summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/haproxy/tasks/main.yml43
-rw-r--r--roles/openshift_ansible_inventory/README.md41
-rw-r--r--roles/openshift_ansible_inventory/defaults/main.yml4
-rw-r--r--roles/openshift_ansible_inventory/handlers/main.yml2
-rw-r--r--roles/openshift_ansible_inventory/meta/main.yml8
-rw-r--r--roles/openshift_ansible_inventory/tasks/main.yml47
-rw-r--r--roles/openshift_ansible_inventory/vars/main.yml2
-rw-r--r--roles/openshift_ca/README.md48
-rw-r--r--roles/openshift_ca/tasks/main.yml56
-rw-r--r--roles/openshift_ca/vars/main.yml6
-rwxr-xr-xroles/openshift_facts/library/openshift_facts.py8
-rw-r--r--roles/openshift_loadbalancer/README.md (renamed from roles/haproxy/README.md)4
-rw-r--r--roles/openshift_loadbalancer/defaults/main.yml (renamed from roles/haproxy/defaults/main.yml)0
-rw-r--r--roles/openshift_loadbalancer/handlers/main.yml (renamed from roles/haproxy/handlers/main.yml)0
-rw-r--r--roles/openshift_loadbalancer/meta/main.yml (renamed from roles/haproxy/meta/main.yml)7
-rw-r--r--roles/openshift_loadbalancer/tasks/main.yml73
-rw-r--r--roles/openshift_loadbalancer/templates/haproxy.cfg.j2 (renamed from roles/haproxy/templates/haproxy.cfg.j2)8
-rw-r--r--roles/openshift_master/meta/main.yml1
-rw-r--r--roles/openshift_master_ca/README.md34
-rw-r--r--roles/openshift_master_ca/meta/main.yml (renamed from roles/openshift_ca/meta/main.yml)8
-rw-r--r--roles/openshift_master_ca/tasks/main.yml23
-rw-r--r--roles/openshift_master_ca/vars/main.yml6
-rw-r--r--roles/openshift_master_certificates/README.md29
-rw-r--r--roles/openshift_master_certificates/meta/main.yml6
-rw-r--r--roles/openshift_master_certificates/tasks/main.yml123
-rw-r--r--roles/openshift_master_certificates/vars/main.yml2
-rw-r--r--roles/openshift_node/meta/main.yml2
-rw-r--r--roles/openshift_node_certificates/README.md33
-rw-r--r--roles/openshift_node_certificates/meta/main.yml6
-rw-r--r--roles/openshift_node_certificates/tasks/main.yml97
-rw-r--r--roles/openshift_node_certificates/vars/main.yml9
31 files changed, 223 insertions, 513 deletions
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
deleted file mode 100644
index 837fa67db..000000000
--- a/roles/haproxy/tasks/main.yml
+++ /dev/null
@@ -1,43 +0,0 @@
----
-- name: Install haproxy
- action: "{{ ansible_pkg_mgr }} name=haproxy state=present"
- when: not openshift.common.is_containerized | bool
-
-- name: Configure systemd service directory for haproxy
- file:
- path: /etc/systemd/system/haproxy.service.d
- state: directory
- when: haproxy_limit_nofile is defined
-
-- name: Configure the nofile limits for haproxy
- ini_file:
- dest: /etc/systemd/system/haproxy.service.d/limits.conf
- section: Service
- option: LimitNOFILE
- value: "{{ haproxy_limit_nofile }}"
- when: haproxy_limit_nofile is defined
- notify: restart haproxy
- register: nofile_limit_result
-
-- name: Reload systemd if needed
- command: systemctl daemon-reload
- when: nofile_limit_result | changed
-
-- name: Configure haproxy
- template:
- src: haproxy.cfg.j2
- dest: /etc/haproxy/haproxy.cfg
- owner: root
- group: root
- mode: 0644
- notify: restart haproxy
-
-- name: Enable and start haproxy
- service:
- name: haproxy
- state: started
- enabled: yes
- register: start_result
-
-- set_fact:
- haproxy_start_result_changed: "{{ start_result | changed }}"
diff --git a/roles/openshift_ansible_inventory/README.md b/roles/openshift_ansible_inventory/README.md
deleted file mode 100644
index b62287c12..000000000
--- a/roles/openshift_ansible_inventory/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-OpenShift Ansible Inventory
-=========
-
-Install and configure openshift-ansible-inventory.
