summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--.tito/packages/openshift-ansible2
-rw-r--r--Dockerfile.rhel753
-rw-r--r--filter_plugins/openshift_version.py129
-rw-r--r--inventory/byo/hosts.openstack2
-rw-r--r--inventory/byo/hosts.origin.example16
-rw-r--r--inventory/byo/hosts.ose.example16
-rw-r--r--openshift-ansible.spec36
-rw-r--r--playbooks/byo/openshift-cluster/config.yml1
-rw-r--r--playbooks/byo/openshift-cluster/openshift-logging.yml1
-rw-r--r--playbooks/byo/openshift-cluster/upgrades/docker/upgrade.yml1
-rw-r--r--playbooks/byo/openshift-cluster/upgrades/v3_6/README.md18
l---------playbooks/byo/openshift-cluster/upgrades/v3_6/roles1
-rw-r--r--playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade.yml111
-rw-r--r--playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_control_plane.yml115
-rw-r--r--playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_nodes.yml104
-rw-r--r--playbooks/byo/openshift-etcd/restart.yml2
-rw-r--r--playbooks/byo/openshift-master/restart.yml2
-rw-r--r--playbooks/byo/openshift-master/scaleup.yml1
-rw-r--r--playbooks/byo/openshift-node/restart.yml2
-rw-r--r--playbooks/byo/openshift-node/scaleup.yml1
-rw-r--r--playbooks/byo/rhel_subscribe.yml2
-rw-r--r--playbooks/common/openshift-cluster/config.yml3
-rw-r--r--playbooks/common/openshift-cluster/enable_dnsmasq.yml2
-rw-r--r--playbooks/common/openshift-cluster/initialize_facts.yml2
-rw-r--r--playbooks/common/openshift-cluster/initialize_openshift_version.yml22
-rw-r--r--playbooks/common/openshift-cluster/redeploy-certificates/registry.yml3
-rw-r--r--playbooks/common/openshift-cluster/std_include.yml2
-rw-r--r--playbooks/common/openshift-cluster/update_repos_and_packages.yml2
-rw-r--r--playbooks/common/openshift-cluster/upgrades/init.yml1
-rw-r--r--playbooks/common/openshift-cluster/upgrades/post_control_plane.yml1
l---------playbooks/common/openshift-cluster/upgrades/v3_6/filter_plugins1
l---------playbooks/common/openshift-cluster/upgrades/v3_6/roles1
-rw-r--r--playbooks/common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml18
-rw-r--r--playbooks/common/openshift-cluster/upgrades/v3_6/validator.yml10
-rw-r--r--playbooks/common/openshift-master/scaleup.yml3
-rw-r--r--playbooks/common/openshift-node/scaleup.yml3
-rw-r--r--roles/etcd/templates/etcd.conf.j26
-rw-r--r--roles/lib_openshift/library/oc_adm_ca_server_cert.py8
-rw-r--r--roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py1
-rw-r--r--roles/lib_openshift/src/class/oc_adm_ca_server_cert.py1
-rw-r--r--roles/lib_openshift/src/doc/ca_server_cert6
-rw-r--r--roles/openshift_ca/README.md2
-rw-r--r--roles/openshift_ca/defaults/main.yml3
-rw-r--r--roles/openshift_ca/tasks/main.yml6
-rw-r--r--roles/openshift_excluder/tasks/disable.yml3
-rw-r--r--roles/openshift_facts/meta/main.yml3
-rw-r--r--roles/openshift_facts/tasks/main.yml3
-rw-r--r--roles/openshift_health_checker/action_plugins/openshift_health_check.py6
-rw-r--r--roles/openshift_health_checker/openshift_checks/__init__.py36
-rw-r--r--roles/openshift_health_checker/openshift_checks/docker_image_availability.py11
-rw-r--r--roles/openshift_health_checker/openshift_checks/package_availability.py2
-rw-r--r--roles/openshift_health_checker/openshift_checks/package_update.py2
-rw-r--r--roles/openshift_health_checker/openshift_checks/package_version.py2
-rw-r--r--roles/openshift_health_checker/test/docker_image_availability_test.py28
-rw-r--r--roles/openshift_health_checker/test/mixins_test.py23
-rw-r--r--roles/openshift_health_checker/test/openshift_check_test.py61
-rw-r--r--roles/openshift_health_checker/test/package_availability_test.py49
-rw-r--r--roles/openshift_health_checker/test/package_update_test.py16
-rw-r--r--roles/openshift_health_checker/test/package_version_test.py21
-rw-r--r--roles/openshift_hosted/README.md1
-rw-r--r--roles/openshift_hosted/defaults/main.yml1
-rw-r--r--roles/openshift_hosted/tasks/registry/secure.yml1
-rw-r--r--roles/openshift_master_certificates/README.md1
-rw-r--r--roles/openshift_master_certificates/defaults/main.yml2
-rw-r--r--roles/openshift_master_certificates/tasks/main.yml6
-rw-r--r--roles/openshift_node_certificates/README.md1
-rw-r--r--roles/openshift_node_certificates/defaults/main.yml2
-rw-r--r--roles/openshift_node_certificates/tasks/main.yml6
-rw-r--r--roles/openshift_repos/meta/main.yml3
-rw-r--r--roles/openshift_repos/tasks/main.yaml4
-rw-r--r--roles/openshift_sanitize_inventory/README.md37
-rw-r--r--roles/openshift_sanitize_inventory/meta/main.yml15
-rw-r--r--roles/openshift_sanitize_inventory/tasks/main.yml28
-rw-r--r--roles/openshift_sanitize_inventory/vars/main.yml (renamed from roles/openshift_repos/vars/main.yml)0
-rw-r--r--roles/openshift_version/tasks/main.yml8
-rw-r--r--roles/openshift_version/tasks/set_version_rpm.yml30
-rw-r--r--test/openshift_version_tests.py72
77 files changed, 1089 insertions, 118 deletions
diff --git a/.tito/packages/openshift-ansible b/.tito/packages/openshift-ansible
index eab5e9469..9a8ce8a69 100644
--- a/.tito/packages/openshift-ansible
+++ b/.tito/packages/openshift-ansible
@@ -1 +1 @@
-3.6.10-1 ./
+3.6.12-1 ./
diff --git a/Dockerfile.rhel7 b/Dockerfile.rhel7
index f3d45837a..0d5a6038a 100644
--- a/Dockerfile.rhel7
+++ b/Dockerfile.rhel7
@@ -1,26 +1,41 @@
-FROM rhel7
+FROM openshift3/playbook2image
-MAINTAINER Troy Dawson <tdawson@redhat.com>
+MAINTAINER OpenShift Team <dev@lists.openshift.redhat.com>
-LABEL Name="openshift3/installer"
-LABEL Vendor="Red Hat" License=GPLv2+
-LABEL Version="v3.1.1.901"
-LABEL Release="6"
-LABEL BZComponent="aos3-installation-docker"
-LABEL Architecture="x86_64"
-LABEL io.k8s.description="Ansible code and playbooks for installing Openshift Container Platform." \
- io.k8s.display-name="Openshift Installer" \
- io.openshift.tags="openshift,installer"
+LABEL name="openshift3/openshift-ansible" \
+ summary="OpenShift's installation and configuration tool" \
+ description="A containerized openshift-ansible image to let you run playbooks to install, upgrade, maintain and check an OpenShift cluster" \
+ url="https://github.com/openshift/openshift-ansible" \
+ io.k8s.display-name="openshift-ansible" \
+ io.k8s.description="A containerized openshift-ansible image to let you run playbooks to install, upgrade, maintain and check an OpenShift cluster" \
+ io.openshift.expose-services="" \
+ io.openshift.tags="openshift,install,upgrade,ansible" \
+ com.redhat.component="aos3-installation-docker" \
+ version="v3.4.1" \
+ release="1" \
+ architecture="x86_64"
-RUN INSTALL_PKGS="atomic-openshift-utils" && \
- yum install -y --enablerepo=rhel-7-server-ose-3.2-rpms $INSTALL_PKGS && \
- rpm -V $INSTALL_PKGS && \
+# Playbooks, roles and their dependencies are installed from packages.
+# Unlike in Dockerfile, we don't invoke the 'assemble' script here
+# because all content and dependencies (like 'oc') is already
+# installed via yum.
+USER root
+RUN INSTALL_PKGS="atomic-openshift-utils atomic-openshift-clients" && \
+ yum repolist > /dev/null && \
+ yum-config-manager --enable rhel-7-server-ose-3.4-rpms && \
+ yum install -y $INSTALL_PKGS && \
yum clean all
-# Expect user to mount a workdir for container output (installer.cfg, hosts inventory, ansible log)
-VOLUME /var/lib/openshift-installer/
-WORKDIR /var/lib/openshift-installer/
+USER ${USER_UID}
-RUN mkdir -p /var/lib/openshift-installer/
+# The playbook to be run is specified via the PLAYBOOK_FILE env var.
+# This sets a default of openshift_facts.yml as it's an informative playbook
+# that can help test that everything is set properly (inventory, sshkeys).
+# As the playbooks are installed via packages instead of being copied to
+# $APP_HOME by the 'assemble' script, we set the WORK_DIR env var to the
+# location of openshift-ansible.
+ENV PLAYBOOK_FILE=playbooks/byo/openshift_facts.yml \
+ WORK_DIR=/usr/share/ansible/openshift-ansible \
+ OPTS="-v"
-ENTRYPOINT ["/usr/bin/atomic-openshift-installer", "-c", "/var/lib/openshift-installer/installer.cfg", "--ansible-log-path", "/var/lib/openshift-installer/ansible.log"]
+CMD [ "/usr/libexec/s2i/run" ]
diff --git a/filter_plugins/openshift_version.py b/filter_plugins/openshift_version.py
new file mode 100644
index 000000000..1403e9dcc
--- /dev/null
+++ b/filter_plugins/openshift_version.py
@@ -0,0 +1,129 @@
+#!/usr/bin/python
+
+# -*- coding: utf-8 -*-
+# vim: expandtab:tabstop=4:shiftwidth=4
+"""
+Custom version comparison filters for use in openshift-ansible
+"""
+
+# pylint can't locate distutils.version within virtualenv
+# https://github.com/PyCQA/pylint/issues/73
+# pylint: disable=no-name-in-module, import-error
+from distutils.version import LooseVersion
+
+
+def legacy_gte_function_builder(name, versions):
+ """
+ Build and return a version comparison function.
+
+ Ex: name = 'oo_version_gte_3_1_or_1_1'
+ versions = {'enterprise': '3.1', 'origin': '1.1'}
+
+ returns oo_version_gte_3_1_or_1_1, a function which based on the
+ version and deployment type will return true if the provided
+ version is greater than or equal to the function's version
+ """
+ enterprise_version = versions['enterprise']
+ origin_version = versions['origin']
+
+ def _gte_function(version, deployment_type):
+ """
+ Dynamic function created by gte_function_builder.
