Configure the OCI registry for BMaaS

Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>

Author: dtantsur

install-bmaas.yml

@@ -0,0 +1,6 @@
+---
+- name: Setup Bare-Metal as a Service (BMaaS)
+  hosts: localhost
+  become: yes
+  roles:
+    - bmaas

install-oras.yml

@@ -4,8 +4,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-echo "Installing ORAS CLI for bare-metal as a service preparation..."
+echo "Setting up bare-metal as a service (BMaaS) configuration..."
 
-ansible-playbook -i localhost, -c local "${SCRIPT_DIR}/install-oras.yml"
+ansible-playbook -i localhost, -c local "${SCRIPT_DIR}/install-bmaas.yml"
 
-echo "ORAS CLI installation completed."
+echo "BMaaS setup completed successfully."

prepare-bmaas.sh

@@ -0,0 +1,3 @@
+---
+bmaas_service_account_name: bmaas-images
+bmaas_namespace: openshift-machine-api

roles/bmaas/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+galaxy_info:
+  author: dev-scripts
+  description: Configure bare-metal as a service with ORAS CLI and OpenShift registry access
+  license: Apache-2.0
+  min_ansible_version: "2.9"
+  platforms:
+    - name: EL
+      versions:
+        - 8
+        - 9
+    - name: Ubuntu
+      versions:
+        - focal
+        - jammy
+    - name: Fedora
+      versions:
+        - 36
+        - 37
+        - 38
+
+dependencies:
+  - oras

roles/bmaas/meta/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Include oras role
+  include_role:
+    name: oras
+
+- name: Create bmaas-images service account
+  kubernetes.core.k8s:
+    name: "{{ bmaas_service_account_name }}"
+    api_version: v1
+    kind: ServiceAccount
+    namespace: "{{ bmaas_namespace }}"
+    state: present
+
+- name: Create ClusterRoleBinding for registry-viewer
+  kubernetes.core.k8s:
+    name: "{{ bmaas_service_account_name }}-registry-viewer"
+    api_version: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    state: present
+    definition:
+      subjects:
+        - kind: ServiceAccount
+          name: "{{ bmaas_service_account_name }}"
+          namespace: "{{ bmaas_namespace }}"
+      roleRef:
+        kind: ClusterRole
+        name: registry-viewer
+        apiGroup: rbac.authorization.k8s.io
+
+- name: Create ClusterRoleBinding for registry-editor
+  kubernetes.core.k8s:
+    name: "{{ bmaas_service_account_name }}-registry-editor"
+    api_version: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    state: present
+    definition:
+      subjects:
+        - kind: ServiceAccount
+          name: "{{ bmaas_service_account_name }}"
+          namespace: "{{ bmaas_namespace }}"
+      roleRef:
+        kind: ClusterRole
+        name: registry-editor
+        apiGroup: rbac.authorization.k8s.io
+
+- name: Enable default route for OpenShift image registry
+  kubernetes.core.k8s:
+    name: cluster
+    api_version: imageregistry.operator.openshift.io/v1
+    kind: Config
+    state: present
+    merge_type: merge
+    definition:
+      spec:
+        defaultRoute: true
+
+- name: Display service account information
+  debug:
+    msg: "BMaaS service account '{{ bmaas_service_account_name }}' created with registry-viewer and registry-editor roles in namespace '{{ bmaas_namespace }}'"