11 files changed, 133 insertions, 116 deletions
diff --git a/playbooks/common/openshift-cluster/config.yml b/playbooks/common/openshift-cluster/config.yml
index 9e0295aaa..239bb211b 100644
--- a/playbooks/common/openshift-cluster/config.yml
+++ b/playbooks/common/openshift-cluster/config.yml
@@ -1,30 +1,7 @@
 ---
-- name: Set oo_option facts
-  hosts: oo_all_hosts
+- include: initialize_oo_option_facts.yml
   tags:
   - always
-  tasks:
-  - set_fact:
-      openshift_docker_additional_registries: "{{ lookup('oo_option', 'docker_additional_registries') }}"
-    when: openshift_docker_additional_registries is not defined
-  - set_fact:
-      openshift_docker_insecure_registries: "{{ lookup('oo_option',  'docker_insecure_registries') }}"
-    when: openshift_docker_insecure_registries is not defined
-  - set_fact:
-      openshift_docker_blocked_registries: "{{ lookup('oo_option', 'docker_blocked_registries') }}"
-    when: openshift_docker_blocked_registries is not defined
-  - set_fact:
-      openshift_docker_options: "{{ lookup('oo_option', 'docker_options') }}"
-    when: openshift_docker_options is not defined
-  - set_fact:
-      openshift_docker_log_driver: "{{ lookup('oo_option', 'docker_log_driver') }}"
-    when: openshift_docker_log_driver is not defined
-  - set_fact:
-      openshift_docker_log_options: "{{ lookup('oo_option', 'docker_log_options') }}"
-    when: openshift_docker_log_options is not defined
-  - set_fact:
-      openshift_docker_selinux_enabled: "{{ lookup('oo_option', 'docker_selinux_enabled') }}"
-    when: openshift_docker_selinux_enabled is not defined
 
 - include: disable_excluder.yml
   tags:
diff --git a/playbooks/common/openshift-cluster/initialize_oo_option_facts.yml b/playbooks/common/openshift-cluster/initialize_oo_option_facts.yml
new file mode 100644
index 000000000..ac3c702a0
--- /dev/null
+++ b/playbooks/common/openshift-cluster/initialize_oo_option_facts.yml
@@ -0,0 +1,27 @@
+---
+- name: Set oo_option facts
+  hosts: oo_all_hosts
+  tags:
+  - always
+  tasks:
+  - set_fact:
+      openshift_docker_additional_registries: "{{ lookup('oo_option', 'docker_additional_registries') }}"
+    when: openshift_docker_additional_registries is not defined
+  - set_fact:
+      openshift_docker_insecure_registries: "{{ lookup('oo_option',  'docker_insecure_registries') }}"
+    when: openshift_docker_insecure_registries is not defined
+  - set_fact:
+      openshift_docker_blocked_registries: "{{ lookup('oo_option', 'docker_blocked_registries') }}"
+    when: openshift_docker_blocked_registries is not defined
+  - set_fact:
+      openshift_docker_options: "{{ lookup('oo_option', 'docker_options') }}"
+    when: openshift_docker_options is not defined
+  - set_fact:
+      openshift_docker_log_driver: "{{ lookup('oo_option', 'docker_log_driver') }}"
+    when: openshift_docker_log_driver is not defined
+  - set_fact:
+      openshift_docker_log_options: "{{ lookup('oo_option', 'docker_log_options') }}"
+    when: openshift_docker_log_options is not defined
+  - set_fact:
+      openshift_docker_selinux_enabled: "{{ lookup('oo_option', 'docker_selinux_enabled') }}"
+    when: openshift_docker_selinux_enabled is not defined
diff --git a/playbooks/common/openshift-cluster/openshift_logging.yml b/playbooks/common/openshift-cluster/openshift_logging.yml
index d96a78c4c..57580406c 100644
--- a/playbooks/common/openshift-cluster/openshift_logging.yml
+++ b/playbooks/common/openshift-cluster/openshift_logging.yml
@@ -1,11 +1,13 @@
 ---
+- include: evaluate_groups.yml
+
 - name: OpenShift Aggregated Logging
   hosts: oo_first_master
   roles:
   - openshift_logging
 
