diff options
| author | Jose A. Rivera <jarrpa@redhat.com> | 2017-09-29 22:45:10 -0500 |
|---|---|---|
| committer | Jose A. Rivera <jarrpa@redhat.com> | 2017-09-29 22:45:10 -0500 |
| commit | 4ab3e20e333d107163abe2a3c88f2aecae3fd77e (patch) | |
| tree | ce693d062a3b4b8e8936b779522bcb5dc546ce25 | |
| parent | 1cd0a0c1165a4f274b30d7570f2e3ab2009e0046 (diff) | |
| download | openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.gz openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.bz2 openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.tar.xz openshift-4ab3e20e333d107163abe2a3c88f2aecae3fd77e.zip | |
GlusterFS: make ServiceAccounts privileged when either glusterfs or heketi is native
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
| -rw-r--r-- | roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml | 11 | ||||
| -rw-r--r-- | roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml | 10 |
2 files changed, 11 insertions, 10 deletions
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml index 3f6dab78b..51724f979 100644 --- a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml +++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml @@ -18,6 +18,17 @@ node_selector: "{% if glusterfs_use_default_selector %}{{ omit }}{% endif %}" when: glusterfs_is_native or glusterfs_heketi_is_native or glusterfs_storageclass +- name: Add namespace service accounts to privileged SCC + oc_adm_policy_user: + user: "system:serviceaccount:{{ glusterfs_namespace }}:{{ item }}" + resource_kind: scc + resource_name: privileged + state: present + with_items: + - 'default' + - 'router' + when: glusterfs_is_native or glusterfs_heketi_is_native + - name: Delete pre-existing heketi resources oc_obj: namespace: "{{ glusterfs_namespace }}" diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml index 8c3e31fc9..932d06038 100644 --- a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml +++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml @@ -55,16 +55,6 @@ - glusterfs_wipe - item.stdout_lines | count > 0 -- name: Add service accounts to privileged SCC - oc_adm_policy_user: - user: "system:serviceaccount:{{ glusterfs_namespace }}:{{ item }}" - resource_kind: scc - resource_name: privileged - state: present - with_items: - - 'default' - - 'router' - - name: Label GlusterFS nodes oc_label: name: "{{ hostvars[item].openshift.node.nodename }}" |