summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--.tito/packages/openshift-ansible2
-rw-r--r--inventory/byo/hosts.origin.example4
-rw-r--r--inventory/byo/hosts.ose.example4
-rw-r--r--openshift-ansible.spec196
-rw-r--r--playbooks/byo/openshift-master/scaleup.yml14
-rw-r--r--playbooks/byo/openshift-node/scaleup.yml13
-rw-r--r--roles/calico/defaults/main.yaml2
-rw-r--r--roles/calico/tasks/main.yml2
-rw-r--r--roles/openshift_hosted/tasks/registry/registry.yml3
-rw-r--r--roles/openshift_hosted/tasks/registry/secure.yml101
-rw-r--r--roles/openshift_hosted/tasks/registry/secure/passthrough.yml45
-rw-r--r--roles/openshift_hosted/tasks/registry/secure/reencrypt.yml38
-rw-r--r--roles/openshift_logging_elasticsearch/tasks/main.yaml7
-rw-r--r--roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j225
-rw-r--r--roles/openshift_logging_elasticsearch/vars/main.yml2
-rw-r--r--roles/openshift_node_dnsmasq/meta/main.yml1
-rw-r--r--utils/src/ooinstall/variants.py2
17 files changed, 399 insertions, 62 deletions
diff --git a/.tito/packages/openshift-ansible b/.tito/packages/openshift-ansible
index a667c3f2d..942c51f27 100644
--- a/.tito/packages/openshift-ansible
+++ b/.tito/packages/openshift-ansible
@@ -1 +1 @@
-3.7.1-1 ./
+3.7.0-0.104.0 ./
diff --git a/inventory/byo/hosts.origin.example b/inventory/byo/hosts.origin.example
index 239727c6e..385278f3b 100644
--- a/inventory/byo/hosts.origin.example
+++ b/inventory/byo/hosts.origin.example
@@ -798,9 +798,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
#openshift_builddefaults_nodeselectors={'nodelabel1':'nodelabelvalue1'}
#openshift_builddefaults_annotations={'annotationkey1':'annotationvalue1'}
#openshift_builddefaults_resources_requests_cpu=100m
-#openshift_builddefaults_resources_requests_memory=256m
+#openshift_builddefaults_resources_requests_memory=256Mi
#openshift_builddefaults_resources_limits_cpu=1000m
-#openshift_builddefaults_resources_limits_memory=512m
+#openshift_builddefaults_resources_limits_memory=512Mi
# Or you may optionally define your own build defaults configuration serialized as json
#openshift_builddefaults_json='{"BuildDefaults":{"configuration":{"apiVersion":"v1","env":[{"name":"HTTP_PROXY","value":"http://proxy.example.com.redhat.com:3128"},{"name":"NO_PROXY","value":"ose3-master.example.com"}],"gitHTTPProxy":"http://proxy.example.com:3128","gitNoProxy":"ose3-master.example.com","kind":"BuildDefaultsConfig"}}}'
diff --git a/inventory/byo/hosts.ose.example b/inventory/byo/hosts.ose.example
index 837c54f27..87fdee904 100644
--- a/inventory/byo/hosts.ose.example
+++ b/inventory/byo/hosts.ose.example
@@ -798,9 +798,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
#openshift_builddefaults_nodeselectors={'nodelabel1':'nodelabelvalue1'}
#openshift_builddefaults_annotations={'annotationkey1':'annotationvalue1'}
#openshift_builddefaults_resources_requests_cpu=100m
-#openshift_builddefaults_resources_requests_memory=256m
+#openshift_builddefaults_resources_requests_memory=256Mi
#openshift_builddefaults_resources_limits_cpu=1000m
-#openshift_builddefaults_resources_limits_memory=512m
+#openshift_builddefaults_resources_limits_memory=512Mi
# Or you may optionally define your own build defaults configuration serialized as json
#openshift_builddefaults_json='{"BuildDefaults":{"configuration":{"apiVersion":"v1","env":[{"name":"HTTP_PROXY","value":"http://proxy.example.com.redhat.com:3128"},{"name":"NO_PROXY","value":"ose3-master.example.com"}],"gitHTTPProxy":"http://proxy.example.com:3128","gitNoProxy":"ose3-master.example.com","kind":"BuildDefaultsConfig"}}}'
diff --git a/openshift-ansible.spec b/openshift-ansible.spec