-
-Requirements
-------------
-
-None
-
-Role Variables
---------------
-
-oo_inventory_group
-oo_inventory_user
-oo_inventory_accounts
-oo_inventory_cache_max_age
-
-Dependencies
-------------
-
-None
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
- - hosts: servers
- roles:
- - { role: username.rolename, x: 42 }
-
-License
--------
-
-ASL 2.0
-
-Author Information
-------------------
-
-OpenShift operations, Red Hat, Inc
diff --git a/roles/openshift_ansible_inventory/defaults/main.yml b/roles/openshift_ansible_inventory/defaults/main.yml
deleted file mode 100644
index f53c00c80..000000000
--- a/roles/openshift_ansible_inventory/defaults/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-oo_inventory_group: root
-oo_inventory_owner: root
-oo_inventory_cache_max_age: 1800
diff --git a/roles/openshift_ansible_inventory/handlers/main.yml b/roles/openshift_ansible_inventory/handlers/main.yml
deleted file mode 100644
index e2db43477..000000000
--- a/roles/openshift_ansible_inventory/handlers/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-# handlers file for openshift_ansible_inventory
diff --git a/roles/openshift_ansible_inventory/meta/main.yml b/roles/openshift_ansible_inventory/meta/main.yml
deleted file mode 100644
index 7f7387e80..000000000
--- a/roles/openshift_ansible_inventory/meta/main.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-galaxy_info:
- author: OpenShift
- description: Install and configure openshift-ansible-inventory
- company: Red Hat, Inc
- license: ASL 2.0
- min_ansible_version: 1.2
-dependencies: []
diff --git a/roles/openshift_ansible_inventory/tasks/main.yml b/roles/openshift_ansible_inventory/tasks/main.yml
deleted file mode 100644
index 05c7a5f93..000000000
--- a/roles/openshift_ansible_inventory/tasks/main.yml
+++ /dev/null
@@ -1,47 +0,0 @@
----
-- action: "{{ ansible_pkg_mgr }} name={{ item}} state=present"
- with_items:
- - openshift-ansible-inventory
- - openshift-ansible-inventory-aws
- - openshift-ansible-inventory-gce
- when: not openshift.common.is_containerized | bool
-
-- name:
- copy:
- content: "{{ oo_inventory_accounts | to_nice_yaml }}"
- dest: /etc/ansible/multi_inventory.yaml
- group: "{{ oo_inventory_group }}"
- owner: "{{ oo_inventory_owner }}"
- mode: "0640"
-
-- file:
- state: directory
- dest: /etc/ansible/inventory
- owner: root
- group: libra_ops
- mode: 0750
-
-- file:
- state: link
- src: /usr/share/ansible/inventory/multi_inventory.py
- dest: /etc/ansible/inventory/multi_inventory.py
- owner: root
- group: libra_ops
-
-# This cron uses the above location to call its job
-- name: Cron to keep cache fresh
- cron:
- name: 'multi_inventory'
- minute: '*/10'
- job: '/usr/share/ansible/inventory/multi_inventory.py --refresh-cache &> /dev/null'
- when: oo_cron_refresh_cache is defined and oo_cron_refresh_cache
-
-- name: Set cache location
- file:
- state: directory
- dest: "{{ oo_inventory_cache_location | dirname }}"
- owner: root
- group: libra_ops
- recurse: yes
- mode: '2770'
- when: oo_inventory_cache_location is defined
diff --git a/roles/openshift_ansible_inventory/vars/main.yml b/roles/openshift_ansible_inventory/vars/main.yml
deleted file mode 100644
index 25c049282..000000000
--- a/roles/openshift_ansible_inventory/vars/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-# vars file for openshift_ansible_inventory
diff --git a/roles/openshift_ca/README.md b/roles/openshift_ca/README.md
deleted file mode 100644
index 96c9cd5f2..000000000
--- a/roles/openshift_ca/README.md
+++ /dev/null
@@ -1,48 +0,0 @@
-OpenShift CA
-============
-
-This role delegates all tasks to the `openshift_ca_host` such that this role can be depended on by other OpenShift certificate roles.
