Read Kuadrant status
|
|
kubernetes.core.k8s_info:
|
|
api_version: kuadrant.io/v1beta1
|
|
kind: Kuadrant
|
|
namespace: kuadrant-system
|
|
name: kuadrant
|
|
register: __rhoai_maas_kuadrant
|
|
until: >-
|
|
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Ready') | list | length) > 0
|
|
retries: 12
|
|
delay: 5
|
|
failed_when: false
|
|
|
|
- name: Restart the Kuadrant operator to detect Istio
|
|
kubernetes.core.k8s:
|
|
state: absent
|
|
api_version: v1
|
|
kind: Pod
|
|
namespace: openshift-operators
|
|
label_selectors:
|
|
- app=kuadrant
|
|
- control-plane=controller-manager
|
|
when: >-
|
|
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Ready') | map(attribute='reason') | first | default(''))
|
|
== 'MissingDependency'
|
|
|
|
- name: Wait for Kuadrant to be ready
|
|
kubernetes.core.k8s_info:
|
|
api_version: kuadrant.io/v1beta1
|
|
kind: Kuadrant
|
|
namespace: kuadrant-system
|
|
name: kuadrant
|
|
register: __rhoai_maas_kuadrant
|
|
until: >-
|
|
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
|
|
| selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
|
|
retries: "{{ __rhoai_maas_wait_retries }}"
|
|
delay: 10
|
|
|
|
- name: Wait for Authorino service
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: Service
|
|
namespace: kuadrant-system
|
|
name: authorino-authorino-authorization
|
|
register: __rhoai_maas_authorino_svc
|
|
until: __rhoai_maas_authorino_svc.resources | length > 0
|
|
retries: "{{ __rhoai_maas_wait_retries }}"
|
|
delay: 10
|
|
|
|
- name: Request a service-ca serving certificate for Authorino
|
|
kubernetes.core.k8s:
|
|
state: patched
|
|
api_version: v1
|
|
kind: Service
|
|
namespace: kuadrant-system
|
|
name: authorino-authorino-authorization
|
|
definition:
|
|
metadata:
|
|
annotations:
|
|
service.beta.openshift.io/serving-cert-secret-name: authorino-server-cert
|
|
|
|
- name: Wait for Authorino serving certificate
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: Secret
|
|
namespace: kuadrant-system
|
|
name: authorino-server-cert
|
|
register: __rhoai_maas_authorino_cert
|
|
until: __rhoai_maas_authorino_cert.resources | length > 0
|
|
retries: 30
|
|
delay: 10
|
|
no_log: true
|
|
|
|
- name: Enable Authorino TLS listener
|
|
kubernetes.core.k8s:
|
|
state: patched
|
|
api_version: operator.authorino.kuadrant.io/v1beta1
|
|
kind: Authorino
|
|
namespace: kuadrant-system
|
|
name: authorino
|
|
merge_type: merge
|
|
definition:
|
|
spec:
|
|
listener:
|
|
tls:
|
|
enabled: true
|
|
certSecretRef:
|
|
name: authorino-server-cert
|
|
|
|
- name: Read Authorino deployment
|
|
kubernetes.core.k8s_info:
|
|
api_version: apps/v1
|
|
kind: Deployment
|
|
namespace: kuadrant-system
|
|
name: authorino
|
|
register: __rhoai_maas_authorino_deploy
|
|
|
|
- name: Trust the service CA in Authorino
|
|
kubernetes.core.k8s:
|
|
state: patched
|
|
api_version: apps/v1
|
|
kind: Deployment
|
|
namespace: kuadrant-system
|
|
name: authorino
|
|
merge_type: strategic-merge
|
|
definition:
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: "{{ __rhoai_maas_authorino_deploy.resources[0].spec.template.spec.containers[0].name }}"
|
|
env:
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt
|