index 9cadf5947..1c3b1757c 100644
--- a/openshift-ansible.spec
+++ b/openshift-ansible.spec
@@ -9,8 +9,8 @@
%global __requires_exclude ^/usr/bin/ansible-playbook$
Name: openshift-ansible
-Version: 3.7.1
-Release: 1%{?dist}
+Version: 3.7.0
+Release: 0.104.0%{?dist}
Summary: Openshift and Atomic Enterprise Ansible
License: ASL 2.0
URL: https://github.com/openshift/openshift-ansible
@@ -280,6 +280,198 @@ Atomic OpenShift Utilities includes
%changelog
+* Sun Aug 20 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.104.0
+- Ensure that openshift_node_facts has been called for dns_ip
+ (sdodson@redhat.com)
+
+* Sat Aug 19 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.103.0
+-
+
+* Fri Aug 18 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.102.0
+-
+
+* Fri Aug 18 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.101.0
+-
+
+* Fri Aug 18 2017 Jenkins CD Merge Bot <smunilla@redhat.com> 3.7.0-0.100.0
+- Change memory requests and limits units (mak@redhat.com)
+- Display "origin 3.6" as in previous installer 3.5 (brunovern.a@gmail.com)
+- Use sdn_cluster_network_cidr as default calico pool (djosborne10@gmail.com)
+- fix missing console appending in logging (jcantril@redhat.com)
+- Enable version 3.6 for OSE (bacek@bacek.com)
+- Adding std_include to the metrics playbook. (kwoodson@redhat.com)
+- Don't include noop (rteague@redhat.com)
+- Remove openshift_repos dependencies (rteague@redhat.com)
+- polish openshift-master role (jchaloup@redhat.com)
+- etc_traffic check: factor away short_version (lmeyer@redhat.com)
+- openshift-checks: have playbooks invoke std_include (lmeyer@redhat.com)
+- bug: container_binary_sync no longer moves upon symlinks (smilner@redhat.com)
+- Remove orphan files (rteague@redhat.com)
+- Additional os_firewall role refactoring (rteague@redhat.com)
+- Standardize usage of std_include in byo (rteague@redhat.com)
+- Cleanup validate_hostnames (rteague@redhat.com)
+- Use openshift.node.dns_ip as listening address (sdodson@redhat.com)
+- Remove obsolete yum check (rteague@redhat.com)
+- Clean up Calico readme (djosborne10@gmail.com)
+- Change vsd user nodes parameter name (rohan.s.parulekar@nuagenetworks.net)
+- Removing dependencies for openshift_repos and setting them up early in the
+ cluster build. (kwoodson@redhat.com)
+- Default values for CFME container images are invalid (jkaur@redhat.com)
+- Fix duplicate evaluate_groups.yml call during install (rteague@redhat.com)
+- Minor update to correct firewall play name (rteague@redhat.com)
+- Moving firewall rules under the role to work with refactor.
+ (kwoodson@redhat.com)
+- Fix Restore Master AWS Options (michael.fraenkel@gmail.com)
+- Update etcd scaleup entrypoint includes and use etcd_{hostname,ip} facts for
+ new member registration. (abutcher@redhat.com)
+- openshift_checks: allow OVS 2.7 on OCP 3.5 and 3.6 (miciah.masters@gmail.com)
+- Refactor group initialization (rteague@redhat.com)
+- Updated README to reflect refactor. Moved firewall initialize into separate
+ file. (kwoodson@redhat.com)
+- system_container.yml: fix braces (lmeyer@redhat.com)
+- Error check project creation. (kwoodson@redhat.com)
+- Update README.md (sdodson@redhat.com)
+- Fix syntax for when statement (rhcarvalho@gmail.com)
+- configure kibana index mode (jcantril@redhat.com)
+- Change default CFME namespace to use reserved openshift- prefix
+ (tbielawa@redhat.com)
+- Start iptables on each master in serial (denverjanke@gmail.com)
+- Remove additional 'restart master' handler references. (abutcher@redhat.com)
+- Adding a default condition and removing unneeded defaults.