-
-Requirements
-------------
-
-Role Variables
---------------
-
-From this role:
-
-| Name | Default value | Description |
-|-------------------------|-----------------------------------------------|-----------------------------------------------------------------------------|
-| openshift_ca_host | None (Required) | The hostname of the system where the OpenShift CA will be created. |
-| openshift_ca_config_dir | `{{ openshift.common.config_base }}/master` | CA certificate directory. |
-| openshift_ca_cert | `{{ openshift_ca_config_dir }}/ca.crt` | CA certificate path including CA certificate filename. |
-| openshift_ca_key | `{{ openshift_ca_config_dir }}/ca.key` | CA key path including CA key filename. |
-| openshift_ca_serial | `{{ openshift_ca_config_dir }}/ca.serial.txt` | CA serial path including CA serial filename. |
-| openshift_version | `{{ openshift_pkg_version }}` | OpenShift package version. |
-
-Dependencies
-------------
-
-* openshift_repos
-* openshift_cli
-
-Example Playbook
-----------------
-
-```
-- name: Create OpenShift CA
- hosts: localhost
- roles:
- - role: openshift_ca
- openshift_ca_host: master1.example.com
-```
-
-License
--------
-
-Apache License Version 2.0
-
-Author Information
-------------------
-
-Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/openshift_ca/tasks/main.yml b/roles/openshift_ca/tasks/main.yml
deleted file mode 100644
index 497473f22..000000000
--- a/roles/openshift_ca/tasks/main.yml
+++ /dev/null
@@ -1,56 +0,0 @@
----
-- fail:
- msg: "openshift_ca_host variable must be defined for this role"
- when: openshift_ca_host is not defined
-
-- name: Install the base package for admin tooling
- action: >
- {{ ansible_pkg_mgr }}
- name={{ openshift.common.service_type }}{{ openshift_version }}
- state=present
- when: not openshift.common.is_containerized | bool
- register: install_result
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
-
-- name: Reload generated facts
- openshift_facts:
- when: install_result | changed
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
-
-- name: Create openshift_ca_config_dir if it does not exist
- file:
- path: "{{ openshift_ca_config_dir }}"
- state: directory
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
-
-- name: Determine if CA must be created
- stat:
- path: "{{ openshift_ca_config_dir }}/{{ item }}"
- register: g_master_ca_stat_result
- with_items:
- - ca.crt
- - ca.key
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
-
-- set_fact:
- master_ca_missing: "{{ False in (g_master_ca_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
-
-- name: Create the master certificates if they do not already exist
- command: >
- {{ openshift.common.admin_binary }} create-master-certs
- --hostnames={{ openshift_master_hostnames | join(',') }}
- --master={{ openshift.master.api_url }}
- --public-master={{ openshift.master.public_api_url }}
- --cert-dir={{ openshift_ca_config_dir }}
- --overwrite=false
- when: hostvars[openshift_ca_host].master_ca_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
- run_once: true
diff --git a/roles/openshift_ca/vars/main.yml b/roles/openshift_ca/vars/main.yml
deleted file mode 100644
index a32e385ec..000000000
--- a/roles/openshift_ca/vars/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-openshift_ca_config_dir: "{{ openshift.common.config_base }}/master"
-openshift_ca_cert: "{{ openshift_ca_config_dir }}/ca.crt"
-openshift_ca_key: "{{ openshift_ca_config_dir }}/ca.key"
-openshift_ca_serial: "{{ openshift_ca_config_dir }}/ca.serial.txt"
-openshift_version: "{{ openshift_pkg_version | default('') }}"
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
index 6daaf6822..09b226671 100755
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -1555,6 +1555,7 @@ class OpenShiftFacts(object):
'docker',
'etcd',
'hosted',
+ 'loadbalancer',
'master',
'node']
@@ -1774,6 +1775,13 @@ class OpenShiftFacts(object):
router=dict()
)
+ if 'loadbalancer' in roles:
+ loadbalancer = dict(frontend_port='8443',
+ default_maxconn='20000',
+ global_maxconn='20000',
+ limit_nofile='100000')
+ defaults['loadbalancer'] = loadbalancer
+
return defaults
def guess_host_provider(self):
diff --git a/roles/haproxy/README.md b/roles/openshift_loadbalancer/README.md
index 5bc415066..81fc282be 100644
--- a/roles/haproxy/README.md
+++ b/roles/openshift_loadbalancer/README.md
@@ -1,5 +1,5 @@
-HAProxy
-=======
+OpenShift HAProxy Loadbalancer
+==============================
TODO
diff --git a/roles/haproxy/defaults/main.yml b/roles/openshift_loadbalancer/defaults/main.yml
index a1524cfe1..a1524cfe1 100644
--- a/roles/haproxy/defaults/main.yml
+++ b/roles/openshift_loadbalancer/defaults/main.yml
diff --git a/roles/haproxy/handlers/main.yml b/roles/openshift_loadbalancer/handlers/main.yml
index 5b8691b26..5b8691b26 100644
--- a/roles/haproxy/handlers/main.yml
+++ b/roles/openshift_loadbalancer/handlers/main.yml
diff --git a/roles/haproxy/meta/main.yml b/roles/openshift_loadbalancer/meta/main.yml
index 0fad106a9..fe336acf7 100644
--- a/roles/haproxy/meta/main.yml
+++ b/roles/openshift_loadbalancer/meta/main.yml
@@ -1,7 +1,7 @@
---
galaxy_info:
author: Jason DeTiberus
- description: HAProxy
+ description: OpenShift haproxy loadbalancer
company: Red Hat, Inc.
