summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeff Cantrill <jcantrill@users.noreply.github.com>2017-02-23 14:33:53 -0500
committerGitHub <noreply@github.com>2017-02-23 14:33:53 -0500
commitdab7c7d035d0a934d9d7f809ddcbfb34913042a4 (patch)
treec475404220d937ff4f4395233697c82f0af3e4dc
parentbb7985f751eab9c9e987e85f00a1918f0f9594c8 (diff)
parent9e76a034e60ad6cbe8c1a4bb4b2175a596856b8f (diff)
downloadopenshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.gz
openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.bz2
openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.xz
openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.zip
Merge pull request #3470 from wshearn/logging_insecureedgeterminationpolicy
Add insecure edge termination policy for kibana.
-rw-r--r--roles/openshift_logging/README.md1
-rw-r--r--roles/openshift_logging/defaults/main.yml1
-rw-r--r--roles/openshift_logging/tasks/generate_routes.yaml1
-rw-r--r--roles/openshift_logging/templates/route_reencrypt.j23
4 files changed, 6 insertions, 0 deletions
diff --git a/roles/openshift_logging/README.md b/roles/openshift_logging/README.md
index c90a5bf20..14b80304d 100644
--- a/roles/openshift_logging/README.md
+++ b/roles/openshift_logging/README.md
@@ -46,6 +46,7 @@ When both `openshift_logging_install_logging` and `openshift_logging_upgrade_log
- `openshift_logging_kibana_proxy_memory_limit`: The amount of memory to allocate to Kibana proxy or unset if not specified.
- `openshift_logging_kibana_replica_count`: The number of replicas Kibana should be scaled up to. Defaults to 1.
- `openshift_logging_kibana_nodeselector`: A map of labels (e.g. {"node":"infra","region":"west"} to select the nodes where the pod will land.
+- `openshift_logging_kibana_edge_term_policy`: Insecure Edge Termination Policy. Defaults to Redirect.
- `openshift_logging_fluentd_nodeselector`: The node selector that the Fluentd daemonset uses to determine where to deploy to. Defaults to '"logging-infra-fluentd": "true"'.
- `openshift_logging_fluentd_cpu_limit`: The CPU limit for Fluentd pods. Defaults to '100m'.
diff --git a/roles/openshift_logging/defaults/main.yml b/roles/openshift_logging/defaults/main.yml
index 9b3c17da1..5440a3647 100644
--- a/roles/openshift_logging/defaults/main.yml
+++ b/roles/openshift_logging/defaults/main.yml
@@ -26,6 +26,7 @@ openshift_logging_kibana_proxy_debug: false
openshift_logging_kibana_proxy_cpu_limit: null
openshift_logging_kibana_proxy_memory_limit: null
openshift_logging_kibana_replica_count: 1
+openshift_logging_kibana_edge_term_policy: Redirect
#The absolute path on the control node to the cert file to use
#for the public facing kibana certs
diff --git a/roles/openshift_logging/tasks/generate_routes.yaml b/roles/openshift_logging/tasks/generate_routes.yaml
index 3c462378b..7af17a708 100644
--- a/roles/openshift_logging/tasks/generate_routes.yaml
+++ b/roles/openshift_logging/tasks/generate_routes.yaml
@@ -26,6 +26,7 @@
tls_cert: "{{kibana_cert | default('') | b64decode}}"
tls_ca_cert: "{{kibana_ca | b64decode}}"
tls_dest_ca_cert: "{{key_pairs | entry_from_named_pair('ca_file')| b64decode }}"
+ edge_term_policy: "{{openshift_logging_kibana_edge_term_policy | default('') }}"
labels:
component: support
logging-infra: support
diff --git a/roles/openshift_logging/templates/route_reencrypt.j2 b/roles/openshift_logging/templates/route_reencrypt.j2
index 341ffdd84..cf8a9e65f 100644
--- a/roles/openshift_logging/templates/route_reencrypt.j2
+++ b/roles/openshift_logging/templates/route_reencrypt.j2
@@ -28,6 +28,9 @@ spec:
{{ line }}
{% endfor %}
termination: reencrypt
+{% if edge_term_policy is defined and edge_term_policy | length > 0 %}
+ insecureEdgeTerminationPolicy: {{ edge_term_policy }}
+{% endif %}
to:
kind: Service
name: {{ service_name }}