+ (kwoodson@redhat.com)
+- adding check to a yaml dump to work properly with new ruamel lib
+ (ihorvath@redhat.com)
+- Bump calico to v2.4.1 (djosborne10@gmail.com)
+- openshift_checks: refactor find_ansible_mount (lmeyer@redhat.com)
+- More complete discovery of entry point playbooks (rteague@redhat.com)
+- Add missing byo v3_7 playbooks (sdodson@redhat.com)
+- Add v3_7 upgrades (sdodson@redhat.com)
+- Remove remaining references to openshift-master.service (ccoleman@redhat.com)
+- Disable old openshift-master.service on upgrade (ccoleman@redhat.com)
+- Use the new election mode (client based) instead of direct etcd access
+ (ccoleman@redhat.com)
+- Remove the origin-master.service and associated files (ccoleman@redhat.com)
+- Make native clustering the default everywhere (ccoleman@redhat.com)
+- Warn when user has no etcd group member nodes (ccoleman@redhat.com)
+- First attempt at refactor of os_firewall (kwoodson@redhat.com)
+- Refactor of openshift_version. (kwoodson@redhat.com)
+- Fix lint errors (sdodson@redhat.com)
+- integration tests: keep openshift_version happy (lmeyer@redhat.com)
+- New pattern involves startup and initializing through the std_include.yml
+ (kwoodson@redhat.com)
+- adding readme for openshift_manageiq (efreiber@redhat.com)
+- papr: Update to use v3.6.0 images (smilner@redhat.com)
+- Removing tasks from module openshift_facts. (kwoodson@redhat.com)
+- Updating PVC generation to only be done if the pvc does not already exist to
+ avoid idempotent issues (ewolinet@redhat.com)
+- Origin image build: add oc client (lmeyer@redhat.com)
+- Add v3.7 hosted templates (sdodson@redhat.com)
+- GlusterFS: Don't use /dev/null for empty file. (jarrpa@redhat.com)
+- Quick Installer should specify which config file to edit. (jkaur@redhat.com)
+- cri-o: configure the CNI network (gscrivan@redhat.com)
+- nfs only run if cloud_provider not defined (sdw35@cornell.edu)
+- Default gte_3_7 to false (sdodson@redhat.com)
+- Add v3.7 content (sdodson@redhat.com)
+- Update version checks to tolerate 3.7 (skuznets@redhat.com)
+- cri-o: Restart cri-o after openshift sdn installation (smilner@redhat.com)
+- cri-o: Continue node without SELinux check (smilner@redhat.com)
+- examples: use the correct variable name (gscrivan@redhat.com)
+- cri-o: allow to override CRI-O image indipendently from Docker
+ (gscrivan@redhat.com)
+- docker: introduce use_crio_only (gscrivan@redhat.com)
+- docker: skip Docker setup when using CRI-O (gscrivan@redhat.com)
+- openvswitch: system container depends on the cri-o service
+ (gscrivan@redhat.com)
+- cli_image: do not require Docker when using CRI-O (gscrivan@redhat.com)
+- cri-o: skip Set precise containerized version check (gscrivan@redhat.com)
+- cri-o: skip Docker version test (gscrivan@redhat.com)
+- cri-o: use only images from Docker Hub (gscrivan@redhat.com)
+- cri-o: Enable systemd-modules-load if required (smilner@redhat.com)
+- openshift_node: fix typo for experimental-cri (smilner@redhat.com)
+- cri-o: Fix node template to use full variable (smilner@redhat.com)
+- cri-o: Ensure overlay is available (smilner@redhat.com)
+- cri-o: Default insecure registries to "" (smilner@redhat.com)
+- crio: use a template for the configuration (gscrivan@redhat.com)
+- openshift_docker_facts: Add use_crio (smilner@redhat.com)
+- cri-o: Minor fixes for tasks (smilner@redhat.com)
+- cri-o: Hardcode image name to cri-o (smilner@redhat.com)
+- cri-o: Add cri-o as a Wants in node units (smilner@redhat.com)
+- cri-o: configure storage and insecure registries (gscrivan@redhat.com)
+- node.yaml: configure node to use cri-o when openshift.common.use_crio
+ (gscrivan@redhat.com)
+- inventory: Add use_crio example (smilner@redhat.com)
+- cri-o: Allow cri-o usage. (smilner@redhat.com)
+- adding pods/logs to manageiq role (efreiber@redhat.com)
+- openshift_checks: refactor logging checks (lmeyer@redhat.com)
+- GlusterFS: Copy SSH private key to master node. (jarrpa@redhat.com)
+- openshift_checks: add property to track 'changed' (lmeyer@redhat.com)
+- Fixing SA and clusterrole namespaces (ewolinet@redhat.com)
+- package_version check: tolerate release version 3.7 (lmeyer@redhat.com)
+- Missing space (kp@tigera.io)
+- add pre-flight checks to ugrade path (jvallejo@redhat.com)
+- add fluentd logging driver config check (jvallejo@redhat.com)
