Merge pull request #6462 from kwoodson/daemonset_config

Automatic merge from submit-queue.

Laying config files down in a daemonset pod.

Work to have daemonset config laydown files for nodes used with golden images.

Based on the original work from @smarterclayton https://github.com/openshift/origin/pull/17351

4 files changed, 222 insertions, 0 deletions

diff --git a/roles/openshift_daemonset_config/defaults/main.yml b/roles/openshift_daemonset_config/defaults/main.yml
new file mode 100644
index 000000000..ebe5671d2
--- /dev/null
+++ b/roles/openshift_daemonset_config/defaults/main.yml
@@ -0,0 +1,19 @@
+---
+openshift_daemonset_config_namespace: openshift-node
+openshift_daemonset_config_daemonset_name: ops-node-config
+openshift_daemonset_config_configmap_name: "{{ openshift_daemonset_config_daemonset_name }}"
+openshift_daemonset_config_node_selector:
+  config: config
+openshift_daemonset_config_sa_name: ops
+openshift_daemonset_config_configmap_files: {}
+openshift_daemonset_config_configmap_literals: {}
+openshift_daemonset_config_monitoring: False
+openshift_daemonset_config_interval: 300
+openshift_daemonset_config_script: config.sh
+openshift_daemonset_config_secret_name: operations-config-secret
+openshift_daemonset_config_secrets: {}
+openshift_daemonset_config_runasuser: 0
+openshift_daemonset_config_privileged: True
+openshift_daemonset_config_resources:
+  cpu: 10m
+  memory: 10Mi
diff --git a/roles/openshift_daemonset_config/meta/main.yml b/roles/openshift_daemonset_config/meta/main.yml
new file mode 100644
index 000000000..d2bbd2576
--- /dev/null
+++ b/roles/openshift_daemonset_config/meta/main.yml
@@ -0,0 +1,3 @@
+---
+dependencies:
+- lib_openshift
diff --git a/roles/openshift_daemonset_config/tasks/main.yml b/roles/openshift_daemonset_config/tasks/main.yml
new file mode 100644
index 000000000..450cc9dca
--- /dev/null
+++ b/roles/openshift_daemonset_config/tasks/main.yml
@@ -0,0 +1,58 @@
+---
+- name: add a sa
+  oc_serviceaccount:
+    name: "{{ openshift_daemonset_config_sa_name }}"
+    namespace: "{{ openshift_daemonset_config_namespace }}"
+
+- name: add sa to privileged scc
+  oc_adm_policy_user:
+    namespace: "{{ openshift_daemonset_config_namespace }}"
+    resource_kind: scc
+    resource_name: privileged
+    state: present
+    user: "system:serviceaccount:{{ openshift_daemonset_config_namespace }}:{{ openshift_daemonset_config_sa_name }}"
+
+- name: copy template to disk
+  template:
+    dest: "/tmp/{{ item.name }}"
+    src: "{{ item.name }}.j2"
+  with_items:
+  - name: daemonset.yml
+
+- name: copy files to disk
+  copy:
+    src: "{{ item.key }}"
+    dest: "{{ item.value }}"
+  with_dict: "{{ openshift_daemonset_config_configmap_files }}"
+
+- name: create the namespace
+  oc_project:
+    state: present
+    name: "{{ openshift_daemonset_config_namespace }}"
+
+- name: lay down secrets
+  oc_secret:
+    state: present
+    name: "{{ openshift_daemonset_config_secret_name }}"
+    namespace: "{{ openshift_daemonset_config_namespace }}"
+    delete_after: true
+    contents: "{{ openshift_daemonset_config_secrets }}"
+  when:
+  - openshift_daemonset_config_secrets != {}
+
+- name: create the configmap
+  oc_configmap:
+    state: present
+    name: "{{ openshift_daemonset_config_configmap_name }}"
+    namespace: "{{ openshift_daemonset_config_namespace }}"
+    from_literal: "{{ openshift_daemonset_config_configmap_literals }}"
+    from_file: "{{ openshift_daemonset_config_configmap_files }}"
+
+- name: deploy daemonset
+  oc_obj:
+    state: present
+    namespace: "{{ openshift_daemonset_config_namespace }}"  # openshift-node??
+    name: "{{ openshift_daemonset_config_daemonset_name }}"
+    kind: daemonset
+    files:
+    - /tmp/daemonset.yml
diff --git a/roles/openshift_daemonset_config/templates/daemonset.yml.j2 b/roles/openshift_daemonset_config/templates/daemonset.yml.j2
new file mode 100644
index 000000000..9792f6d16
--- /dev/null
+++ b/roles/openshift_daemonset_config/templates/daemonset.yml.j2
@@ -0,0 +1,142 @@
+---
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+  name: {{ openshift_daemonset_config_daemonset_name }}
+  annotations:
+    kubernetes.io/description: |
+      This daemon set manages the operational configuration for a cluster and ensures all nodes have