+
+ Ex: version = '3.1'
+ deployment_type = 'openshift-enterprise'
+ returns True/False
+ """
+ version_gte = False
+ if 'enterprise' in deployment_type:
+ if str(version) >= LooseVersion(enterprise_version):
+ version_gte = True
+ elif 'origin' in deployment_type:
+ if str(version) >= LooseVersion(origin_version):
+ version_gte = True
+ return version_gte
+ _gte_function.__name__ = name
+ return _gte_function
+
+
+def gte_function_builder(name, gte_version):
+ """
+ Build and return a version comparison function.
+
+ Ex: name = 'oo_version_gte_3_6'
+ version = '3.6'
+
+ returns oo_version_gte_3_6, a function which based on the
+ version will return true if the provided version is greater
+ than or equal to the function's version
+ """
+ def _gte_function(version):
+ """
+ Dynamic function created by gte_function_builder.
+
+ Ex: version = '3.1'
+ returns True/False
+ """
+ version_gte = False
+ if str(version) >= LooseVersion(gte_version):
+ version_gte = True
+ return version_gte
+ _gte_function.__name__ = name
+ return _gte_function
+
+
+# pylint: disable=too-few-public-methods
+class FilterModule(object):
+ """
+ Filters for version checking.
+ """
+ # Each element of versions is composed of (major, minor_start, minor_end)
+ # Origin began versioning 3.x with 3.6, so begin 3.x with 3.6.
+ versions = [(3, 6, 10)]
+
+ def __init__(self):
+ """
+ Creates a new FilterModule for ose version checking.
+ """
+ self._filters = {}
+
+ # For each set of (major, minor, minor_iterations)
+ for major, minor_start, minor_end in self.versions:
+ # For each minor version in the range
+ for minor in range(minor_start, minor_end):
+ # Create the function name
+ func_name = 'oo_version_gte_{}_{}'.format(major, minor)
+ # Create the function with the builder
+ func = gte_function_builder(func_name, "{}.{}.0".format(major, minor))
+ # Add the function to the mapping
+ self._filters[func_name] = func
+
+ # Create filters with special versioning requirements.
+ # Treat all Origin 1.x as special case.
+ legacy_filters = [{'name': 'oo_version_gte_3_1_or_1_1',
+ 'versions': {'enterprise': '3.0.2.905',
+ 'origin': '1.1.0'}},
+ {'name': 'oo_version_gte_3_1_1_or_1_1_1',
+ 'versions': {'enterprise': '3.1.1',
+ 'origin': '1.1.1'}},
+ {'name': 'oo_version_gte_3_2_or_1_2',
+ 'versions': {'enterprise': '3.1.1.901',
+ 'origin': '1.2.0'}},
+ {'name': 'oo_version_gte_3_3_or_1_3',
+ 'versions': {'enterprise': '3.3.0',
+ 'origin': '1.3.0'}},
+ {'name': 'oo_version_gte_3_4_or_1_4',
+ 'versions': {'enterprise': '3.4.0',
+ 'origin': '1.4.0'}},
+ {'name': 'oo_version_gte_3_5_or_1_5',
+ 'versions': {'enterprise': '3.5.0',
+ 'origin': '1.5.0'}}]
+ for legacy_filter in legacy_filters:
+ self._filters[legacy_filter['name']] = legacy_gte_function_builder(legacy_filter['name'],
+ legacy_filter['versions'])
+
+ def filters(self):
+ """
+ Return the filters mapping.
+ """
+ return self._filters
diff --git a/inventory/byo/hosts.openstack b/inventory/byo/hosts.openstack
index ea7e905cb..c648078c4 100644
--- a/inventory/byo/hosts.openstack
+++ b/inventory/byo/hosts.openstack
@@ -15,7 +15,7 @@ ansible_become=yes
# Debug level for all OpenShift components (Defaults to 2)
debug_level=2
-deployment_type=openshift-enterprise
+openshift_deployment_type=openshift-enterprise
openshift_additional_repos=[{'id': 'ose-3.1', 'name': 'ose-3.1', 'baseurl': 'http://pulp.dist.prod.ext.phx2.redhat.com/content/dist/rhel/server/7/7Server/x86_64/ose/3.1/os', 'enabled': 1, 'gpgcheck': 0}]
diff --git a/inventory/byo/hosts.origin.example b/inventory/byo/hosts.origin.example
index 033ce8a82..d61f033f8 100644
--- a/inventory/byo/hosts.origin.example
+++ b/inventory/byo/hosts.origin.example
@@ -23,7 +23,7 @@ ansible_ssh_user=root
debug_level=2
# deployment type valid values are origin, online, atomic-enterprise and openshift-enterprise
-deployment_type=origin
+openshift_deployment_type=origin
# Specify the generic release of OpenShift to install. This is used mainly just during installation, after which we
# rely on the version running on the first master. Works best for containerized installs where we can usually
@@ -91,6 +91,10 @@ openshift_release=v1.5
# Specify exact version of etcd to configure or upgrade to.
# etcd_version="3.1.0"
+# Enable etcd debug logging, defaults to false
+# etcd_debug=true
+# Set etcd log levels by package
+# etcd_log_package_levels="etcdserver=WARNING,security=DEBUG"
# Upgrade Hooks
#
@@ -384,6 +388,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
# based on the number of nodes matching the openshift registry selector.
#openshift_hosted_registry_replicas=2
#
+# Validity of the auto-generated certificate in days (optional)
+#openshift_hosted_registry_cert_expire_days=730
+#
# Disable management of the OpenShift Registry
#openshift_hosted_manage_registry=false
@@ -750,6 +757,13 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
# by deployment_type=origin
#openshift_enable_origin_repo=false
+# Validity of the auto-generated certificates in days.
+# See also openshift_hosted_registry_cert_expire_days above.
+#
+#openshift_ca_cert_expire_days=1825
+#openshift_node_cert_expire_days=730
+#openshift_master_cert_expire_days=730
+
# host group for masters
[masters]
ose3-master[1:3]-ansible.test.example.com
diff --git a/inventory/byo/hosts.ose.example b/inventory/byo/hosts.ose.example
index 49bcb7405..823d6f58f 100644
--- a/inventory/byo/hosts.ose.example
+++ b/inventory/byo/hosts.ose.example
@@ -23,7 +23,7 @@ ansible_ssh_user=root
debug_level=2
# deployment type valid values are origin, online, atomic-enterprise, and openshift-enterprise
-deployment_type=openshift-enterprise
+openshift_deployment_type=openshift-enterprise
# Specify the generic release of OpenShift to install. This is used mainly just during installation, after which we
# rely on the version running on the first master. Works best for containerized installs where we can usually
@@ -91,6 +91,10 @@ openshift_release=v3.5
# Specify exact version of etcd to configure or upgrade to.
# etcd_version="3.1.0"
+# Enable etcd debug logging, defaults to false
+# etcd_debug=true
+# Set etcd log levels by package
+# etcd_log_package_levels="etcdserver=WARNING,security=DEBUG"
# Upgrade Hooks
#
@@ -384,6 +388,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
# based on the number of nodes matching the openshift registry selector.
#openshift_hosted_registry_replicas=2
#
+# Validity of the auto-generated certificate in days (optional)
+#openshift_hosted_registry_cert_expire_days=730
+#
# Disable management of the OpenShift Registry
#openshift_hosted_manage_registry=false
@@ -747,6 +754,13 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
# Enable API service auditing, available as of 3.2
#openshift_master_audit_config={"basicAuditEnabled": true}
+# Validity of the auto-generated certificates in days.
+# See also openshift_hosted_registry_cert_expire_days above.
+#
+#openshift_ca_cert_expire_days=1825
+#openshift_node_cert_expire_days=730
+#openshift_master_cert_expire_days=730
+
# host group for masters
[masters]
ose3-master[1:3]-ansible.test.example.com
diff --git a/openshift-ansible.spec b/openshift-ansible.spec
index 228afea58..c25c152df 100644
--- a/openshift-ansible.spec
+++ b/openshift-ansible.spec
@@ -9,7 +9,7 @@
%global __requires_exclude ^/usr/bin/ansible-playbook$
Name: openshift-ansible
-Version: 3.6.10
+Version: 3.6.12
Release: 1%{?dist}
Summary: Openshift and Atomic Enterprise Ansible
License: ASL 2.0
@@ -270,6 +270,40 @@ Atomic OpenShift Utilities includes
%changelog
+* Thu Mar 30 2017 Jenkins CD Merge Bot <tdawson@redhat.com> 3.6.12-1
+- Update example inventory files to mention certificate validity parameters.
+ (vsemushi@redhat.com)
+- openshift_hosted: add openshift_hosted_registry_cert_expire_days parameter.
+ (vsemushi@redhat.com)
+- oc_adm_ca_server_cert.py: re-generate. (vsemushi@redhat.com)
+- oc_adm_ca_server_cert: add expire_days parameter. (vsemushi@redhat.com)
+- openshift_ca: add openshift_ca_cert_expire_days and
+ openshift_master_cert_expire_days parameters. (vsemushi@redhat.com)
+- redeploy-certificates/registry.yml: add
+ openshift_hosted_registry_cert_expire_days parameter. (vsemushi@redhat.com)
+- openshift_master_certificates: add openshift_master_cert_expire_days
+ parameter. (vsemushi@redhat.com)
+- openshift_node_certificates: add openshift_node_cert_expire_days parameter.
+ (vsemushi@redhat.com)
+- Update Dockerfile.rhel7 to reflect changes to Dockerfile (pep@redhat.com)
+
+* Wed Mar 29 2017 Jenkins CD Merge Bot <tdawson@redhat.com> 3.6.11-1
+- Add etcd_debug and etcd_log_package_levels variables (sdodson@redhat.com)
+- Make the OCP available version detection excluder free (jchaloup@redhat.com)
+- Add test scaffold for docker_image_availability.py (rhcarvalho@gmail.com)
+- Add unit tests for package_version.py (rhcarvalho@gmail.com)
+- Add unit tests for package_update.py (rhcarvalho@gmail.com)
+- Add unit tests for package_availability.py (rhcarvalho@gmail.com)
+- Add unit tests for mixins.py (rhcarvalho@gmail.com)
+- Test recursively finding subclasses (rhcarvalho@gmail.com)
+- Test OpenShift health check loader (rhcarvalho@gmail.com)
+- Rename module_executor -> execute_module (rhcarvalho@gmail.com)
+- Use oo_version_gte_3_6+ for future versions and treat 1.x origin as legacy.
+ Add tests. (abutcher@redhat.com)
+- Added 3.5 -> 3.6 upgrade playbooks (skuznets@redhat.com)
+- Add oo_version_gte_X_X_or_Y_Y version comparison filters.
