summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
authorScott Dodson <sdodson@redhat.com>2016-08-02 12:33:47 -0400
committerGitHub <noreply@github.com>2016-08-02 12:33:47 -0400
commitee9413cebdb8a7c5ff03a5da767b1c74742bc898 (patch)
treee629c528cc1089a64cb2bb6f3f5466a355a11b41 /roles
parentaf6025be5c26e505e2577f84528d7bcf78f046e2 (diff)
parentdbb140a649a5540102e3af1d74cbacdd12f1d04a (diff)
downloadopenshift-ee9413cebdb8a7c5ff03a5da767b1c74742bc898.tar.gz
openshift-ee9413cebdb8a7c5ff03a5da767b1c74742bc898.tar.bz2
openshift-ee9413cebdb8a7c5ff03a5da767b1c74742bc898.tar.xz
openshift-ee9413cebdb8a7c5ff03a5da767b1c74742bc898.zip
Merge pull request #1953 from abutcher/etcd-certificates
Refactor etcd certificates roles.
Diffstat (limited to 'roles')
-rw-r--r--roles/etcd/meta/main.yml4
-rw-r--r--roles/etcd/templates/etcd.conf.j22
-rw-r--r--roles/etcd_ca/meta/main.yml6
-rw-r--r--roles/etcd_ca/tasks/main.yml16
-rw-r--r--roles/etcd_certificates/tasks/client.yml42
-rw-r--r--roles/etcd_certificates/tasks/main.yml6
-rw-r--r--roles/etcd_certificates/tasks/server.yml71
-rw-r--r--roles/etcd_client_certificates/README.md (renamed from roles/etcd_certificates/README.md)4
l---------roles/etcd_client_certificates/library1
-rw-r--r--roles/etcd_client_certificates/meta/main.yml (renamed from roles/etcd_certificates/meta/main.yml)6
-rw-r--r--roles/etcd_client_certificates/tasks/main.yml119
-rw-r--r--roles/etcd_server_certificates/README.md34
l---------roles/etcd_server_certificates/library1
-rw-r--r--roles/etcd_server_certificates/meta/main.yml16
-rw-r--r--roles/etcd_server_certificates/tasks/main.yml136
-rw-r--r--roles/flannel/meta/main.yml6
-rw-r--r--roles/openshift_etcd_client_certificates/meta/main.yml (renamed from roles/openshift_etcd_certificates/meta/main.yml)8
-rw-r--r--roles/openshift_etcd_facts/vars/main.yml5
-rw-r--r--roles/openshift_master/meta/main.yml1
19 files changed, 347 insertions, 137 deletions
diff --git a/roles/etcd/meta/main.yml b/roles/etcd/meta/main.yml
index 7156a9fff..cfd72dfbc 100644
--- a/roles/etcd/meta/main.yml
+++ b/roles/etcd/meta/main.yml
@@ -7,7 +7,7 @@ galaxy_info:
description: etcd management
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.2
+ min_ansible_version: 2.1
platforms:
- name: EL
versions:
@@ -22,4 +22,4 @@ dependencies:
port: "{{etcd_client_port}}/tcp"
- service: etcd peering
port: "{{ etcd_peer_port }}/tcp"
-- role: etcd_common
+- role: etcd_server_certificates
diff --git a/roles/etcd/templates/etcd.conf.j2 b/roles/etcd/templates/etcd.conf.j2
index cd048ec60..7ccf78212 100644
--- a/roles/etcd/templates/etcd.conf.j2
+++ b/roles/etcd/templates/etcd.conf.j2
@@ -1,5 +1,5 @@
{% macro initial_cluster() -%}
-{% for host in etcd_peers -%}
+{% for host in etcd_peers | default([]) -%}
{% if loop.last -%}
{{ hostvars[host].etcd_hostname }}={{ etcd_peer_url_scheme }}://{{ hostvars[host].etcd_ip }}:{{ etcd_peer_port }}
{%- else -%}
diff --git a/roles/etcd_ca/meta/main.yml b/roles/etcd_ca/meta/main.yml
index d02456ca3..e3e2f7781 100644
--- a/roles/etcd_ca/meta/main.yml
+++ b/roles/etcd_ca/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
author: Jason DeTiberus
- description:
+ description: Etcd CA
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.9
+ min_ansible_version: 2.1
platforms:
- name: EL
versions:
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
- system
dependencies:
-- { role: etcd_common }
+- role: etcd_common
diff --git a/roles/etcd_ca/tasks/main.yml b/roles/etcd_ca/tasks/main.yml
index e1bb9baed..865074e41 100644
--- a/roles/etcd_ca/tasks/main.yml
+++ b/roles/etcd_ca/tasks/main.yml
@@ -2,6 +2,8 @@
- name: Install openssl
action: "{{ ansible_pkg_mgr }} name=openssl state=present"
when: not etcd_is_atomic | bool
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- file:
path: "{{ item }}"
@@ -13,29 +15,41 @@
- "{{ etcd_ca_new_certs_dir }}"
- "{{ etcd_ca_crl_dir }}"
- "{{ etcd_ca_dir }}/fragments"
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- command: cp /etc/pki/tls/openssl.cnf ./
args:
chdir: "{{ etcd_ca_dir }}/fragments"
creates: "{{ etcd_ca_dir }}/fragments/openssl.cnf"
