17 files changed, 130 insertions, 44 deletions
diff --git a/playbooks/common/openshift-checks/adhoc.yml b/playbooks/common/openshift-checks/adhoc.yml
index dfcef8435..d0deaeb65 100644
--- a/playbooks/common/openshift-checks/adhoc.yml
+++ b/playbooks/common/openshift-checks/adhoc.yml
@@ -1,12 +1,13 @@
 ---
-- name: OpenShift health checks
+- name: OpenShift Health Checks
   hosts: oo_all_hosts
+
   roles:
   - openshift_health_checker
   vars:
   - r_openshift_health_checker_playbook_context: adhoc
   post_tasks:
-  - name: Run health checks
+  - name: Run health checks (adhoc)
     action: openshift_health_check
     args:
       checks: '{{ openshift_checks | default([]) }}'
diff --git a/playbooks/common/openshift-checks/health.yml b/playbooks/common/openshift-checks/health.yml
index 21ea785ef..d0921b9d3 100644
--- a/playbooks/common/openshift-checks/health.yml
+++ b/playbooks/common/openshift-checks/health.yml
@@ -1,11 +1,13 @@
 ---
-- name: Run OpenShift health checks
+- name: OpenShift Health Checks
   hosts: oo_all_hosts
+
   roles:
   - openshift_health_checker
   vars:
   - r_openshift_health_checker_playbook_context: health
   post_tasks:
-  - action: openshift_health_check
+  - name: Run health checks (@health)
+    action: openshift_health_check
     args:
       checks: ['@health']
diff --git a/playbooks/common/openshift-checks/install.yml b/playbooks/common/openshift-checks/install.yml
new file mode 100644
index 000000000..6701a2e15
--- /dev/null
+++ b/playbooks/common/openshift-checks/install.yml
@@ -0,0 +1,47 @@
+---
+- name: Health Check Checkpoint Start
+  hosts: oo_all_hosts
+  gather_facts: false
+  tasks:
+  - name: Set Health Check 'In Progress'
+    set_stats:
+      data:
+        installer_phase_health: "In Progress"
+      aggregate: false
+
+- name: OpenShift Health Checks
+  hosts: oo_all_hosts
+  any_errors_fatal: true
+  roles:
+  - openshift_health_checker
+  vars:
+  - r_openshift_health_checker_playbook_context: install
+  post_tasks:
+  - name: Run health checks (install) - EL
+    when: ansible_distribution != "Fedora"
+    action: openshift_health_check
+    args:
+      checks:
+      - disk_availability
+      - memory_availability
+      - package_availability
+      - package_version
+      - docker_image_availability
+      - docker_storage
+
+  - name: Run health checks (install) - Fedora
+    when: ansible_distribution == "Fedora"
+    action: openshift_health_check
+    args:
+      checks:
+      - docker_image_availability
+
+- name: Health Check Checkpoint End
+  hosts: oo_all_hosts
+  gather_facts: false
+  tasks:
+  - name: Set Health Check 'Complete'
+    set_stats:
+      data:
+        installer_phase_health: "Complete"
+      aggregate: false
diff --git a/playbooks/common/openshift-checks/pre-install.yml b/playbooks/common/openshift-checks/pre-install.yml
index 88e6f9120..32449d4e4 100644
--- a/playbooks/common/openshift-checks/pre-install.yml
+++ b/playbooks/common/openshift-checks/pre-install.yml
@@ -1,11 +1,13 @@
 ---
-- name: run OpenShift pre-install checks
+- name: OpenShift Health Checks
   hosts: oo_all_hosts
+
   roles:
   - openshift_health_checker
   vars:
   - r_openshift_health_checker_playbook_context: pre-install
   post_tasks:
-  - action: openshift_health_check
+  - name: Run health checks (@preflight)
+    action: openshift_health_check
     args:
       checks: ['@preflight']
diff --git a/playbooks/common/openshift-cluster/config.yml b/playbooks/common/openshift-cluster/config.yml
index 395eb51f1..244787985 100644
--- a/playbooks/common/openshift-cluster/config.yml
+++ b/playbooks/common/openshift-cluster/config.yml
@@ -1,31 +1,5 @@
 ---
-# TODO: refactor this into its own include
-# and pass a variable for ctx
-- name: Verify Requirements
-  hosts: oo_all_hosts
-  roles:
-  - openshift_health_checker
-  vars:
-  - r_openshift_health_checker_playbook_context: install
-  post_tasks:
-
-  - name: Verify Requirements - EL
-    when: ansible_distribution != "Fedora"
-    action: openshift_health_check
-    args:
-      checks:
-      - disk_availability
-      - memory_availability
-      - package_availability
-      - package_version
-      - docker_image_availability
-      - docker_storage
-  - name: Verify Requirements - Fedora
-    when: ansible_distribution == "Fedora"
-    action: openshift_health_check
-    args:
-      checks:
-      - docker_image_availability
+- include: ../openshift-checks/install.yml
 
