Merge pull request #2409 from abutcher/secure-registry

Secure registry for atomic registry deployment 

2 files changed, 90 insertions, 1 deletions

diff --git a/roles/openshift_hosted/tasks/registry/registry.yml b/roles/openshift_hosted/tasks/registry/registry.yml
index b28974236..d5077932b 100644
--- a/roles/openshift_hosted/tasks/registry/registry.yml
+++ b/roles/openshift_hosted/tasks/registry/registry.yml
@@ -18,7 +18,9 @@
     l_default_replicas: 0
   when: l_node_count | int == 0
 
-# If registry nodes are defined and the registry storage kind is defined, default should be the number of registry nodes, otherwise just 1:
+# If registry nodes are defined and the registry storage kind is
+# defined, default should be the number of registry nodes, otherwise
+# just 1:
 - set_fact:
     l_default_replicas: "{{ l_node_count if openshift.hosted.registry.storage.kind | default(none) is not none else 1 }}"
   when: l_node_count | int > 0
@@ -49,6 +51,10 @@
   failed_when: "openshift_hosted_registry_results.rc != 0 and 'service exists' not in openshift_hosted_registry_results.stdout and 'deployment_config' not in openshift_hosted_registry_results.stderr and 'service' not in openshift_hosted_registry_results.stderr"
   when: replicas | int > 0
 
+- include: secure.yml
+  static: no
+  when: openshift.common.deployment_subtype == 'registry'
+
 - include: storage/object_storage.yml
   static: no
   when: replicas | int > 0 and openshift.hosted.registry.storage.kind | default(none) == 'object'
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
new file mode 100644
index 000000000..ef1c7c5bc
--- /dev/null
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -0,0 +1,83 @@
+---
+- name: Determine if registry certificates must be created
+  stat:
+    path: "{{ openshift_master_config_dir }}/{{ item }}"
+  with_items:
+  - registry.crt
+  - registry.key
+  register: docker_registry_certificates_stat_result
+  changed_when: false
+  failed_when: false
+
+- name: Retrieve registry service IP
+  command: >
+    {{ openshift.common.client_binary }} get service docker-registry
+    --template='{{ '{{' }} .spec.clusterIP {{ '}}' }}'
+  register: docker_registry_service_ip
+  changed_when: false
+
+- set_fact:
+    docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift.master.default_subdomain | default('router.default.svc.cluster.local', true)) }}"
+
+- name: Create registry certificates if they do not exist
+  command: >
+    {{ openshift.common.admin_binary }} ca create-server-cert
+    --signer-cert=/etc/origin/master/ca.crt
+    --signer-key=/etc/origin/master/ca.key
+    --signer-serial=/etc/origin/master/ca.serial.txt
+    --hostnames="{{ docker_registry_service_ip.stdout }},docker-registry.default.svc.cluster.local,{{ docker_registry_route_hostname }}"
+    --cert={{ openshift_master_config_dir }}/registry.crt
+    --key={{ openshift_master_config_dir }}/registry.key
+  when: False in (docker_registry_certificates_stat_result.results | default([]) | oo_collect(attribute='stat.exists') | list)
+
+- name: Create the secret for the registry certificates
+  command: >
+    {{ openshift.common.client_binary }} secrets new registry-certificates
+    {{ openshift_master_config_dir }}/registry.crt
+    {{ openshift_master_config_dir }}/registry.key
+    --config={{ openshift_hosted_kubeconfig }}
+    -n default
+  register: create_registry_certificates_secret
+  changed_when: "'already exists' not in create_registry_certificates_secret.stderr"
+  failed_when: "'already exists' not in create_registry_certificates_secret.stderr and create_registry_certificates_secret.rc != 0"
+
+- name: "Add the secret to the registry's pod service accounts"
+  command: >
+    {{ openshift.common.client_binary }} secrets link {{ item }} registry-certificates
+    --config={{ openshift_hosted_kubeconfig }}
+    -n default
+  with_items:
+  - registry
+  - default
+
+- name: Determine if registry-certificates secret volume attached
+  command: >
+    {{ openshift.common.client_binary }} get dc/docker-registry
+    --template='{{ '{{' }} range .spec.template.spec.volumes {{ '}}' }}{{ '{{' }} .secret.secretName {{ '}}' }}{{ '{{' }} end {{ '}}' }}'
+    --config={{ openshift_hosted_kubeconfig }}
+    -n default
+  register: docker_registry_volumes
+  changed_when: false
+  failed_when: false
+
+- name: Attach registry-certificates secret volume
+  command: >
+   {{ openshift.common.client_binary }} volume dc/docker-registry --add --type=secret
+   --secret-name=registry-certificates
+   -m /etc/secrets
+   --config={{ openshift_hosted_kubeconfig }}
+   -n default
+  when: "'registry-certificates' not in docker_registry_volumes.stdout"
+
+- name: Set registry environment variables for TLS certificate
+  command: >
+    {{ openshift.common.client_binary }} env dc/docker-registry
+    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt
+    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key
+
+# These commands are on a single line to preserve patch json.
+- name: Update registry liveness probe from HTTP to HTTPS
+  command: "{{ openshift.common.client_binary }} patch dc/docker-registry --api-version=v1 -p '{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"registry\",\"livenessProbe\":{\"httpGet\":{\"scheme\":\"HTTPS\"}}}]}}}}' --config={{ openshift_hosted_kubeconfig }} -n default"
+
+- name: Update registry readiness probe from HTTP to HTTPS
+  command: "{{ openshift.common.client_binary }} patch dc/docker-registry --api-version=v1 -p '{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"registry\",\"readinessProbe\":{\"httpGet\":{\"scheme\":\"HTTPS\"}}}]}}}}' --config={{ openshift_hosted_kubeconfig }} -n default"