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- template:
dest: "{{ etcd_ca_dir }}/fragments/openssl_append.cnf"
src: openssl_append.j2
backup: true
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- assemble:
src: "{{ etcd_ca_dir }}/fragments"
dest: "{{ etcd_openssl_conf }}"
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- command: touch {{ etcd_ca_db }}
args:
creates: "{{ etcd_ca_db }}"
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- copy:
dest: "{{ etcd_ca_serial }}"
content: "01"
force: no
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
- command: >
openssl req -config {{ etcd_openssl_conf }} -newkey rsa:4096
@@ -48,3 +62,5 @@
creates: "{{ etcd_ca_cert }}"
environment:
SAN: 'etcd-signer'
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
diff --git a/roles/etcd_certificates/tasks/client.yml b/roles/etcd_certificates/tasks/client.yml
deleted file mode 100644
index b497a46c0..000000000
--- a/roles/etcd_certificates/tasks/client.yml
+++ /dev/null
@@ -1,42 +0,0 @@
----
-- name: Ensure generated_certs directory present
- file:
- path: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- state: directory
- mode: 0700
- with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- name: Create the client csr
- command: >
- openssl req -new -keyout {{ item.etcd_cert_prefix }}client.key
- -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}client.csr
- -reqexts {{ etcd_req_ext }} -batch -nodes
- -subj /CN={{ item.etcd_hostname }}
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'client.csr' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- name: Sign and create the client crt
- command: >
- openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}client.crt
- -in {{ item.etcd_cert_prefix }}client.csr
- -batch
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'client.crt' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- file:
- src: "{{ etcd_ca_cert }}"
- dest: "{{ etcd_generated_certs_dir}}/{{ item.etcd_cert_subdir }}/{{ item.etcd_cert_prefix }}ca.crt"
- state: hard
- with_items: "{{ etcd_needing_client_certs | default([]) }}"
diff --git a/roles/etcd_certificates/tasks/main.yml b/roles/etcd_certificates/tasks/main.yml
deleted file mode 100644
index 17092ca58..000000000
--- a/roles/etcd_certificates/tasks/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-- include: client.yml
- when: etcd_needing_client_certs | default([]) | length > 0
-
-- include: server.yml
- when: etcd_needing_server_certs | default([]) | length > 0
diff --git a/roles/etcd_certificates/tasks/server.yml b/roles/etcd_certificates/tasks/server.yml
deleted file mode 100644
index 934b8b805..000000000
--- a/roles/etcd_certificates/tasks/server.yml
+++ /dev/null
@@ -1,71 +0,0 @@
----
-- name: Ensure generated_certs directory present
- file:
- path: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- state: directory
- mode: 0700
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Create the server csr
- command: >
- openssl req -new -keyout {{ item.etcd_cert_prefix }}server.key
- -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}server.csr
- -reqexts {{ etcd_req_ext }} -batch -nodes
- -subj /CN={{ item.etcd_hostname }}
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'server.csr' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Sign and create the server crt
- command: >
- openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}server.crt
- -in {{ item.etcd_cert_prefix }}server.csr
- -extensions {{ etcd_ca_exts_server }} -batch
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'server.crt' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Create the peer csr
- command: >
- openssl req -new -keyout {{ item.etcd_cert_prefix }}peer.key
- -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}peer.csr
- -reqexts {{ etcd_req_ext }} -batch -nodes
- -subj /CN={{ item.etcd_hostname }}
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'peer.csr' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Sign and create the peer crt
- command: >
- openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