license: Apache License, Version 2.0
min_ansible_version: 1.9
@@ -10,5 +10,6 @@ galaxy_info:
versions:
- 7
dependencies:
-- { role: os_firewall }
-- { role: openshift_repos }
+- role: openshift_facts
+- role: os_firewall
+- role: openshift_repos
diff --git a/roles/openshift_loadbalancer/tasks/main.yml b/roles/openshift_loadbalancer/tasks/main.yml
new file mode 100644
index 000000000..5514aa70b
--- /dev/null
+++ b/roles/openshift_loadbalancer/tasks/main.yml
@@ -0,0 +1,73 @@
+---
+- name: Set haproxy frontend port
+ openshift_facts:
+ role: loadbalancer
+ local_facts:
+ frontend_port: "{{ openshift_master_api_port | default(None) }}"
+
+- name: Set loadbalancer facts
+ openshift_facts:
+ role: loadbalancer
+ local_facts:
+ limit_nofile: "{{ openshift_loadbalancer_limit_nofile | default(None) }}"
+ default_maxconn: "{{ openshift_loadbalancer_default_maxconn | default(None) }}"
+ global_maxconn: "{{ openshift_loadbalancer_global_maxconn | default(None) }}"
+ frontends:
+ - name: atomic-openshift-api
+ mode: tcp
+ options:
+ - tcplog
+ binds:
+ - "*:{{ openshift.loadbalancer.frontend_port }}"
+ default_backend: atomic-openshift-api
+ backends:
+ - name: atomic-openshift-api
+ mode: tcp
+ option: tcplog
+ balance: source
+ servers: "{{ hostvars
+ | oo_select_keys(groups['oo_masters'])
+ | oo_haproxy_backend_masters(openshift.loadbalancer.frontend_port) }}"
+
+- name: Install haproxy
+ action: "{{ ansible_pkg_mgr }} name=haproxy state=present"
+ when: not openshift.common.is_containerized | bool
+
+- name: Configure systemd service directory for haproxy
+ file:
+ path: /etc/systemd/system/haproxy.service.d
+ state: directory
+ when: "'limit_nofile' in openshift.loadbalancer"
+
+- name: Configure the nofile limits for haproxy
+ ini_file:
+ dest: /etc/systemd/system/haproxy.service.d/limits.conf
+ section: Service
+ option: LimitNOFILE
+ value: "{{ openshift.loadbalancer.limit_nofile }}"
+ when: "'limit_nofile' in openshift.loadbalancer"
+ notify: restart haproxy
+ register: nofile_limit_result
+
+- name: Reload systemd if needed
+ command: systemctl daemon-reload
+ when: nofile_limit_result | changed
+
+- name: Configure haproxy
+ template:
+ src: haproxy.cfg.j2
+ dest: /etc/haproxy/haproxy.cfg
+ owner: root
+ group: root
+ mode: 0644
+ notify: restart haproxy
+
+- name: Enable and start haproxy
+ service:
+ name: haproxy
+ state: started
+ enabled: yes
+ register: start_result
+
+- set_fact:
+ haproxy_start_result_changed: "{{ start_result | changed }}"
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/openshift_loadbalancer/templates/haproxy.cfg.j2
index cb4380971..05e360d3b 100644
--- a/roles/haproxy/templates/haproxy.cfg.j2
+++ b/roles/openshift_loadbalancer/templates/haproxy.cfg.j2
@@ -3,7 +3,7 @@
global
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
- maxconn {{ haproxy_global_maxconn | default('4000') }}
+ maxconn {{ openshift.loadbalancer.global_maxconn }}
user haproxy
group haproxy
daemon
@@ -31,14 +31,14 @@ defaults
timeout server 300s
timeout http-keep-alive 10s
timeout check 10s
- maxconn {{ haproxy_default_maxconn | default('3000') }}
+ maxconn {{ openshift.loadbalancer.default_maxconn }}
listen stats :9000
mode http
stats enable
stats uri /
-{% for frontend in haproxy_frontends %}
+{% for frontend in openshift.loadbalancer.frontends %}
frontend {{ frontend.name }}
{% for bind in frontend.binds %}
bind {{ bind }}
@@ -59,7 +59,7 @@ frontend {{ frontend.name }}
{% endif %}
{% endfor %}
-{% for backend in haproxy_backends %}
+{% for backend in openshift.loadbalancer.backends %}
backend {{ backend.name }}
balance {{ backend.balance }}
{% if 'mode' in backend %}
diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml
index f6b926d74..0a69b3eef 100644
--- a/roles/openshift_master/meta/main.yml
+++ b/roles/openshift_master/meta/main.yml
@@ -15,7 +15,6 @@ dependencies:
- role: openshift_clock
- role: openshift_docker
- role: openshift_cli
-- role: openshift_master_certificates
- role: openshift_cloud_provider
- role: openshift_builddefaults
- role: openshift_master_facts
diff --git a/roles/openshift_master_ca/README.md b/roles/openshift_master_ca/README.md
new file mode 100644
index 000000000..5b2d3601b
--- /dev/null
+++ b/roles/openshift_master_ca/README.md
@@ -0,0 +1,34 @@
+OpenShift Master CA
+========================
+
+TODO
+
+Requirements
+------------
+
+TODO
+
+Role Variables
+--------------
+
+TODO
+
+Dependencies
+------------
+
+TODO
+
+Example Playbook
+----------------
+
+TODO
+
+License
+-------
+
+Apache License Version 2.0
