summaryrefslogtreecommitdiffstats
path: root/roles/openshift_aws_sg
diff options
context:
space:
mode:
authorScott Dodson <sdodson@redhat.com>2017-08-23 14:19:32 -0400
committerGitHub <noreply@github.com>2017-08-23 14:19:32 -0400
commit6968359e77172a8a332d95b5cd146e475d688c7e (patch)
tree71546b462e798c54b7711abc816165ec3689a326 /roles/openshift_aws_sg
parent66f5e69759542ab8a2b5a5698c192894d9274699 (diff)
parent435bbcb4af02ddedaa2ebcbea48b00f2bbf4d164 (diff)
downloadopenshift-6968359e77172a8a332d95b5cd146e475d688c7e.tar.gz
openshift-6968359e77172a8a332d95b5cd146e475d688c7e.tar.bz2
openshift-6968359e77172a8a332d95b5cd146e475d688c7e.tar.xz
openshift-6968359e77172a8a332d95b5cd146e475d688c7e.zip
Merge pull request #5011 from kwoodson/provision
AWS Provisioning with scale groups.
Diffstat (limited to 'roles/openshift_aws_sg')
-rw-r--r--roles/openshift_aws_sg/README.md59
-rw-r--r--roles/openshift_aws_sg/defaults/main.yml48
-rw-r--r--roles/openshift_aws_sg/tasks/main.yml53
3 files changed, 160 insertions, 0 deletions
diff --git a/roles/openshift_aws_sg/README.md b/roles/openshift_aws_sg/README.md
new file mode 100644
index 000000000..eeb76bbb6
--- /dev/null
+++ b/roles/openshift_aws_sg/README.md
@@ -0,0 +1,59 @@
+openshift_aws_sg
+=========
+
+Ansible role to create an aws security groups
+
+Requirements
+------------
+
+Ansible Modules:
+
+
+Role Variables
+--------------
+
+- r_openshift_aws_sg_clusterid: myclusterid
+- r_openshift_aws_sg_region: us-east-1
+- r_openshift_aws_sg_type: master|infra|compute
+```yaml
+# defaults/main.yml
+ default:
+ name: "{{ r_openshift_aws_sg_clusterid }}"
+ desc: "{{ r_openshift_aws_sg_clusterid }} default"
+ rules:
+ - proto: tcp
+ from_port: 22
+ to_port: 22
+ cidr_ip: 0.0.0.0/0
+ - proto: all
+ from_port: all
+ to_port: all
+ group_name: "{{ r_openshift_aws_sg_clusterid }}"
+```
+
+
+Dependencies
+------------
+
+
+Example Playbook
+----------------
+```yaml
+- name: create security groups for master
+ include_role:
+ name: openshift_aws_sg
+ vars:
+ r_openshift_aws_sg_clusterid: mycluster
+ r_openshift_aws_sg_region: us-east-1
+ r_openshift_aws_sg_type: master
+```
+
+License
+-------
+
+Apache 2.0
+
+Author Information
+------------------
+
+Openshift
diff --git a/roles/openshift_aws_sg/defaults/main.yml b/roles/openshift_aws_sg/defaults/main.yml
new file mode 100644
index 000000000..9c480d337
--- /dev/null
+++ b/roles/openshift_aws_sg/defaults/main.yml
@@ -0,0 +1,48 @@
+---
+r_openshift_aws_sg_sg:
+ default:
+ name: "{{ r_openshift_aws_sg_clusterid }}"
+ desc: "{{ r_openshift_aws_sg_clusterid }} default"
+ rules:
+ - proto: tcp
+ from_port: 22
+ to_port: 22
+ cidr_ip: 0.0.0.0/0
+ - proto: all
+ from_port: all
+ to_port: all
+ group_name: "{{ r_openshift_aws_sg_clusterid }}"
+ master:
+ name: "{{ r_openshift_aws_sg_clusterid }}_master"
+ desc: "{{ r_openshift_aws_sg_clusterid }} master instances"
+ rules:
+ - proto: tcp
+ from_port: 80
+ to_port: 80
+ cidr_ip: 0.0.0.0/0
+ - proto: tcp
+ from_port: 443
+ to_port: 443
+ cidr_ip: 0.0.0.0/0
+ compute:
+ name: "{{ r_openshift_aws_sg_clusterid }}_compute"
+ desc: "{{ r_openshift_aws_sg_clusterid }} compute node instances"
+ infra:
+ name: "{{ r_openshift_aws_sg_clusterid }}_infra"
+ desc: "{{ r_openshift_aws_sg_clusterid }} infra node instances"
+ rules:
+ - proto: tcp
+ from_port: 80
+ to_port: 80
+ cidr_ip: 0.0.0.0/0
+ - proto: tcp
+ from_port: 443
+ to_port: 443
+ cidr_ip: 0.0.0.0/0
+ - proto: tcp
+ from_port: 30000
+ to_port: 32000
+ cidr_ip: 0.0.0.0/0
+ etcd:
+ name: "{{ r_openshift_aws_sg_clusterid }}_etcd"
+ desc: "{{ r_openshift_aws_sg_clusterid }} etcd instances"
diff --git a/roles/openshift_aws_sg/tasks/main.yml b/roles/openshift_aws_sg/tasks/main.yml
new file mode 100644
index 000000000..2294fdcc9
--- /dev/null
+++ b/roles/openshift_aws_sg/tasks/main.yml
@@ -0,0 +1,53 @@
+---
+- name: Validate role inputs
+ fail:
+ msg: Please ensure to pass the correct variables
+ when:
+ - r_openshift_aws_sg_region is undefined
+ - r_openshift_aws_sg_region is undefined
+
+
+- name: Fetch the VPC for vpc.id
+ ec2_vpc_net_facts:
+ region: "{{ r_openshift_aws_sg_region }}"
+ filters:
+ "tag:Name": "{{ r_openshift_aws_sg_clusterid }}"
+ register: vpcout
+
+- name: Create default security group for cluster
+ ec2_group:
+ name: "{{ r_openshift_aws_sg_sg.default.name }}"
+ description: "{{ r_openshift_aws_sg_sg.default.desc }}"
+ region: "{{ r_openshift_aws_sg_region }}"
+ vpc_id: "{{ vpcout.vpcs[0].id }}"
+ rules: "{{ r_openshift_aws_sg_sg.default.rules | default(omit, True)}}"
+ register: sg_default_created
+
+- name: create the node group sgs
+ ec2_group:
+ name: "{{ item.name}}"
+ description: "{{ item.desc }}"
+ rules: "{{ item.rules if 'rules' in item else [] }}"
+ region: "{{ r_openshift_aws_sg_region }}"
+ vpc_id: "{{ vpcout.vpcs[0].id }}"
+ register: sg_create
+ with_items:
+ - "{{ r_openshift_aws_sg_sg[r_openshift_aws_sg_type]}}"
+
+- name: create the k8s sgs for the node group
+ ec2_group:
+ name: "{{ item.name }}_k8s"
+ description: "{{ item.desc }} for k8s"
+ region: "{{ r_openshift_aws_sg_region }}"
+ vpc_id: "{{ vpcout.vpcs[0].id }}"
+ register: k8s_sg_create
+ with_items:
+ - "{{ r_openshift_aws_sg_sg[r_openshift_aws_sg_type] }}"
+
+- name: tag sg groups with proper tags
+ ec2_tag:
+ tags:
+ KubernetesCluster: "{{ r_openshift_aws_sg_clusterid }}"
+ resource: "{{ item.group_id }}"
+ region: "{{ r_openshift_aws_sg_region }}"
+ with_items: "{{ k8s_sg_create.results }}"