# Standards: 1.8
---
# Run playbook
#   ansible-playbook -i test-inventory test.yml
# During active development, you can re-use the same
# environment setup:
#   ansible-playbook -i test-inventory test.yml --skip-tags 'environment-setup'
- name: setup environment
  hosts: masters
  tasks:
  - name: cleanup existing cluster
    command: >
      oc cluster down
    register: cmd_cluster_down
    changed_when: cmd_cluster_down.rc == 0

  - name: bring up new cluster
    command: >
      oc cluster up
      --image {{ osbs_test_ocp_image | default('registry.access.redhat.com/openshift3/ose') }}
      --version {{ osbs_test_ocp_version | default('v3.7') }}
    register: cmd_cluster_up
    changed_when: cmd_cluster_up.rc == 0

  - name: login as admin
    command: >
      oc login -u system:admin
    register: cmd_login_admin
    changed_when: cmd_login_admin.rc == 0

  - name: cleanup tmp folder
    file:
      path: tmp
      state: absent

  - name: setup tmp folder
    file:
      path: tmp
      state: directory

  tags:
  - environment-setup

- name: setup worker namespace
  hosts: masters
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-worker
    osbs_nodeselector: "worker=true"
    osbs_service_accounts:
    - orchestrator

- name: test worker namespace
  hosts: masters
  tasks:
  - name: namespace worker created
    command: >
      oc get project test-worker
    changed_when: false

  - name: orchestrator service account created in worker namespace
    command: >
      oc -n test-worker get serviceaccount orchestrator
    changed_when: false

  - name: expected rolebindings created in worker namespace
    command: >
      oc -n test-worker get rolebinding {{ item }}
    with_items:
    - osbs-admin
    - osbs-custom-build-serviceaccounts
    - osbs-readonly
    - osbs-readwrite
    - osbs-readwrite-serviceaccounts
    changed_when: false

  - name: nodeselector exists
    shell: >
       oc get namespace test-worker -o json |grep 'node-selector'
    register: node_selector_exists
    failed_when: "'node-selector' not in node_selector_exists.stdout"

- name: setup orchestrator namespace
  hosts: masters
  tags:
    orchestrator
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_generated_config_path: tmp
    osbs_namespace: test-orchestrator
    osbs_orchestrator: true

- name: test orchestrator namespace
  hosts: masters
  tags:
    orchestrator
  tasks:
  - name: reactor config secret generated
    stat:
      path: tmp/test-orchestrator-reactor-config-secret.yml
    register: stat_reactor_config_secret
    changed_when: false

  - name: fail if reactor config secret was generated
    fail:
      msg: Reactor config secret file not created!
    when: not stat_reactor_config_secret.stat.exists

  - name: client-config-secret was generated properly
    command: >
      diff {{ playbook_dir }}/files/expected-client-config-secret.conf
      {{ playbook_dir }}/tmp/test-orchestrator-client-config-secret.conf
    changed_when: false

  - name: reactor config maps were generated properly
    command: >
      diff {{ playbook_dir }}/files/expected-{{ item }}.yml
      {{ playbook_dir }}/tmp/test-host-test-orchestrator-{{ item }}.yml
    changed_when: false
    with_items:
    - reactor-config-map-ppc64le-on-premise
    - reactor-config-map-scratch-ppc64le-on-premise
    - reactor-config-map-scratch-x86-64-aws
    - reactor-config-map-scratch-x86-64-azure
    - reactor-config-map-scratch-x86-64-on-premise
    - reactor-config-map-scratch
    - reactor-config-map-x86-64-aws
    - reactor-config-map-x86-64-azure
    - reactor-config-map-x86-64-on-premise
    - reactor-config-map
    register: cmd_diff_config_maps

  - name: reactor config mpas were created
    command: oc -n test-orchestrator get configmaps {{ item.item }}
    changed_when: false
    with_items: "{{ cmd_diff_config_maps.results }}"

- name: setup namespace as non admin
  hosts: masters
  pre_tasks:
  - name: Login with non cluster admin account
    command: >
      oc login -u non-admin -p non-admin
    register: cmd_login_non_admin
    changed_when: cmd_login_non_admin.rc == 0
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-non-admin
    osbs_is_admin: false
    osbs_service_accounts:
    - orchestrator
  post_tasks:
  - name: Log back in with cluster admin account
    command: >
      oc login -u system:admin
    register: cmd_login_admin
    changed_when: cmd_login_admin.rc == 0
  tags:
  - wip

- name: test non-admin namespace
  hosts: masters
  tasks:
  - name: namespace non-admin created
    command: >
      oc get project test-non-admin
    changed_when: false

  - name: orchestrator service account created in non-admin namespace
    command: >
      oc -n test-non-admin get serviceaccount orchestrator
    changed_when: false

  - name: custom builds roles NOT created in non-admin namespace
    command: >
      oc -n test-non-admin get role osbs-custom-build
    register: cmd_role
    failed_when: ('No resources found' not in cmd_role.stderr) and ('NotFound' not in cmd_role.stderr)
    changed_when: false

  - name: custom rolebindings NOT created in non-admin namespace
    command: >
      oc -n test-non-admin get rolebinding {{ item }}
    register: cmd_rolebinding
    failed_when: ('No resources found' not in cmd_rolebinding.stderr) and ('NotFound' not in cmd_rolebinding.stderr)
    with_items:
    - osbs-admin
    - osbs-custom-build-serviceaccounts
    - osbs-readonly
    - osbs-readwrite
    - osbs-readwrite-serviceaccounts
    changed_when: false
  tags:
  - wip

- name: create limitrange namespace
  hosts: masters
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-limitrange
    osbs_cpu_limitrange: '100m'