+ (abutcher@redhat.com)
+
* Tue Mar 28 2017 Jenkins CD Merge Bot <tdawson@redhat.com> 3.6.10-1
- Use meta/main.yml for role dependencies (rteague@redhat.com)
- Upgrade specific rpms instead of just master/node. (dgoodwin@redhat.com)
diff --git a/playbooks/byo/openshift-cluster/config.yml b/playbooks/byo/openshift-cluster/config.yml
index 86eff4ca4..4db0720d0 100644
--- a/playbooks/byo/openshift-cluster/config.yml
+++ b/playbooks/byo/openshift-cluster/config.yml
@@ -7,5 +7,4 @@
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
openshift_debug_level: "{{ debug_level | default(2) }}"
- openshift_deployment_type: "{{ deployment_type }}"
openshift_deployment_subtype: "{{ deployment_subtype | default(none) }}"
diff --git a/playbooks/byo/openshift-cluster/openshift-logging.yml b/playbooks/byo/openshift-cluster/openshift-logging.yml
index eebfcd20d..f8eebe898 100644
--- a/playbooks/byo/openshift-cluster/openshift-logging.yml
+++ b/playbooks/byo/openshift-cluster/openshift-logging.yml
@@ -32,4 +32,3 @@
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
openshift_debug_level: "{{ debug_level | default(2) }}"
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/byo/openshift-cluster/upgrades/docker/upgrade.yml b/playbooks/byo/openshift-cluster/upgrades/docker/upgrade.yml
index d5fd7c424..5feb33be4 100644
--- a/playbooks/byo/openshift-cluster/upgrades/docker/upgrade.yml
+++ b/playbooks/byo/openshift-cluster/upgrades/docker/upgrade.yml
@@ -30,7 +30,6 @@
g_new_master_hosts: []
g_new_node_hosts: []
openshift_cluster_id: "{{ cluster_id | default('default') }}"
- openshift_deployment_type: "{{ deployment_type }}"
- include: ../../../../common/openshift-cluster/upgrades/initialize_nodes_to_upgrade.yml
diff --git a/playbooks/byo/openshift-cluster/upgrades/v3_6/README.md b/playbooks/byo/openshift-cluster/upgrades/v3_6/README.md
new file mode 100644
index 000000000..930cc753c
--- /dev/null
+++ b/playbooks/byo/openshift-cluster/upgrades/v3_6/README.md
@@ -0,0 +1,18 @@
+# v3.5 Major and Minor Upgrade Playbook
+
+## Overview
+This playbook currently performs the
+following steps.
+
+ * Upgrade and restart master services
+ * Unschedule node.
+ * Upgrade and restart docker
+ * Upgrade and restart node services
+ * Modifies the subset of the configuration necessary
+ * Applies the latest cluster policies
+ * Updates the default router if one exists
+ * Updates the default registry if one exists
+ * Updates image streams and quickstarts
+
+## Usage
+ansible-playbook -i ~/ansible-inventory openshift-ansible/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade.yml
diff --git a/playbooks/byo/openshift-cluster/upgrades/v3_6/roles b/playbooks/byo/openshift-cluster/upgrades/v3_6/roles
new file mode 120000
index 000000000..6bc1a7aef
--- /dev/null
+++ b/playbooks/byo/openshift-cluster/upgrades/v3_6/roles
@@ -0,0 +1 @@
+../../../../../roles \ No newline at end of file
diff --git a/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade.yml b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade.yml
new file mode 100644
index 000000000..900bbc8d8
--- /dev/null
+++ b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade.yml
@@ -0,0 +1,111 @@
+---
+#
+# Full Control Plane + Nodes Upgrade
+#
+- include: ../../../../common/openshift-cluster/upgrades/init.yml
+ tags:
+ - pre_upgrade
+
+- name: Configure the upgrade target for the common upgrade tasks
+ hosts: l_oo_all_hosts
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_upgrade_target: '3.6'
+ openshift_upgrade_min: "{{ '1.5' if deployment_type == 'origin' else '3.5' }}"
+
+# Pre-upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/initialize_nodes_to_upgrade.yml
+ tags:
+ - pre_upgrade
+
+- name: Update repos and initialize facts on all hosts
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade:oo_etcd_to_config:oo_lb_to_config
+ tags:
+ - pre_upgrade
+ roles:
+ - openshift_repos
+
+- name: Set openshift_no_proxy_internal_hostnames
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_no_proxy_internal_hostnames: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_config']
+ | union(groups['oo_masters_to_config'])
+ | union(groups['oo_etcd_to_config'] | default([])))
+ | oo_collect('openshift.common.hostname') | default([]) | join (',')
+ }}"
+ when: "{{ (openshift_http_proxy is defined or openshift_https_proxy is defined) and
+ openshift_generate_no_proxy_hosts | default(True) | bool }}"
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_inventory_vars.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/disable_excluder.yml
+ tags:
+ - pre_upgrade
+
+# Note: During upgrade the openshift excluder is not unexcluded inside the initialize_openshift_version.yml play.
+# So it is necassary to run the play after running disable_excluder.yml.
+- include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
+ tags:
+ - pre_upgrade
+ vars:
+ # Request specific openshift_release and let the openshift_version role handle converting this
+ # to a more specific version, respecting openshift_image_tag and openshift_pkg_version if
+ # defined, and overriding the normal behavior of protecting the installed version
+ openshift_release: "{{ openshift_upgrade_target }}"
+ openshift_protect_installed_version: False
+
+ # We skip the docker role at this point in upgrade to prevent
+ # unintended package, container, or config upgrades which trigger
+ # docker restarts. At this early stage of upgrade we can assume
+ # docker is configured and running.
+ skip_docker_role: True
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_control_plane_running.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-master/validate_restart.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_docker_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/v3_6/validator.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/gate_checks.yml
+ tags:
+ - pre_upgrade
+
+# Pre-upgrade completed, nothing after this should be tagged pre_upgrade.
+
+# Separate step so we can execute in parallel and clear out anything unused
+# before we get into the serialized upgrade process which will then remove
+# remaining images if possible.
+- name: Cleanup unused Docker images
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade:oo_etcd_to_config
+ tasks:
+ - include: ../../../../common/openshift-cluster/upgrades/cleanup_unused_images.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/upgrade_control_plane.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/upgrade_nodes.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/post_control_plane.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml
diff --git a/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_control_plane.yml b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_control_plane.yml
new file mode 100644
index 000000000..5bd0f7ac5
--- /dev/null
+++ b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_control_plane.yml
@@ -0,0 +1,115 @@
+---
+#
+# Control Plane Upgrade Playbook
+#
+# Upgrades masters and Docker (only on standalone etcd hosts)
+#
+# This upgrade does not include:
+# - node service running on masters
+# - docker running on masters
+# - node service running on dedicated nodes
+#
+# You can run the upgrade_nodes.yml playbook after this to upgrade these components separately.
+#
+- include: ../../../../common/openshift-cluster/upgrades/init.yml
+ tags:
+ - pre_upgrade
+
+# Configure the upgrade target for the common upgrade tasks:
+- hosts: l_oo_all_hosts
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_upgrade_target: '3.6'
+ openshift_upgrade_min: "{{ '1.5' if deployment_type == 'origin' else '3.5' }}"
+
+# Pre-upgrade
+- include: ../../../../common/openshift-cluster/upgrades/initialize_nodes_to_upgrade.yml
+ tags:
+ - pre_upgrade
+
+- name: Update repos on control plane hosts
+ hosts: oo_masters_to_config:oo_etcd_to_config:oo_lb_to_config
+ tags:
+ - pre_upgrade
+ roles:
+ - openshift_repos
+
+- name: Set openshift_no_proxy_internal_hostnames
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_no_proxy_internal_hostnames: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_config']
+ | union(groups['oo_masters_to_config'])
+ | union(groups['oo_etcd_to_config'] | default([])))
+ | oo_collect('openshift.common.hostname') | default([]) | join (',')
+ }}"
+ when: "{{ (openshift_http_proxy is defined or openshift_https_proxy is defined) and
+ openshift_generate_no_proxy_hosts | default(True) | bool }}"
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_inventory_vars.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/disable_excluder.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
+ tags:
+ - pre_upgrade
+ vars:
+ # Request specific openshift_release and let the openshift_version role handle converting this
+ # to a more specific version, respecting openshift_image_tag and openshift_pkg_version if
+ # defined, and overriding the normal behavior of protecting the installed version
+ openshift_release: "{{ openshift_upgrade_target }}"
+ openshift_protect_installed_version: False
+
+ # We skip the docker role at this point in upgrade to prevent
+ # unintended package, container, or config upgrades which trigger
+ # docker restarts. At this early stage of upgrade we can assume
+ # docker is configured and running.
+ skip_docker_role: True
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_control_plane_running.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-master/validate_restart.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_docker_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/v3_6/validator.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/gate_checks.yml
+ tags:
+ - pre_upgrade
+
+# Pre-upgrade completed, nothing after this should be tagged pre_upgrade.
+
+# Separate step so we can execute in parallel and clear out anything unused
+# before we get into the serialized upgrade process which will then remove
+# remaining images if possible.
+- name: Cleanup unused Docker images
+ hosts: oo_masters_to_config:oo_etcd_to_config
+ tasks:
+ - include: ../../../../common/openshift-cluster/upgrades/cleanup_unused_images.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/upgrade_control_plane.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/post_control_plane.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml
diff --git a/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_nodes.yml b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_nodes.yml
new file mode 100644
index 000000000..96d89dbdd
--- /dev/null
+++ b/playbooks/byo/openshift-cluster/upgrades/v3_6/upgrade_nodes.yml
@@ -0,0 +1,104 @@
+---
+#
+# Node Upgrade Playbook
+#
+# Upgrades nodes only, but requires the control plane to have already been upgraded.
+#
+- include: ../../../../common/openshift-cluster/upgrades/init.yml
+ tags:
+ - pre_upgrade
+
+# Configure the upgrade target for the common upgrade tasks:
+- hosts: l_oo_all_hosts
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_upgrade_target: '3.6'
+ openshift_upgrade_min: "{{ '1.5' if deployment_type == 'origin' else '3.5' }}"
+
+# Pre-upgrade
+- include: ../../../../common/openshift-cluster/upgrades/initialize_nodes_to_upgrade.yml
+ tags:
+ - pre_upgrade
+
+- name: Update repos on nodes
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade:oo_etcd_to_config:oo_lb_to_config
+ roles:
+ - openshift_repos
+ tags:
+ - pre_upgrade
+
+- name: Set openshift_no_proxy_internal_hostnames
+ hosts: oo_masters_to_config:oo_nodes_to_upgrade
+ tags:
+ - pre_upgrade
+ tasks:
+ - set_fact:
+ openshift_no_proxy_internal_hostnames: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_upgrade']
+ | union(groups['oo_masters_to_config'])
+ | union(groups['oo_etcd_to_config'] | default([])))
+ | oo_collect('openshift.common.hostname') | default([]) | join (',')
+ }}"
+ when: "{{ (openshift_http_proxy is defined or openshift_https_proxy is defined) and
+ openshift_generate_no_proxy_hosts | default(True) | bool }}"
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_inventory_vars.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/disable_excluder.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
+ tags:
+ - pre_upgrade
+ vars:
+ # Request specific openshift_release and let the openshift_version role handle converting this
+ # to a more specific version, respecting openshift_image_tag and openshift_pkg_version if
+ # defined, and overriding the normal behavior of protecting the installed version
+ openshift_release: "{{ openshift_upgrade_target }}"
+ openshift_protect_installed_version: False
+
+ # We skip the docker role at this point in upgrade to prevent
+ # unintended package, container, or config upgrades which trigger
+ # docker restarts. At this early stage of upgrade we can assume
+ # docker is configured and running.
