1 files changed, 52 insertions, 0 deletions
diff --git a/roles/openshift_metrics/tasks/setup_certificate.yaml b/roles/openshift_metrics/tasks/setup_certificate.yaml
new file mode 100644
index 000000000..5ca8f4462
--- /dev/null
+++ b/roles/openshift_metrics/tasks/setup_certificate.yaml
@@ -0,0 +1,52 @@
+---
+- name: generate {{ component }} keys
+  command: >
+    {{ openshift.common.admin_binary }} ca create-server-cert
+    --config={{ mktemp.stdout }}/admin.kubeconfig
+    --key='{{ openshift_metrics_certs_dir }}/{{ component }}.key'
+    --cert='{{ openshift_metrics_certs_dir }}/{{ component }}.crt'
+    --hostnames='{{ hostnames }}'
+    --signer-cert='{{ openshift_metrics_certs_dir }}/ca.crt'
+    --signer-key='{{ openshift_metrics_certs_dir }}/ca.key'
+    --signer-serial='{{ openshift_metrics_certs_dir }}/ca.serial.txt'
+  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.key'|exists
+
+- slurp: src={{item}}
+  register: component_certs
+  with_items:
+    - '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.key'
+    - '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}.crt'
+  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'|exists
+
+- name: generate {{ component }} certificate
+  copy:
+    dest: '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'
+    content: "{{ component_certs.results | map(attribute='content') | map('b64decode') | join('')  }}"
+  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'|exists
+
+- name: generate random password for the {{ component }} keystore
+  copy:
+    content: "{{ 15 | oo_random_word }}"
+    dest: '{{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd'
+  when: >
+    not '{{ openshift_metrics_certs_dir }}/{{ component }}-keystore.pwd'|exists
+
+- slurp: src={{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-keystore.pwd
+  register: keystore_password
+
+- name: create the {{ component }} pkcs12 from the pem file
+  command: >
+    openssl pkcs12 -export
+    -in '{{ openshift_metrics_certs_dir }}/{{ component }}.pem'
+    -out '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'
+    -name '{{ component }}' -noiter -nomaciter
+    -password 'pass:{{keystore_password.content | b64decode }}'
+  when: not '{{ openshift_metrics_certs_dir }}/{{ component }}.pkcs12'|exists
+
+- name: generate random password for the {{ component }} truststore
+  copy:
+    content: "{{ 15 | oo_random_word }}"
+    dest: '{{ openshift_metrics_certs_dir | quote }}/{{ component|quote }}-truststore.pwd'
+  when: >
+    not
+    '{{ openshift_metrics_certs_dir | quote }}/{{ component| quote  }}-truststore.pwd'|exists