- -out {{ item.etcd_cert_prefix }}peer.crt
- -in {{ item.etcd_cert_prefix }}peer.csr
- -extensions {{ etcd_ca_exts_peer }} -batch
- args:
- chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
- creates: "{{ etcd_generated_certs_dir ~ '/' ~ item.etcd_cert_subdir ~ '/'
- ~ item.etcd_cert_prefix ~ 'peer.crt' }}"
- environment:
- SAN: "IP:{{ item.etcd_ip }}"
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- file:
- src: "{{ etcd_ca_cert }}"
- dest: "{{ etcd_generated_certs_dir}}/{{ item.etcd_cert_subdir }}/{{ item.etcd_cert_prefix }}ca.crt"
- state: hard
- with_items: "{{ etcd_needing_server_certs | default([]) }}"
diff --git a/roles/etcd_certificates/README.md b/roles/etcd_client_certificates/README.md
index 95f8f8aab..269d5296d 100644
--- a/roles/etcd_certificates/README.md
+++ b/roles/etcd_client_certificates/README.md
@@ -1,5 +1,5 @@
-OpenShift etcd certificates
-========================
+OpenShift Etcd Certificates
+===========================
TODO
diff --git a/roles/etcd_client_certificates/library b/roles/etcd_client_certificates/library
new file mode 120000
index 000000000..494d3c39e
--- /dev/null
+++ b/roles/etcd_client_certificates/library
@@ -0,0 +1 @@
+../../library \ No newline at end of file
diff --git a/roles/etcd_certificates/meta/main.yml b/roles/etcd_client_certificates/meta/main.yml
index 41370fab4..713c78c70 100644
--- a/roles/etcd_certificates/meta/main.yml
+++ b/roles/etcd_client_certificates/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
author: Jason DeTiberus
- description:
+ description: Etcd Client Certificates
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.8
+ min_ansible_version: 2.1
platforms:
- name: EL
versions:
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
- system
dependencies:
-- { role: etcd_ca }
+- role: etcd_ca
diff --git a/roles/etcd_client_certificates/tasks/main.yml b/roles/etcd_client_certificates/tasks/main.yml
new file mode 100644
index 000000000..b86afb81c
--- /dev/null
+++ b/roles/etcd_client_certificates/tasks/main.yml
@@ -0,0 +1,119 @@
+---
+- name: Check status of external etcd certificatees
+ stat:
+ path: "{{ etcd_cert_config_dir }}/{{ item }}"
+ with_items:
+ - "{{ etcd_cert_prefix }}client.crt"
+ - "{{ etcd_cert_prefix }}client.key"
+ - "{{ etcd_cert_prefix }}ca.crt"
+ register: g_external_etcd_cert_stat_result
+
+- set_fact:
+ etcd_client_certs_missing: "{{ False in (g_external_etcd_cert_stat_result.results
+ | oo_collect(attribute='stat.exists')
+ | list) }}"
+
+- name: Ensure generated_certs directory present
+ file:
+ path: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ state: directory
+ mode: 0700
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the client csr
+ command: >
+ openssl req -new -keyout {{ etcd_cert_prefix }}client.key
+ -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}client.csr
+ -reqexts {{ etcd_req_ext }} -batch -nodes
+ -subj /CN={{ etcd_hostname }}
+ args:
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'client.csr' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+# Certificates must be signed serially in order to avoid competing
+# for the serial file.
+- name: Sign and create the client crt
+ delegated_serial_command:
+ command: >
+ openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}client.crt
+ -in {{ etcd_cert_prefix }}client.csr
+ -batch
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'client.crt' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- file:
+ src: "{{ etcd_ca_cert }}"
+ dest: "{{ etcd_generated_certs_dir}}/{{ etcd_cert_subdir }}/{{ etcd_cert_prefix }}ca.crt"
+ state: hard
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create local temp directory for syncing certs
+ local_action: command mktemp -d /tmp/etcd_certificates-XXXXXXX
+ register: g_etcd_client_mktemp
+ changed_when: False
+ when: etcd_client_certs_missing | bool
+ delegate_to: localhost
+ become: no
+
+- name: Create a tarball of the etcd certs
+ command: >
+ tar -czvf {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz
+ -C {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }} .