+- Paren wrap integration print(). (abutcher@redhat.com)
+- Update openshift_cert_expiry for py3 support. (abutcher@redhat.com)
+- Use enterprise images for CFME enterprise deployments (sdodson@redhat.com)
+- use mux_client_mode instead of use_mux_client (rmeggins@redhat.com)
+- openshift_checks: enable variable conversion (lmeyer@redhat.com)
+- GlusterFS: Check for namespace if deploying a StorageClass
+ (jarrpa@redhat.com)
+- Switch logging and metrics OCP image tag from 3.6.0 to v3.6
+ (sdodson@redhat.com)
+- Fixing storageclass doc variable. (kwoodson@redhat.com)
+- GlusterFS: Fix variable names in defaults. (jarrpa@redhat.com)
+- Fix aws_secret_key check (carlpett@users.noreply.github.com)
+- Impl fluentd file buffer (nhosoi@redhat.com)
+- Use existing OPENSHIFT_DEFAULT_REGISTRY setting during masters scaleup
+ (tbielawa@redhat.com)
+- GlusterFS: Default glusterfs_name in loop items. (jarrpa@redhat.com)
+- Remove cluster in favor of rolebindings. (kwoodson@redhat.com)
+- Updating metrics role to create serviceaccounts and roles immediately
+ (ewolinet@redhat.com)
+- GlusterFS: Use default namespace when not native. (jarrpa@redhat.com)
+- Set the openshift_version from the openshift.common.version in case it is
+ empty (jchaloup@redhat.com)
+- Revert "Add health checks to upgrade playbook" (rhcarvalho@gmail.com)
+- move common tasks to a single file included by both systemd_units.yml
+ (jchaloup@redhat.com)
+- Fixes for auth_proxy, vxlan mode (srampal@cisco.com)
+- Tolerate non existence of /etc/sysconfig/atomic-openshift-master
+ (sdodson@redhat.com)
+- Block etcdv3 migration for supported configurations (sdodson@redhat.com)
+- Shut down masters before taking an etcd backup (sdodson@redhat.com)
+- Move node facts to new openshift_node_facts role. (abutcher@redhat.com)
+- Add glusterfs_registry hosts to oo_all_hosts. (jarrpa@redhat.com)
+- Updating template parameter replica to be more unique to avoid var scope
+ creeping (ewolinet@redhat.com)
+- Add 3.7 releaser (sdodson@redhat.com)
+- add selector and storage class name to oc_pvc module (jcantril@redhat.com)
+- backport 'Add systemctl daemon-reload handler to openshift_node' #4403 to
+ openshift_node_upgrade (jchaloup@redhat.com)
+- Normalize list of checks passed to action plugin (rhcarvalho@gmail.com)
+- Clean up unnecessary quotes (rhcarvalho@gmail.com)
+- Make LoggingCheck.run return the correct type (rhcarvalho@gmail.com)
+- Clean up openshift-checks playbooks (rhcarvalho@gmail.com)
+- fixes after rebasing with #4485 (jvallejo@redhat.com)
+- add pre-flight checks to ugrade path (jvallejo@redhat.com)
+- Refactor openshift_facts BIOS vendor discovery (rteague@redhat.com)
+- Normalize logging entry. (kwoodson@redhat.com)
+- Nuage changes to support IPTables kube-proxy in OpenShift
+ (siva_teja.areti@nokia.com)
+- Remove default provisioner. (kwoodson@redhat.com)
+- Fix for : https://bugzilla.redhat.com/show_bug.cgi?id=1467423
+ (jkaur@redhat.com)
+- allow to specify docker registry for system containers (jchaloup@redhat.com)
+- Fail within scaleup playbooks when new_{nodes,masters} host groups are empty.
+ (abutcher@redhat.com)
+- Add rate limit configurability (sdodson@redhat.com)
+- Resolve deprecation warnings in Contiv roles (rteague@redhat.com)
+- add etcd scaleup playbook (jawed.khelil@amadeus.com)
+- Spacing and moving deleget_to to bottom. (kwoodson@redhat.com)
+- Updated to use modules instead of command for user permissions.
+ (kwoodson@redhat.com)
+- fix BZ1422541 on master branch (weshi@redhat.com)
+
* Thu Jul 27 2017 Scott Dodson <sdodson@redhat.com> 3.7.1-1
- Fix incorrect delegate_to in control plane upgrade (sdodson@redhat.com)
- Follow the new naming conventions. (zhang.wanmin@zte.com.cn)
diff --git a/playbooks/byo/openshift-master/scaleup.yml b/playbooks/byo/openshift-master/scaleup.yml
index 8aa07a664..64811e80d 100644
--- a/playbooks/byo/openshift-master/scaleup.yml
+++ b/playbooks/byo/openshift-master/scaleup.yml
@@ -1,6 +1,20 @@
---
- include: ../openshift-cluster/initialize_groups.yml
+- name: Ensure there are new_masters
+ hosts: localhost
+ connection: local
+ become: no
+ gather_facts: no
+ tasks:
+ - fail:
+ msg: >
+ Detected no new_masters or no new_nodes in inventory. Please
+ add hosts to the new_masters and new_nodes host groups to add
+ masters.
