summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/etcd/tasks/main.yml2
-rwxr-xr-xroles/openshift_facts/library/openshift_facts.py99
-rw-r--r--roles/openshift_manageiq/tasks/main.yaml4
-rw-r--r--roles/openshift_master/tasks/main.yml5
-rw-r--r--roles/openshift_master/templates/master.yaml.v1.j22
-rw-r--r--roles/openshift_master/templates/sessionSecretsFile.yaml.v1.j26
-rw-r--r--roles/openshift_node/tasks/storage_plugins/ceph.yml2
-rw-r--r--roles/openshift_node/tasks/storage_plugins/glusterfs.yml2
-rw-r--r--roles/openshift_node/tasks/storage_plugins/main.yml5
-rw-r--r--roles/rhel_subscribe/tasks/main.yml10
10 files changed, 120 insertions, 17 deletions
diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml
index 663f6e537..e83cfc33c 100644
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -104,4 +104,4 @@
register: start_result
- set_fact:
- etcd_service_status_changed = "{{ start_result | changed }}"
+ etcd_service_status_changed: "{{ start_result | changed }}"
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
index 911a684fc..8dc16f5e4 100755
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -628,7 +628,7 @@ def set_deployment_facts_if_unset(facts):
facts['common']['service_type'] = service_type
if 'config_base' not in facts['common']:
config_base = '/etc/origin'
- if deployment_type in ['enterprise', 'online']:
+ if deployment_type in ['enterprise']:
config_base = '/etc/openshift'
# Handle upgrade scenarios when symlinks don't yet exist:
if not os.path.exists(config_base) and os.path.exists('/etc/openshift'):
@@ -636,7 +636,7 @@ def set_deployment_facts_if_unset(facts):
facts['common']['config_base'] = config_base
if 'data_dir' not in facts['common']:
data_dir = '/var/lib/origin'
- if deployment_type in ['enterprise', 'online']:
+ if deployment_type in ['enterprise']:
data_dir = '/var/lib/openshift'
# Handle upgrade scenarios when symlinks don't yet exist:
if not os.path.exists(data_dir) and os.path.exists('/var/lib/openshift'):
@@ -715,6 +715,26 @@ def set_version_facts_if_unset(facts):
return facts
+def set_manageiq_facts_if_unset(facts):
+ """ Set manageiq facts. This currently includes common.use_manageiq.
+
+ Args:
+ facts (dict): existing facts
+ Returns:
+ dict: the facts dict updated with version facts.
+ Raises:
+ OpenShiftFactsInternalError:
+ """
+ if 'common' not in facts:
+ if 'version_greater_than_3_1_or_1_1' not in facts['common']:
+ raise OpenShiftFactsInternalError(
+ "Invalid invocation: The required facts are not set"
+ )
+
+ facts['common']['use_manageiq'] = facts['common']['version_greater_than_3_1_or_1_1']
+
+ return facts
+
def set_sdn_facts_if_unset(facts, system_facts):
""" Set sdn facts if not already present in facts dict
@@ -1021,6 +1041,11 @@ def set_container_facts_if_unset(facts):
return facts
+class OpenShiftFactsInternalError(Exception):
+ """Origin Facts Error"""
+ pass
+
+
class OpenShiftFactsUnsupportedRoleError(Exception):
"""Origin Facts Unsupported Role Error"""
pass
@@ -1043,6 +1068,7 @@ class OpenShiftFacts(object):
facts (dict): facts for the host
Args:
+ module (AnsibleModule): an AnsibleModule object
role (str): role for setting local facts
filename (str): local facts file to use
local_facts (dict): local facts to set
@@ -1096,6 +1122,7 @@ class OpenShiftFacts(object):
facts = set_sdn_facts_if_unset(facts, self.system_facts)
facts = set_deployment_facts_if_unset(facts)
facts = set_version_facts_if_unset(facts)
+ facts = set_manageiq_facts_if_unset(facts)