+
+Author Information
+------------------
+
+Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/openshift_ca/meta/main.yml b/roles/openshift_master_ca/meta/main.yml
index 0089f4209..b5dd466c9 100644
--- a/roles/openshift_ca/meta/main.yml
+++ b/roles/openshift_master_ca/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
author: Jason DeTiberus
- description: OpenShift CA
+ description:
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.9.4
+ min_ansible_version: 1.8
platforms:
- name: EL
versions:
@@ -13,5 +13,5 @@ galaxy_info:
- cloud
- system
dependencies:
-- role: openshift_repos
-- role: openshift_cli
+- { role: openshift_repos }
+- { role: openshift_cli }
diff --git a/roles/openshift_master_ca/tasks/main.yml b/roles/openshift_master_ca/tasks/main.yml
new file mode 100644
index 000000000..4b7ef1d84
--- /dev/null
+++ b/roles/openshift_master_ca/tasks/main.yml
@@ -0,0 +1,23 @@
+---
+- name: Install the base package for admin tooling
+ action: "{{ ansible_pkg_mgr }} name={{ openshift.common.service_type }}{{ openshift_version }} state=present"
+ when: not openshift.common.is_containerized | bool
+ register: install_result
+
+- name: Reload generated facts
+ openshift_facts:
+ when: install_result | changed
+
+- name: Create openshift_master_config_dir if it doesn't exist
+ file:
+ path: "{{ openshift_master_config_dir }}"
+ state: directory
+
+- name: Create the master certificates if they do not already exist
+ command: >
+ {{ openshift.common.admin_binary }} create-master-certs
+ --hostnames={{ master_hostnames | join(',') }}
+ --master={{ openshift.master.api_url }}
+ --public-master={{ openshift.master.public_api_url }}
+ --cert-dir={{ openshift_master_config_dir }} --overwrite=false
+ when: master_certs_missing | bool
diff --git a/roles/openshift_master_ca/vars/main.yml b/roles/openshift_master_ca/vars/main.yml
new file mode 100644
index 000000000..b35339b18
--- /dev/null
+++ b/roles/openshift_master_ca/vars/main.yml
@@ -0,0 +1,6 @@
+---
+openshift_master_config_dir: "{{ openshift.common.config_base }}/master"
+openshift_master_ca_cert: "{{ openshift_master_config_dir }}/ca.crt"
+openshift_master_ca_key: "{{ openshift_master_config_dir }}/ca.key"
+openshift_master_ca_serial: "{{ openshift_master_config_dir }}/ca.serial.txt"
+openshift_version: "{{ openshift_pkg_version | default('') }}"
diff --git a/roles/openshift_master_certificates/README.md b/roles/openshift_master_certificates/README.md
index a80d47040..ba3d5f28c 100644
--- a/roles/openshift_master_certificates/README.md
+++ b/roles/openshift_master_certificates/README.md
@@ -1,44 +1,27 @@
OpenShift Master Certificates
========================
-This role determines if OpenShift master certificates must be created, delegates certificate creation to the `openshift_ca_host` and then deploys those certificates to master hosts which this role is being applied to. If this role is applied to the `openshift_ca_host`, certificate deployment will be skipped.
+TODO
Requirements
------------
+TODO
+
Role Variables
--------------
-From `openshift_ca`:
-
-| Name | Default value | Description |
-|---------------------------------------|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
-| openshift_ca_host | None (Required) | The hostname of the system where the OpenShift CA will be (or has been) created. |
-
-From this role:
-
-| Name | Default value | Description |
-|---------------------------------------|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
-| openshift_generated_configs_dir | `{{ openshift.common.config_base }}/generated-configs` | Directory in which per-master generated config directories will be created on the `openshift_ca_host`. |
-| openshift_master_cert_subdir | `master-{{ openshift.common.hostname }}` | Directory within `openshift_generated_configs_dir` where per-master configurations will be placed on the `openshift_ca_host`. |
-| openshift_master_config_dir | `{{ openshift.common.config_base }}/master` | Master configuration directory in which certificates will be deployed on masters. |
-| openshift_master_generated_config_dir | `{{ openshift_generated_configs_dir }}/{{ openshift_master_cert_subdir }` | Full path to the per-master generated config directory. |
+TODO
Dependencies
------------
-* openshift_ca
+TODO
Example Playbook
----------------
-```
-- name: Create OpenShift Master Certificates
- hosts: masters
- roles:
- - role: openshift_master_certificates
- openshift_ca_host: master1.example.com
-```
+TODO
License
-------
