community.okd.openshift_auth module – Authenticate to OpenShift clusters which require an explicit login step
Note
This module is part of the community.okd collection (version 3.0.1).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install community.okd
.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: community.okd.openshift_auth
.
New in community.okd 0.2.0
Synopsis
This module handles authenticating to OpenShift clusters requiring explicit authentication procedures, meaning ones where a client logs in (obtains an authentication token), performs API operations using said token and then logs out (revokes the token).
On the other hand a popular configuration for username+password authentication is one utilizing HTTP Basic Auth, which does not involve any additional login/logout steps (instead login credentials can be attached to each and every API call performed) and as such is handled directly by the
k8s
module (and other resource–specific modules) by utilizing thehost
,username
andpassword
parameters. Please consult your preferred module’s documentation for more details.
Aliases: k8s_auth
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.6
urllib3
requests
requests-oauthlib
Parameters
Parameter |
Comments |
---|---|
When |
|
Path to a CA certificate file used to verify connection to the API server. The full certificate chain must be provided to avoid certificate validation errors. |
|
Provide a URL for accessing the API server. |
|
Provide a password for authenticating with the API server. |
|
If set to present connect to the API server using the URL specified in If set to absent attempt to log out by revoking the authentication token specified in Choices:
|
|
Provide a username for authenticating with the API server. |
|
Whether or not to verify the API server’s SSL certificates. Choices:
|
Examples
- name: Example Playbook
hosts: localhost
module_defaults:
group/community.okd.okd:
host: https://k8s.example.com/
ca_cert: ca.pem
tasks:
- name: Authenticate to OpenShift cluster and gell a list of all pods from any namespace
block:
# It's good practice to store login credentials in a secure vault and not
# directly in playbooks.
- name: Include 'openshift_passwords.yml'
ansible.builtin.include_vars: openshift_passwords.yml
- name: Log in (obtain access token)
community.okd.openshift_auth:
username: admin
password: "{{ openshift_admin_password }}"
register: openshift_auth_results
# Previous task provides the token/api_key, while all other parameters
# are taken from module_defaults
- name: Get a list of all pods from any namespace
kubernetes.core.k8s_info:
api_key: "{{ openshift_auth_results.openshift_auth.api_key }}"
kind: Pod
register: pod_list
always:
- name: If login succeeded, try to log out (revoke access token)
when: openshift_auth_results.openshift_auth.api_key is defined
community.okd.openshift_auth:
state: absent
api_key: "{{ openshift_auth_results.openshift_auth.api_key }}"
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
---|---|
Same as returned openshift_auth. Kept only for backwards compatibility Returned: success |
|
Authentication token. Returned: success |
|
Path to a CA certificate file used to verify connection to the API server. Returned: success |
|
URL for accessing the API server. Returned: success |
|
Username for authenticating with the API server. Returned: success |
|
Whether or not to verify the API server’s SSL certificates. Returned: success |
|
OpenShift authentication facts. Returned: success |
|
Authentication token. Returned: success |
|
Path to a CA certificate file used to verify connection to the API server. Returned: success |
|
URL for accessing the API server. Returned: success |
|
Username for authenticating with the API server. Returned: success |
|
Whether or not to verify the API server’s SSL certificates. Returned: success |