facts = set_aggregate_facts(facts)
facts = set_etcd_facts_if_unset(facts)
facts = set_container_facts_if_unset(facts)
@@ -1121,7 +1148,7 @@ class OpenShiftFacts(object):
common = dict(use_openshift_sdn=True, ip=ip_addr, public_ip=ip_addr,
deployment_type='origin', hostname=hostname,
- public_hostname=hostname, use_manageiq=True)
+ public_hostname=hostname)
common['client_binary'] = 'oc'
common['admin_binary'] = 'oadm'
common['dns_domain'] = 'cluster.local'
@@ -1263,14 +1290,78 @@ class OpenShiftFacts(object):
del facts[key]
if new_local_facts != local_facts:
+ self.validate_local_facts(new_local_facts)
changed = True
-
if not module.check_mode:
save_local_facts(self.filename, new_local_facts)
self.changed = changed
return new_local_facts
+ def validate_local_facts(self, facts=None):
+ """ Validate local facts
+
+ Args:
+ facts (dict): local facts to validate
+ """
+ invalid_facts = dict()
+ invalid_facts = self.validate_master_facts(facts, invalid_facts)
+ if invalid_facts:
+ msg = 'Invalid facts detected:\n'
+ for key in invalid_facts.keys():
+ msg += '{0}: {1}\n'.format(key, invalid_facts[key])
+ module.fail_json(msg=msg,
+ changed=self.changed)
+
+ # disabling pylint errors for line-too-long since we're dealing
+ # with best effort reduction of error messages here.
+ # disabling errors for too-many-branches since we require checking
+ # many conditions.
+ # pylint: disable=line-too-long, too-many-branches
+ @staticmethod
+ def validate_master_facts(facts, invalid_facts):
+ """ Validate master facts
+
+ Args:
+ facts (dict): local facts to validate
+ invalid_facts (dict): collected invalid_facts
+
+ Returns:
+ dict: Invalid facts
+ """
+ if 'master' in facts:
+ # openshift.master.session_auth_secrets
+ if 'session_auth_secrets' in facts['master']:
+ session_auth_secrets = facts['master']['session_auth_secrets']
+ if not issubclass(type(session_auth_secrets), list):
+ invalid_facts['session_auth_secrets'] = 'Expects session_auth_secrets is a list.'
+ elif 'session_encryption_secrets' not in facts['master']:
+ invalid_facts['session_auth_secrets'] = ('openshift_master_session_encryption secrets must be set '
+ 'if openshift_master_session_auth_secrets is provided.')
+ elif len(session_auth_secrets) != len(facts['master']['session_encryption_secrets']):
+ invalid_facts['session_auth_secrets'] = ('openshift_master_session_auth_secrets and '
+ 'openshift_master_session_encryption_secrets must be '
+ 'equal length.')
+ else:
+ for secret in session_auth_secrets:
+ if len(secret) < 32:
+ invalid_facts['session_auth_secrets'] = ('Invalid secret in session_auth_secrets. '
+ 'Secrets must be at least 32 characters in length.')
+ # openshift.master.session_encryption_secrets
+ if 'session_encryption_secrets' in facts['master']:
+ session_encryption_secrets = facts['master']['session_encryption_secrets']
+ if not issubclass(type(session_encryption_secrets), list):
+ invalid_facts['session_encryption_secrets'] = 'Expects session_encryption_secrets is a list.'
+ elif 'session_auth_secrets' not in facts['master']:
+ invalid_facts['session_encryption_secrets'] = ('openshift_master_session_auth_secrets must be '
+ 'set if openshift_master_session_encryption_secrets '
+ 'is provided.')
+ else:
+ for secret in session_encryption_secrets:
+ if len(secret) not in [16, 24, 32]:
+ invalid_facts['session_encryption_secrets'] = ('Invalid secret in session_encryption_secrets. '
+ 'Secrets must be 16, 24, or 32 characters in length.')
