feat: Include pinniped local-user-authenticator

ansible/roles/assets/tasks/containerimages.yml

@@ -14,6 +14,12 @@
   loop_control:
     label: "{{ item.dest | basename }}"
 
+- name: Parse pinniped manifest for container images
+  ansible.builtin.shell:
+    cmd: >-
+      cat {{ pinniped_manifest.dest }} | yq --no-doc eval '.. | .image? | select(.)' | awk '!/ /';
+  register: pinniped_parsedmanifest
+
 - name: Parse metacluster helm charts for container images
   ansible.builtin.shell:
     cmd: "{{ item.value.helm.parse_logic }}"
@@ -43,6 +49,8 @@
       results: "{{ kubeadmimages.stdout_lines }}"
     - source: clusterapi
       results: "{{ clusterapi_parsedmanifests | json_query('results[*].stdout_lines') | select() | flatten | list }}"
+    - source: pinniped
+      results: "{{ pinniped_parsedmanifest.stdout_lines }}"
   loop_control:
     label: "{{ item.source }}"
 
@@ -64,4 +72,4 @@
         docker://{{ item }} \
         docker-archive:./{{ ( item | regex_findall('[^/:]+'))[-2] }}_{{ lookup('ansible.builtin.password', '/dev/null length=5 chars=ascii_lowercase,digits seed={{ item }}') }}.tar:{{ item }}
     chdir: /opt/metacluster/container-images
-  loop: "{{ (containerimages_charts + containerimages_kubeadm + containerimages_clusterapi + dependencies.container_images) | flatten | unique | sort }}"
+  loop: "{{ (containerimages_charts + containerimages_kubeadm + containerimages_clusterapi + containerimages_pinniped + dependencies.container_images) | flatten | unique | sort }}"

ansible/roles/assets/tasks/main.yml

@@ -16,6 +16,7 @@
     - /opt/metacluster/helm-charts
     - /opt/metacluster/k3s
     - /opt/metacluster/kube-vip
+    - /opt/metacluster/pinniped
     - /opt/workloadcluster/helm-charts
     - /opt/workloadcluster/node-templates
     - /var/lib/rancher/k3s/agent/images

ansible/roles/assets/tasks/manifests.yml

@@ -15,8 +15,9 @@
           {{
             { 'components': (
               metacluster_chartvalues |
-              combine({ 'clusterapi': components.clusterapi }) |
-              combine({ 'kubevip'   : components.kubevip }) ),
+              combine({ 'clusterapi'     : components['clusterapi'] }) |
+              combine({ 'kubevip'        : components['kubevip'] }) |
+              combine({ 'local-user-auth': components['local-user-auth'] })),
               'appliance': {
                 'version': (applianceversion)
               }
@@ -108,6 +109,21 @@
   delay: 5
   until: kubevip_manifest is not failed
 
+- name: Download pinniped local-user-authenticator manifest
+  ansible.builtin.get_url:
+    url: https://get.pinniped.dev/{{ components['local-user-authenticator'].version }}/install-local-user-authenticator.yaml
+    dest: /opt/metacluster/pinniped/local-user-authenticator.yaml
+  register: pinniped_manifest
+  retries: 5
+  delay: 5
+  until: pinniped_manifest is not failed
+
+- name: Trim image hash from manifest
+  ansible.builtin.copy:
+    dest: /opt/metacluster/pinniped/local-user-authenticator.yaml
+    content: "{{ lookup('ansible.builtin.file', '/opt/metacluster/pinniped/local-user-authenticator.yaml') | regex_replace('([ ]*image: .*)@.*', '\\1') }}"
+  no_log: true
+
 # - name: Inject manifests
 #   ansible.builtin.template:
 #     src: "{{ item.type }}.j2"