Improve handling of filesystem permissions and other fixes

1 files changed, 13 insertions, 15 deletions

diff --git a/roles/ands_openshift/tasks/security_resources.yml b/roles/ands_openshift/tasks/security_resources.yml
index 5b80f1e..fd72240 100644
--- a/roles/ands_openshift/tasks/security_resources.yml
+++ b/roles/ands_openshift/tasks/security_resources.yml
@@ -1,7 +1,4 @@
 ---
-- name: Ensure OpenShift patch directory exists
-  file: path="{{ ands_openshift_patch_path }}" state="directory" mode=0644 owner=root group=root
-
 # No spaces in patch, otherwise escaping mess...
 - name: Patch group range in project configuration
   include_role: name="openshift_resource" tasks_from="patch.yml" 
@@ -9,7 +6,6 @@
     project: "{{ item.key }}" 
     resource: "ns/{{ item.key }}"
     patch: '{"metadata":{"annotations":{"openshift.io/sa.scc.supplemental-groups":"{{ item.value }}"}}}'
-    patch_path: "{{ ands_openshift_patch_path }}"
   with_dict: "{{ ands_openshift_gid_ranges | default({}) }}"
 
 - name: Patch uid range in project configuration
@@ -18,29 +14,31 @@
     project: "{{ item.key }}" 
     resource: "ns/{{ item.key }}"
     patch: '{"metadata":{"annotations":{"openshift.io/sa.scc.uid-range":"{{ item.value }}"}}}'
-    patch_path: "{{ ands_openshift_patch_path }}"
   with_dict: "{{ ands_openshift_uid_ranges | default({}) }}"
 
 - name: Restrict supplementalGroups
   include_role: name="openshift_resource" tasks_from="patch.yml" 
   vars:
-    project: "{{ item.key }}" 
+    project: "default" 
     resource: "scc/restricted"
-    modes: "{{ ands_openshift_gid_mode | default({}) }}"
-    mode: "{{ modes[item.key] | default(modes['ands_default'] | default(false)) }}"
+    mode: "{{ ands_openshift_groups_mode | default(false) }}"
     patch: '{"supplementalGroups":{"type":"{{mode}}"}}'
-    patch_path: "{{ ands_openshift_patch_path }}"
   when: mode != false
-  with_dict: "{{ ands_openshift_projects | default({}) }}"
+
+- name: Restrict fsGroup
+  include_role: name="openshift_resource" tasks_from="patch.yml" 
+  vars:
+    project: "default" 
+    resource: "scc/restricted"
+    mode: "{{ ands_openshift_gid_mode | default(false) }}"
+    patch: '{"fsGroup":{"type":"{{mode}}"}}'
+  when: mode != false
 
 - name: Configure runAsUser
   include_role: name="openshift_resource" tasks_from="patch.yml" 
   vars:
-    project: "{{ item.key }}" 
+    project: "default" 
     resource: "scc/restricted"
-    modes: "{{ ands_openshift_uid_mode | default({}) }}"
-    mode: "{{ modes[item.key] | default(modes['ands_default'] | default(false)) }}"
+    mode: "{{ ands_openshift_uid_mode | default(false) }}"
     patch: '{"runAsUser":{"type":"{{mode}}"}}'
-    patch_path: "{{ ands_openshift_patch_path }}"
   when: mode != false
-  with_dict: "{{ ands_openshift_projects | default({}) }}"