2 files changed, 23 insertions, 28 deletions
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
index b74cda5ba..556da5304 100644
--- a/roles/openshift_hosted/tasks/registry/secure.yml
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -42,21 +42,26 @@
   when: False in (docker_registry_certificates_stat_result.results | default([]) | oo_collect(attribute='stat.exists') | list)
 
 - name: Create the secret for the registry certificates
-  command: >
-    {{ openshift.common.client_binary }} secrets new registry-certificates
-    {{ openshift_master_config_dir }}/registry.crt
-    {{ openshift_master_config_dir }}/registry.key
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
+  oc_secret:
+    kubeconfig: "{{ openshift_hosted_kubeconfig }}"
+    name: registry-certificates
+    namespace: default
+    state: present
+    files:
+    - name: registry.crt
+      path: "{{ openshift_master_config_dir }}/registry.crt"
+    - name: registry.key
+      path: "{{ openshift_master_config_dir }}/registry.key"
   register: create_registry_certificates_secret
-  changed_when: "'already exists' not in create_registry_certificates_secret.stderr"
-  failed_when: "'already exists' not in create_registry_certificates_secret.stderr and create_registry_certificates_secret.rc != 0"
+  run_once: true
 
 - name: "Add the secret to the registry's pod service accounts"
-  command: >
-    {{ openshift.common.client_binary }} secrets add {{ item }} registry-certificates
-    --config={{ openshift_hosted_kubeconfig  }}
-    -n default
+  oc_serviceaccount_secret:
+    service_account: "{{ item }}"
+    secret: registry-certificates
+    namespace: default
+    kubeconfig: "{{ openshift_hosted_kubeconfig  }}"
+    state: present
   with_items:
   - registry
   - default
diff --git a/roles/openshift_hosted/tasks/registry/storage/object_storage.yml b/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
index e56a68e27..15128784e 100644
--- a/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
+++ b/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
@@ -53,23 +53,13 @@
     create -f -
   when: secrets.rc == 1
 
-- name: Determine if service account contains secrets
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    get serviceaccounts registry
-    -o jsonpath='{.secrets[?(@.name=="{{ registry_config_secret_name }}")].name}'
-  register: serviceaccount
-  changed_when: false
-
 - name: Add secrets to registry service account
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    secrets add serviceaccount/registry secrets/{{ registry_config_secret_name }}
-  when: serviceaccount.stdout == ''
+  oc_serviceaccount_secret:
+    service_account: registry
+    secret: "{{ registry_config_secret_name }}"
+    namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+    kubeconfig: "{{ openshift_hosted_kubeconfig }}"
+    state: present
 
 - name: Determine if deployment config contains secrets
   command: >