+ skip_docker_role: True
+
+- name: Verify masters are already upgraded
+ hosts: oo_masters_to_config
+ tags:
+ - pre_upgrade
+ tasks:
+ - fail: msg="Master running {{ openshift.common.version }} must be upgraded to {{ openshift_version }} before node upgrade can be run."
+ when: openshift.common.version != openshift_version
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_control_plane_running.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/verify_docker_upgrade_targets.yml
+ tags:
+ - pre_upgrade
+
+- include: ../../../../common/openshift-cluster/upgrades/pre/gate_checks.yml
+ tags:
+ - pre_upgrade
+
+# Pre-upgrade completed, nothing after this should be tagged pre_upgrade.
+
+# Separate step so we can execute in parallel and clear out anything unused
+# before we get into the serialized upgrade process which will then remove
+# remaining images if possible.
+- name: Cleanup unused Docker images
+ hosts: oo_nodes_to_upgrade
+ tasks:
+ - include: ../../../../common/openshift-cluster/upgrades/cleanup_unused_images.yml
+
+- include: ../../../../common/openshift-cluster/upgrades/upgrade_nodes.yml
diff --git a/playbooks/byo/openshift-etcd/restart.yml b/playbooks/byo/openshift-etcd/restart.yml
index 6713f07e3..19403116d 100644
--- a/playbooks/byo/openshift-etcd/restart.yml
+++ b/playbooks/byo/openshift-etcd/restart.yml
@@ -4,5 +4,3 @@
- always
- include: ../../common/openshift-etcd/restart.yml
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/byo/openshift-master/restart.yml b/playbooks/byo/openshift-master/restart.yml
index 2d20f69f4..21e4cff1b 100644
--- a/playbooks/byo/openshift-master/restart.yml
+++ b/playbooks/byo/openshift-master/restart.yml
@@ -4,5 +4,3 @@
- always
- include: ../../common/openshift-master/restart.yml
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/byo/openshift-master/scaleup.yml b/playbooks/byo/openshift-master/scaleup.yml
index 7075bb59e..a5705e990 100644
--- a/playbooks/byo/openshift-master/scaleup.yml
+++ b/playbooks/byo/openshift-master/scaleup.yml
@@ -27,4 +27,3 @@
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
openshift_debug_level: "{{ debug_level | default(2) }}"
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/byo/openshift-node/restart.yml b/playbooks/byo/openshift-node/restart.yml
index 3985a83bb..6861625b9 100644
--- a/playbooks/byo/openshift-node/restart.yml
+++ b/playbooks/byo/openshift-node/restart.yml
@@ -4,5 +4,3 @@
- always
- include: ../../common/openshift-node/restart.yml
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/byo/openshift-node/scaleup.yml b/playbooks/byo/openshift-node/scaleup.yml
index 2b10b6c76..88d236b53 100644
--- a/playbooks/byo/openshift-node/scaleup.yml
+++ b/playbooks/byo/openshift-node/scaleup.yml
@@ -27,6 +27,5 @@
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
openshift_debug_level: "{{ debug_level | default(2) }}"
- openshift_deployment_type: "{{ deployment_type }}"
openshift_master_etcd_hosts: "{{ groups.etcd | default([]) }}"
openshift_master_etcd_port: 2379
diff --git a/playbooks/byo/rhel_subscribe.yml b/playbooks/byo/rhel_subscribe.yml
index 65c0b1c01..8c6d77024 100644
--- a/playbooks/byo/rhel_subscribe.yml
+++ b/playbooks/byo/rhel_subscribe.yml
@@ -5,8 +5,6 @@
- name: Subscribe hosts, update repos and update OS packages
hosts: l_oo_all_hosts
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
roles:
- role: rhel_subscribe
when: deployment_type in ['atomic-enterprise', 'enterprise', 'openshift-enterprise'] and
diff --git a/playbooks/common/openshift-cluster/config.yml b/playbooks/common/openshift-cluster/config.yml
index ff4c4b0d7..1b967b7f1 100644
--- a/playbooks/common/openshift-cluster/config.yml
+++ b/playbooks/common/openshift-cluster/config.yml
@@ -27,9 +27,6 @@
when: openshift_docker_selinux_enabled is not defined
- include: disable_excluder.yml
- vars:
- # the excluders needs to be disabled no matter what status says
- with_status_check: false
tags:
- always
diff --git a/playbooks/common/openshift-cluster/enable_dnsmasq.yml b/playbooks/common/openshift-cluster/enable_dnsmasq.yml
index ca5177852..5425f448f 100644
--- a/playbooks/common/openshift-cluster/enable_dnsmasq.yml
+++ b/playbooks/common/openshift-cluster/enable_dnsmasq.yml
@@ -56,8 +56,6 @@
- role: node
local_facts:
dns_ip: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
roles:
- openshift_node_dnsmasq
post_tasks:
diff --git a/playbooks/common/openshift-cluster/initialize_facts.yml b/playbooks/common/openshift-cluster/initialize_facts.yml
index 18f99728c..9cebecd68 100644
--- a/playbooks/common/openshift-cluster/initialize_facts.yml
+++ b/playbooks/common/openshift-cluster/initialize_facts.yml
@@ -15,5 +15,3 @@
hostname: "{{ openshift_hostname | default(None) }}"
- set_fact:
openshift_docker_hosted_registry_network: "{{ hostvars[groups.oo_first_master.0].openshift.common.portal_net }}"
- - set_fact:
- openshift_deployment_type: "{{ deployment_type }}"
diff --git a/playbooks/common/openshift-cluster/initialize_openshift_version.yml b/playbooks/common/openshift-cluster/initialize_openshift_version.yml
index 1f74e929f..07b38920f 100644
--- a/playbooks/common/openshift-cluster/initialize_openshift_version.yml
+++ b/playbooks/common/openshift-cluster/initialize_openshift_version.yml
@@ -18,18 +18,6 @@
msg: Incompatible versions of yum and subscription-manager found. You may need to update yum and yum-utils.
when: "not openshift.common.is_atomic | bool and 'Plugin \"search-disabled-repos\" requires API 2.7. Supported API is 2.6.' in yum_ver_test.stdout"
-# TODO(jchaloup): find a different way how to make repoquery --qf '%version` atomic-openshift work without disabling the excluders
-- include: disable_excluder.yml
- vars:
- # the excluders needs to be disabled no matter what status says
- with_status_check: false
- # Only openshift excluder needs to be temporarily disabled
- # So ignore the docker one
- enable_docker_excluder: false
- tags:
- - always
- when: openshift_upgrade_target is not defined
-
- name: Determine openshift_version to configure on first master
hosts: oo_first_master
roles:
@@ -44,13 +32,3 @@
openshift_version: "{{ hostvars[groups.oo_first_master.0].openshift_version }}"
roles:
- openshift_version
-
- # Re-enable excluders if they are meant to be enabled (and only during installation, upgrade disables the excluders before this play)
-- include: reset_excluder.yml
- vars:
- # Only openshift excluder needs to be re-enabled
- # So ignore the docker one
- enable_docker_excluder: false
- tags:
- - always
- when: openshift_upgrade_target is not defined
diff --git a/playbooks/common/openshift-cluster/redeploy-certificates/registry.yml b/playbooks/common/openshift-cluster/redeploy-certificates/registry.yml
index 08ebfe735..e82996cf4 100644
--- a/playbooks/common/openshift-cluster/redeploy-certificates/registry.yml
+++ b/playbooks/common/openshift-cluster/redeploy-certificates/registry.yml
@@ -69,6 +69,9 @@
--hostnames="{{ docker_registry_service_ip.results.clusterip }},docker-registry.default.svc.cluster.local,{{ docker_registry_route_hostname }}"
--cert={{ openshift.common.config_base }}/master/registry.crt
--key={{ openshift.common.config_base }}/master/registry.key
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_hosted_registry_cert_expire_days | default(730) }}
+ {% endif %}
- name: Update registry certificates secret
oc_secret:
diff --git a/playbooks/common/openshift-cluster/std_include.yml b/playbooks/common/openshift-cluster/std_include.yml
index 078991b12..74cc1d527 100644
--- a/playbooks/common/openshift-cluster/std_include.yml
+++ b/playbooks/common/openshift-cluster/std_include.yml
@@ -22,8 +22,6 @@
- always
tasks:
- include_vars: ../../byo/openshift-cluster/cluster_hosts.yml
- - set_fact:
- openshift_deployment_type: "{{ deployment_type }}"
- include: evaluate_groups.yml
tags:
diff --git a/playbooks/common/openshift-cluster/update_repos_and_packages.yml b/playbooks/common/openshift-cluster/update_repos_and_packages.yml
index b83e4d821..be956fca5 100644
--- a/playbooks/common/openshift-cluster/update_repos_and_packages.yml
+++ b/playbooks/common/openshift-cluster/update_repos_and_packages.yml
@@ -3,8 +3,6 @@
- name: Subscribe hosts, update repos and update OS packages
hosts: oo_hosts_to_update
- vars:
- openshift_deployment_type: "{{ deployment_type }}"
roles:
# Explicitly calling openshift_facts because it appears that when
# rhel_subscribe is skipped that the openshift_facts dependency for
diff --git a/playbooks/common/openshift-cluster/upgrades/init.yml b/playbooks/common/openshift-cluster/upgrades/init.yml
index a3b8c489e..bcbc4ee02 100644
--- a/playbooks/common/openshift-cluster/upgrades/init.yml
+++ b/playbooks/common/openshift-cluster/upgrades/init.yml
@@ -29,7 +29,6 @@
g_new_master_hosts: []
g_new_node_hosts: []
openshift_cluster_id: "{{ cluster_id | default('default') }}"
- openshift_deployment_type: "{{ deployment_type }}"
- name: Set oo_options
hosts: oo_all_hosts
diff --git a/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
index 6f096f705..c00795a8d 100644
--- a/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
+++ b/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
@@ -5,7 +5,6 @@
- name: Upgrade default router and default registry
hosts: oo_first_master
vars:
- openshift_deployment_type: "{{ deployment_type }}"
registry_image: "{{ openshift.master.registry_url | replace( '${component}', 'docker-registry' ) | replace ( '${version}', openshift_image_tag ) }}"
router_image: "{{ openshift.master.registry_url | replace( '${component}', 'haproxy-router' ) | replace ( '${version}', openshift_image_tag ) }}"
oc_cmd: "{{ openshift.common.client_binary }} --config={{ openshift.common.config_base }}/master/admin.kubeconfig"
diff --git a/playbooks/common/openshift-cluster/upgrades/v3_6/filter_plugins b/playbooks/common/openshift-cluster/upgrades/v3_6/filter_plugins
new file mode 120000
index 000000000..7de3c1dd7
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/v3_6/filter_plugins
@@ -0,0 +1 @@
+../../../../../filter_plugins/ \ No newline at end of file
diff --git a/playbooks/common/openshift-cluster/upgrades/v3_6/roles b/playbooks/common/openshift-cluster/upgrades/v3_6/roles
new file mode 120000
index 000000000..415645be6
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/v3_6/roles
@@ -0,0 +1 @@
+../../../../../roles/ \ No newline at end of file
diff --git a/playbooks/common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml b/playbooks/common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml
new file mode 100644
index 000000000..48c69eccd
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/v3_6/storage_upgrade.yml
@@ -0,0 +1,18 @@
+---
+###############################################################################
+# Post upgrade - Upgrade job storage
+###############################################################################
+- name: Upgrade job storage
+ hosts: oo_first_master
+ roles:
+ - { role: openshift_cli }
+ vars:
+ # Another spot where we assume docker is running and do not want to accidentally trigger an unsafe
+ # restart.
