3 files changed, 111 insertions, 10 deletions
diff --git a/roles/nuage_master/tasks/certificates.yml b/roles/nuage_master/tasks/certificates.yml
new file mode 100644
index 000000000..32b024487
--- /dev/null
+++ b/roles/nuage_master/tasks/certificates.yml
@@ -0,0 +1,50 @@
+---
+- name: Create a directory to hold the certificates
+  file: path="{{ nuage_mon_rest_server_crt_dir }}" state=directory
+  delegate_to: "{{ nuage_ca_master }}" 
+
+- name: Create the key
+  command: >
+    openssl genrsa -out "{{ nuage_ca_master_rest_server_key }}" 4096  
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create the req file
+  command: >
+    openssl req -key "{{ nuage_ca_master_rest_server_key }}" -new -out "{{ nuage_mon_rest_server_crt_dir }}/restServer.req" -subj "/CN={{ nuage_mon_rest_server_host }}"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Generate the crt file
+  command: >
+     openssl x509 -req -in "{{ nuage_mon_rest_server_crt_dir }}/restServer.req" -CA "{{ nuage_ca_crt }}" -CAkey "{{ nuage_ca_key }}" -CAserial "{{ nuage_ca_serial }}"  -out "{{ nuage_ca_master_rest_server_crt }}"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Remove the req file
+  file: path="{{ nuage_mon_rest_server_crt_dir }}/restServer.req" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Copy nuage CA crt
+  shell: cp "{{ nuage_ca_crt }}" "{{ nuage_mon_rest_server_crt_dir }}"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Archive the certificate dir
+  shell: "cd {{ nuage_mon_rest_server_crt_dir }} && tar -czvf /tmp/{{ ansible_nodename }}.tgz *"
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Create a temp directory for the certificates 
+  local_action: command mktemp -d "/tmp/openshift-{{ ansible_nodename }}-XXXXXXX"
+  register: mktemp
+
+- name: Download the certificates
+  fetch: src="/tmp/{{ ansible_nodename }}.tgz" dest="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" flat=yes
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Extract the certificates
+  unarchive: src="{{ mktemp.stdout }}/{{ ansible_nodename }}.tgz" dest={{ nuage_master_crt_dir }}
+
+- name: Delete the certificates after copy
+  file: path="{{ nuage_mon_rest_server_crt_dir }}" state=absent 
+  delegate_to: "{{ nuage_ca_master }}"
+
+- name: Delete the temp directory
+  file: path="{{ mktemp.stdout }}" state=absent
+  delegate_to: "{{ nuage_ca_master }}"
diff --git a/roles/nuage_master/tasks/main.yaml b/roles/nuage_master/tasks/main.yaml
index 20d105b9e..b8eaede3b 100644
--- a/roles/nuage_master/tasks/main.yaml
+++ b/roles/nuage_master/tasks/main.yaml
@@ -1,31 +1,31 @@
 ---
 - name: Create directory /usr/share/nuage-openshift-monitor
-  sudo: true
+  become: yes
   file: path=/usr/share/nuage-openshift-monitor state=directory  
 
 - name: Create the log directory
-  sudo: true
-  file: path={{ nuage_openshift_monitor_log_dir }} state=directory
+  become: yes
+  file: path={{ nuage_mon_rest_server_logdir }} state=directory
 
 - name: Install Nuage Openshift Monitor 
-  sudo: true
+  become: yes
   yum: name={{ nuage_openshift_rpm }} state=present
 
-- name: Run the service account creation script
-  sudo: true
-  script: serviceaccount.sh --server={{ openshift.master.api_url }} --output-cert-dir={{ cert_output_dir }} --master-cert-dir={{ openshift_master_config_dir }}
+- include: serviceaccount.yml
 
 - name: Download the certs and keys
-  sudo: true
+  become: yes
   fetch: src={{ cert_output_dir }}/{{ item }} dest=/tmp/{{ item }} flat=yes
   with_items:
         - ca.crt
         - nuage.crt
         - nuage.key
         - nuage.kubeconfig 
- 
+
+- include: certificates.yml 
+
 - name: Create nuage-openshift-monitor.yaml
-  sudo: true
+  become: yes
   template: src=nuage-openshift-monitor.j2 dest=/usr/share/nuage-openshift-monitor/nuage-openshift-monitor.yaml owner=root mode=0644
   notify:
     - restart master
diff --git a/roles/nuage_master/tasks/serviceaccount.yml b/roles/nuage_master/tasks/serviceaccount.yml
new file mode 100644
index 000000000..5b4af5824
--- /dev/null
+++ b/roles/nuage_master/tasks/serviceaccount.yml
@@ -0,0 +1,51 @@
+---
+- name: Create temporary directory for admin kubeconfig
+  command: mktemp -u /tmp/openshift-ansible-XXXXXXX.kubeconfig
+  register: nuage_tmp_conf_mktemp
+  changed_when: False
+
+- set_fact:
+    nuage_tmp_conf: "{{ nuage_tmp_conf_mktemp.stdout }}"
+
+- name: Copy Configuration to temporary conf
+  command: >
+    cp {{ openshift.common.config_base }}/master/admin.kubeconfig {{nuage_tmp_conf}}
+  changed_when: false
+
+- name: Create Admin Service Account
+  shell: >
+    echo {{ nuage_service_account_config | to_json | quote }} |
+    {{ openshift.common.client_binary }} create
+    -n default 
+    --config={{nuage_tmp_conf}}
+    -f -
+  register: osnuage_create_service_account
+  failed_when: "'already exists' not in osnuage_create_service_account.stderr and osnuage_create_service_account.rc != 0"
+  changed_when: osnuage_create_service_account.rc == 0
+
+- name: Configure role/user permissions
+  command: >
+    {{ openshift.common.admin_binary }} {{item}}
+    --config={{nuage_tmp_conf}}
+  with_items: "{{nuage_tasks}}"
+  register: osnuage_perm_task
+  failed_when: "'already exists' not in osnuage_perm_task.stderr and osnuage_perm_task.rc != 0"
+  changed_when: osnuage_perm_task.rc == 0
+
+- name: Generate the node client config
+  command: >
+    {{ openshift.common.admin_binary }} create-api-client-config
+      --certificate-authority={{ openshift_master_ca_cert }}
+      --client-dir={{ cert_output_dir }}
+      --master={{ openshift.master.api_url }}
+      --public-master={{ openshift.master.api_url }}
+      --signer-cert={{ openshift_master_ca_cert }}
+      --signer-key={{ openshift_master_ca_key }}
+      --signer-serial={{ openshift_master_ca_serial }}
+      --basename='nuage'
+      --user={{ nuage_service_account }}
+
+- name: Clean temporary configuration file
+  command: >
+    rm -f {{nuage_tmp_conf}}
+  changed_when: false