 - name: Update Master configs
-  hosts: masters:!oo_first_master
+  hosts: oo_masters:!oo_first_master
   tasks:
   - block:
     - include_role:
diff --git a/playbooks/common/openshift-cluster/openshift_provisioners.yml b/playbooks/common/openshift-cluster/openshift_provisioners.yml
new file mode 100644
index 000000000..b1ca6f606
--- /dev/null
+++ b/playbooks/common/openshift-cluster/openshift_provisioners.yml
@@ -0,0 +1,5 @@
+---
+- name: OpenShift Provisioners
+  hosts: oo_first_master
+  roles:
+  - openshift_provisioners
diff --git a/playbooks/common/openshift-cluster/redeploy-certificates/ca.yml b/playbooks/common/openshift-cluster/redeploy-certificates/ca.yml
index cbb4a2434..3b26abcc7 100644
--- a/playbooks/common/openshift-cluster/redeploy-certificates/ca.yml
+++ b/playbooks/common/openshift-cluster/redeploy-certificates/ca.yml
@@ -130,7 +130,7 @@
       state: absent
     changed_when: false
 
-- include: ../../../common/openshift-etcd/restart.yml
+- include: ../openshift-etcd/restart.yml
 
 # Update master config when ca-bundle not referenced. Services will be
 # restarted below after new CA certificate has been distributed.
@@ -322,7 +322,7 @@
       group: "{{ 'root' if item == 'root' else _ansible_ssh_user_gid.stdout  }}"
     with_items: "{{ client_users }}"
 
-- include: ../../../common/openshift-master/restart.yml
+- include: ../openshift-master/restart.yml
 
 - name: Distribute OpenShift CA certificate to nodes
   hosts: oo_nodes_to_config
@@ -371,4 +371,4 @@
       state: absent
     changed_when: false
 
-- include: ../../../common/openshift-node/restart.yml
+- include: ../openshift-node/restart.yml
diff --git a/playbooks/common/openshift-cluster/std_include.yml b/playbooks/common/openshift-cluster/std_include.yml
index 74cc1d527..6ed31a644 100644
--- a/playbooks/common/openshift-cluster/std_include.yml
+++ b/playbooks/common/openshift-cluster/std_include.yml
@@ -1,28 +1,4 @@
 ---
-- name: Create initial host groups for localhost
-  hosts: localhost
-  connection: local
-  become: no
-  gather_facts: no
-  tags:
-  - always
-  tasks:
-  - include_vars: ../../byo/openshift-cluster/cluster_hosts.yml
-  - name: Evaluate group l_oo_all_hosts
-    add_host:
-      name: "{{ item }}"
-      groups: l_oo_all_hosts
-    with_items: "{{ g_all_hosts | default([]) }}"
-    changed_when: no
-
-- name: Create initial host groups for all hosts
-  hosts: l_oo_all_hosts
-  gather_facts: no
-  tags:
-  - always
-  tasks:
-  - include_vars: ../../byo/openshift-cluster/cluster_hosts.yml
-
 - include: evaluate_groups.yml
   tags:
   - always
diff --git a/playbooks/common/openshift-cluster/upgrades/docker/docker_upgrade.yml b/playbooks/common/openshift-cluster/upgrades/docker/docker_upgrade.yml
new file mode 100644
index 000000000..07db071ce
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/docker/docker_upgrade.yml
@@ -0,0 +1,71 @@
+---
+- include: ../../evaluate_groups.yml
+  vars:
+    # Do not allow adding hosts during upgrade.
+    g_new_master_hosts: []
+    g_new_node_hosts: []
+    openshift_cluster_id: "{{ cluster_id | default('default') }}"
+
+- include: ../initialize_nodes_to_upgrade.yml
+
+- name: Check for appropriate Docker versions
+  hosts: oo_masters_to_config:oo_nodes_to_upgrade:oo_etcd_to_config
+  roles:
+  - openshift_facts
+  tasks:
+  - set_fact:
+      repoquery_cmd: "{{ 'dnf repoquery --latest-limit 1 -d 0' if ansible_pkg_mgr == 'dnf' else 'repoquery --plugins' }}"
+
+  - fail:
+      msg: Cannot upgrade Docker on Atomic operating systems.
+    when: openshift.common.is_atomic | bool
+
+  - include: upgrade_check.yml
+    when: docker_upgrade is not defined or docker_upgrade | bool
+
+
+# If a node fails, halt everything, the admin will need to clean up and we
+# don't want to carry on, potentially taking out every node. The playbook can safely be re-run
+# and will not take any action on a node already running the requested docker version.
+- name: Drain and upgrade nodes
+  hosts: oo_masters_to_config:oo_nodes_to_upgrade:oo_etcd_to_config
+  serial: 1
+  any_errors_fatal: true
+
+  roles:
+  - lib_openshift
+
+  tasks:
+  - name: Mark node unschedulable
+    oc_adm_manage_node:
+      node: "{{ openshift.node.nodename | lower }}"
+      schedulable: False
+    delegate_to: "{{ groups.oo_first_master.0 }}"
+    retries: 10
+    delay: 5
+    register: node_unschedulable
+    until: node_unschedulable|succeeded
+    when:
+    - l_docker_upgrade is defined
+    - l_docker_upgrade | bool
+    - inventory_hostname in groups.oo_nodes_to_upgrade
+
+  - name: Drain Node for Kubelet upgrade
+    command: >
+      {{ openshift.common.admin_binary }} drain {{ openshift.node.nodename }} --force --delete-local-data --ignore-daemonsets
+    delegate_to: "{{ groups.oo_first_master.0 }}"
+    when: l_docker_upgrade is defined and l_docker_upgrade | bool and inventory_hostname in groups.oo_nodes_to_upgrade
+
+  - include: upgrade.yml
+    when: l_docker_upgrade is defined and l_docker_upgrade | bool
+
+  - name: Set node schedulability
+    oc_adm_manage_node:
+      node: "{{ openshift.node.nodename | lower }}"
+      schedulable: True
+    delegate_to: "{{ groups.oo_first_master.0 }}"
+    retries: 10
+    delay: 5
+    register: node_schedulable
+    until: node_schedulable|succeeded
+    when: node_unschedulable|changed
diff --git a/playbooks/common/openshift-cluster/upgrades/files/nuke_images.sh b/playbooks/common/openshift-cluster/upgrades/docker/nuke_images.sh
index 8635eab0d..8635eab0d 100644
--- a/playbooks/common/openshift-cluster/upgrades/files/nuke_images.sh
+++ b/playbooks/common/openshift-cluster/upgrades/docker/nuke_images.sh
diff --git a/playbooks/common/openshift-cluster/upgrades/docker/roles b/playbooks/common/openshift-cluster/upgrades/docker/roles
new file mode 120000
index 000000000..6bc1a7aef
--- /dev/null
+++ b/playbooks/common/openshift-cluster/upgrades/docker/roles
@@ -0,0 +1 @@
+../../../../../roles
+\ No newline at end of file
diff --git a/playbooks/common/openshift-cluster/upgrades/init.yml b/playbooks/common/openshift-cluster/upgrades/init.yml
index 01d151eb9..cbf6d58b3 100644
--- a/playbooks/common/openshift-cluster/upgrades/init.yml
+++ b/playbooks/common/openshift-cluster/upgrades/init.yml
@@ -1,28 +1,4 @@
 ---
-- name: Create initial host groups for localhost
-  hosts: localhost
-  connection: local
-  become: no
-  gather_facts: no
-  tags:
-  - always
-  tasks:
-  - include_vars: ../../../byo/openshift-cluster/cluster_hosts.yml
-  - name: Evaluate group l_oo_all_hosts
-    add_host:
-      name: "{{ item }}"
-      groups: l_oo_all_hosts
-    with_items: "{{ g_all_hosts | default([]) }}"
-    changed_when: False
-
-- name: Create initial host groups for all hosts
-  hosts: l_oo_all_hosts
-  gather_facts: no
-  tags:
-  - always
-  tasks:
-  - include_vars: ../../../byo/openshift-cluster/cluster_hosts.yml
-
 - include: ../evaluate_groups.yml
   vars:
     # Do not allow adding hosts during upgrade.
@@ -30,27 +6,7 @@
     g_new_node_hosts: []
     openshift_cluster_id: "{{ cluster_id | default('default') }}"
 
-- name: Set oo_options
-  hosts: oo_all_hosts
-  tasks:
-  - set_fact:
-      openshift_docker_additional_registries: "{{ lookup('oo_option', 'docker_additional_registries') }}"
-    when: openshift_docker_additional_registries is not defined
-  - set_fact:
-      openshift_docker_insecure_registries: "{{ lookup('oo_option',  'docker_insecure_registries') }}"
-    when: openshift_docker_insecure_registries is not defined
-  - set_fact:
-      openshift_docker_blocked_registries: "{{ lookup('oo_option', 'docker_blocked_registries') }}"
-    when: openshift_docker_blocked_registries is not defined
-  - set_fact:
-      openshift_docker_options: "{{ lookup('oo_option', 'docker_options') }}"
-    when: openshift_docker_options is not defined
-  - set_fact:
-      openshift_docker_log_driver: "{{ lookup('oo_option', 'docker_log_driver') }}"
-    when: openshift_docker_log_driver is not defined
-  - set_fact:
-      openshift_docker_log_options: "{{ lookup('oo_option', 'docker_log_options') }}"
-    when: openshift_docker_log_options is not defined
+- include: ../initialize_oo_option_facts.yml
 
