From a3f2626530456e9eae9492758900a30e8d641b8b Mon Sep 17 00:00:00 2001
From: Russell Teague <rteague@redhat.com>
Date: Tue, 14 Mar 2017 08:25:21 -0400
Subject: Add router svcacct cluster-reader role
---
roles/openshift_hosted/tasks/router/router.yml | 9 +++++++++
1 file changed, 9 insertions(+)
(limited to 'roles/openshift_hosted')
diff --git a/roles/openshift_hosted/tasks/router/router.yml b/roles/openshift_hosted/tasks/router/router.yml
index 969fb27a9..0861b9ec2 100644
--- a/roles/openshift_hosted/tasks/router/router.yml
+++ b/roles/openshift_hosted/tasks/router/router.yml
@@ -37,6 +37,15 @@
resource_name: hostnetwork
with_items: "{{ openshift_hosted_routers }}"
+- name: Set additional permissions for router service account
+ oc_adm_policy_user:
+ user: "system:serviceaccount:{{ item.namespace }}:{{ item.serviceaccount }}"
+ namespace: "{{ item.namespace }}"
+ resource_kind: cluster-role
+ resource_name: cluster-reader
+ when: item.namespace == 'default'
+ with_items: "{{ openshift_hosted_routers }}"
+
- name: Create OpenShift router
oc_adm_router:
name: "{{ item.name }}"
--
cgit v1.2.3