+ skip_docker_role: True
+ tasks:
+ - name: Upgrade job storage
+ command: >
+ {{ openshift.common.client_binary }} adm --config={{ openshift.common.config_base }}/master/admin.kubeconfig
+ migrate storage --include=jobs --confirm
+ run_once: true
diff --git a/playbooks/common/openshift-cluster/upgrades/v3_6/validator.yml b/playbooks/common/openshift-cluster/upgrades/v3_6/validator.yml
new file mode 100644
index 000000000..ac5704f69
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/v3_6/validator.yml
@@ -0,0 +1,10 @@
+---
+###############################################################################
+# Pre upgrade checks for known data problems, if this playbook fails you should
+# contact support. If you're not supported contact users@lists.openshift.com
+###############################################################################
+- name: Verify 3.6 specific upgrade checks
+ hosts: oo_first_master
+ roles:
+ - { role: lib_openshift }
+ tasks: []
diff --git a/playbooks/common/openshift-master/scaleup.yml b/playbooks/common/openshift-master/scaleup.yml
index c59747081..92f16dc47 100644
--- a/playbooks/common/openshift-master/scaleup.yml
+++ b/playbooks/common/openshift-master/scaleup.yml
@@ -61,9 +61,6 @@
- openshift_docker
- include: ../openshift-cluster/disable_excluder.yml
- vars:
- # the excluders needs to be disabled no matter what status says
- with_status_check: false
tags:
- always
diff --git a/playbooks/common/openshift-node/scaleup.yml b/playbooks/common/openshift-node/scaleup.yml
index d81bd152e..c31aca62b 100644
--- a/playbooks/common/openshift-node/scaleup.yml
+++ b/playbooks/common/openshift-node/scaleup.yml
@@ -28,9 +28,6 @@
- openshift_docker
- include: ../openshift-cluster/disable_excluder.yml
- vars:
- # the excluders needs to be disabled no matter what status says
- with_status_check: false
tags:
- always
diff --git a/roles/etcd/templates/etcd.conf.j2 b/roles/etcd/templates/etcd.conf.j2
index 990a86c21..9151dd0bd 100644
--- a/roles/etcd/templates/etcd.conf.j2
+++ b/roles/etcd/templates/etcd.conf.j2
@@ -60,3 +60,9 @@ ETCD_PEER_CA_FILE={{ etcd_peer_ca_file }}
ETCD_PEER_CERT_FILE={{ etcd_peer_cert_file }}
ETCD_PEER_KEY_FILE={{ etcd_peer_key_file }}
{% endif -%}
+
+#[logging]
+ETCD_DEBUG="{{ etcd_debug | default(false) | string }}"
+{% if etcd_log_package_levels is defined %}
+ETCD_LOG_PACKAGE_LEVELS="{{ etcd_log_package_levels }}"
+{% endif %}
diff --git a/roles/lib_openshift/library/oc_adm_ca_server_cert.py b/roles/lib_openshift/library/oc_adm_ca_server_cert.py
index af1d13fe1..afe026099 100644
--- a/roles/lib_openshift/library/oc_adm_ca_server_cert.py
+++ b/roles/lib_openshift/library/oc_adm_ca_server_cert.py
@@ -130,6 +130,12 @@ options:
required: false
default: True
aliases: []
+ expire_days:
+ description
+ - Validity of the certificate in days
+ required: false
+ default: None
+ aliases: []
author:
- "Kenny Woodson <kwoodson@redhat.com>"
extends_documentation_fragment: []
@@ -1480,6 +1486,7 @@ class CAServerCert(OpenShiftCLI):
'signer_cert': {'value': params['signer_cert'], 'include': True},
'signer_key': {'value': params['signer_key'], 'include': True},
'signer_serial': {'value': params['signer_serial'], 'include': True},
+ 'expire_days': {'value': params['expire_days'], 'include': True},
'backup': {'value': params['backup'], 'include': False},
})
@@ -1538,6 +1545,7 @@ def main():
signer_key=dict(default='/etc/origin/master/ca.key', type='str'),
signer_serial=dict(default='/etc/origin/master/ca.serial.txt', type='str'),
hostnames=dict(default=[], type='list'),
+ expire_days=dict(default=None, type='int'),
),
supports_check_mode=True,
)
diff --git a/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py b/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py
index c80c2eb44..10f1c9b4b 100644
--- a/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py
+++ b/roles/lib_openshift/src/ansible/oc_adm_ca_server_cert.py
@@ -20,6 +20,7 @@ def main():
signer_key=dict(default='/etc/origin/master/ca.key', type='str'),
signer_serial=dict(default='/etc/origin/master/ca.serial.txt', type='str'),
hostnames=dict(default=[], type='list'),
+ expire_days=dict(default=None, type='int'),
),
supports_check_mode=True,
)
diff --git a/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
index 18c69f2fa..fa0c4e3af 100644
--- a/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
+++ b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
@@ -102,6 +102,7 @@ class CAServerCert(OpenShiftCLI):
'signer_cert': {'value': params['signer_cert'], 'include': True},
'signer_key': {'value': params['signer_key'], 'include': True},
'signer_serial': {'value': params['signer_serial'], 'include': True},
+ 'expire_days': {'value': params['expire_days'], 'include': True},
'backup': {'value': params['backup'], 'include': False},
})
diff --git a/roles/lib_openshift/src/doc/ca_server_cert b/roles/lib_openshift/src/doc/ca_server_cert
index ff9229281..7f2be4ada 100644
--- a/roles/lib_openshift/src/doc/ca_server_cert
+++ b/roles/lib_openshift/src/doc/ca_server_cert
@@ -79,6 +79,12 @@ options:
required: false
default: True
aliases: []
+ expire_days:
+ description
+ - Validity of the certificate in days
+ required: false
+ default: None
+ aliases: []
author:
- "Kenny Woodson <kwoodson@redhat.com>"
extends_documentation_fragment: []
diff --git a/roles/openshift_ca/README.md b/roles/openshift_ca/README.md
index 96c9cd5f2..dfbe81c6c 100644
--- a/roles/openshift_ca/README.md
+++ b/roles/openshift_ca/README.md
@@ -19,6 +19,8 @@ From this role:
| openshift_ca_key | `{{ openshift_ca_config_dir }}/ca.key` | CA key path including CA key filename. |
| openshift_ca_serial | `{{ openshift_ca_config_dir }}/ca.serial.txt` | CA serial path including CA serial filename. |
| openshift_version | `{{ openshift_pkg_version }}` | OpenShift package version. |
+| openshift_master_cert_expire_days | `730` (2 years) | Validity of the certificates in days. Works only with OpenShift version 1.5 (3.5) and later. |
+| openshift_ca_cert_expire_days | `1825` (5 years) | Validity of the CA certificates in days. Works only with OpenShift version 1.5 (3.5) and later. |
Dependencies
------------
diff --git a/roles/openshift_ca/defaults/main.yml b/roles/openshift_ca/defaults/main.yml
new file mode 100644
index 000000000..ecfcc88b3
--- /dev/null
+++ b/roles/openshift_ca/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+openshift_ca_cert_expire_days: 1825
+openshift_master_cert_expire_days: 730
diff --git a/roles/openshift_ca/tasks/main.yml b/roles/openshift_ca/tasks/main.yml
index 70c2a9121..3b17d9ed6 100644
--- a/roles/openshift_ca/tasks/main.yml
+++ b/roles/openshift_ca/tasks/main.yml
@@ -88,7 +88,7 @@
# This should NOT replace the CA due to --overwrite=false when a CA already exists.
- name: Create the master certificates if they do not already exist
command: >
- {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm create-master-certs
+ {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm ca create-master-certs
{% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
--certificate-authority {{ named_ca_certificate }}
{% endfor %}
@@ -99,6 +99,10 @@
--master={{ openshift.master.api_url }}
--public-master={{ openshift.master.public_api_url }}
--cert-dir={{ openshift_ca_config_dir }}
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_master_cert_expire_days }}
+ --signer-expire-days={{ openshift_ca_cert_expire_days }}
+ {% endif %}
--overwrite=false
when: master_ca_missing | bool or openshift_certificates_redeploy | default(false) | bool
delegate_to: "{{ openshift_ca_host }}"
diff --git a/roles/openshift_excluder/tasks/disable.yml b/roles/openshift_excluder/tasks/disable.yml
index e23496b3b..325d2a4e8 100644
--- a/roles/openshift_excluder/tasks/disable.yml
+++ b/roles/openshift_excluder/tasks/disable.yml
@@ -1,6 +1,5 @@
---
# input variables
-# - with_status_check
# - excluder_package_state
# - docker_excluder_package_state
- include: init.yml
@@ -35,6 +34,6 @@
unexclude_docker_excluder: false
# disable openshift excluder is never overrided to be enabled
# disable it if the docker excluder is enabled
- unexclude_openshift_excluder: true
+ unexclude_openshift_excluder: "{{ openshift_excluder_on | bool }}"
when:
- not openshift.common.is_atomic | bool
diff --git a/roles/openshift_facts/meta/main.yml b/roles/openshift_facts/meta/main.yml
index 0be3afd24..7eead2d6e 100644
--- a/roles/openshift_facts/meta/main.yml
+++ b/roles/openshift_facts/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
categories:
- cloud
- system
-dependencies: []
+dependencies:
+- role: openshift_sanitize_inventory
diff --git a/roles/openshift_facts/tasks/main.yml b/roles/openshift_facts/tasks/main.yml
index 73c668c72..93972f0e0 100644
--- a/roles/openshift_facts/tasks/main.yml
+++ b/roles/openshift_facts/tasks/main.yml
@@ -64,8 +64,7 @@
role: common
local_facts:
debug_level: "{{ openshift_debug_level | default(2) }}"
- # TODO: Deprecate deployment_type in favor of openshift_deployment_type
- deployment_type: "{{ openshift_deployment_type | default(deployment_type) }}"
+ deployment_type: "{{ openshift_deployment_type }}"
deployment_subtype: "{{ openshift_deployment_subtype | default(None) }}"
cluster_id: "{{ openshift_cluster_id | default('default') }}"
hostname: "{{ openshift_hostname | default(None) }}"
diff --git a/roles/openshift_health_checker/action_plugins/openshift_health_check.py b/roles/openshift_health_checker/action_plugins/openshift_health_check.py
index 8b23533c8..cf0fe19f1 100644
--- a/roles/openshift_health_checker/action_plugins/openshift_health_check.py
+++ b/roles/openshift_health_checker/action_plugins/openshift_health_check.py
@@ -17,7 +17,7 @@ from ansible.plugins.action import ActionBase
# this callback plugin.
sys.path.insert(1, os.path.dirname(os.path.dirname(__file__)))
-from openshift_checks import OpenShiftCheck, OpenShiftCheckException # noqa: E402
+from openshift_checks import OpenShiftCheck, OpenShiftCheckException, load_checks # noqa: E402
class ActionModule(ActionBase):
@@ -78,6 +78,8 @@ class ActionModule(ActionBase):
return result
def load_known_checks(self):
+ load_checks()
+
known_checks = {}
known_check_classes = set(cls for cls in OpenShiftCheck.subclasses())
@@ -91,7 +93,7 @@ class ActionModule(ActionBase):
check_name,
cls.__module__, cls.__name__,
other_cls.__module__, other_cls.__name__))
- known_checks[check_name] = cls(module_executor=self._execute_module)
+ known_checks[check_name] = cls(execute_module=self._execute_module)
return known_checks
diff --git a/roles/openshift_health_checker/openshift_checks/__init__.py b/roles/openshift_health_checker/openshift_checks/__init__.py
index 93547a2e0..be63d864a 100644
--- a/roles/openshift_health_checker/openshift_checks/__init__.py
+++ b/roles/openshift_health_checker/openshift_checks/__init__.py
@@ -21,8 +21,13 @@ class OpenShiftCheckException(Exception):
class OpenShiftCheck(object):
"""A base class for defining checks for an OpenShift cluster environment."""
