convenient utility to set up roles for openshift ROSA clusters

setup-roles.sh

#!/usr/bin/env bash

usage() {
	printf "%s" "
usage: $0 [-h|--help]

sets up ocm, user and account roles for you, so you don't have to. you're welcome.

here's what it does:

- attempts to create an ocm-role
- if ocm-role creation failed:
  - if failed due to an already linked role:
    - unlinks the existing ocm-role
  - if failed for any other reason:
    - searches for existing ocm-roles
    - if ocm-roles found:
      - deletes all existing ocm-roles
  - creates an ocm-role
- creates a user-role
- creates account-roles

"
	exit 0
}

main() {
	local status
	local output
	local linked_ocm_role_arn

	validate_dependencies 'jq' 'rosa'

	if [[ $1 =~ -h|--help ]]; then
		usage
	fi

	log "hi!"
	log

	log "creating an ocm-role..."
	output=$(create_ocm_role)
	status=$?
	status_log $status "ocm-role created" "ocm-role creation failed"

	if ((status == 1)); then
		linked_ocm_role_arn="$(extract_linked_ocm_role_arn "$output")"
		if [ -n "$linked_ocm_role_arn" ]; then
			log "unlinking existing ocm-role ($linked_ocm_role_arn)"
			unlink_ocm_role "$linked_ocm_role_arn" >/dev/null
			status=$?
			status_log $status "ocm-role unlinked" "ocm-role unlink failed"
		else
			log "searching for existing ocm-roles..."
			has_ocm_role_arns >/dev/null
			status=$?
			status_log $status "ocm-roles found" "no ocm-roles found"
			if ((status == 0)); then
				log "deleting all existing ocm-roles..."
				get_ocm_role_arns | delete_ocm_roles
				status=$?
				status_log $status "all existing ocm-roles were deleted" "failed to delete existing ocm-roles"
			fi
		fi

		if ((status != 0)); then
			abort $status "$output"
		fi

		log "creating an ocm-role..."
		create_ocm_role >/dev/null
		status=$?
		status_log $status "ocm-role created" "ocm-role creation failed"
	fi

	if ((status != 0)); then
		abort $status "$output"
	fi

	log "creating user-role..."
	create_user_role >/dev/null
	status=$?
	status_log $status "user-role created" "user-role creation failed"

	log "creating account-roles..."
	create_account_roles >/dev/null
	status=$?
	status_log $status "account-roles created" "account-role creation failed"

	log
	log "bye :)"
}

create_ocm_role() {
	rosa create ocm-role --mode auto --yes 2>&1
}

create_user_role() {
	rosa create user-role --mode auto --yes 2>&1
}

create_account_roles() {
	rosa create account-roles --mode auto --yes 2>&1
}

unlink_ocm_role() {
	local role_arn="$1"
	rosa unlink ocm-role --role-arn "$role_arn" --yes 2>&1
}

get_ocm_role_arns() {
	rosa list ocm-role --output json | jq 'map(.RoleARN) | join("\n")' --raw-output
}

has_ocm_role_arns() {
	get_ocm_role_arns >/dev/null 2>&1
}

delete_ocm_roles() {
	local role_arns
	role_arns=$(cat -)

	while read -r arn; do
		rosa delete ocm-role --mode auto --role-arn "$arn" --yes >/dev/null 2>&1
	done <<< "$role_arns"
}

extract_linked_ocm_role_arn() {
	local error_output="$1"
	echo "$error_output" | grep 'you have to unlink the ocm-role' | grep -Eo "arn:[^']+"
}

validate_dependencies() {
	for cmd in "$@"; do
		if ! type "$cmd" >/dev/null 2>&1; then
			log "'$cmd' was not found, but is required for running this script."
			log "please install it using your system's package-manager, and try again."
			exit 1
		fi
	done
}

abort() {
	local status=$1
	local output="$2"

	log "something went horribly wrong :/"
	log "status: $status"
	log "last command output: $output"
}

log() {
	echo " [setup-roles] $1"
}

status_log() {
	local status
	status=$1
	success_message=$2
	failure_message=$3
	if ((status == 0)); then
		log "$success_message"
	else
		log "$failure_message"
	fi
}


main "$@"