+ when:
+ - (g_new_master_hosts | default([]) | length == 0) or (g_new_node_hosts | default([]) | length == 0)
+
- include: ../../common/openshift-master/scaleup.yml
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
diff --git a/playbooks/byo/openshift-node/scaleup.yml b/playbooks/byo/openshift-node/scaleup.yml
index c6965fd6f..fda89b1ea 100644
--- a/playbooks/byo/openshift-node/scaleup.yml
+++ b/playbooks/byo/openshift-node/scaleup.yml
@@ -1,6 +1,19 @@
---
- include: ../openshift-cluster/initialize_groups.yml
+- name: Ensure there are new_nodes
+ hosts: localhost
+ connection: local
+ become: no
+ gather_facts: no
+ tasks:
+ - fail:
+ msg: >
+ Detected no new_nodes in inventory. Please add hosts to the
+ new_nodes host group to add nodes.
+ when:
+ - g_new_node_hosts | default([]) | length == 0
+
- include: ../../common/openshift-node/scaleup.yml
vars:
openshift_cluster_id: "{{ cluster_id | default('default') }}"
diff --git a/roles/calico/defaults/main.yaml b/roles/calico/defaults/main.yaml
index 03c96be36..b1907f8cb 100644
--- a/roles/calico/defaults/main.yaml
+++ b/roles/calico/defaults/main.yaml
@@ -1,5 +1,5 @@
---
-kubeconfig: "{{openshift.common.config_base}}/node/{{ 'system:node:' + openshift.common.hostname }}.kubeconfig"
+kubeconfig: "{{ openshift.common.config_base }}/node/{{ 'system:node:' + openshift.common.hostname }}.kubeconfig"
cni_conf_dir: "/etc/cni/net.d/"
cni_bin_dir: "/opt/cni/bin/"
diff --git a/roles/calico/tasks/main.yml b/roles/calico/tasks/main.yml
index e62378532..39f730462 100644
--- a/roles/calico/tasks/main.yml
+++ b/roles/calico/tasks/main.yml
@@ -38,7 +38,7 @@
path: "{{ item }}"
with_items:
- "{{ calico_etcd_ca_cert_file }}"
- - "{{ calico_etcd_cert_file}}"
+ - "{{ calico_etcd_cert_file }}"
- "{{ calico_etcd_key_file }}"
- name: Calico Node | Configure Calico service unit file
diff --git a/roles/openshift_hosted/tasks/registry/registry.yml b/roles/openshift_hosted/tasks/registry/registry.yml
index dcd9c87fc..6f012aed1 100644
--- a/roles/openshift_hosted/tasks/registry/registry.yml
+++ b/roles/openshift_hosted/tasks/registry/registry.yml
@@ -43,9 +43,6 @@
openshift_hosted_registry_images: "{{ openshift.hosted.registry.registryurl | default('openshift3/ose-${component}:${version}')}}"
openshift_hosted_registry_volumes: []
openshift_hosted_registry_env_vars: {}
- openshift_hosted_registry_routecertificates: "{{ ('routecertificates' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routecertificates, {}) }}"
- openshift_hosted_registry_routehost: "{{ ('routehost' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routehost, False) }}"
- openshift_hosted_registry_routetermination: "{{ ('routetermination' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routetermination, 'passthrough') }}"
openshift_hosted_registry_edits:
# These edits are being specified only to prevent 'changed' on rerun
- key: spec.strategy.rollingParams
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
index 29c164f52..a18e6eea9 100644
--- a/roles/openshift_hosted/tasks/registry/secure.yml
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -1,65 +1,68 @@
---
-- name: Set fact docker_registry_route_hostname
+- name: Configure facts for docker-registry
set_fact:
- docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}"
+ openshift_hosted_registry_routecertificates: "{{ ('routecertificates' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routecertificates, {}) }}"
+ openshift_hosted_registry_routehost: "{{ ('routehost' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routehost, False) }}"
+ openshift_hosted_registry_routetermination: "{{ ('routetermination' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routetermination, 'passthrough') }}"