- def __init__(self, module_executor):
- self.module_executor = module_executor
+ def __init__(self, execute_module=None, module_executor=None):
+ if execute_module is module_executor is None:
+ raise TypeError(
+ "__init__() takes either execute_module (recommended) "
+ "or module_executor (deprecated), none given")
+ self.execute_module = execute_module or module_executor
+ self.module_executor = self.execute_module
@abstractproperty
def name(self):
@@ -58,6 +63,21 @@ class OpenShiftCheck(object):
yield subclass
+LOADER_EXCLUDES = (
+ "__init__.py",
+ "mixins.py",
+)
+
+
+def load_checks():
+ """Dynamically import all check modules for the side effect of registering checks."""
+ return [
+ import_module(__package__ + "." + name[:-3])
+ for name in os.listdir(os.path.dirname(__file__))
+ if name.endswith(".py") and name not in LOADER_EXCLUDES
+ ]
+
+
def get_var(task_vars, *keys, **kwargs):
"""Helper function to get deeply nested values from task_vars.
@@ -73,15 +93,3 @@ def get_var(task_vars, *keys, **kwargs):
return kwargs["default"]
raise OpenShiftCheckException("'{}' is undefined".format(".".join(map(str, keys))))
return value
-
-
-# Dynamically import all submodules for the side effect of loading checks.
-
-EXCLUDES = (
- "__init__.py",
- "mixins.py",
-)
-
-for name in os.listdir(os.path.dirname(__file__)):
- if name.endswith(".py") and name not in EXCLUDES:
- import_module(__package__ + "." + name[:-3])
diff --git a/roles/openshift_health_checker/openshift_checks/docker_image_availability.py b/roles/openshift_health_checker/openshift_checks/docker_image_availability.py
index 7a7498cb7..cce289b95 100644
--- a/roles/openshift_health_checker/openshift_checks/docker_image_availability.py
+++ b/roles/openshift_health_checker/openshift_checks/docker_image_availability.py
@@ -15,6 +15,9 @@ class DockerImageAvailability(OpenShiftCheck):
skopeo_image = "openshift/openshift-ansible"
+ # FIXME(juanvallejo): we should consider other possible values of
+ # `deployment_type` (the key here). See
+ # https://github.com/openshift/openshift-ansible/blob/8e26f8c/roles/openshift_repos/vars/main.yml#L7
docker_image_base = {
"origin": {
"repo": "openshift",
@@ -62,9 +65,15 @@ class DockerImageAvailability(OpenShiftCheck):
def required_images(self, task_vars):
deployment_type = get_var(task_vars, "deployment_type")
+ # FIXME(juanvallejo): we should handle gracefully with a proper error
+ # message when given an unexpected value for `deployment_type`.
image_base_name = self.docker_image_base[deployment_type]
openshift_release = get_var(task_vars, "openshift_release")
+ # FIXME(juanvallejo): this variable is not required when the
+ # installation is non-containerized. The example inventories have it
+ # commented out. We should handle gracefully and with a proper error
+ # message when this variable is required and not set.
openshift_image_tag = get_var(task_vars, "openshift_image_tag")
is_containerized = get_var(task_vars, "openshift", "common", "is_containerized")
@@ -104,6 +113,8 @@ class DockerImageAvailability(OpenShiftCheck):
if result.get("failed", False):
return []
+ # FIXME(juanvallejo): wrong default type, result["info"] is expected to
+ # contain a dictionary (see how we call `docker_info.get` below).
docker_info = result.get("info", "")
return [registry.get("Name", "") for registry in docker_info.get("Registries", {})]
diff --git a/roles/openshift_health_checker/openshift_checks/package_availability.py b/roles/openshift_health_checker/openshift_checks/package_availability.py
index 771123d61..9891972a6 100644
--- a/roles/openshift_health_checker/openshift_checks/package_availability.py
+++ b/roles/openshift_health_checker/openshift_checks/package_availability.py
@@ -21,7 +21,7 @@ class PackageAvailability(NotContainerizedMixin, OpenShiftCheck):
packages.update(self.node_packages(rpm_prefix))
args = {"packages": sorted(set(packages))}
- return self.module_executor("check_yum_update", args, tmp, task_vars)
+ return self.execute_module("check_yum_update", args, tmp, task_vars)
@staticmethod
def master_packages(rpm_prefix):
diff --git a/roles/openshift_health_checker/openshift_checks/package_update.py b/roles/openshift_health_checker/openshift_checks/package_update.py
index c5a226954..fd0c0a755 100644
--- a/roles/openshift_health_checker/openshift_checks/package_update.py
+++ b/roles/openshift_health_checker/openshift_checks/package_update.py
@@ -11,4 +11,4 @@ class PackageUpdate(NotContainerizedMixin, OpenShiftCheck):
def run(self, tmp, task_vars):
args = {"packages": []}
- return self.module_executor("check_yum_update", args, tmp, task_vars)
+ return self.execute_module("check_yum_update", args, tmp, task_vars)
diff --git a/roles/openshift_health_checker/openshift_checks/package_version.py b/roles/openshift_health_checker/openshift_checks/package_version.py
index 2e9d07deb..42193a1c6 100644
--- a/roles/openshift_health_checker/openshift_checks/package_version.py
+++ b/roles/openshift_health_checker/openshift_checks/package_version.py
@@ -17,4 +17,4 @@ class PackageVersion(NotContainerizedMixin, OpenShiftCheck):
"prefix": rpm_prefix,
"version": openshift_release,
}
- return self.module_executor("aos_version", args, tmp, task_vars)
+ return self.execute_module("aos_version", args, tmp, task_vars)
diff --git a/roles/openshift_health_checker/test/docker_image_availability_test.py b/roles/openshift_health_checker/test/docker_image_availability_test.py
new file mode 100644
index 000000000..2a9c32f77
--- /dev/null
+++ b/roles/openshift_health_checker/test/docker_image_availability_test.py
@@ -0,0 +1,28 @@
+import pytest
+
+from openshift_checks.docker_image_availability import DockerImageAvailability
+
+
+@pytest.mark.xfail(strict=True) # TODO: remove this once this test is fully implemented.
+@pytest.mark.parametrize('task_vars,expected_result', [
+ (
+ dict(
+ openshift=dict(common=dict(
+ service_type='origin',
+ is_containerized=False,
+ )),
+ openshift_release='v3.5',
+ deployment_type='origin',
+ openshift_image_tag='', # FIXME: should not be required
+ ),
+ {'changed': False},
+ ),
+ # TODO: add more parameters here to test the multiple possible inputs that affect behavior.
+])
+def test_docker_image_availability(task_vars, expected_result):
+ def execute_module(module_name=None, module_args=None, tmp=None, task_vars=None):
+ return {'info': {}} # TODO: this will vary depending on input parameters.
+
+ check = DockerImageAvailability(execute_module=execute_module)
+ result = check.run(tmp=None, task_vars=task_vars)
+ assert result == expected_result
diff --git a/roles/openshift_health_checker/test/mixins_test.py b/roles/openshift_health_checker/test/mixins_test.py
new file mode 100644
index 000000000..2d83e207d
--- /dev/null
+++ b/roles/openshift_health_checker/test/mixins_test.py
@@ -0,0 +1,23 @@
+import pytest
+
+from openshift_checks import OpenShiftCheck, OpenShiftCheckException
+from openshift_checks.mixins import NotContainerizedMixin
+
+
+class NotContainerizedCheck(NotContainerizedMixin, OpenShiftCheck):
+ name = "not_containerized"
+ run = NotImplemented
+
+
+@pytest.mark.parametrize('task_vars,expected', [
+ (dict(openshift=dict(common=dict(is_containerized=False))), True),
+ (dict(openshift=dict(common=dict(is_containerized=True))), False),
+])
+def test_is_active(task_vars, expected):
+ assert NotContainerizedCheck.is_active(task_vars) == expected
+
+
+def test_is_active_missing_task_vars():
+ with pytest.raises(OpenShiftCheckException) as excinfo:
+ NotContainerizedCheck.is_active(task_vars={})
+ assert 'is_containerized' in str(excinfo.value)
diff --git a/roles/openshift_health_checker/test/openshift_check_test.py b/roles/openshift_health_checker/test/openshift_check_test.py
index c4c8cd1c2..e3153979c 100644
--- a/roles/openshift_health_checker/test/openshift_check_test.py
+++ b/roles/openshift_health_checker/test/openshift_check_test.py
@@ -1,6 +1,7 @@
import pytest
-from openshift_checks import get_var, OpenShiftCheckException
+from openshift_checks import OpenShiftCheck, OpenShiftCheckException
+from openshift_checks import load_checks, get_var
# Fixtures
@@ -22,6 +23,64 @@ def missing_keys(request):
# Tests
+def test_OpenShiftCheck_init():
+ class TestCheck(OpenShiftCheck):
+ name = "test_check"
+ run = NotImplemented
+
+ # initialization requires at least one argument (apart from self)
+ with pytest.raises(TypeError) as excinfo:
+ TestCheck()
+ assert 'execute_module' in str(excinfo.value)
+ assert 'module_executor' in str(excinfo.value)
+
+ execute_module = object()
+
+ # initialize with positional argument
+ check = TestCheck(execute_module)
+ # new recommended name
+ assert check.execute_module == execute_module
+ # deprecated attribute name
+ assert check.module_executor == execute_module
+
+ # initialize with keyword argument, recommended name
+ check = TestCheck(execute_module=execute_module)
+ # new recommended name
+ assert check.execute_module == execute_module
+ # deprecated attribute name
+ assert check.module_executor == execute_module
+
+ # initialize with keyword argument, deprecated name
+ check = TestCheck(module_executor=execute_module)
+ # new recommended name
+ assert check.execute_module == execute_module
+ # deprecated attribute name
+ assert check.module_executor == execute_module
+
+
+def test_subclasses():
+ """OpenShiftCheck.subclasses should find all subclasses recursively."""
