{"action":"created","issue":{"url":"https://api.github.com/repos/imain/ocp-doit/issues/3","repository_url":"https://api.github.com/repos/imain/ocp-doit","labels_url":"https://api.github.com/repos/imain/ocp-doit/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/imain/ocp-doit/issues/3/comments","events_url":"https://api.github.com/repos/imain/ocp-doit/issues/3/events","html_url":"https://github.com/imain/ocp-doit/issues/3","id":379134997,"node_id":"MDU6SXNzdWUzNzkxMzQ5OTc=","number":3,"title":"Create a nonprivileged user","user":{"login":"tomassedovic","id":104339,"node_id":"MDQ6VXNlcjEwNDMzOQ==","avatar_url":"https://avatars1.githubusercontent.com/u/104339?v=4","gravatar_id":"","url":"https://api.github.com/users/tomassedovic","html_url":"https://github.com/tomassedovic","followers_url":"https://api.github.com/users/tomassedovic/followers","following_url":"https://api.github.com/users/tomassedovic/following{/other_user}","gists_url":"https://api.github.com/users/tomassedovic/gists{/gist_id}","starred_url":"https://api.github.com/users/tomassedovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomassedovic/subscriptions","organizations_url":"https://api.github.com/users/tomassedovic/orgs","repos_url":"https://api.github.com/users/tomassedovic/repos","events_url":"https://api.github.com/users/tomassedovic/events{/privacy}","received_events_url":"https://api.github.com/users/tomassedovic/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-11-09T12:00:05Z","updated_at":"2018-11-09T12:07:24Z","closed_at":null,"author_association":"COLLABORATOR","body":"Every command including the OpenShift deployment is run as the OpenStack admin user / project. This is neither necessary, nor desirable (the installer should work for regular cloud users and therefore we should test it as such.\r\n\r\nThe script below creates a normal user with one extra privilege (we do have to add the `swiftoperator` role to be able to create containers).\r\n\r\nIt expects two `clouds.yaml` entries: `standalone-admin` (the admin user, currently called `standalone` in ocp-doit) and `standalone` -- the new user we're going to be creating.\r\n\r\nThis creates the necessary networks, security group rules and so on to be able to run openshift-installer. I have tested it and it all seems to be working.\r\n\r\nI suggest we change ocp-doit to always do this and run the installer as a regular user, but that would require changes to clouds.yaml and a bunch of the scripts so I'm opening this issue first. Maybe we just want to ship this script instead and not disrupt the existing ones.\r\n\r\n```bash\r\n#!/bin/bash\r\n\r\nset -eux\r\nset -o pipefail\r\n\r\n# Create & configure the user, project and quota\r\nexport OS_CLOUD=standalone-admin\r\n\r\nopenstack project create openshift\r\nopenstack user create --password 'password' openshift\r\nopenstack role add --user openshift --project openshift _member_\r\nopenstack role add --user openshift --project openshift swiftoperator\r\n# NOTE(shadower): minimum secgroup: 6, secgroup-rules: 60\r\nopenstack quota set --secgroups 100 --secgroup-rules 1000 openshift\r\n\r\n# Set the user's key, router, subnet, tempurl access, etc.\r\nexport OS_CLOUD=standalone\r\n\r\nopenstack keypair create --public-key ~/.ssh/id_rsa.pub default\r\nopenstack network create --internal private\r\nopenstack subnet create private --subnet-range 192.168.24.0/24 --network private\r\nopenstack router create internets\r\nopenstack router set internets --external-gateway public\r\nopenstack router add subnet internets private\r\nopenstack object store account set --property Temp-URL-Key=superkey\r\n\r\nopenstack security group rule create default --protocol tcp --dst-port 22:22 --remote-ip 0.0.0.0/0\r\nopenstack security group rule create --protocol icmp default\r\nopenstack security group rule create --protocol udp --dst-port 53:53 default\r\n```"},"comment":{"url":"https://api.github.com/repos/imain/ocp-doit/issues/comments/437341068","html_url":"https://github.com/imain/ocp-doit/issues/3#issuecomment-437341068","issue_url":"https://api.github.com/repos/imain/ocp-doit/issues/3","id":437341068,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNzM0MTA2OA==","user":{"login":"tomassedovic","id":104339,"node_id":"MDQ6VXNlcjEwNDMzOQ==","avatar_url":"https://avatars1.githubusercontent.com/u/104339?v=4","gravatar_id":"","url":"https://api.github.com/users/tomassedovic","html_url":"https://github.com/tomassedovic","followers_url":"https://api.github.com/users/tomassedovic/followers","following_url":"https://api.github.com/users/tomassedovic/following{/other_user}","gists_url":"https://api.github.com/users/tomassedovic/gists{/gist_id}","starred_url":"https://api.github.com/users/tomassedovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomassedovic/subscriptions","organizations_url":"https://api.github.com/users/tomassedovic/orgs","repos_url":"https://api.github.com/users/tomassedovic/repos","events_url":"https://api.github.com/users/tomassedovic/events{/privacy}","received_events_url":"https://api.github.com/users/tomassedovic/received_events","type":"User","site_admin":false},"created_at":"2018-11-09T12:07:24Z","updated_at":"2018-11-09T12:07:24Z","author_association":"COLLABORATOR","body":"Yeah. This is mostly about the OpenStack user itself. And personally, I deploy openshift from my laptop, using standalone as an external cloud (so no sudo required there).\r\n\r\nI'll create a PR."}}
{"actor":{"display_login":"tomassedovic"}}