+ return invalid_facts
def main():
""" main """
diff --git a/roles/openshift_manageiq/tasks/main.yaml b/roles/openshift_manageiq/tasks/main.yaml
index 2d3187e21..0357fc85a 100644
--- a/roles/openshift_manageiq/tasks/main.yaml
+++ b/roles/openshift_manageiq/tasks/main.yaml
@@ -1,4 +1,8 @@
---
+- fail:
+ msg: "The openshift_manageiq role requires OpenShift Enterprise 3.1 or Origin 1.1."
+ when: not openshift.common.version_greater_than_3_1_or_1_1 | bool
+
- name: Copy Configuration to temporary conf
command: >
cp {{ openshift.common.config_base }}/master/admin.kubeconfig {{manage_iq_tmp_conf}}
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index a22654678..397122631 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -9,7 +9,6 @@
Invalid OAuth grant method: {{ openshift_master_oauth_grant_method }}
when: openshift_master_oauth_grant_method is defined and openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods
-
# HA Variable Validation
- fail:
msg: "openshift_master_cluster_method must be set to either 'native' or 'pacemaker' for multi-master installations"
@@ -55,9 +54,9 @@
portal_net: "{{ openshift_master_portal_net | default(None) }}"
session_max_seconds: "{{ openshift_master_session_max_seconds | default(None) }}"
session_name: "{{ openshift_master_session_name | default(None) }}"
+ session_secrets_file: "{{ openshift_master_session_secrets_file | default(None) }}"
session_auth_secrets: "{{ openshift_master_session_auth_secrets | default(None) }}"
session_encryption_secrets: "{{ openshift_master_session_encryption_secrets | default(None) }}"
- session_secrets_file: "{{ openshift_master_session_secrets_file | default(None) }}"
access_token_max_seconds: "{{ openshift_master_access_token_max_seconds | default(None) }}"
auth_token_max_seconds: "{{ openshift_master_auth_token_max_seconds | default(None) }}"
identity_providers: "{{ openshift_master_identity_providers | default(None) }}"
@@ -221,7 +220,7 @@
template:
dest: "{{ openshift.master.session_secrets_file }}"
src: sessionSecretsFile.yaml.v1.j2
- force: no
+ when: openshift.master.session_auth_secrets is defined and openshift.master.session_encryption_secrets is defined
notify:
- restart master
- restart master api
diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index 317049c44..647476b7f 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -127,7 +127,9 @@ oauthConfig:
sessionConfig:
sessionMaxAgeSeconds: {{ openshift.master.session_max_seconds }}
sessionName: {{ openshift.master.session_name }}
+{% if openshift.master.session_auth_secrets is defined and openshift.master.session_encryption_secrets is defined %}
sessionSecretsFile: {{ openshift.master.session_secrets_file }}
+{% endif %}
tokenConfig:
accessTokenMaxAgeSeconds: {{ openshift.master.access_token_max_seconds }}
authorizeTokenMaxAgeSeconds: {{ openshift.master.auth_token_max_seconds }}
diff --git a/roles/openshift_master/templates/sessionSecretsFile.yaml.v1.j2 b/roles/openshift_master/templates/sessionSecretsFile.yaml.v1.j2
index d12d9db90..3d4b573a9 100644
--- a/roles/openshift_master/templates/sessionSecretsFile.yaml.v1.j2
+++ b/roles/openshift_master/templates/sessionSecretsFile.yaml.v1.j2
@@ -1,7 +1,7 @@
apiVersion: v1
kind: SessionSecrets
secrets:
-{% for secret in openshift_master_session_auth_secrets %}
-- authentication: "{{ openshift_master_session_auth_secrets[loop.index0] }}"
- encryption: "{{ openshift_master_session_encryption_secrets[loop.index0] }}"
+{% for secret in openshift.master.session_auth_secrets %}