diff --git a/roles/openshift_master_certificates/meta/main.yml b/roles/openshift_master_certificates/meta/main.yml
index 90fc0fb10..fd7b73b0f 100644
--- a/roles/openshift_master_certificates/meta/main.yml
+++ b/roles/openshift_master_certificates/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
author: Jason DeTiberus
- description: OpenShift Master Certificates
+ description:
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.9.4
+ min_ansible_version: 1.8
platforms:
- name: EL
versions:
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
- system
dependencies:
-- role: openshift_ca
+- { role: openshift_master_ca }
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index dd105652b..394f9d381 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -1,121 +1,38 @@
---
-- set_fact:
- openshift_master_certs_no_etcd:
- - admin.crt
- - master.kubelet-client.crt
- - "{{ 'master.proxy-client.crt' if openshift.common.version_gte_3_1_or_1_1 else omit }}"
- - master.server.crt
- - openshift-master.crt
- - openshift-registry.crt
- - openshift-router.crt
- - etcd.server.crt
- openshift_master_certs_etcd:
- - master.etcd-client.crt
-
-- set_fact:
- openshift_master_certs: "{{ (openshift_master_certs_no_etcd | union(openshift_master_certs_etcd )) if openshift_master_etcd_hosts | length > 0 else openshift_master_certs_no_etcd }}"
-
-- name: Check status of master certificates
- stat:
- path: "{{ openshift_master_config_dir }}/{{ item }}"
- with_items:
- - "{{ openshift_master_certs }}"
- register: g_master_cert_stat_result
-
-- set_fact:
- master_certs_missing: "{{ False in (g_master_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
-
- name: Ensure the generated_configs directory present
file:
- path: "{{ openshift_master_generated_config_dir }}"
+ path: "{{ openshift_generated_configs_dir }}/{{ item.master_cert_subdir }}"
state: directory
mode: 0700
- when: master_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
+ with_items: "{{ masters_needing_certs | default([]) }}"
- file:
- src: "{{ openshift_master_config_dir }}/{{ item }}"
- dest: "{{ openshift_master_generated_config_dir }}/{{ item }}"
+ src: "{{ openshift_master_config_dir }}/{{ item.1 }}"
+ dest: "{{ openshift_generated_configs_dir }}/{{ item.0.master_cert_subdir }}/{{ item.1 }}"
state: hard
- with_items:
- - ca.crt
- - ca.key
- - ca.serial.txt
- when: master_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
+ with_nested:
+ - "{{ masters_needing_certs | default([]) }}"
+ -
+ - ca.crt
+ - ca.key
+ - ca.serial.txt
- name: Create the master certificates if they do not already exist
command: >
{{ openshift.common.admin_binary }} create-master-certs
- --hostnames={{ openshift.common.all_hostnames | join(',') }}
- --master={{ openshift.master.api_url }}
- --public-master={{ openshift.master.public_api_url }}
- --cert-dir={{ openshift_master_generated_config_dir }}
+ --hostnames={{ item.openshift.common.all_hostnames | join(',') }}
+ --master={{ item.openshift.master.api_url }}
+ --public-master={{ item.openshift.master.public_api_url }}
+ --cert-dir={{ openshift_generated_configs_dir }}/{{ item.master_cert_subdir }}
--overwrite=false
- when: master_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
+ when: item.master_certs_missing | bool
+ with_items: "{{ masters_needing_certs | default([]) }}"
- file:
- src: "{{ openshift_master_config_dir }}/{{ item }}"
- dest: "{{ openshift_master_generated_config_dir }}/{{ item }}"
+ src: "{{ openshift_master_config_dir }}/{{ item.1 }}"
+ dest: "{{ openshift_generated_configs_dir }}/{{ item.0.master_cert_subdir }}/{{ item.1 }}"
state: hard
force: true
- with_items:
+ with_nested:
+ - "{{ masters_needing_certs | default([]) }}"
- "{{ hostvars[inventory_hostname] | certificates_to_synchronize }}"
- when: master_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Remove generated etcd client certs when using external etcd
- file:
- path: "{{ openshift_master_generated_config_dir }}/{{ item }}"
- state: absent
- when: openshift_master_etcd_hosts | length > 0
- with_items:
- - master.etcd-client.crt
- - master.etcd-client.key
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Create local temp directory for syncing certs
- local_action: command mktemp -d /tmp/openshift-ansible-XXXXXXX
- register: g_master_mktemp
- changed_when: False
- when: master_certs_missing | bool
- delegate_to: localhost
-
-- name: Create a tarball of the master certs
- command: >
- tar -czvf {{ openshift_master_generated_config_dir }}.tgz
- -C {{ openshift_master_generated_config_dir }} .