 - include: ../openshift-etcd/config.yml
 
diff --git a/playbooks/common/openshift-cluster/initialize_facts.yml b/playbooks/common/openshift-cluster/initialize_facts.yml
index 0f563adb7..91223d368 100644
--- a/playbooks/common/openshift-cluster/initialize_facts.yml
+++ b/playbooks/common/openshift-cluster/initialize_facts.yml
@@ -10,6 +10,7 @@
   - name: load openshift_facts module
     include_role:
       name: openshift_facts
+    static: yes
 
   # TODO: Should this role be refactored into health_checks??
   - name: Run openshift_sanitize_inventory to set variables
diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
index 1c830cb4e..3f0752f4c 100644
--- a/roles/docker/defaults/main.yml
+++ b/roles/docker/defaults/main.yml
@@ -21,3 +21,11 @@ l2_docker_blocked_registries: "{% if openshift_docker_blocked_registries is stri
 l2_docker_insecure_registries: "{% if openshift_docker_insecure_registries is string %}{% if openshift_docker_insecure_registries == '' %}[]{% elif ',' in openshift_docker_insecure_registries %}{{ openshift_docker_insecure_registries.split(',') | list }}{% else %}{{ [ openshift_docker_insecure_registries ] }}{% endif %}{% else %}{{ openshift_docker_insecure_registries }}{% endif %}"
 
 containers_registries_conf_path: /etc/containers/registries.conf
+
+r_crio_firewall_enabled: "{{ os_firewall_enabled | default(True) }}"
+r_crio_use_firewalld: "{{ os_firewall_use_firewalld | default(False) }}"
+
+r_crio_os_firewall_deny: []
+r_crio_os_firewall_allow:
+- service: crio
+  port: 10010/tcp
diff --git a/roles/docker/meta/main.yml b/roles/docker/meta/main.yml
index b773a417c..62b8a2eb5 100644
--- a/roles/docker/meta/main.yml
+++ b/roles/docker/meta/main.yml
@@ -11,3 +11,4 @@ galaxy_info:
     - 7
 dependencies:
 - role: lib_openshift
+- role: lib_os_firewall
diff --git a/roles/docker/tasks/crio_firewall.yml b/roles/docker/tasks/crio_firewall.yml
new file mode 100644
index 000000000..fbd1ff515
--- /dev/null
+++ b/roles/docker/tasks/crio_firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: r_crio_firewall_enabled | bool and not r_crio_use_firewalld | bool
+  block:
+  - name: Add iptables allow rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: add
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_crio_os_firewall_allow }}"
+
+  - name: Remove iptables rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: remove
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_crio_os_firewall_deny }}"
+
+- when: r_crio_firewall_enabled | bool and r_crio_use_firewalld | bool
+  block:
+  - name: Add firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: enabled
+    when: item.cond | default(True)
+    with_items: "{{ r_crio_os_firewall_allow }}"
+
+  - name: Remove firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: disabled
+    when: item.cond | default(True)
+    with_items: "{{ r_crio_os_firewall_deny }}"
diff --git a/roles/docker/tasks/systemcontainer_crio.yml b/roles/docker/tasks/systemcontainer_crio.yml
index 13bbd359e..5a87813a0 100644
--- a/roles/docker/tasks/systemcontainer_crio.yml
+++ b/roles/docker/tasks/systemcontainer_crio.yml
@@ -62,7 +62,7 @@
   shell: lsmod | grep overlay
   register: l_has_overlay_in_kernel
   ignore_errors: yes
-
+  failed_when: false
 
 - when: l_has_overlay_in_kernel.rc != 0
   block:
@@ -161,11 +161,19 @@
     path: /etc/cni/net.d/
     state: directory
 
+- name: setup firewall for CRI-O
+  include: crio_firewall.yml
+  static: yes
+
 - name: Configure the CNI network
   template:
     dest: /etc/cni/net.d/openshift-sdn.conf
     src: 80-openshift-sdn.conf.j2
 
+- name: Fix SELinux Permissions on /var/lib/containers
+  command: "restorecon -R /var/lib/containers/"
+  changed_when: false
+
 - name: Start the CRI-O service
   systemd:
     name: "cri-o"
diff --git a/roles/docker/tasks/systemcontainer_docker.yml b/roles/docker/tasks/systemcontainer_docker.yml
index 726e8ada7..aa3b35ddd 100644
--- a/roles/docker/tasks/systemcontainer_docker.yml
+++ b/roles/docker/tasks/systemcontainer_docker.yml
@@ -173,4 +173,6 @@
 - set_fact:
     docker_service_status_changed: "{{ r_docker_systemcontainer_docker_start_result | changed }}"
 
+- include: registry_auth.yml
+
 - meta: flush_handlers
diff --git a/roles/docker/templates/crio.conf.j2 b/roles/docker/templates/crio.conf.j2
index b715c2ffa..93014a80d 100644
--- a/roles/docker/templates/crio.conf.j2
+++ b/roles/docker/templates/crio.conf.j2
@@ -108,7 +108,7 @@ pids_limit = 1024
 
