Description of problem: I can not run playbook as a unprivileged user (non-root) since playbook is writing under /usr/share/ansible/kubevirt-ansible/roles/kubevirt/templates directory . This playbook should require only oc-login for cluster admin and that is it. Definitely no need for root user in my opinion. Version-Release number of selected component (if applicable): kubevirt-ansible-0.9.2-4.9c5b566.noarch How reproducible: 100% Steps to Reproduce: 1.ansible-playbook -i inventory -e@/usr/share/ansible/kubevirt-ansible/vars/all.yml -e@/usr/share/ansible/kubevirt-ansible/vars/cnv.yml -e "registry_url=brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888" /usr/share/ansible/kubevirt-ansible/playbooks/kubevirt.yml Actual results: fatal: [localhost]: FAILED! => {"changed": false, "msg": "Destination /usr/share/ansible/kubevirt-ansible/roles/kubevirt/templates is not writable"} Expected results: Playbook should be executable without root permission, since it is not meant to perform any change on playbook controller's system. Additional info: PLAY [Initial configuration] ****************************************************************************************************************************************************************** TASK [Login As Super User] ******************************************************************************************************************************************************************** skipping: [localhost] TASK [Config kubernetes client binary] ******************************************************************************************************************************************************** skipping: [localhost] TASK [Config openshift client binary] ********************************************************************************************************************************************************* ok: [localhost] PLAY [Initial configuration] ****************************************************************************************************************************************************************** TASK [Login As Super User] ******************************************************************************************************************************************************************** skipping: [localhost] TASK [Config kubernetes client binary] ******************************************************************************************************************************************************** skipping: [localhost] TASK [Config openshift client binary] ********************************************************************************************************************************************************* ok: [localhost] PLAY [nodes masters] ************************************************************************************************************************************************************************** TASK [Gathering Facts] ************************************************************************************************************************************************************************ ok: [172.16.0.24] ok: [172.16.0.25] ok: [172.16.0.16] TASK [remove multus config from nodes on deprovisioning] ************************************************************************************************************************************** skipping: [172.16.0.16] => (item=/etc/cni/net.d/00-multus.conf) skipping: [172.16.0.16] => (item=/etc/cni/net.d/multus.d) skipping: [172.16.0.24] => (item=/etc/cni/net.d/00-multus.conf) skipping: [172.16.0.24] => (item=/etc/cni/net.d/multus.d) skipping: [172.16.0.25] => (item=/etc/cni/net.d/00-multus.conf) skipping: [172.16.0.25] => (item=/etc/cni/net.d/multus.d) TASK [make sure ovs is installed] ************************************************************************************************************************************************************* skipping: [172.16.0.16] skipping: [172.16.0.24] skipping: [172.16.0.25] TASK [enable and start OVS] ******************************************************************************************************************************************************************* skipping: [172.16.0.16] skipping: [172.16.0.24] skipping: [172.16.0.25] TASK [Create /etc/pcidp] ********************************************************************************************************************************************************************** skipping: [172.16.0.16] skipping: [172.16.0.24] skipping: [172.16.0.25] TASK [Configure SR-IOV DP allocation pool] **************************************************************************************************************************************************** skipping: [172.16.0.16] skipping: [172.16.0.24] skipping: [172.16.0.25] TASK [Fix SELinux labels for /var/lib/kubelet/device-plugins/] ******************************************************************************************************************************** skipping: [172.16.0.16] skipping: [172.16.0.24] skipping: [172.16.0.25] PLAY [Deploy network roles] ******************************************************************************************************************************************************************* TASK [network-multus : include_tasks] ********************************************************************************************************************************************************* included: /usr/share/ansible/kubevirt-ansible/roles/network-multus/tasks/provision.yml for localhost TASK [network-multus : Check if namespace "kube-system" exists] ******************************************************************************************************************************* changed: [localhost] TASK [network-multus : Create kube-system namespace] ****************************************************************************************************************************************** skipping: [localhost] TASK [network-multus : openshift cni config] ************************************************************************************************************************************************** ok: [localhost] TASK [network-multus : kubernetes cni config] ************************************************************************************************************************************************* skipping: [localhost] TASK [network-multus : Render multus deployment yaml] ***************************************************************************************************************************************** ok: [localhost] TASK [network-multus : Create multus Resources] *********************************************************************************************************************************************** changed: [localhost] TASK [network-multus : Render cni plugins deployment yaml] ************************************************************************************************************************************ skipping: [localhost] TASK [network-multus : Create cni plugins Resources] ****************************************************************************************************************************************** skipping: [localhost] TASK [network-multus : Render