php-getpods/Containerfile

@@ -0,0 +1,3 @@
+FROM registry.redhat.io/ubi8/php-74:latest
+COPY index.php /opt/app-root/src
+CMD /usr/libexec/s2i/run

php-getpods/index.php

@@ -0,0 +1,86 @@
+<p>Hello, world!</p>
+<ul>
+<li/>Hostname is <?= getenv('HOSTNAME') ?> (<?= $_ENV["HOSTNAME"] ?>)
+<li/>Server name is <?= getenv('SERVER_NAME') ?> (<?= $_ENV["SERVER_NAME"] ?>)
+<li/>Namespace is <?= getenv('NAMESPACE') ?> (<?= $_ENV["NAMESPACE"] ?>)
+<li/>Service account name is <?= getenv('ACCOUNT_NAME') ?> (<?= $_ENV["ACCOUNT_NAME"] ?>)
+<li/>Service name is <?= getenv('SERVICE_NAME') ?> (<?= $_ENV["SERVICE_NAME"] ?>)
+<li/>Pod name is <?= getenv('POD_NAME') ?> (<?= $_ENV["POD_NAME"] ?>)
+<li/>Pod IP is <?= getenv('POD_IP') ?> (<?= $_ENV["POD_IP"] ?>)
+<li/>Application label is <code>app=<?= getenv('APP_LABEL') ?></code> (<?= $_ENV["APP_LABEL"] ?>)
+</ul>
+<?php
+	$tfile = "/token/token";
+	if (isset($_ENV['TOKEN_FILE'])) {
+		$tfile = $_ENV['TOKEN_FILE'];
+	}
+	if (!file_exists($tfile)) {
+	    print("<p>Can not read the token file. Exiting.</p>\n");
+	    exit();
+	}
+
+	$token = file_get_contents($tfile);;
+	print("<p>Using token <code>" . $token . "</code>.</p>\n");
+
+	$errors = 0;
+	if (!isset($_ENV["NAMESPACE"])) {
+		print("<p>Namespace variable not set (NAMESPACE).</p>\n");
+		$errors++;
+	}
+	if (!isset($_ENV["APP_LABEL"])) {
+		print("<p>App label variable not set (APP_LABEL).</p>\n");
+		$errors++;
+	}
+	if ($errors == 0) {
+		$cs = curl_init("https://kubernetes.default/api/v1/namespaces/" . $_ENV["NAMESPACE"] . "/pods?labelSelector=app=" . $_ENV["APP_LABEL"]);
+		curl_setopt($cs, CURLOPT_SSL_VERIFYPEER, false);
+		curl_setopt($cs, CURLOPT_RETURNTRANSFER, true);
+		curl_setopt($cs, CURLOPT_HTTPHEADER, [
+			"Authorization: Bearer " . $token,
+			"Accept: application/json"
+			]);
+		$response = curl_exec($cs);
+
+		print("<p>Got pod list response:<p>\n");
+?><code>
+<?= $response ?>
+</code>
+<?php
+	} else {
+		print("<p>Skipping pod list due to errors.</p>\n");
+	}
+	$errors = 0;
+	if (!isset($_ENV["NAMESPACE"])) {
+		print("<p>Namespace variable not set (NAMESPACE).</p>\n");
+		$errors++;
+	}
+	if (!isset($_ENV["SERVICE_NAME"])) {
+		print("<p>Service name variable not set (SERVICE_NAME).</p>\n");
+		$errors++;
+	}
+	if ($errors == 0) {
+		$cs = curl_init("https://kubernetes.default/api/v1/namespaces/" . $_ENV["NAMESPACE"] . "/endpoints/" . $_ENV["SERVICE_NAME"]);
+		curl_setopt($cs, CURLOPT_SSL_VERIFYPEER, false);
+		curl_setopt($cs, CURLOPT_RETURNTRANSFER, true);
+		curl_setopt($cs, CURLOPT_HTTPHEADER, [
+			"Authorization: Bearer " . $token,
+			"Accept: application/json"
+			]);
+		$response = curl_exec($cs);
+		print("<p>Got endpoint list response:<p>\n");
+?><code>
+<?= $response ?>
+</code>
+<?php
+		$dnsrec = dns_get_record($_ENV["SERVICE_NAME"] . "." . $_ENV["NAMESPACE"] . ".svc.cluster.local", DNS_A);
+		if ($dnsrec) {
+			print("<p>Got dns query response:<p>\n<code>\n");
+			var_dump($dnsrec);
+			print("\n</code>\n");
+		} else {
+			print("<p>Could not look up DNS record for service.</p>\n");
+		}
+	} else {
+		print("<p>Skipping service test due to errors.</p>\n");
+	}
+?>

playbooks/.vault_pull

@@ -0,0 +1 @@
+redhat@123!

playbooks/ansible.cfg

@@ -4,6 +4,7 @@ jinja2_native = True
 inventory = ./inventory.yml
 remote_user = student
 ask_pass = no
+vault_identity_list = pull@.vault_pull
 
 [privilege_escalation]
 become = no

playbooks/roles/deploy-certmanager/tasks/main.yml

@@ -1,5 +1,8 @@
 ---
 # Ensures a CertManager instance is deployed and configured with a CA.
+#
+# TODO: oc patch featuregate/cluster --type=merge -p '{"spec": {"customNoUpgrade": {"enabled": ["RouteExternalCertificate"]}}}'
+#
 - name: See if the Cert Manager project is there.
   kubernetes.core.k8s_info:
     kubeconfig: tmp/kubeconfig-ocp4

playbooks/roles/user-workload-monitoring/tasks/main.yml

@@ -47,7 +47,7 @@
             enableUserAlertmanagerConfig: true
           prometheusK8s:
             retention: 1w
-            retentionSize: 4Gi
+            retentionSize: 4G
             volumeClaimTemplate:
               spec:
                 storageClassName: nfs-storage
@@ -71,7 +71,7 @@
             enableAlertmanagerConfig: true
           prometheus:
             retention: 1w
-            retentionSize: 4Gi
+            retentionSize: 4G
             volumeClaimTemplate:
               spec:
                 storageClassName: nfs-storage