diff options
Diffstat (limited to 'roles/ands_openshift/tasks/security_resources.yml')
| -rw-r--r-- | roles/ands_openshift/tasks/security_resources.yml | 28 |
1 files changed, 13 insertions, 15 deletions
diff --git a/roles/ands_openshift/tasks/security_resources.yml b/roles/ands_openshift/tasks/security_resources.yml index 5b80f1e..fd72240 100644 --- a/roles/ands_openshift/tasks/security_resources.yml +++ b/roles/ands_openshift/tasks/security_resources.yml @@ -1,7 +1,4 @@ --- -- name: Ensure OpenShift patch directory exists - file: path="{{ ands_openshift_patch_path }}" state="directory" mode=0644 owner=root group=root - # No spaces in patch, otherwise escaping mess... - name: Patch group range in project configuration include_role: name="openshift_resource" tasks_from="patch.yml" @@ -9,7 +6,6 @@ project: "{{ item.key }}" resource: "ns/{{ item.key }}" patch: '{"metadata":{"annotations":{"openshift.io/sa.scc.supplemental-groups":"{{ item.value }}"}}}' - patch_path: "{{ ands_openshift_patch_path }}" with_dict: "{{ ands_openshift_gid_ranges | default({}) }}" - name: Patch uid range in project configuration @@ -18,29 +14,31 @@ project: "{{ item.key }}" resource: "ns/{{ item.key }}" patch: '{"metadata":{"annotations":{"openshift.io/sa.scc.uid-range":"{{ item.value }}"}}}' - patch_path: "{{ ands_openshift_patch_path }}" with_dict: "{{ ands_openshift_uid_ranges | default({}) }}" - name: Restrict supplementalGroups include_role: name="openshift_resource" tasks_from="patch.yml" vars: - project: "{{ item.key }}" + project: "default" resource: "scc/restricted" - modes: "{{ ands_openshift_gid_mode | default({}) }}" - mode: "{{ modes[item.key] | default(modes['ands_default'] | default(false)) }}" + mode: "{{ ands_openshift_groups_mode | default(false) }}" patch: '{"supplementalGroups":{"type":"{{mode}}"}}' - patch_path: "{{ ands_openshift_patch_path }}" when: mode != false - with_dict: "{{ ands_openshift_projects | default({}) }}" + +- name: Restrict fsGroup + include_role: name="openshift_resource" tasks_from="patch.yml" + vars: + project: "default" + resource: "scc/restricted" + mode: "{{ ands_openshift_gid_mode | default(false) }}" + patch: '{"fsGroup":{"type":"{{mode}}"}}' + when: mode != false - name: Configure runAsUser include_role: name="openshift_resource" tasks_from="patch.yml" vars: - project: "{{ item.key }}" + project: "default" resource: "scc/restricted" - modes: "{{ ands_openshift_uid_mode | default({}) }}" - mode: "{{ modes[item.key] | default(modes['ands_default'] | default(false)) }}" + mode: "{{ ands_openshift_uid_mode | default(false) }}" patch: '{"runAsUser":{"type":"{{mode}}"}}' - patch_path: "{{ ands_openshift_patch_path }}" when: mode != false - with_dict: "{{ ands_openshift_projects | default({}) }}" |