58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
---
|
|
- name: DevAccess | Render RBAC manifests
|
|
ansible.builtin.template:
|
|
src: "{{ item.src }}"
|
|
dest: "/tmp/{{ item.dest }}"
|
|
mode: "0600"
|
|
loop:
|
|
- { src: dev-serviceaccount.yml.j2, dest: dev-sa.yml }
|
|
- { src: dev-role.yml.j2, dest: dev-role.yml }
|
|
- { src: dev-rolebinding.yml.j2, dest: dev-rolebinding.yml }
|
|
- { src: dev-clusterrole.yml.j2, dest: dev-clusterrole.yml }
|
|
- { src: dev-clusterrolebinding.yml.j2, dest: dev-clusterrolebinding.yml }
|
|
|
|
- name: DevAccess | Apply ServiceAccount
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dev-sa.yml
|
|
environment:
|
|
KUBECONFIG: "{{ dev_access_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _dev_sa
|
|
changed_when: "'created' in _dev_sa.stdout or 'configured' in _dev_sa.stdout"
|
|
|
|
- name: DevAccess | Apply Role
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dev-role.yml
|
|
environment:
|
|
KUBECONFIG: "{{ dev_access_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _dev_role
|
|
changed_when: "'created' in _dev_role.stdout or 'configured' in _dev_role.stdout"
|
|
|
|
- name: DevAccess | Apply RoleBinding
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dev-rolebinding.yml
|
|
environment:
|
|
KUBECONFIG: "{{ dev_access_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _dev_rb
|
|
changed_when: "'created' in _dev_rb.stdout or 'configured' in _dev_rb.stdout"
|
|
|
|
- name: DevAccess | Apply ClusterRole (namespace reader)
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dev-clusterrole.yml
|
|
environment:
|
|
KUBECONFIG: "{{ dev_access_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _dev_cr
|
|
changed_when: "'created' in _dev_cr.stdout or 'configured' in _dev_cr.stdout"
|
|
|
|
- name: DevAccess | Apply ClusterRoleBinding (namespace reader)
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dev-clusterrolebinding.yml
|
|
environment:
|
|
KUBECONFIG: "{{ dev_access_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _dev_crb
|
|
changed_when: "'created' in _dev_crb.stdout or 'configured' in _dev_crb.stdout"
|