kmurudi

---


- hosts: master.unset.ocp-admin.aws.openshifttestdrive.com


  tasks:

    
    - name: Checking status of all the nodes

kmurudi

---
- hosts: 
  
  tasks: 
    - name: Running diagnostics test and display errors
      command: oc adm diagnostics
      become: root
...

kmurudi

---


- name: Verifying the OpenShift installation lab module - Verifying lab module-1
  hosts: masters

  tasks:
    
    - name: Checking if the 'oc version' is correct
      command: oc version

kmurudi

4.3 - Using external authentication providers

This lab module is about using external authentication providers and LDAP is one of them. Access to resources like a project in OCP can be controlled by using authentication methods like LDAP and only the allowed privileges can be mapped to a user or a certain group.

LDAP stands for Lightweight Directory Access Protocol. LDAP provides different levels of access to users based on their groups and privileges.

We have defined 4 groups for this lab :-

1. ose-user "Users with OpenShift access"

2. ose-normal-dev "Normal OpenShift users"

kmurudi

---
kind: LDAPSyncConfig
apiVersion: v1
url: ldap://idm.unset.ocp-admin.aws.openshifttestdrive.com
ca: /etc/origin/master/ipa-ca.crt
bindDN: uid=admin,cn=users,cn=accounts,dc=unset,dc=ocp-admin,dc=aws,dc=openshifttestdrive,dc=com
bindPassword: ldapadmin
rfc2307:
  groupsQuery:
    baseDN: cn=groups,cn=accounts,dc=unset,dc=ocp-admin,dc=aws,dc=openshifttestdrive,dc=com

kmurudi

---

- hosts: masters

  tasks:
   
    - name: ssh into idm and echo tp
      command: ldapsearch -h idm -D uid=admin,cn=users,cn=accounts,dc=unset,dc=ocp-admin,dc=aws,dc=openshifttestdrive,dc=com -w ldapadmin
      register: result
      delegate_to: idm.unset.ocp-admin.aws.openshifttestdrive.com

kmurudi

---

- name: Automation of module 3.3 (if user wants to skip)
  hosts: masters
  become_user: root
  
  tasks: 
    - name: syncing all the groups using 'oc adm' CLI tool and applying changes to the system
      command: oc adm groups sync --sync-config=/home/ec2-user/groupsync.yaml --confirm
      

kmurudi

---

- hosts: masters

  tasks:
   
    - name: Login as cluster:admin so as to list all groups and projects
      command: oc login -u teamuser1 -p openshift
      become_user : root
        

kmurudi

apiVersion: v1
kind: Template
metadata:
  creationTimestamp: null
  name: project-request
objects:
- apiVersion: v1
  kind: Project
  metadata:
    annotations:

kmurudi

---
- name: Verifying the creation of project and quota and limitranges applied to it
  hosts: masters
  
  tasks:
    - name: Login as system:admin to create projects
      command: oc login -u system:admin
      
    - name: Checking the creation of a new project
      command: oc new-project my-project