+ args:
+ creates: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Retrieve the etcd cert tarballs
+ fetch:
+ src: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+ dest: "{{ g_etcd_client_mktemp.stdout }}/"
+ flat: yes
+ fail_on_missing: yes
+ validate_checksum: yes
+ when: etcd_client_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Ensure certificate directory exists
+ file:
+ path: "{{ etcd_cert_config_dir }}"
+ state: directory
+ when: etcd_client_certs_missing | bool
+
+- name: Unarchive etcd cert tarballs
+ unarchive:
+ src: "{{ g_etcd_client_mktemp.stdout }}/{{ etcd_cert_subdir }}.tgz"
+ dest: "{{ etcd_cert_config_dir }}"
+ when: etcd_client_certs_missing | bool
+
+- file:
+ path: "{{ etcd_cert_config_dir }}/{{ item }}"
+ owner: root
+ group: root
+ mode: 0600
+ with_items:
+ - "{{ etcd_cert_prefix }}client.crt"
+ - "{{ etcd_cert_prefix }}client.key"
+ - "{{ etcd_cert_prefix }}ca.crt"
+ when: etcd_client_certs_missing | bool
+
+- name: Delete temporary directory
+ file: name={{ g_etcd_client_mktemp.stdout }} state=absent
+ changed_when: False
+ when: etcd_client_certs_missing | bool
+ delegate_to: localhost
+ become: no
diff --git a/roles/etcd_server_certificates/README.md b/roles/etcd_server_certificates/README.md
new file mode 100644
index 000000000..269d5296d
--- /dev/null
+++ b/roles/etcd_server_certificates/README.md
@@ -0,0 +1,34 @@
+OpenShift Etcd Certificates
+===========================
+
+TODO
+
+Requirements
+------------
+
+TODO
+
+Role Variables
+--------------
+
+TODO
+
+Dependencies
+------------
+
+TODO
+
+Example Playbook
+----------------
+
+TODO
+
+License
+-------
+
+Apache License Version 2.0
+
+Author Information
+------------------
+
+Scott Dodson (sdodson@redhat.com)
diff --git a/roles/etcd_server_certificates/library b/roles/etcd_server_certificates/library
new file mode 120000
index 000000000..494d3c39e
--- /dev/null
+++ b/roles/etcd_server_certificates/library
@@ -0,0 +1 @@
+../../library \ No newline at end of file
diff --git a/roles/etcd_server_certificates/meta/main.yml b/roles/etcd_server_certificates/meta/main.yml
new file mode 100644
index 000000000..b453f2bd8
--- /dev/null
+++ b/roles/etcd_server_certificates/meta/main.yml
@@ -0,0 +1,16 @@
+---
+galaxy_info:
+ author: Jason DeTiberus
+ description: Etcd Server Certificates
+ company: Red Hat, Inc.
+ license: Apache License, Version 2.0
+ min_ansible_version: 2.1
+ platforms:
+ - name: EL
+ versions:
+ - 7
+ categories:
+ - cloud
+ - system
+dependencies:
+- role: etcd_ca
diff --git a/roles/etcd_server_certificates/tasks/main.yml b/roles/etcd_server_certificates/tasks/main.yml
new file mode 100644
index 000000000..edcf51092
--- /dev/null
+++ b/roles/etcd_server_certificates/tasks/main.yml
@@ -0,0 +1,136 @@
+---
+- name: Check status of etcd certificates
+ stat:
+ path: "{{ etcd_cert_config_dir }}/{{ item }}"
+ with_items:
+ - "{{ etcd_cert_prefix }}server.crt"
+ - "{{ etcd_cert_prefix }}peer.crt"
+ - "{{ etcd_cert_prefix }}ca.crt"
+ register: g_etcd_server_cert_stat_result
+
+- set_fact:
+ etcd_server_certs_missing: "{{ False in (g_etcd_server_cert_stat_result.results
+ | oo_collect(attribute='stat.exists')
+ | list) }}"
+
+- name: Ensure generated_certs directory present
+ file:
+ path: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ state: directory
+ mode: 0700
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the server csr
+ command: >
+ openssl req -new -keyout {{ etcd_cert_prefix }}server.key
+ -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}server.csr
+ -reqexts {{ etcd_req_ext }} -batch -nodes
+ -subj /CN={{ etcd_hostname }}
+ args:
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'server.csr' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+# Certificates must be signed serially in order to avoid competing
+# for the serial file.
