Add osbs-secret role to create secret for namedspaced cluster

Signed-off-by: Clement Verna <cverna@tutanota.com>

roles/osbs-secret/README.md

@@ -0,0 +1,70 @@
+osbs-secret
+===========
+
+This role imports various secrets, such as Pulp or Koji certificates, from
+filesystem into OpenShift. See the [OSBS
+documentation](https://github.com/projectatomic/osbs-client/blob/master/docs/secret.md)
+for more information.
+
+This role is part of
+[ansible-osbs](https://github.com/projectatomic/ansible-osbs/) playbook for
+deploying OpenShift build service. Please refer to that github repository for
+[documentation](https://github.com/projectatomic/ansible-osbs/blob/master/README.md)
+and [issue tracker](https://github.com/projectatomic/ansible-osbs/issues).
+
+Role Variables
+--------------
+
+The role imports the keys from the machine running ansible. You have to provide
+`osbs_secret_files` list, which enumerates what files to import. Elements of
+the list are dictionaries with two keys: `source` and `dest`. Source is the
+location of the file on the machine where ansible is run. Dest is the filename
+of the secret.
+
+    osbs_secret_files:
+    - source: /home/user/.pulp/pulp.cer
+      dest: pulp.cer
+    - source: /home/user/.pulp/pulp.key
+      dest: pulp.key
+
+The name of the secret in OpenShift is defined by the `osbs_secret_name`
+variable.
+
+    osbs_secret_name: pulpsecret
+
+The secret has to be associated with a service account. This service account
+can be set by the `osbs_secret_service_account` variable.
+
+    osbs_secret_service_account: builder
+
+We need a kubeconfig file on the remote machine in order to talk to OpenShift.
+Its location is contained in the `pulp_secret_kubeconfig`.
+
+    osbs_kubeconfig_path: /etc/origin/master/admin.kubeconfig
+
+Example Playbook
+----------------
+
+Following playbook imports the keys from my home directory on the machine where
+ansible is executed. You may need to run something like this after the current
+set of keys expires.
+
+    - hosts: builders
+      roles:
+      - role: osbs-secret
+        osbs_secret_name: pulpsecret
+        osbs_secret_files:
+        - source: /home/mmilata/.pulp/pulp.cer
+          dest: pulp.cer
+        - source: {{ pulp_secret_local_dir }}/pulp.key
+          dest: pulp.key
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Martin Milata <mmilata@redhat.com>

roles/osbs-secret/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+osbs_secret_name: pulpsecret
+osbs_secret_type: Opaque
+osbs_secret_service_account: builder
+osbs_secret_remote_dir: /var/lib/origin
+osbs_secret_can_fail: false
+
+osbs_secret_files:
+- source: /home/user/.pulp/pulp.cer
+  dest: pulp.cer
+- source: /home/user/.pulp/pulp.key
+  dest: pulp.key
+
+osbs_namespace: default
+osbs_kubeconfig_path: /etc/origin/master/admin.kubeconfig
+osbs_environment:
+  KUBECONFIG: "{{ osbs_kubeconfig_path }}"

roles/osbs-secret/handlers/main.yml

@@ -0,0 +1,22 @@
+---
+- name: import osbs secret
+  command: >
+    oc replace
+    --namespace={{ osbs_namespace }}
+    --force=true
+    --filename={{ osbs_secret_remote_dir }}/openshift-secret-{{ inventory_hostname }}-{{ osbs_namespace }}-{{ osbs_secret_name }}.yml
+  environment: "{{ osbs_environment }}"
+  notify: allow service account
+
+- name: allow service account
+  command: >
+    oc secrets
+    add serviceaccount/{{ osbs_secret_service_account }} secrets/{{ osbs_secret_name }}
+    --for=mount
+    --namespace={{ osbs_namespace }}
+  environment: "{{ osbs_environment }}"
+
+- name: delete secret resource file
+  file:
+    path: "{{ osbs_secret_remote_dir }}/openshift-secret-{{ inventory_hostname }}-{{ osbs_namespace }}-{{ osbs_secret_name }}.yml"
+    state: absent

roles/osbs-secret/meta/main.yml

@@ -0,0 +1,21 @@
+---
+galaxy_info:
+  author: Martin Milata
+  description: Import secrets from local filesystem into OpenShift.
+  company: Red Hat
+  issue_tracker_url: https://github.com/projectatomic/ansible-osbs/issues
+  license: BSD
+  min_ansible_version: 1.2
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  - name: Fedora
+    versions:
+    - 21
+    - 22
+  categories:
+  - cloud
+  - development
+  - packaging
+dependencies: []

roles/osbs-secret/tasks/main.yml

@@ -0,0 +1,40 @@
+---
+- set_fact:
+    osbs_secret_files_exist: true
+  tags:
+  - oc
+
+- set_fact:
+    osbs_secret_files_exist: false
+  when: lookup('file', lookup('first_found', [item.source, '/dev/null'])) == ''
+  with_items: "{{ osbs_secret_files }}"
+  tags:
+  - oc
+
+- fail:
+    msg: Some of the source secret files do not exist (and osbs_secret_can_fail is false)
+  when: not (osbs_secret_files_exist or osbs_secret_can_fail)
+  tags:
+  - oc
+
+- debug:
+    msg: Some of the source secret files do not exist, skipping import
+  when: not osbs_secret_files_exist
+  tags:
+  - oc
+
+- name: create secrets resource file
+  template:
+    src: openshift-secret.yml.j2
+    dest: "{{ osbs_secret_remote_dir }}/openshift-secret-{{ inventory_hostname }}-{{ osbs_namespace }}-{{ osbs_secret_name }}.yml"
+    mode: "0600"
+  when: osbs_secret_files_exist
+  notify:
+  - import osbs secret
+  - delete secret resource file
+  tags:
+  - oc
+
+- meta: flush_handlers
+  tags:
+  - oc

roles/osbs-secret/templates/openshift-secret.yml.j2

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ osbs_secret_name }}
+type: {{ osbs_secret_type }}
+data:
+{% for f in osbs_secret_files %}
+  {{ f.dest }}: {{ lookup('file', f.source) | b64encode }}
+{% endfor %}
+