-- name: Get the certificate contents for registry
- copy:
- backup: True
- dest: "/etc/origin/master/named_certificates/{{ item.value | basename }}"
- src: "{{ item.value }}"
- when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
- with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+- name: Include reencrypt route configuration
+ include: secure/reencrypt.yml
+ static: no
+ when: openshift_hosted_registry_routetermination == 'reencrypt'
-# When certificates are defined we will create the reencrypt
-# docker-registry route
-- name: Create a reencrypt route for docker-registry
- oc_route:
- name: docker-registry
- namespace: "{{ openshift_hosted_registry_namespace }}"
- service_name: docker-registry
- tls_termination: "{{ openshift_hosted_registry_routetermination }}"
- host: "{{ openshift_hosted_registry_routehost | default(docker_registry_route_hostname) }}"
- cert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
- key_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
- cacert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
- dest_cacert_path: /etc/origin/master/ca.crt
- when:
- - "'cafile' in openshift_hosted_registry_routecertificates"
- - "'certfile' in openshift_hosted_registry_routecertificates"
- - "'keyfile' in openshift_hosted_registry_routecertificates"
+- name: Include passthrough route configuration
+ include: secure/passthrough.yml
+ static: no
+ when: openshift_hosted_registry_routetermination == 'passthrough'
-# When routetermination is passthrough we will create the route
-- name: Create passthrough route for docker-registry
+- name: Fetch the docker-registry route
oc_route:
name: docker-registry
- namespace: "{{ openshift_hosted_registry_namespace }}"
- service_name: docker-registry
- tls_termination: "{{ openshift_hosted_registry_routetermination }}"
- host: "{{ openshift_hosted_registry_routehost | ternary(openshift_hosted_registry_routehost, docker_registry_route_hostname) }}"
- when: openshift_hosted_registry_routetermination == 'passthrough'
+ namespace: default
+ state: list
+ register: docker_registry_route
-- name: Retrieve registry service IP
+- name: Retrieve registry service for the clusterip
oc_service:
namespace: "{{ openshift_hosted_registry_namespace }}"
name: docker-registry
state: list
- register: docker_registry_service_ip
+ register: docker_registry_service
-- name: Create registry certificates
+- name: Generate self-signed docker-registry certificates
oc_adm_ca_server_cert:
signer_cert: "{{ openshift_master_config_dir }}/ca.crt"
signer_key: "{{ openshift_master_config_dir }}/ca.key"
signer_serial: "{{ openshift_master_config_dir }}/ca.serial.txt"
hostnames:
- - "{{ docker_registry_service_ip.results.clusterip }}"
- - "{{ openshift_hosted_registry_name }}.default.svc"
- - "{{ openshift_hosted_registry_name }}.default.svc.{{ openshift.common.dns_domain }}"
- - "{{ docker_registry_route_hostname }}"
- cert: "{{ openshift_master_config_dir }}/registry.crt"
- key: "{{ openshift_master_config_dir }}/registry.key"
+ - "{{ docker_registry_service.results.clusterip }}"
+ - "{{ docker_registry_route.results[0].spec.host }}"
+ cert: "{{ docker_registry_cert_path }}"
+ key: "{{ docker_registry_key_path }}"
expire_days: "{{ openshift_hosted_registry_cert_expire_days if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool else omit }}"
- register: server_cert_out
+ register: registry_self_cert
+ when: docker_registry_self_signed
+
+# Setting up REGISTRY_HTTP_TLS_CLIENTCAS as the cacert doesn't seem to work.
+# If we need to set up a cacert, bundle it with the cert.