OVS deployment yaml] ******************************************************************************************************************************************** ok: [localhost] TASK [network-multus : Create ovs Resources] ************************************************************************************************************************************************** changed: [localhost] TASK [network-multus : Render ovs-vsctl deployment yaml] ************************************************************************************************************************************** ok: [localhost] TASK [network-multus : Create ovs-vsctl resources] ******************************************************************************************************************************************** changed: [localhost] TASK [network-multus : Render SR-IOV DP deployment yaml] ************************************************************************************************************************************** skipping: [localhost] TASK [network-multus : Create SR-IOV DP resources] ******************************************************************************************************************************************** skipping: [localhost] TASK [network-multus : Render SR-IOV CNI deployment yaml] ************************************************************************************************************************************* skipping: [localhost] TASK [network-multus : Create SR-IOV CNI resources] ******************************************************************************************************************************************* skipping: [localhost] TASK [network-multus : Render SR-IOV network CRD yaml] **************************************************************************************************************************************** skipping: [localhost] TASK [network-multus : Create SR-IOV network CRD] ********************************************************************************************************************************************* skipping: [localhost] TASK [network-multus : Wait until multus is running] ****************************************************************************************************************************************** changed: [localhost] TASK [network-multus : Wait until CNI plugins are running] ************************************************************************************************************************************ skipping: [localhost] TASK [network-multus : Wait until OVS Plugin is running] ************************************************************************************************************************************** changed: [localhost] TASK [network-multus : Wait until SR-IOV DP plugin is running] ******************************************************************************************************************************** skipping: [localhost] TASK [network-multus : Wait until SR-IOV CNI plugin is running] ******************************************************************************************************************************* skipping: [localhost] TASK [skydive : include_tasks] **************************************************************************************************************************************************************** skipping: [localhost] PLAY [Deploy kubevirt role] ******************************************************************************************************************************************************************* TASK [kubevirt : include_tasks] *************************************************************************************************************************************************************** included: /usr/share/ansible/kubevirt-ansible/roles/kubevirt/tasks/provision.yml for localhost TASK [kubevirt : Check if kubevirt exists] **************************************************************************************************************************************************** changed: [localhost] TASK [kubevirt : Create kubevirt namespace] *************************************************************************************************************************************************** changed: [localhost] TASK [kubevirt : Add Privileged Policy] ******************************************************************************************************************************************************* changed: [localhost] => (item=kubevirt-privileged) changed: [localhost] => (item=kubevirt-controller) changed: [localhost] => (item=kubevirt-infra) changed: [localhost] => (item=kubevirt-apiserver) TASK [kubevirt : Add Hostmount-anyuid Policy] ************************************************************************************************************************************************* changed: [localhost] TASK [kubevirt : Enable kubevirt feature gates] *********************************************************************************************************************************************** changed: [localhost] TASK [kubevirt : Check for kubevirt.yaml.j2 template in /usr/share/ansible/kubevirt-ansible/roles/kubevirt/templates] ************************************************************************* ok: [localhost] TASK [kubevirt : Check for kubevirt.yaml.j2 version v0.12.0-alpha.2 in /opt/apb/kubevirt-templates] ******************************************************************************************* ok: [localhost] TASK [kubevirt : Download KubeVirt Template] ************************************************************************************************************************************************** fatal: [localhost]: FAILED! => {"changed": false, "msg": "Destination /usr/share/ansible/kubevirt-ansible/roles/kubevirt/templates is not writable"} [WARNING]: Could not create retry file '/usr/share/ansible/kubevirt-ansible/playbooks/kubevirt.retry'. [Errno 13] Permission denied: u'/usr/share/ansible/kubevirt- ansible/playbooks/kubevirt.retry' PLAY RECAP ************************************************************************************************************************************************************************************ 172.16.0.16 : ok=1 changed=0 unreachable=0 failed=0 172.16.0.24 : ok=1 changed=0 unreachable=0 failed=0 172.16.0.25 : ok=1 changed=0 unreachable=0 failed=0 localhost : ok=21 changed=11 unreachable=0 failed=1
The download code will be removed in this PR https://github.com/kubevirt/kubevirt-ansible/pull/536. The operator work will simplify what kubevirt-ansible does.
need to handle this one as well: Destination /usr/share/ansible/kubevirt-ansible/roles/cdi/templates is not writable
*** Bug 1668694 has been marked as a duplicate of this bug. ***
cd into '/usr/share/ansible/kubevirt-ansible' to run you playbooks or run them locally. Both these cases are covered in docs + kubevirt-ansible-0.12.2-1.acde806
Created attachment 1527526 [details] run installation playbook as a unprivileged user (non-root)
I was able to run the playbook as a non root user, cloud-user, successfully, see the attachment and `oc get pods --all-namespaces` displays kubevirt pods. Docs line checked. Thanks for a fix.