- args:
- creates: "{{ openshift_master_generated_config_dir }}.tgz"
- when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Retrieve the master cert tarball from the master
- fetch:
- src: "{{ openshift_master_generated_config_dir }}.tgz"
- dest: "{{ g_master_mktemp.stdout }}/"
- flat: yes
- fail_on_missing: yes
- validate_checksum: yes
- when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Ensure certificate directory exists
- file:
- path: "{{ openshift_master_config_dir }}"
- state: directory
- when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
-
-- name: Unarchive the tarball on the master
- unarchive:
- src: "{{ g_master_mktemp.stdout }}/{{ openshift_master_cert_subdir }}.tgz"
- dest: "{{ openshift_master_config_dir }}"
- when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
-
-- file: name={{ g_master_mktemp.stdout }} state=absent
- changed_when: False
- when: master_certs_missing | bool
- delegate_to: localhost
diff --git a/roles/openshift_master_certificates/vars/main.yml b/roles/openshift_master_certificates/vars/main.yml
index 66f2e5162..3f18ddc79 100644
--- a/roles/openshift_master_certificates/vars/main.yml
+++ b/roles/openshift_master_certificates/vars/main.yml
@@ -1,5 +1,3 @@
---
openshift_generated_configs_dir: "{{ openshift.common.config_base }}/generated-configs"
-openshift_master_cert_subdir: "master-{{ openshift.common.hostname }}"
openshift_master_config_dir: "{{ openshift.common.config_base }}/master"
-openshift_master_generated_config_dir: "{{ openshift_generated_configs_dir }}/{{ openshift_master_cert_subdir }}"
diff --git a/roles/openshift_node/meta/main.yml b/roles/openshift_node/meta/main.yml
index ea52bbb99..31547b846 100644
--- a/roles/openshift_node/meta/main.yml
+++ b/roles/openshift_node/meta/main.yml
@@ -14,9 +14,9 @@ galaxy_info:
dependencies:
- role: openshift_clock
- role: openshift_docker
-- role: openshift_node_certificates
- role: openshift_cloud_provider
- role: openshift_common
- role: openshift_node_dnsmasq
when: openshift.common.use_dnsmasq
- role: os_firewall
+
diff --git a/roles/openshift_node_certificates/README.md b/roles/openshift_node_certificates/README.md
index f56066b29..6264d253a 100644
--- a/roles/openshift_node_certificates/README.md
+++ b/roles/openshift_node_certificates/README.md
@@ -1,44 +1,27 @@
-OpenShift Node Certificates
-===========================
+OpenShift/Atomic Enterprise Node Certificates
+=============================================
-This role determines if OpenShift node certificates must be created, delegates certificate creation to the `openshift_ca_host` and then deploys those certificates to node hosts which this role is being applied to.
+TODO
Requirements
------------
+TODO
+
Role Variables
--------------
-From `openshift_ca`:
-
-| Name | Default value | Description |
-|-------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
-| openshift_ca_host | None (Required) | The hostname of the system where the OpenShift CA will be (or has been) created. |
-
-From this role:
-
-| Name | Default value | Description |
-|-------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
-| openshift_generated_configs_dir | `{{ openshift.common.config_base }}/generated-configs` | Directory in which per-node generated config directories will be created on the `openshift_ca_host`. |
-| openshift_node_cert_subdir | `node-{{ openshift.common.hostname }}` | Directory within `openshift_generated_configs_dir` where per-node certificates will be placed on the `openshift_ca_host`. |
-| openshift_node_config_dir | `{{ openshift.common.config_base }}/node` | Node configuration directory in which certificates will be deployed on nodes. |
-| openshift_node_generated_config_dir | `{{ openshift_generated_configs_dir }}/{{ openshift_node_cert_subdir }` | Full path to the per-node generated config directory. |
+TODO
Dependencies
------------
-* openshift_ca
+TODO
Example Playbook
----------------
-```
-- name: Create OpenShift Node Certificates
- hosts: nodes
- roles:
- - role: openshift_node_certificates
- openshift_ca_host: master1.example.com
-```
+TODO
License
-------
diff --git a/roles/openshift_node_certificates/meta/main.yml b/roles/openshift_node_certificates/meta/main.yml
index 3caa1cdf1..f3236e850 100644
--- a/roles/openshift_node_certificates/meta/main.yml
+++ b/roles/openshift_node_certificates/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
author: Jason DeTiberus
- description: OpenShift Node Certificates
+ description:
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.9.4
+ min_ansible_version: 1.8
platforms:
- name: EL
versions:
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
- system
dependencies:
-- role: openshift_ca
+- { role: openshift_facts }
diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml
index 147a432a4..216c11093 100644
--- a/roles/openshift_node_certificates/tasks/main.yml
+++ b/roles/openshift_node_certificates/tasks/main.yml
@@ -1,95 +1,36 @@
---
-- name: Check status of node certificates
- stat:
- path: "{{ openshift.common.config_base }}/node/{{ item }}"
- with_items:
- - "system:node:{{ openshift.common.hostname }}.crt"
- - "system:node:{{ openshift.common.hostname }}.key"