+- authentication: "{{ openshift.master.session_auth_secrets[loop.index0] }}"
+ encryption: "{{ openshift.master.session_encryption_secrets[loop.index0] }}"
{% endfor %}
diff --git a/roles/openshift_node/tasks/storage_plugins/ceph.yml b/roles/openshift_node/tasks/storage_plugins/ceph.yml
index 119ad62ef..eed3c99a3 100644
--- a/roles/openshift_node/tasks/storage_plugins/ceph.yml
+++ b/roles/openshift_node/tasks/storage_plugins/ceph.yml
@@ -1,4 +1,4 @@
---
- name: Install Ceph storage plugin dependencies
action: "{{ ansible_pkg_mgr }} name=ceph-common state=present"
- when: not openshift.common.is_containerized | bool \ No newline at end of file
+ when: not openshift.common.is_atomic | bool \ No newline at end of file
diff --git a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
index 91ee77e7e..8fc8497fa 100644
--- a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
+++ b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
@@ -1,7 +1,7 @@
---
- name: Install GlusterFS storage plugin dependencies
action: "{{ ansible_pkg_mgr }} name=glusterfs-fuse state=present"
- when: not openshift.common.is_containerized | bool
+ when: not openshift.common.is_atomic | bool
- name: Set sebooleans to allow gluster storage plugin access from containers
seboolean:
diff --git a/roles/openshift_node/tasks/storage_plugins/main.yml b/roles/openshift_node/tasks/storage_plugins/main.yml
index d237c26ec..39c7b9390 100644
--- a/roles/openshift_node/tasks/storage_plugins/main.yml
+++ b/roles/openshift_node/tasks/storage_plugins/main.yml
@@ -3,12 +3,11 @@
# additional package dependencies
- name: NFS storage plugin configuration
include: nfs.yml
- when: not openshift.common.is_containerized | bool
- name: GlusterFS storage plugin configuration
include: glusterfs.yml
- when: "'glusterfs' in openshift.node.storage_plugin_deps and not openshift.common.is_containerized | bool "
+ when: "'glusterfs' in openshift.node.storage_plugin_deps"
- name: Ceph storage plugin configuration
include: ceph.yml
- when: "'ceph' in openshift.node.storage_plugin_deps and not openshift.common.is_containerized | bool"
+ when: "'ceph' in openshift.node.storage_plugin_deps"
diff --git a/roles/rhel_subscribe/tasks/main.yml b/roles/rhel_subscribe/tasks/main.yml
index 30c0920a1..c160ea4e9 100644
--- a/roles/rhel_subscribe/tasks/main.yml
+++ b/roles/rhel_subscribe/tasks/main.yml
@@ -4,6 +4,7 @@
# to make it able to enable repositories
- set_fact:
+ rhel_subscription_pool: "{{ lookup('oo_option', 'rhel_subscription_pool') | default(rhsub_pool, True) | default('OpenShift Enterprise, Premium*', True) }}"
rhel_subscription_user: "{{ lookup('oo_option', 'rhel_subscription_user') | default(rhsub_user, True) | default(omit, True) }}"
rhel_subscription_pass: "{{ lookup('oo_option', 'rhel_subscription_pass') | default(rhsub_pass, True) | default(omit, True) }}"
rhel_subscription_server: "{{ lookup('oo_option', 'rhel_subscription_server') | default(rhsub_server) }}"
@@ -30,7 +31,14 @@
redhat_subscription:
username: "{{ rhel_subscription_user }}"
password: "{{ rhel_subscription_pass }}"
- autosubscribe: yes
+
+- name: Retrieve the OpenShift Pool ID
+ command: subscription-manager list --available --matches="{{ rhel_subscription_pool }}" --pool-only
+ register: openshift_pool_id
+ changed_when: False
+
+- name: Attach to OpenShift Pool
+ command: subscription-manager subscribe --pool {{ openshift_pool_id.stdout_lines[0] }}
- include: enterprise.yml
when: deployment_type == 'enterprise'