+- when: docker_registry_cacert_path is defined
+ block:
+ - name: Retrieve certificate files to generate certificate bundle
+ slurp:
+ src: "{{ item }}"
+ with_items:
+ - "{{ docker_registry_cert_path }}"
+ - "{{ docker_registry_cacert_path }}"
+ register: certificate_files
+
+ - name: Generate certificate bundle
+ copy:
+ content: "{{ certificate_files.results | map(attribute='content') | map('b64decode') | join('') }}"
+ dest: "{{ openshift_master_config_dir }}/named_certificates/docker-registry.pem"
+
+ - name: Reset the certificate path to use the bundle
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/named_certificates/docker-registry.pem"
- name: Create the secret for the registry certificates
oc_secret:
@@ -67,9 +70,9 @@
namespace: "{{ openshift_hosted_registry_namespace }}"
files:
- name: registry.crt
- path: "{{ openshift_master_config_dir }}/registry.crt"
+ path: "{{ docker_registry_cert_path }}"
- name: registry.key
- path: "{{ openshift_master_config_dir }}/registry.key"
+ path: "{{ docker_registry_key_path }}"
register: create_registry_certificates_secret_out
- name: Add the secret to the registry's pod service accounts
@@ -99,9 +102,15 @@
value: HTTPS
action: put
+- name: Detect if there has been certificate changes
+ set_fact:
+ registry_cert_changed: true
+ when: ( registry_self_cert is defined and registry_self_cert.changed ) or
+ create_registry_certificates_secret_out.changed
+
- name: Update openshift_hosted facts with secure registry variables
set_fact:
openshift_hosted_registry_volumes: "{{ openshift_hosted_registry_volumes | union(registry_secure_volume_mounts) }}"
openshift_hosted_registry_env_vars: "{{ openshift_hosted_registry_env_vars | combine(registry_secure_env_vars) }}"
openshift_hosted_registry_edits: "{{ openshift_hosted_registry_edits | union(registry_secure_edits) }}"
- openshift_hosted_registry_force: "{{ openshift_hosted_registry_force | union([server_cert_out.changed]) | union([create_registry_certificates_secret_out.changed]) }}"
+ openshift_hosted_registry_force: "{{ openshift_hosted_registry_force | union([registry_cert_changed | default(false)]) }}"
diff --git a/roles/openshift_hosted/tasks/registry/secure/passthrough.yml b/roles/openshift_hosted/tasks/registry/secure/passthrough.yml
new file mode 100644
index 000000000..5b44fda10
--- /dev/null
+++ b/roles/openshift_hosted/tasks/registry/secure/passthrough.yml
@@ -0,0 +1,45 @@
+---
+# Generate a self-signed certificate when there is no user-supplied certificate
+- name: Configure self-signed certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key"
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
+ docker_registry_self_signed: true
+ when:
+ - "'certfile' not in openshift_hosted_registry_routecertificates"
+ - "'keyfile' not in openshift_hosted_registry_routecertificates"
+
+# Retrieve user supplied certificate files if they are provided
+- when:
+ - "'certfile' in openshift_hosted_registry_routecertificates"
+ - "'keyfile' in openshift_hosted_registry_routecertificates"
+ block:
+ - name: Configure provided certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
+ docker_registry_self_signed: false
+
+ # Since we end up bundling the cert, cacert and key in a .pem file, the 'cafile'
+ # is optional
+ - name: Configure provided ca certificate file path
+ set_fact:
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
+ when: "'cafile' in openshift_hosted_registry_routecertificates"
+
+ - name: Retrieve provided certificate files
+ copy:
+ backup: True
+ dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}"
+ src: "{{ item.value }}"
+ when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
+ with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+
+- name: Configure a passthrough route for docker-registry
+ oc_route:
+ name: docker-registry
+ namespace: "{{ openshift_hosted_registry_namespace }}"
+ service_name: docker-registry
+ tls_termination: "{{ openshift_hosted_registry_routetermination }}"
+ host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}"
diff --git a/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml b/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml
new file mode 100644
index 000000000..48e5b0fba
--- /dev/null
+++ b/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml
@@ -0,0 +1,38 @@
+---
+- name: Validate route termination configuration
+ fail:
+ msg: >
+ When 'openshift_hosted_registry_routetermination' is 'reencrypt', you must
+ provide certificate files with 'openshift_hosted_registry_routecertificates'
+ when: ('certfile' not in openshift_hosted_registry_routecertificates) or
+ ('keyfile' not in openshift_hosted_registry_routecertificates) or
+ ('cafile' not in openshift_hosted_registry_routecertificates)
+
+- name: Configure self-signed certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key"
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
+ docker_registry_self_signed: true
+
+- name: Retrieve provided certificate files
+ copy:
+ backup: True
+ dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}"
+ src: "{{ item.value }}"
+ when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
