97 lines
3.7 KiB
YAML
97 lines
3.7 KiB
YAML
---
|
|
- name: Probe environment inside AWX EE
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: no
|
|
tasks:
|
|
- name: Who am I and where
|
|
ansible.builtin.shell: |
|
|
echo "=== whoami ==="; id
|
|
echo "=== hostname ==="; hostname
|
|
echo "=== os-release ==="; cat /etc/os-release 2>/dev/null
|
|
echo "=== cgroup ==="; cat /proc/1/cgroup 2>/dev/null
|
|
echo "=== pid1 cmdline ==="; tr '\0' ' ' < /proc/1/cmdline; echo
|
|
echo "=== /etc/hosts ==="; cat /etc/hosts
|
|
echo "=== resolv.conf ==="; cat /etc/resolv.conf
|
|
echo "=== env kube ==="; env | grep -i -E 'kube|k8s|runner' || true
|
|
args: { executable: /bin/sh }
|
|
register: env_info
|
|
failed_when: false
|
|
|
|
- ansible.builtin.debug: { var: env_info.stdout_lines }
|
|
|
|
- name: Check service account & kubeconfig
|
|
ansible.builtin.shell: |
|
|
echo "=== /var/run/secrets/kubernetes.io ==="
|
|
ls -la /var/run/secrets/kubernetes.io/serviceaccount/ 2>&1 || true
|
|
echo "=== ~/.kube ==="
|
|
ls -la ~/.kube 2>&1 || true
|
|
echo "=== /etc/rancher ==="
|
|
ls -la /etc/rancher 2>&1 || true
|
|
echo "=== /root/.kube ==="
|
|
ls -la /root/.kube 2>&1 || true
|
|
echo "=== find kubeconfig ==="
|
|
find / -maxdepth 4 -name 'kubeconfig*' -o -name '*.kubeconfig' 2>/dev/null | head
|
|
args: { executable: /bin/sh }
|
|
register: kube_files
|
|
failed_when: false
|
|
|
|
- ansible.builtin.debug: { var: kube_files.stdout_lines }
|
|
|
|
- name: Available tools
|
|
ansible.builtin.shell: |
|
|
for t in kubectl oc curl wget python3 python perl nc socat nsenter docker podman crictl; do
|
|
p=$(command -v $t 2>/dev/null)
|
|
echo "$t -> ${p:-NOT FOUND}"
|
|
done
|
|
echo "=== PATH ==="
|
|
echo $PATH
|
|
args: { executable: /bin/sh }
|
|
register: tools
|
|
failed_when: false
|
|
|
|
- ansible.builtin.debug: { var: tools.stdout_lines }
|
|
|
|
- name: Try k8s API via service account (if token exists)
|
|
ansible.builtin.shell: |
|
|
SA=/var/run/secrets/kubernetes.io/serviceaccount
|
|
if [ -f $SA/token ]; then
|
|
TOKEN=$(cat $SA/token)
|
|
CACERT=$SA/ca.crt
|
|
API="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
|
|
echo "API=$API"
|
|
echo "--- /version ---"
|
|
curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" $API/version || true
|
|
echo
|
|
echo "--- /api/v1/namespaces/default/pods ---"
|
|
curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
|
|
"$API/api/v1/namespaces/default/pods?limit=5" | head -c 800 || true
|
|
echo
|
|
echo "--- can-i create pods? ---"
|
|
curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-X POST "$API/apis/authorization.k8s.io/v1/selfsubjectaccessreviews" \
|
|
-d '{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"verb":"create","resource":"pods"}}}' || true
|
|
echo
|
|
else
|
|
echo "No service account token found"
|
|
fi
|
|
args: { executable: /bin/sh }
|
|
register: api_probe
|
|
failed_when: false
|
|
|
|
- ansible.builtin.debug: { var: api_probe.stdout_lines }
|
|
|
|
- name: Check for awx-ee specific paths and k8s hints
|
|
ansible.builtin.shell: |
|
|
echo "=== mounts ==="
|
|
mount 2>/dev/null | head -20
|
|
echo "=== /run/secrets ==="
|
|
ls -la /run/secrets 2>/dev/null || true
|
|
echo "=== /var/run ==="
|
|
ls -la /var/run 2>/dev/null | head
|
|
args: { executable: /bin/sh }
|
|
register: mounts
|
|
failed_when: false
|
|
|
|
- ansible.builtin.debug: { var: mounts.stdout_lines } |