- name: test limitrange namespace
  hosts: masters
  tasks:
  - name: namespace limitrange created
    command: >
      oc get project test-limitrange
    changed_when: false

  - name: limitrange created
    command: >
      oc -n test-limitrange get limitrange cpureq
    changed_when: false

- name: update limitrange namespace
  hosts: masters
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-limitrange
    # No osbs_cpu_limitrage provided should trigger removal

- name: test updated limitrange namespace
  hosts: masters
  tasks:
  - name: limitrange deleted
    command: >
      oc -n test-limitrange get limitrange cpureq
    register: cmd_limitrange
    failed_when: ('No resources found' not in cmd_limitrange.stderr) and ('NotFound' not in cmd_limitrange.stderr)
    changed_when: false

- name: setup policybinding dedicated-admin namespace
  hosts: masters
  pre_tasks:
  - name: login as admin
    command: >
      oc login -u system:admin
    register: cmd_login_admin
    changed_when: cmd_login_admin.rc == 0
  - name: Create dedicated-poject-admin clusterrole
    command: >
      oc create -f {{ playbook_dir }}/files/dedicated-project-admin.yaml
    register: cmd_create_clusterrole
    changed_when: cmd_create_clusterrole.rc == 0
  - name: Create the namespace as cluster admin
    command: >
      oc new-project test-policybinding-dedicated-admin
    register: cmd_pre_create_namespace
    changed_when: cmd_pre_create_namespace.rc == 0
  - name: Create dedicated-admin user
    command: >
      oc -n test-policybinding-dedicated-admin
      create user dedicated-admin
    register: cmd_create_user
    changed_when: cmd_create_user.rc == 0
  - name: Add dedicated-project-admin role to dedicated-admin
    command: >
      oc -n test-policybinding-dedicated-admin
      policy add-role-to-user dedicated-project-admin dedicated-admin
    register: cmd_role_dedicated_project_admin
    changed_when: cmd_role_dedicated_project_admin.rc == 0
  - name: Create policybinding as cluster admin
    command: >
      oc -n test-policybinding-dedicated-admin
      create policybinding test-policybinding-dedicated-admin
    register: cmd_pre_create_policybinding
    changed_when: cmd_pre_create_policybinding.rc == 0
  # This is only needed because the project was created
  # by a different user: system:admin.
  - name: Give dedicated-admin user project admin access
    command: >
      oc -n test-policybinding-dedicated-admin
      adm policy add-role-to-user admin dedicated-admin
    register: cmd_role_project_admin
    changed_when: cmd_role_project_admin.rc == 0
  - name: Login with non cluster admin account
    command: >
      oc login -u dedicated-admin -p dedicated-admin
    register: cmd_login_dedicated_admin
    changed_when: cmd_login_dedicated_admin.rc == 0
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-policybinding-dedicated-admin
    osbs_is_admin: true
    osbs_service_accounts:
    - orchestrator
  post_tasks:
  - name: Log back in with cluster admin account
    command: >
      oc login -u system:admin
    register: cmd_login_admin
    changed_when: cmd_login_admin.rc == 0
  tags:
  - wip

- name: test policybinding dedicated-admin namespace
  hosts: masters
  tasks:
  - name: custom rolebindings created in dedicated-admin namespace
    command: >
      oc -n test-policybinding-dedicated-admin get rolebinding {{ item }}
    register: cmd_rolebinding
    with_items:
    - osbs-admin
    - osbs-admin
    - osbs-custom-build-admin
    - osbs-custom-build-readwrite
    - osbs-custom-build-serviceaccounts
    - osbs-readonly
    - osbs-readwrite
    - osbs-readwrite-serviceaccounts
    changed_when: false
  tags:
  - wip

- name: setup users and groups in namespace
  hosts: masters
  roles:
  - role: "{{ playbook_dir }}/../."
    osbs_kubeconfig_path: "{{ lookup('env','HOME') }}/.kube/config"
    osbs_openshift_home: tmp
    osbs_namespace: test-users-and-groups
    osbs_nodeselector: "worker=true"
    osbs_admin_groups:
    - admin-group
    osbs_admin_users:
    - admin-user
    osbs_cluster_reader_groups:
    - cluster-reader-group
    osbs_cluster_reader_users:
    - cluster-reader-user
    osbs_readonly_groups:
    - readonly-group
    osbs_readonly_users:
    - readonly-user
    osbs_readwrite_groups:
    - readwrite-group
    osbs_readwrite_users:
    - readwrite-user

- name: test users and groups namespace
  hosts: masters
  vars:
    osbs_users_groups_info:
    - role_name: osbs-admin
      type: rolebinding
      expected: User Groupadmin-user admin-group
    - role_name: osbs-readonly
      type: rolebinding
      expected: User Groupreadonly-user readonly-group
    - role_name: osbs-readwrite
      type: rolebinding
      expected: User Groupreadwrite-user readwrite-group
    - role_name: osbs-cluster-reader
      type: clusterrolebinding
      expected: User Groupcluster-reader-user cluster-reader-group
  tasks:
  - name: query rolebindings
    command: >
      oc -n test-users-and-groups get {{ item.type }} {{ item.role_name }}
      -o jsonpath='{.subjects[*].kind}{.subjects[*].name}'
    register: osbs_rolebindings
    changed_when: false
    with_items: "{{ osbs_users_groups_info }}"

  - name: verify rolebindings
    fail:
      msg: "{{ item.1.type }} {{ item.1.role_name }} not as expected"
    when: "item.0.stdout != item.1.expected"
    with_together:
    - "{{ osbs_rolebindings.results }}"
    - "{{ osbs_users_groups_info }}"