 # log_size_max is the max limit for the container log size in bytes.
 # Negative values indicate that no limit is imposed.
-log_size_max = -1
+log_size_max = 52428800
 
 # The "crio.image" table contains settings pertaining to the
 # management of OCI images.
diff --git a/roles/installer_checkpoint/callback_plugins/installer_checkpoint.py b/roles/installer_checkpoint/callback_plugins/installer_checkpoint.py
index 55c44bb84..b17358882 100644
--- a/roles/installer_checkpoint/callback_plugins/installer_checkpoint.py
+++ b/roles/installer_checkpoint/callback_plugins/installer_checkpoint.py
@@ -72,6 +72,7 @@ class CallbackModule(CallbackBase):
         # Set the order of the installer phases
         installer_phases = [
             'installer_phase_initialize',
+            'installer_phase_health',
             'installer_phase_etcd',
             'installer_phase_nfs',
             'installer_phase_loadbalancer',
@@ -93,6 +94,10 @@ class CallbackModule(CallbackBase):
                 'title': 'Initialization',
                 'playbook': ''
             },
+            'installer_phase_health': {
+                'title': 'Health Check',
+                'playbook': 'playbooks/byo/openshift-checks/pre-install.yml'
+            },
             'installer_phase_etcd': {
                 'title': 'etcd Install',
                 'playbook': 'playbooks/byo/openshift-etcd/config.yml'
@@ -166,11 +171,6 @@ class CallbackModule(CallbackBase):
                         self._display.display(
                             '\tThis phase can be restarted by running: {}'.format(
                                 phase_attributes[phase]['playbook']))
-                else:
-                    # Phase was not found in custom stats
-                    self._display.display(
-                        '{}{}: {}'.format(phase_title, ' ' * padding, 'Not Started'),
-                        color=C.COLOR_SKIP)
 
         self._display.display("", screen_only=True)
 
diff --git a/roles/openshift_aws/templates/user_data.j2 b/roles/openshift_aws/templates/user_data.j2
index ed9c0ed0b..76aebdcea 100644
--- a/roles/openshift_aws/templates/user_data.j2
+++ b/roles/openshift_aws/templates/user_data.j2
@@ -9,7 +9,7 @@ write_files:
   content: |
     openshift_group_type: {{ openshift_aws_node_group_type }}
 {%   if openshift_aws_node_group_type != 'master' %}
-- path: /etc/origin/node/csr_kubeconfig
+- path: /etc/origin/node/bootstrap.kubeconfig
   owner: 'root:root'
   permissions: '0640'
   encoding: b64
diff --git a/roles/openshift_health_checker/openshift_checks/docker_storage.py b/roles/openshift_health_checker/openshift_checks/docker_storage.py
index 0558ddf14..6808d8b2f 100644
--- a/roles/openshift_health_checker/openshift_checks/docker_storage.py
+++ b/roles/openshift_health_checker/openshift_checks/docker_storage.py
@@ -14,7 +14,7 @@ class DockerStorage(DockerHostMixin, OpenShiftCheck):
     """
 
     name = "docker_storage"
-    tags = ["pre-install", "health", "preflight"]
+    tags = ["health", "preflight"]
 
     dependencies = ["python-docker-py"]
     storage_drivers = ["devicemapper", "overlay", "overlay2"]
diff --git a/roles/openshift_node/tasks/bootstrap.yml b/roles/openshift_node/tasks/bootstrap.yml
index 8c03f6c41..2deb005da 100644
--- a/roles/openshift_node/tasks/bootstrap.yml
+++ b/roles/openshift_node/tasks/bootstrap.yml
@@ -25,7 +25,7 @@
     state: "{{ item.state | default('present') }}"
   with_items:
   # add the kubeconfig
-  - line: "KUBECONFIG=/etc/origin/node/csr_kubeconfig"
+  - line: "KUBECONFIG=/etc/origin/node/bootstrap.kubeconfig"
     regexp: "^KUBECONFIG=.*"
   # remove the config file.  This comes from openshift_facts
   - regexp: "^CONFIG_FILE=.*"
diff --git a/roles/openshift_sanitize_inventory/tasks/main.yml b/roles/openshift_sanitize_inventory/tasks/main.yml
index 5dccc9faf..a6c168bc7 100644
--- a/roles/openshift_sanitize_inventory/tasks/main.yml
+++ b/roles/openshift_sanitize_inventory/tasks/main.yml
@@ -47,7 +47,7 @@
 - name: Abort when openshift_release is invalid
   when:
     - openshift_release is defined
-    - not openshift_release | match('\d+(\.\d+){1,3}$')
+    - not openshift_release | match('^\d+(\.\d+){1,3}$')
   fail:
     msg: |-
       openshift_release is "{{ openshift_release }}" which is not a valid version string.