+ with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+
+# Encrypt with the provided certificate and provide the dest_cacert for the
+# self-signed certificate at the endpoint
+- name: Configure a reencrypt route for docker-registry
+ oc_route:
+ name: docker-registry
+ namespace: "{{ openshift_hosted_registry_namespace }}"
+ service_name: docker-registry
+ tls_termination: "{{ openshift_hosted_registry_routetermination }}"
+ host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}"
+ cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
+ key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
+ cacert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
+ dest_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
diff --git a/roles/openshift_logging_elasticsearch/tasks/main.yaml b/roles/openshift_logging_elasticsearch/tasks/main.yaml
index 5593fac3a..28c3ffd96 100644
--- a/roles/openshift_logging_elasticsearch/tasks/main.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/main.yaml
@@ -107,9 +107,16 @@
- openshift_logging_elasticsearch_kibana_index_mode in __kibana_index_modes
msg: "The openshift_logging_elasticsearch_kibana_index_mode '{{ openshift_logging_elasticsearch_kibana_index_mode }}' only supports one of: {{ __kibana_index_modes | join(', ') }}"
+- assert:
+ that:
+ - "{{ openshift_logging_es_log_appenders | length > 0 }}"
+ msg: "The openshift_logging_es_log_appenders '{{ openshift_logging_es_log_appenders }}' has an unrecognized option and only supports the following as a list: {{ __es_log_appenders | join(', ') }}"
+
- template:
src: elasticsearch-logging.yml.j2
dest: "{{ tempdir }}/elasticsearch-logging.yml"
+ vars:
+ root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
when: es_logging_contents is undefined
changed_when: no
diff --git a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2 b/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
index 38948ba2f..c7b2b2721 100644
--- a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
+++ b/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
@@ -1,14 +1,26 @@
# you can override this using by setting a system property, for example -Des.logger.level=DEBUG
es.logger.level: INFO
-rootLogger: ${es.logger.level}, console, file
+rootLogger: ${es.logger.level}, {{root_logger}}
logger:
# log action execution errors for easier debugging
action: WARN
+
+ #
+ # deprecation logging, turn to DEBUG to see them
+ deprecation: WARN, deprecation_log_file
+
# reduce the logging for aws, too much is logged under the default INFO
com.amazonaws: WARN
+
io.fabric8.elasticsearch: ${PLUGIN_LOGLEVEL}
io.fabric8.kubernetes: ${PLUGIN_LOGLEVEL}
+ # aws will try to do some sketchy JMX stuff, but its not needed.
+ com.amazonaws.jmx.SdkMBeanRegistrySupport: ERROR
+ com.amazonaws.metrics.AwsSdkMetrics: ERROR
+
+ org.apache.http: INFO
+
# gateway
#gateway: DEBUG
#index.gateway: DEBUG
@@ -28,13 +40,14 @@ logger:
additivity:
index.search.slowlog: false
index.indexing.slowlog: false
+ deprecation: false
appender:
console:
type: console
layout:
type: consolePattern
- conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+ conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %.1000m%n"
# need this filter until https://github.com/openshift/origin/issues/14515 is fixed
filter:
1:
@@ -67,6 +80,14 @@ appender:
#type: pattern
#conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+ deprecation_log_file:
+ type: dailyRollingFile
+ file: ${path.logs}/${cluster.name}_deprecation.log
+ datePattern: "'.'yyyy-MM-dd"
+ layout:
+ type: pattern
+ conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+
index_search_slow_log_file:
type: dailyRollingFile
file: ${path.logs}/${cluster.name}_index_search_slowlog.log
diff --git a/roles/openshift_logging_elasticsearch/vars/main.yml b/roles/openshift_logging_elasticsearch/vars/main.yml
index 5b4b226e8..20fa63543 100644
--- a/roles/openshift_logging_elasticsearch/vars/main.yml
+++ b/roles/openshift_logging_elasticsearch/vars/main.yml
@@ -2,7 +2,7 @@
__latest_es_version: "3_5"
__allowed_es_versions: ["3_5", "3_6"]
__allowed_es_types: ["data-master", "data-client", "master", "client"]
-
+__es_log_appenders: ['file', 'console']
__kibana_index_modes: ["unique", "shared_ops"]
# TODO: integrate these
diff --git a/roles/openshift_node_dnsmasq/meta/main.yml b/roles/openshift_node_dnsmasq/meta/main.yml
index 18e04e06d..84035b88c 100644
--- a/roles/openshift_node_dnsmasq/meta/main.yml
+++ b/roles/openshift_node_dnsmasq/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
- cloud
dependencies:
- role: openshift_common
+- role: openshift_node_facts
diff --git a/utils/src/ooinstall/variants.py b/utils/src/ooinstall/variants.py
index 1574d447a..546bf91f8 100644
--- a/utils/src/ooinstall/variants.py
+++ b/utils/src/ooinstall/variants.py
@@ -61,7 +61,7 @@ LEGACY = Variant('openshift-enterprise', 'OpenShift Container Platform', [
# Ordered list of variants we can install, first is the default.
SUPPORTED_VARIANTS = (OSE, REG, origin, LEGACY)
-DISPLAY_VARIANTS = (OSE, REG,)
+DISPLAY_VARIANTS = (OSE, REG, origin)
def find_variant(name, version=None):