+      a concrete set of config in place. It could also use a local ansible run against the /host directory.
+spec:
+  selector:
+    matchLabels:
+      app: {{ openshift_daemonset_config_daemonset_name }}
+      confighosts: ops
+      ops.openshift.io/role: operations
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ openshift_daemonset_config_daemonset_name }}
+        confighosts: ops
+        ops.openshift.io/role: operations
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+    spec:
+{% if openshift_daemonset_config_node_selector is defined and openshift_daemonset_config_node_selector != {} %}
+      nodeSelector: {{ openshift_daemonset_config_node_selector | to_json }}
+{% endif %}
+      serviceAccountName: {{ openshift_daemonset_config_sa_name }}
+      hostNetwork: true
+      hostPID: true
+      hostIPC: true
+      containers:
+      - name: config
+        image: centos:7
+        env:
+        - name: RESYNC_INTERVAL
+          value: "{{ openshift_daemonset_config_interval }}"
+        command:
+        - /bin/bash
+        - -c
+        - |
+          #!/bin/sh
+          set -o errexit
+
+          while true; do
+
+            # execute user defined script
+            sh /opt/config/{{ openshift_daemonset_config_script }}
+
+            # sleep for ${RESYNC_INTERVAL} minutes, then loop. if we fail Kubelet will restart us again
+            echo "Success, sleeping for ${RESYNC_INTERVAL}s"
+            exec sleep ${RESYNC_INTERVAL}
+
+          # Return to perform the config
+          done
+        securityContext:
+          # Must be root to modify host system
+          runAsUser: {{ openshift_daemonset_config_runasuser }}
+          # Permission could be reduced by selecting an appropriate SELinux policy that allows
+          # us to update the named directories
+          privileged: {{ openshift_daemonset_config_privileged }}
+        volumeMounts:
+        # Directory which contains the host volume.
+        - mountPath: /host
+          name: host
+        # Our node configuration
+        - mountPath: /opt/config
+          name: config
+{% if openshift_daemonset_config_secrets != {} %}
+        # Our delivered secrets
+        - mountPath: /opt/secrets
+          name: secrets
+{% endif %}
+        resources:
+          requests:
+            cpu: {{ openshift_daemonset_config_resources.cpu }}
+            memory: {{ openshift_daemonset_config_resources.memory }}
+{% if openshift_daemonset_config_monitoring %}
+      - name: monitoring
+        image: openshifttools/oso-centos7-host-monitoring:latest
+        securityContext:
+          # Must be root to read content
+          runAsUser: 0
+          privileged: true
+
+        volumeMounts:
+        - mountPath: /host
+          name: host
+          readOnly: true
+        - mountPath: /etc/localtime
+          subPath: etc/localtime
+          name: host
+          readOnly: true
+        - mountPath: /sys
+          subPath: sys
+          name: host
+          readOnly: true
+        - mountPath: /var/run/docker.sock
+          subPath: var/run/docker.sock
+          name: host
+          readOnly: true
+        - mountPath: /var/run/openvswitch
+          subPath: var/run/openvswitch
+          name: host
+          readOnly: true
+        - mountPath: /etc/origin
+          subPath: etc/origin
+          name: host
+          readOnly: true
+        - mountPath: /usr/bin/oc
+          subPath: usr/bin/oc
+          name: host
+          readOnly: true
+          name: host
+          readOnly: true
+        - mountPath: /host/var/cache/yum
+          subPath: var/cache/yum
+          name: host
+        - mountPath: /container_setup/monitoring-config.yml
+          subPath: monitoring-config.yaml
+          name: config
+        - mountPath: /opt/config
+          name: config
+        resources:
+          requests:
+            cpu: 10m
+            memory: 10Mi
+{% endif %}
+      volumes:
+      - name: config
+        configMap:
+          name: {{ openshift_daemonset_config_configmap_name }}
+{% if openshift_daemonset_config_secrets != {} %}
+      - name: secrets
+        secret:
+          secretName: {{ openshift_daemonset_config_secret_name }}
+{% endif %}
+      - name: host
+        hostPath:
+          path: /