+- name: Sign and create the server crt
+ delegated_serial_command:
+ command: >
+ openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}server.crt
+ -in {{ etcd_cert_prefix }}server.csr
+ -extensions {{ etcd_ca_exts_server }} -batch
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'server.crt' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the peer csr
+ command: >
+ openssl req -new -keyout {{ etcd_cert_prefix }}peer.key
+ -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}peer.csr
+ -reqexts {{ etcd_req_ext }} -batch -nodes
+ -subj /CN={{ etcd_hostname }}
+ args:
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'peer.csr' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Sign and create the peer crt
+ delegated_serial_command:
+ command: >
+ openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+ -out {{ etcd_cert_prefix }}peer.crt
+ -in {{ etcd_cert_prefix }}peer.csr
+ -extensions {{ etcd_ca_exts_peer }} -batch
+ chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+ creates: "{{ etcd_generated_certs_dir ~ '/' ~ etcd_cert_subdir ~ '/'
+ ~ etcd_cert_prefix ~ 'peer.crt' }}"
+ environment:
+ SAN: "IP:{{ etcd_ip }}"
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- file:
+ src: "{{ etcd_ca_cert }}"
+ dest: "{{ etcd_generated_certs_dir}}/{{ etcd_cert_subdir }}/{{ etcd_cert_prefix }}ca.crt"
+ state: hard
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create local temp directory for syncing certs
+ local_action: command mktemp -d /tmp/etcd_certificates-XXXXXXX
+ register: g_etcd_server_mktemp
+ changed_when: False
+ when: etcd_server_certs_missing | bool
+ delegate_to: localhost
+
+- name: Create a tarball of the etcd certs
+ command: >
+ tar -czvf {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz
+ -C {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }} .
+ args:
+ creates: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Retrieve etcd cert tarball
+ fetch:
+ src: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+ dest: "{{ g_etcd_server_mktemp.stdout }}/"
+ flat: yes
+ fail_on_missing: yes
+ validate_checksum: yes
+ when: etcd_server_certs_missing | bool
+ delegate_to: "{{ etcd_ca_host }}"
+
+- name: Ensure certificate directory exists
+ file:
+ path: "{{ etcd_cert_config_dir }}"
+ state: directory
+ when: etcd_server_certs_missing | bool
+
+- name: Unarchive cert tarball
+ unarchive:
+ src: "{{ g_etcd_server_mktemp.stdout }}/{{ etcd_cert_subdir }}.tgz"
+ dest: "{{ etcd_cert_config_dir }}"
+ when: etcd_server_certs_missing | bool
+
+- name: Delete temporary directory
+ file: name={{ g_etcd_server_mktemp.stdout }} state=absent
+ changed_when: False
+ when: etcd_server_certs_missing | bool
+ delegate_to: localhost
diff --git a/roles/flannel/meta/main.yml b/roles/flannel/meta/main.yml
index 909bdbfa4..616ae61d2 100644
--- a/roles/flannel/meta/main.yml
+++ b/roles/flannel/meta/main.yml
@@ -4,7 +4,7 @@ galaxy_info:
description: flannel management
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.2
+ min_ansible_version: 2.1
platforms:
- name: EL
versions:
@@ -13,4 +13,6 @@ galaxy_info:
- cloud
- system
dependencies:
-- { role: openshift_facts }
+- role: openshift_facts
+- role: openshift_etcd_client_certificates
+ etcd_cert_prefix: flannel.etcd-
diff --git a/roles/openshift_etcd_certificates/meta/main.yml b/roles/openshift_etcd_client_certificates/meta/main.yml
index 2725fdb51..3268c390f 100644
--- a/roles/openshift_etcd_certificates/meta/main.yml
+++ b/roles/openshift_etcd_client_certificates/meta/main.yml
@@ -1,10 +1,10 @@
---
galaxy_info:
- author: Andrew Butcher
- description: OpenShift etcd Certificates
+ author: Jason DeTiberus
+ description: OpenShift Etcd Client Certificates
company: Red Hat, Inc.
license: Apache License, Version 2.0
- min_ansible_version: 1.9
+ min_ansible_version: 2.1
platforms:
- name: EL
versions:
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
dependencies:
- role: openshift_etcd_facts
-- role: etcd_certificates
+- role: etcd_client_certificates
diff --git a/roles/openshift_etcd_facts/vars/main.yml b/roles/openshift_etcd_facts/vars/main.yml
index 6f3894565..cae15d61a 100644
--- a/roles/openshift_etcd_facts/vars/main.yml
+++ b/roles/openshift_etcd_facts/vars/main.yml
@@ -3,3 +3,8 @@ etcd_is_containerized: "{{ openshift.common.is_containerized }}"
etcd_is_atomic: "{{ openshift.common.is_atomic }}"
etcd_hostname: "{{ openshift.common.hostname }}"
etcd_ip: "{{ openshift.common.ip }}"
+etcd_cert_subdir: "etcd-{{ openshift.common.hostname }}"
+etcd_cert_prefix:
+etcd_cert_config_dir: /etc/etcd
+etcd_peer_url_scheme: https
+etcd_url_scheme: https
diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml
index e391acfaa..a2f665702 100644
--- a/roles/openshift_master/meta/main.yml
+++ b/roles/openshift_master/meta/main.yml
@@ -12,4 +12,3 @@ galaxy_info:
categories:
- cloud
dependencies: []
-