+ class TestCheck1(OpenShiftCheck):
+ pass
+
+ class TestCheck2(OpenShiftCheck):
+ pass
+
+ class TestCheck1A(TestCheck1):
+ pass
+
+ local_subclasses = set([TestCheck1, TestCheck1A, TestCheck2])
+ known_subclasses = set(OpenShiftCheck.subclasses())
+
+ assert local_subclasses - known_subclasses == set(), "local_subclasses should be a subset of known_subclasses"
+
+
+def test_load_checks():
+ """Loading checks should load and return Python modules."""
+ modules = load_checks()
+ assert modules
+
+
@pytest.mark.parametrize("keys,expected", [
(("foo",), 42),
(("bar", "baz"), "openshift"),
diff --git a/roles/openshift_health_checker/test/package_availability_test.py b/roles/openshift_health_checker/test/package_availability_test.py
new file mode 100644
index 000000000..25385339a
--- /dev/null
+++ b/roles/openshift_health_checker/test/package_availability_test.py
@@ -0,0 +1,49 @@
+import pytest
+
+from openshift_checks.package_availability import PackageAvailability
+
+
+@pytest.mark.parametrize('task_vars,must_have_packages,must_not_have_packages', [
+ (
+ dict(openshift=dict(common=dict(service_type='openshift'))),
+ set(),
+ set(['openshift-master', 'openshift-node']),
+ ),
+ (
+ dict(
+ openshift=dict(common=dict(service_type='origin')),
+ group_names=['masters'],
+ ),
+ set(['origin-master']),
+ set(['origin-node']),
+ ),
+ (
+ dict(
+ openshift=dict(common=dict(service_type='atomic-openshift')),
+ group_names=['nodes'],
+ ),
+ set(['atomic-openshift-node']),
+ set(['atomic-openshift-master']),
+ ),
+ (
+ dict(
+ openshift=dict(common=dict(service_type='atomic-openshift')),
+ group_names=['masters', 'nodes'],
+ ),
+ set(['atomic-openshift-master', 'atomic-openshift-node']),
+ set(),
+ ),
+])
+def test_package_availability(task_vars, must_have_packages, must_not_have_packages):
+ return_value = object()
+
+ def execute_module(module_name=None, module_args=None, tmp=None, task_vars=None):
+ assert module_name == 'check_yum_update'
+ assert 'packages' in module_args
+ assert set(module_args['packages']).issuperset(must_have_packages)
+ assert not set(module_args['packages']).intersection(must_not_have_packages)
+ return return_value
+
+ check = PackageAvailability(execute_module=execute_module)
+ result = check.run(tmp=None, task_vars=task_vars)
+ assert result is return_value
diff --git a/roles/openshift_health_checker/test/package_update_test.py b/roles/openshift_health_checker/test/package_update_test.py
new file mode 100644
index 000000000..5e000cff5
--- /dev/null
+++ b/roles/openshift_health_checker/test/package_update_test.py
@@ -0,0 +1,16 @@
+from openshift_checks.package_update import PackageUpdate
+
+
+def test_package_update():
+ return_value = object()
+
+ def execute_module(module_name=None, module_args=None, tmp=None, task_vars=None):
+ assert module_name == 'check_yum_update'
+ assert 'packages' in module_args
+ # empty list of packages means "generic check if 'yum update' will work"
+ assert module_args['packages'] == []
+ return return_value
+
+ check = PackageUpdate(execute_module=execute_module)
+ result = check.run(tmp=None, task_vars=None)
+ assert result is return_value
diff --git a/roles/openshift_health_checker/test/package_version_test.py b/roles/openshift_health_checker/test/package_version_test.py
new file mode 100644
index 000000000..cc1d263bc
--- /dev/null
+++ b/roles/openshift_health_checker/test/package_version_test.py
@@ -0,0 +1,21 @@
+from openshift_checks.package_version import PackageVersion
+
+
+def test_package_version():
+ task_vars = dict(
+ openshift=dict(common=dict(service_type='origin')),
+ openshift_release='v3.5',
+ )
+ return_value = object()
+
+ def execute_module(module_name=None, module_args=None, tmp=None, task_vars=None):
+ assert module_name == 'aos_version'
+ assert 'prefix' in module_args
+ assert 'version' in module_args
+ assert module_args['prefix'] == task_vars['openshift']['common']['service_type']
+ assert module_args['version'] == task_vars['openshift_release']
+ return return_value
+
+ check = PackageVersion(execute_module=execute_module)
+ result = check.run(tmp=None, task_vars=task_vars)
+ assert result is return_value
diff --git a/roles/openshift_hosted/README.md b/roles/openshift_hosted/README.md
index 328f800bf..6d576df71 100644
--- a/roles/openshift_hosted/README.md
+++ b/roles/openshift_hosted/README.md
@@ -26,6 +26,7 @@ From this role:
| openshift_hosted_registry_registryurl | 'openshift3/ose-${component}:${version}' | The image to base the OpenShift registry on. |
| openshift_hosted_registry_replicas | Number of nodes matching selector | The number of replicas to configure. |
| openshift_hosted_registry_selector | region=infra | Node selector used when creating registry. The OpenShift registry will only be deployed to nodes matching this selector. |
+| openshift_hosted_registry_cert_expire_days | `730` (2 years) | Validity of the certificates in days. Works only with OpenShift version 1.5 (3.5) and later. |
Dependencies
------------
diff --git a/roles/openshift_hosted/defaults/main.yml b/roles/openshift_hosted/defaults/main.yml
index 32bcd8d08..d73f339f7 100644
--- a/roles/openshift_hosted/defaults/main.yml
+++ b/roles/openshift_hosted/defaults/main.yml
@@ -28,3 +28,4 @@ openshift_hosted_routers:
openshift_hosted_router_certificates: {}
+openshift_hosted_registry_cert_expire_days: 730
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
index f9ea2ebeb..8a159bf73 100644
--- a/roles/openshift_hosted/tasks/registry/secure.yml
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -57,6 +57,7 @@
- "{{ docker_registry_route_hostname }}"
cert: "{{ openshift_master_config_dir }}/registry.crt"
key: "{{ openshift_master_config_dir }}/registry.key"
+ expire_days: "{{ openshift_hosted_registry_cert_expire_days if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool else omit }}"
register: server_cert_out
- name: Create the secret for the registry certificates
diff --git a/roles/openshift_master_certificates/README.md b/roles/openshift_master_certificates/README.md
index a80d47040..4758bbdfb 100644
--- a/roles/openshift_master_certificates/README.md
+++ b/roles/openshift_master_certificates/README.md
@@ -21,6 +21,7 @@ From this role:
|---------------------------------------|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
| openshift_generated_configs_dir | `{{ openshift.common.config_base }}/generated-configs` | Directory in which per-master generated config directories will be created on the `openshift_ca_host`. |
| openshift_master_cert_subdir | `master-{{ openshift.common.hostname }}` | Directory within `openshift_generated_configs_dir` where per-master configurations will be placed on the `openshift_ca_host`. |
+| openshift_master_cert_expire_days | `730` (2 years) | Validity of the certificates in days. Works only with OpenShift version 1.5 (3.5) and later. |
| openshift_master_config_dir | `{{ openshift.common.config_base }}/master` | Master configuration directory in which certificates will be deployed on masters. |
| openshift_master_generated_config_dir | `{{ openshift_generated_configs_dir }}/{{ openshift_master_cert_subdir }` | Full path to the per-master generated config directory. |
diff --git a/roles/openshift_master_certificates/defaults/main.yml b/roles/openshift_master_certificates/defaults/main.yml
new file mode 100644
index 000000000..dba62c4ec
--- /dev/null
+++ b/roles/openshift_master_certificates/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+openshift_master_cert_expire_days: 730
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index 61541acb8..d4c9a96ca 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -57,6 +57,9 @@
--hostnames={{ hostvars[item].openshift.common.all_hostnames | join(',') }}
--cert={{ openshift_generated_configs_dir }}/master-{{ hostvars[item].openshift.common.hostname }}/master.server.crt
--key={{ openshift_generated_configs_dir }}/master-{{ hostvars[item].openshift.common.hostname }}/master.server.key
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_master_cert_expire_days }}
+ {% endif %}
--signer-cert={{ openshift_ca_cert }}
--signer-key={{ openshift_ca_key }}
--signer-serial={{ openshift_ca_serial }}
@@ -84,6 +87,9 @@
--signer-serial={{ openshift_ca_serial }}
--user=system:openshift-master
--basename=openshift-master
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_master_cert_expire_days }}
+ {% endif %}
args:
creates: "{{ openshift_generated_configs_dir }}/master-{{ hostvars[item].openshift.common.hostname }}/openshift-master.kubeconfig"
with_items: "{{ hostvars
diff --git a/roles/openshift_node_certificates/README.md b/roles/openshift_node_certificates/README.md
index f4215950f..fef2f0783 100644
--- a/roles/openshift_node_certificates/README.md
+++ b/roles/openshift_node_certificates/README.md
@@ -23,6 +23,7 @@ From this role:
|-------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
| openshift_generated_configs_dir | `{{ openshift.common.config_base }}/generated-configs` | Directory in which per-node generated config directories will be created on the `openshift_ca_host`. |
| openshift_node_cert_subdir | `node-{{ openshift.common.hostname }}` | Directory within `openshift_generated_configs_dir` where per-node certificates will be placed on the `openshift_ca_host`. |
+| openshift_node_cert_expire_days | `730` (2 years) | Validity of the certificates in days. Works only with OpenShift version 1.5 (3.5) and later. |
| openshift_node_config_dir | `{{ openshift.common.config_base }}/node` | Node configuration directory in which certificates will be deployed on nodes. |
| openshift_node_generated_config_dir | `{{ openshift_generated_configs_dir }}/{{ openshift_node_cert_subdir }` | Full path to the per-node generated config directory. |
diff --git a/roles/openshift_node_certificates/defaults/main.yml b/roles/openshift_node_certificates/defaults/main.yml
new file mode 100644
index 000000000..70a38b844
--- /dev/null
+++ b/roles/openshift_node_certificates/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+openshift_node_cert_expire_days: 730
diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml
index 4cb89aba2..9120915b2 100644
--- a/roles/openshift_node_certificates/tasks/main.yml
+++ b/roles/openshift_node_certificates/tasks/main.yml
@@ -66,6 +66,9 @@
--signer-key={{ openshift_ca_key }}
--signer-serial={{ openshift_ca_serial }}
--user=system:node:{{ hostvars[item].openshift.common.hostname }}
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_node_cert_expire_days }}
+ {% endif %}
args:
creates: "{{ openshift_generated_configs_dir }}/node-{{ hostvars[item].openshift.common.hostname }}"
with_items: "{{ hostvars
@@ -79,6 +82,9 @@
{{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm ca create-server-cert
--cert={{ openshift_generated_configs_dir }}/node-{{ hostvars[item].openshift.common.hostname }}/server.crt
--key={{ openshift_generated_configs_dir }}/node-{{ hostvars[item].openshift.common.hostname }}/server.key
+ {% if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool %}
+ --expire-days={{ openshift_node_cert_expire_days }}
+ {% endif %}
--overwrite=true
--hostnames={{ hostvars[item].openshift.common.hostname }},{{ hostvars[item].openshift.common.public_hostname }},{{ hostvars[item].openshift.common.ip }},{{ hostvars[item].openshift.common.public_ip }}
--signer-cert={{ openshift_ca_cert }}
diff --git a/roles/openshift_repos/meta/main.yml b/roles/openshift_repos/meta/main.yml
index cc18c453c..1b043863b 100644
--- a/roles/openshift_repos/meta/main.yml
+++ b/roles/openshift_repos/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
- 7
categories:
- cloud
-dependencies: []
+dependencies:
+- role: openshift_sanitize_inventory
diff --git a/roles/openshift_repos/tasks/main.yaml b/roles/openshift_repos/tasks/main.yaml
index ffb760bfe..84a0905cc 100644
--- a/roles/openshift_repos/tasks/main.yaml
+++ b/roles/openshift_repos/tasks/main.yaml
@@ -4,10 +4,6 @@
path: /run/ostree-booted
register: ostree_booted
-- assert:
- that: openshift_deployment_type in known_openshift_deployment_types
- msg: "openshift_deployment_type must be one of {{ known_openshift_deployment_types }}"
-
- block:
- name: Ensure libselinux-python is installed
package: name=libselinux-python state=present
diff --git a/roles/openshift_sanitize_inventory/README.md b/roles/openshift_sanitize_inventory/README.md
new file mode 100644
index 000000000..23f6b84fc
--- /dev/null
+++ b/roles/openshift_sanitize_inventory/README.md
@@ -0,0 +1,37 @@
+OpenShift Inventory
+===================
+
+Provides a role to validate and normalize the variables the user has
+provided. This role should run before pretty much everything else so that
+this kind of logic only has to be in one place. However, complicated
+business logic should usually be left to other roles.