 - include: ../initialize_facts.yml
 
diff --git a/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
index c00795a8d..0d7cdb227 100644
--- a/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
+++ b/playbooks/common/openshift-cluster/upgrades/post_control_plane.yml
@@ -5,9 +5,10 @@
 - name: Upgrade default router and default registry
   hosts: oo_first_master
   vars:
-    registry_image: "{{  openshift.master.registry_url | replace( '${component}', 'docker-registry' )  | replace ( '${version}', openshift_image_tag ) }}"
-    router_image: "{{ openshift.master.registry_url | replace( '${component}', 'haproxy-router' ) | replace ( '${version}', openshift_image_tag ) }}"
-    oc_cmd: "{{ openshift.common.client_binary }} --config={{ openshift.common.config_base }}/master/admin.kubeconfig"
+    registry_image: "{{  openshift.master.registry_url | replace( '${component}', 'docker-registry' )  |
+                         replace ( '${version}', openshift_image_tag ) }}"
+    router_image: "{{ openshift.master.registry_url | replace( '${component}', 'haproxy-router' ) |
+                      replace ( '${version}', openshift_image_tag ) }}"
 
   pre_tasks:
   - name: Load lib_openshift modules
@@ -21,7 +22,10 @@
       selector: 'router'
     register: all_routers
 
-  - set_fact: haproxy_routers="{{ all_routers.results.results[0]['items'] | oo_pods_match_component(openshift_deployment_type, 'haproxy-router') | oo_select_keys_from_list(['metadata']) }}"
+  - set_fact:
+      haproxy_routers: "{{ all_routers.results.results[0]['items'] |
+                           oo_pods_match_component(openshift_deployment_type, 'haproxy-router') |
+                           oo_select_keys_from_list(['metadata']) }}"
     when:
     - all_routers.results.returncode == 0
 
@@ -30,16 +34,15 @@
     - all_routers.results.returncode != 0
 
   - name: Update router image to current version
+    oc_edit:
+      kind: dc
+      name: "{{ item['labels']['deploymentconfig'] }}"
+      namespace: "{{ item['namespace'] }}"
+      content:
+        spec.template.spec.containers[0].image: "{{ router_image }}"
+    with_items: "{{ haproxy_routers }}"
     when:
     - all_routers.results.returncode == 0
-    command: >
-      {{ oc_cmd }} patch dc/{{ item['labels']['deploymentconfig'] }} -n {{ item['namespace'] }} -p
-      '{"spec":{"template":{"spec":{"containers":[{"name":"router","image":"{{ router_image }}","livenessProbe":{"tcpSocket":null,"httpGet":{"path": "/healthz", "port": 1936, "host": "localhost", "scheme": "HTTP"},"initialDelaySeconds":10,"timeoutSeconds":1}}]}}}}'
-      --api-version=v1
-    with_items: "{{ haproxy_routers }}"
-    # AUDIT:changed_when_note: `false` not being set here. What we
-    # need to do is check the current router image version and see if
-    # this task needs to be ran.
 
   - name: Check for default registry
     oc_obj:
@@ -49,15 +52,14 @@
     register: _default_registry
 
   - name: Update registry image to current version
+    oc_edit:
+      kind: dc
+      name: docker-registry
+      namespace: default
+      content:
+        spec.template.spec.containers[0].image: "{{ registry_image }}"
     when:
     - _default_registry.results.results[0] != {}
-    command: >
-      {{ oc_cmd }} patch dc/docker-registry -n default -p
-      '{"spec":{"template":{"spec":{"containers":[{"name":"registry","image":"{{ registry_image }}"}]}}}}'
-      --api-version=v1
-    # AUDIT:changed_when_note: `false` not being set here. What we
-    # need to do is check the current registry image version and see
-    # if this task needs to be ran.
 
   roles:
   - openshift_manageiq