- - "system:node:{{ openshift.common.hostname }}.kubeconfig"
- - ca.crt
- - server.key
- - server.crt
- register: g_node_cert_stat_result
-
-- set_fact:
- node_certs_missing: "{{ False in (g_node_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
-
-- name: Create openshift_generated_configs_dir if it does not exist
+- name: Create openshift_generated_configs_dir if it doesn\'t exist
file:
path: "{{ openshift_generated_configs_dir }}"
state: directory
mode: 0700
- when: node_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
+ when: nodes_needing_certs | length > 0
- name: Generate the node client config
command: >
{{ openshift.common.admin_binary }} create-api-client-config
- --certificate-authority={{ openshift_ca_cert }}
- --client-dir={{ openshift_node_generated_config_dir }}
+ --certificate-authority={{ openshift_master_ca_cert }}
+ --client-dir={{ openshift_generated_configs_dir }}/node-{{ item.openshift.common.hostname }}
--groups=system:nodes
- --master={{ hostvars[openshift_ca_host].openshift.master.api_url }}
- --signer-cert={{ openshift_ca_cert }}
- --signer-key={{ openshift_ca_key }}
- --signer-serial={{ openshift_ca_serial }}
- --user=system:node:{{ openshift.common.hostname }}
+ --master={{ openshift.master.api_url }}
+ --signer-cert={{ openshift_master_ca_cert }}
+ --signer-key={{ openshift_master_ca_key }}
+ --signer-serial={{ openshift_master_ca_serial }}
+ --user=system:node:{{ item.openshift.common.hostname }}
args:
- creates: "{{ openshift_node_generated_config_dir }}"
- when: node_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
+ creates: "{{ openshift_generated_configs_dir }}/node-{{ item.openshift.common.hostname }}"
+ with_items: "{{ nodes_needing_certs | default([]) }}"
- name: Generate the node server certificate
command: >
{{ openshift.common.admin_binary }} ca create-server-cert
- --cert={{ openshift_node_generated_config_dir }}/server.crt
- --key={{ openshift_generated_configs_dir }}/node-{{ openshift.common.hostname }}/server.key
+ --cert={{ openshift_generated_configs_dir }}/node-{{ item.openshift.common.hostname }}/server.crt
+ --key={{ openshift_generated_configs_dir }}/node-{{ item.openshift.common.hostname }}/server.key
--overwrite=true
- --hostnames={{ openshift.common.all_hostnames |join(",") }}
- --signer-cert={{ openshift_ca_cert }}
- --signer-key={{ openshift_ca_key }}
- --signer-serial={{ openshift_ca_serial }}
- args:
- creates: "{{ openshift_node_generated_config_dir }}/server.crt"
- when: node_certs_missing | bool
- delegate_to: "{{ openshift_ca_host}}"
-
-- name: Create local temp directory for syncing certs
- local_action: command mktemp -d /tmp/openshift-ansible-XXXXXXX
- register: node_cert_mktemp
- changed_when: False
- when: node_certs_missing | bool
- delegate_to: localhost
-
-- name: Create a tarball of the node config directories
- command: >
- tar -czvf {{ openshift_node_generated_config_dir }}.tgz
- --transform 's|system:{{ openshift_node_cert_subdir }}|node|'
- -C {{ openshift_node_generated_config_dir }} .
+ --hostnames={{ item.openshift.common.all_hostnames |join(",") }}
+ --signer-cert={{ openshift_master_ca_cert }}
+ --signer-key={{ openshift_master_ca_key }}
+ --signer-serial={{ openshift_master_ca_serial }}
args:
- creates: "{{ openshift_node_generated_config_dir }}.tgz"
- when: node_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Retrieve the node config tarballs from the master
- fetch:
- src: "{{ openshift_node_generated_config_dir }}.tgz"
- dest: "{{ node_cert_mktemp.stdout }}/"
- flat: yes
- fail_on_missing: yes
- validate_checksum: yes
- when: node_certs_missing | bool
- delegate_to: "{{ openshift_ca_host }}"
-
-- name: Ensure certificate directory exists
- file:
- path: "{{ openshift_node_cert_dir }}"
- state: directory
- when: node_certs_missing | bool
-
-- name: Unarchive the tarball on the node
- unarchive:
- src: "{{ node_cert_mktemp.stdout }}/{{ openshift_node_cert_subdir }}.tgz"
- dest: "{{ openshift_node_cert_dir }}"
- when: node_certs_missing | bool
+ creates: "{{ openshift_generated_configs_dir }}/node-{{ item.openshift.common.hostname }}/server.crt"
+ with_items: "{{ nodes_needing_certs | default([]) }}"
diff --git a/roles/openshift_node_certificates/vars/main.yml b/roles/openshift_node_certificates/vars/main.yml
index 2fafc7387..61fbb1e51 100644
--- a/roles/openshift_node_certificates/vars/main.yml
+++ b/roles/openshift_node_certificates/vars/main.yml
@@ -1,6 +1,7 @@
---
-openshift_generated_configs_dir: "{{ openshift.common.config_base }}/generated-configs"
-openshift_node_cert_dir: "{{ openshift.common.config_base }}/node"
-openshift_node_cert_subdir: "node-{{ openshift.common.hostname }}"
openshift_node_config_dir: "{{ openshift.common.config_base }}/node"
-openshift_node_generated_config_dir: "{{ openshift_generated_configs_dir }}/{{ openshift_node_cert_subdir }}"
+openshift_master_config_dir: "{{ openshift.common.config_base }}/master"
+openshift_generated_configs_dir: "{{ openshift.common.config_base }}/generated-configs"
+openshift_master_ca_cert: "{{ openshift_master_config_dir }}/ca.crt"
+openshift_master_ca_key: "{{ openshift_master_config_dir }}/ca.key"
+openshift_master_ca_serial: "{{ openshift_master_config_dir }}/ca.serial.txt"