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+None
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+TODO
+
+License
+-------
+
+Apache License, Version 2.0
+
+Author Information
+------------------
+
+OpenShift dev (dev@lists.openshift.redhat.com)
diff --git a/roles/openshift_sanitize_inventory/meta/main.yml b/roles/openshift_sanitize_inventory/meta/main.yml
new file mode 100644
index 000000000..f5b37186e
--- /dev/null
+++ b/roles/openshift_sanitize_inventory/meta/main.yml
@@ -0,0 +1,15 @@
+---
+galaxy_info:
+ author: OpenShift dev
+ description:
+ company: Red Hat, Inc.
+ license: Apache License, Version 2.0
+ min_ansible_version: 1.8
+ platforms:
+ - name: EL
+ versions:
+ - 7
+ categories:
+ - cloud
+ - system
+dependencies: []
diff --git a/roles/openshift_sanitize_inventory/tasks/main.yml b/roles/openshift_sanitize_inventory/tasks/main.yml
new file mode 100644
index 000000000..fc562c42c
--- /dev/null
+++ b/roles/openshift_sanitize_inventory/tasks/main.yml
@@ -0,0 +1,28 @@
+---
+- name: Standardize on latest variable names
+ no_log: True # keep task description legible
+ set_fact:
+ # goal is to deprecate deployment_type in favor of openshift_deployment_type.
+ # both will be accepted for now, but code should refer to the new name.
+ # TODO: once this is well-documented, add deprecation notice if using old name.
+ deployment_type: "{{ openshift_deployment_type | default(deployment_type) | default | string }}"
+ openshift_deployment_type: "{{ openshift_deployment_type | default(deployment_type) | default | string }}"
+
+- name: Normalize openshift_release
+ no_log: True # keep task description legible
+ set_fact:
+ # Normalize release if provided, e.g. "v3.5" => "3.5"
+ # Currently this is not required to be defined for all installs, and the
+ # `openshift_version` role can generally figure out the specific version
+ # that gets installed (e.g. 3.5.0.1). So consider this the user's expressed
+ # intent (if any), not the authoritative version that will be installed.
+ openshift_release: "{{ openshift_release | string | regex_replace('^v', '') }}"
+ when: openshift_release is defined
+
+- name: Ensure a valid deployment type has been given.
+ # this variable is required; complain early and clearly if it is invalid.
+ when: openshift_deployment_type not in known_openshift_deployment_types
+ fail:
+ msg: |-
+ Please set openshift_deployment_type to one of:
+ {{ known_openshift_deployment_types | join(', ') }}
diff --git a/roles/openshift_repos/vars/main.yml b/roles/openshift_sanitize_inventory/vars/main.yml
index da48e42c1..da48e42c1 100644
--- a/roles/openshift_repos/vars/main.yml
+++ b/roles/openshift_sanitize_inventory/vars/main.yml
diff --git a/roles/openshift_version/tasks/main.yml b/roles/openshift_version/tasks/main.yml
index 0f2a660a7..35953b744 100644
--- a/roles/openshift_version/tasks/main.yml
+++ b/roles/openshift_version/tasks/main.yml
@@ -13,14 +13,6 @@
# Normalize some values that we need in a certain format that might be confusing:
- set_fact:
- openshift_release: "{{ openshift_release[1:] }}"
- when: openshift_release is defined and openshift_release[0] == 'v'
-
-- set_fact:
- openshift_release: "{{ openshift_release | string }}"
- when: openshift_release is defined
-
-- set_fact:
openshift_image_tag: "{{ 'v' + openshift_image_tag }}"
when: openshift_image_tag is defined and openshift_image_tag[0] != 'v' and openshift_image_tag != 'latest'
diff --git a/roles/openshift_version/tasks/set_version_rpm.yml b/roles/openshift_version/tasks/set_version_rpm.yml
index 7fa74e24f..0c2ef4bb7 100644
--- a/roles/openshift_version/tasks/set_version_rpm.yml
+++ b/roles/openshift_version/tasks/set_version_rpm.yml
@@ -5,14 +5,42 @@
openshift_version: "{{ openshift_pkg_version[1:].split('-')[0] }}"
when: openshift_pkg_version is defined and openshift_version is not defined
+# if {{ openshift.common.service_type}}-excluder is enabled,
+# the repoquery for {{ openshift.common.service_type}} will not work.
+# Thus, create a temporary yum,conf file where exclude= is set to an empty list
+- name: Create temporary yum.conf file
+ command: mktemp -d /tmp/yum.conf.XXXXXX
+ register: yum_conf_temp_file_result
+
+- set_fact:
+ yum_conf_temp_file: "{{yum_conf_temp_file_result.stdout}}/yum.conf"
+
+- name: Copy yum.conf into the temporary file
+ copy:
+ src: /etc/yum.conf
+ dest: "{{ yum_conf_temp_file }}"
+ remote_src: True
+
+- name: Clear the exclude= list in the temporary yum.conf
+ lineinfile:
+ # since ansible 2.3 s/dest/path
+ dest: "{{ yum_conf_temp_file }}"
+ regexp: '^exclude='
+ line: 'exclude='
+
- name: Gather common package version
command: >
- {{ repoquery_cmd }} --qf '%{version}' "{{ openshift.common.service_type}}"
+ {{ repoquery_cmd }} --config "{{ yum_conf_temp_file }}" --qf '%{version}' "{{ openshift.common.service_type}}"
register: common_version
failed_when: false
changed_when: false
when: openshift_version is not defined
+- name: Delete the temporary yum.conf
+ file:
+ path: "{{ yum_conf_temp_file_result.stdout }}"
+ state: absent
+
- set_fact:
openshift_version: "{{ common_version.stdout | default('0.0', True) }}"
when: openshift_version is not defined
diff --git a/test/openshift_version_tests.py b/test/openshift_version_tests.py
new file mode 100644
index 000000000..52e9a9888
--- /dev/null
+++ b/test/openshift_version_tests.py
@@ -0,0 +1,72 @@
+""" Tests for the openshift_version Ansible filter module. """
+# pylint: disable=missing-docstring,invalid-name
+
+import os
+import sys
+import unittest
+
+sys.path = [os.path.abspath(os.path.dirname(__file__) + "/../filter_plugins/")] + sys.path
+
+# pylint: disable=import-error
+import openshift_version # noqa: E402
+
+
+class OpenShiftVersionTests(unittest.TestCase):
+
+ openshift_version_filters = openshift_version.FilterModule()
+
+ # Static tests for legacy filters.
+ legacy_gte_tests = [{'name': 'oo_version_gte_3_1_or_1_1',
+ 'positive_enterprise_version': '3.2.0',
+ 'negative_enterprise_version': '3.0.0',
+ 'positive_origin_version': '1.2.0',
+ 'negative_origin_version': '1.0.0'},
+ {'name': 'oo_version_gte_3_1_1_or_1_1_1',
+ 'positive_enterprise_version': '3.2.0',
+ 'negative_enterprise_version': '3.1.0',
+ 'positive_origin_version': '1.2.0',
+ 'negative_origin_version': '1.1.0'},
+ {'name': 'oo_version_gte_3_2_or_1_2',
+ 'positive_enterprise_version': '3.3.0',
+ 'negative_enterprise_version': '3.1.0',
+ 'positive_origin_version': '1.3.0',
+ 'negative_origin_version': '1.1.0'},
+ {'name': 'oo_version_gte_3_3_or_1_3',
+ 'positive_enterprise_version': '3.4.0',
+ 'negative_enterprise_version': '3.2.0',
+ 'positive_origin_version': '1.4.0',
+ 'negative_origin_version': '1.2.0'},
+ {'name': 'oo_version_gte_3_4_or_1_4',
+ 'positive_enterprise_version': '3.5.0',
+ 'negative_enterprise_version': '3.3.0',
+ 'positive_origin_version': '1.5.0',
+ 'negative_origin_version': '1.3.0'},
+ {'name': 'oo_version_gte_3_5_or_1_5',
+ 'positive_enterprise_version': '3.6.0',
+ 'negative_enterprise_version': '3.4.0',
+ 'positive_origin_version': '1.6.0',
+ 'negative_origin_version': '1.4.0'}]
+
+ def test_legacy_gte_filters(self):
+ for test in self.legacy_gte_tests:
+ for deployment_type in ['enterprise', 'origin']:
+ # Test negative case per deployment_type
+ self.assertFalse(
+ self.openshift_version_filters._filters[test['name']](
+ test["negative_{}_version".format(deployment_type)], deployment_type))
+ # Test positive case per deployment_type
+ self.assertTrue(
+ self.openshift_version_filters._filters[test['name']](
+ test["positive_{}_version".format(deployment_type)], deployment_type))
+
+ def test_gte_filters(self):
+ for major, minor_start, minor_end in self.openshift_version_filters.versions:
+ for minor in range(minor_start, minor_end):
+ # Test positive case
+ self.assertTrue(
+ self.openshift_version_filters._filters["oo_version_gte_{}_{}".format(major, minor)](
+ "{}.{}".format(major, minor + 1)))
+ # Test negative case
+ self.assertFalse(
+ self.openshift_version_filters._filters["oo_version_gte_{}_{}".format(major, minor)](
+ "{}.{}".format(major, minor)))