summaryrefslogtreecommitdiffstats
path: root/roles/openshift_hosted
diff options
context:
space:
mode:
Diffstat (limited to 'roles/openshift_hosted')
-rw-r--r--roles/openshift_hosted/tasks/registry/registry.yml4
-rw-r--r--roles/openshift_hosted/tasks/registry/secure.yml32
2 files changed, 35 insertions, 1 deletions
diff --git a/roles/openshift_hosted/tasks/registry/registry.yml b/roles/openshift_hosted/tasks/registry/registry.yml
index 2369c4e2e..f9441dd57 100644
--- a/roles/openshift_hosted/tasks/registry/registry.yml
+++ b/roles/openshift_hosted/tasks/registry/registry.yml
@@ -40,6 +40,9 @@
openshift_hosted_registry_images: "{{ openshift.hosted.registry.registryurl | default('openshift3/ose-${component}:${version}')}}"
openshift_hosted_registry_volumes: []
openshift_hosted_registry_env_vars: {}
+ openshift_hosted_registry_route_certificates: "{{ openshift.hosted.registry.route.certificates | default(false) }}"
+ openshift_hosted_registry_route_host: "{{ openshift.hosted.registry.route.host | default(false) }}"
+ openshift_hosted_registry_route_termination: "{{ openshift.hosted.registry.route.termination | default('passthrough') }}"
openshift_hosted_registry_edits:
# These edits are being specified only to prevent 'changed' on rerun
- key: spec.strategy.rollingParams
@@ -89,6 +92,7 @@
- name: Create OpenShift registry
oc_adm_registry:
+#debug: True
name: "{{ openshift_hosted_registry_name }}"
namespace: "{{ openshift_hosted_registry_namespace }}"
selector: "{{ openshift_hosted_registry_selector }}"
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
index e70d377c6..244979f2e 100644
--- a/roles/openshift_hosted/tasks/registry/secure.yml
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -2,14 +2,43 @@
- name: Set fact docker_registry_route_hostname
set_fact:
docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}"
+ run_once: true
+
+#- name: Create passthrough route for docker-registry
+# oc_route:
+# name: docker-registry
+# namespace: "{{ openshift_hosted_registry_namespace }}"
+# service_name: docker-registry
+# tls_termination: passthrough
+# host: "{{ docker_registry_route_hostname }}"
+# run_once: true
+- name: Get the certificate contents for registry
+ local_action:
+ module: slurp
+ src: "{{ item }}"
+ register: openshift_hosted_registry_certificate_content
+ with_items:
+ - "{{ (openshift_hosted_registry_route_certificates | default({'certfile':none})).certfile }}"
+ - "{{ (openshift_hosted_registry_route_certificates | default({'keyfile':none})).keyfile }}"
+ - "{{ (openshift_hosted_registry_route_certificates | default({'cafile':none})).cafile }}"
+ when: openshift_hosted_registry_route_certificates
+
+- debug: var=openshift_hosted_registry_certificate_content
+ when: openshift_hosted_registry_route_certificates
- name: Create passthrough route for docker-registry
oc_route:
name: docker-registry
namespace: "{{ openshift_hosted_registry_namespace }}"
service_name: docker-registry
- tls_termination: passthrough
host: "{{ docker_registry_route_hostname }}"
+ tls_termination: "{{ openshift_hosted_registry_route_termination }}"
+ host: "{{ openshift_hosted_registry_route_host | default(docker_registry_route_hostname) }}"
+ cert_content: "{{ openshift_hosted_registry_certificate_content is defined | ternary(openshift_hosted_registry_certificate_content.results[0].content,omit) }}"
+ key_content: "{{ openshift_hosted_registry_certificate_content is defined | ternary(openshift_hosted_registry_certificate_content.results[0].content, omit) }}"
+ cacert_content: "{{ openshift_hosted_registry_certificate_content is defined | ternary(openshift_hosted_registry_certificate_content.results[0].content, omit) }}"
+ dest_cacert_path: "{{ openshift_hosted_registry_certificate_content is defined | ternary('/etc/origin/master/ca.crt', omit) }}"
+ run_once: true
- name: Retrieve registry service IP
oc_service:
@@ -17,6 +46,7 @@
name: docker-registry
state: list
register: docker_registry_service_ip
+ run_once: true
- name: Create registry certificates
oc_adm_ca_server_cert: