summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/calico/README.md1
-rw-r--r--roles/calico/defaults/main.yaml3
-rw-r--r--roles/calico/meta/main.yml1
-rw-r--r--roles/calico/tasks/main.yml2
-rw-r--r--roles/calico/templates/calico.service.j23
-rw-r--r--roles/calico_master/README.md1
-rw-r--r--roles/etcd_common/defaults/main.yml10
-rw-r--r--roles/etcd_common/tasks/main.yml2
-rw-r--r--roles/etcd_migrate/tasks/add_ttls.yml33
-rw-r--r--roles/etcd_migrate/tasks/check.yml3
-rw-r--r--roles/etcd_migrate/tasks/clean_data.yml5
-rw-r--r--roles/etcd_migrate/tasks/main.yml4
-rw-r--r--roles/etcd_migrate/tasks/migrate.yml49
-rw-r--r--roles/openshift_cli/library/openshift_container_binary_sync.py5
-rw-r--r--roles/openshift_health_checker/openshift_checks/etcd_traffic.py4
-rw-r--r--roles/openshift_health_checker/test/etcd_traffic_test.py6
-rw-r--r--roles/openshift_hosted/tasks/registry/registry.yml3
-rw-r--r--roles/openshift_hosted/tasks/registry/secure.yml101
-rw-r--r--roles/openshift_hosted/tasks/registry/secure/passthrough.yml45
-rw-r--r--roles/openshift_hosted/tasks/registry/secure/reencrypt.yml38
-rw-r--r--roles/openshift_hosted/tasks/registry/storage/object_storage.yml15
l---------roles/openshift_hosted/tasks/registry/storage/registry_config_secret.j21
-rw-r--r--roles/openshift_hosted/templates/registry_config.j22
-rw-r--r--roles/openshift_hosted/templates/registry_config_secret.j29
-rw-r--r--roles/openshift_logging_elasticsearch/tasks/main.yaml7
-rw-r--r--roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j225
-rw-r--r--roles/openshift_logging_elasticsearch/vars/main.yml2
-rw-r--r--roles/openshift_logging_kibana/defaults/main.yml2
-rw-r--r--roles/openshift_master/handlers/main.yml23
-rw-r--r--roles/openshift_master/tasks/clean_systemd_units.yml6
-rw-r--r--roles/openshift_master/tasks/firewall.yml12
-rw-r--r--roles/openshift_master/tasks/main.yml191
-rw-r--r--roles/openshift_master/tasks/set_loopback_context.yml13
-rw-r--r--roles/openshift_master/tasks/system_container.yml9
-rw-r--r--roles/openshift_master/tasks/systemd_units.yml66
-rw-r--r--roles/openshift_node_dnsmasq/meta/main.yml1
-rw-r--r--roles/openshift_node_dnsmasq/templates/origin-dns.conf.j22
-rw-r--r--roles/openshift_repos/meta/main.yml15
-rw-r--r--roles/rhel_subscribe/tasks/enterprise.yml4
39 files changed, 478 insertions, 246 deletions
diff --git a/roles/calico/README.md b/roles/calico/README.md
index 65f66ebfa..10e5e4e0a 100644
--- a/roles/calico/README.md
+++ b/roles/calico/README.md
@@ -32,7 +32,6 @@ Additional parameters that can be defined in the inventory are:
| Environment | Description | Schema | Default |
|---------|----------------------|---------|---------|
-|CALICO_IPV4POOL_CIDR| The IPv4 Pool to create if none exists at start up. It is invalid to define this variable and NO_DEFAULT_POOLS. |IPv4 CIDR | 192.168.0.0/16 |
| CALICO_IPV4POOL_IPIP | IPIP Mode to use for the IPv4 POOL created at start up. | off, always, cross-subnet | always |
| CALICO_LOG_DIR | Directory on the host machine where Calico Logs are written.| String | /var/log/calico |
diff --git a/roles/calico/defaults/main.yaml b/roles/calico/defaults/main.yaml
index e7a9db92f..b1907f8cb 100644
--- a/roles/calico/defaults/main.yaml
+++ b/roles/calico/defaults/main.yaml
@@ -1,5 +1,5 @@
---
-kubeconfig: "{{openshift.common.config_base}}/node/{{ 'system:node:' + openshift.common.hostname }}.kubeconfig"
+kubeconfig: "{{ openshift.common.config_base }}/node/{{ 'system:node:' + openshift.common.hostname }}.kubeconfig"
cni_conf_dir: "/etc/cni/net.d/"
cni_bin_dir: "/opt/cni/bin/"
@@ -9,7 +9,6 @@ calico_url_cni: "https://github.com/projectcalico/cni-plugin/releases/download/v
calico_url_ipam: "https://github.com/projectcalico/cni-plugin/releases/download/v1.10.0/calico-ipam"
calico_ipv4pool_ipip: "always"
-calico_ipv4pool_cidr: "192.168.0.0/16"
calico_log_dir: "/var/log/calico"
calico_node_image: "calico/node:v2.4.1"
diff --git a/roles/calico/meta/main.yml b/roles/calico/meta/main.yml
index 102b82bde..816c81369 100644
--- a/roles/calico/meta/main.yml
+++ b/roles/calico/meta/main.yml
@@ -14,3 +14,4 @@ galaxy_info:
- system
dependencies:
- role: openshift_facts
+- role: openshift_master_facts
diff --git a/roles/calico/tasks/main.yml b/roles/calico/tasks/main.yml
index e62378532..39f730462 100644
--- a/roles/calico/tasks/main.yml
+++ b/roles/calico/tasks/main.yml
@@ -38,7 +38,7 @@
path: "{{ item }}"
with_items:
- "{{ calico_etcd_ca_cert_file }}"
- - "{{ calico_etcd_cert_file}}"
+ - "{{ calico_etcd_cert_file }}"
- "{{ calico_etcd_key_file }}"
- name: Calico Node | Configure Calico service unit file
diff --git a/roles/calico/templates/calico.service.j2 b/roles/calico/templates/calico.service.j2
index 302c5f34e..7653e19b1 100644
--- a/roles/calico/templates/calico.service.j2
+++ b/roles/calico/templates/calico.service.j2
@@ -11,13 +11,14 @@ ExecStart=/usr/bin/docker run --net=host --privileged \
-e WAIT_FOR_DATASTORE=true \
-e FELIX_DEFAULTENDPOINTTOHOSTACTION=ACCEPT \
-e CALICO_IPV4POOL_IPIP={{ calico_ipv4pool_ipip }} \
- -e CALICO_IPV4POOL_CIDR={{ calico_ipv4pool_cidr }} \
+ -e CALICO_IPV4POOL_CIDR={{ openshift.master.sdn_cluster_network_cidr }} \
-e FELIX_IPV6SUPPORT=false \
-e ETCD_ENDPOINTS={{ calico_etcd_endpoints }} \
-v {{ calico_etcd_cert_dir }}:{{ calico_etcd_cert_dir }} \
-e ETCD_CA_CERT_FILE={{ calico_etcd_ca_cert_file }} \
-e ETCD_CERT_FILE={{ calico_etcd_cert_file }} \
-e ETCD_KEY_FILE={{ calico_etcd_key_file }} \
+ -e CLUSTER_TYPE=origin,bgp \
-e NODENAME={{ openshift.common.hostname }} \
-v {{ calico_log_dir }}:/var/log/calico\
-v /lib/modules:/lib/modules \
diff --git a/roles/calico_master/README.md b/roles/calico_master/README.md
index 6f5ed0664..88fd44086 100644
--- a/roles/calico_master/README.md
+++ b/roles/calico_master/README.md
@@ -29,7 +29,6 @@ Additional parameters that can be defined in the inventory are:
| Environment | Description | Schema | Default |
|---------|----------------------|---------|---------|
-|CALICO_IPV4POOL_CIDR| The IPv4 Pool to create if none exists at start up. It is invalid to define this variable and NO_DEFAULT_POOLS. |IPv4 CIDR | 192.168.0.0/16 |
| CALICO_IPV4POOL_IPIP | IPIP Mode to use for the IPv4 POOL created at start up. | off, always, cross-subnet | always |
| CALICO_LOG_DIR | Directory on the host machine where Calico Logs are written.| String | /var/log/calico |
diff --git a/roles/etcd_common/defaults/main.yml b/roles/etcd_common/defaults/main.yml
index b1bfa4592..89993f7ea 100644
--- a/roles/etcd_common/defaults/main.yml
+++ b/roles/etcd_common/defaults/main.yml
@@ -63,3 +63,13 @@ etcd_client_port: 2379
etcd_peer_port: 2380
etcd_url_scheme: http
etcd_peer_url_scheme: http
+
+etcd_initial_cluster_state: new
+etcd_initial_cluster_token: etcd-cluster-1
+
+etcd_initial_advertise_peer_urls: "{{ etcd_peer_url_scheme }}://{{ etcd_ip }}:{{ etcd_peer_port }}"
+etcd_listen_peer_urls: "{{ etcd_peer_url_scheme }}://{{ etcd_ip }}:{{ etcd_peer_port }}"
+etcd_advertise_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
+etcd_listen_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
+
+etcd_systemd_dir: "/etc/systemd/system/{{ etcd_service }}.service.d"
diff --git a/roles/etcd_common/tasks/main.yml b/roles/etcd_common/tasks/main.yml
index 6ed87e6c7..f5bcd03ee 100644
--- a/roles/etcd_common/tasks/main.yml
+++ b/roles/etcd_common/tasks/main.yml
@@ -6,4 +6,4 @@
- name: Include main action task file
include: "{{ r_etcd_common_action }}.yml"
- when: r_etcd_common_action != "noop"
+ when: '"noop" not in r_etcd_common_action'
diff --git a/roles/etcd_migrate/tasks/add_ttls.yml b/roles/etcd_migrate/tasks/add_ttls.yml
new file mode 100644
index 000000000..c10465af9
--- /dev/null
+++ b/roles/etcd_migrate/tasks/add_ttls.yml
@@ -0,0 +1,33 @@
+---
+# To be executed on first master
+- slurp:
+ src: "{{ openshift.common.config_base }}/master/master-config.yaml"
+ register: g_master_config_output
+
+- set_fact:
+ accessTokenMaxAgeSeconds: "{{ (g_master_config_output.content|b64decode|from_yaml).oauthConfig.tokenConfig.accessTokenMaxAgeSeconds | default(86400) }}"
+ authroizeTokenMaxAgeSeconds: "{{ (g_master_config_output.content|b64decode|from_yaml).oauthConfig.tokenConfig.authroizeTokenMaxAgeSeconds | default(500) }}"
+ controllerLeaseTTL: "{{ (g_master_config_output.content|b64decode|from_yaml).controllerLeaseTTL | default(30) }}"
+- name: Re-introduce leases (as a replacement for key TTLs)
+ command: >
+ oadm migrate etcd-ttl \
+ --cert {{ r_etcd_common_master_peer_cert_file }} \
+ --key {{ r_etcd_common_master_peer_key_file }} \
+ --cacert {{ r_etcd_common_master_peer_ca_file }} \
+ --etcd-address 'https://{{ etcd_peer }}:{{ etcd_client_port }}' \
+ --ttl-keys-prefix {{ item.keys }} \
+ --lease-duration {{ item.ttl }}
+ environment:
+ ETCDCTL_API: 3
+ PATH: "/usr/local/bin:/var/usrlocal/bin:{{ ansible_env.PATH }}"
+ with_items:
+ - keys: "/kubernetes.io/events"
+ ttl: "1h"
+ - keys: "/kubernetes.io/masterleases"
+ ttl: "10s"
+ - keys: "/openshift.io/oauth/accesstokens"
+ ttl: "{{ accessTokenMaxAgeSeconds }}s"
+ - keys: "/openshift.io/oauth/authorizetokens"
+ ttl: "{{ authroizeTokenMaxAgeSeconds }}s"
+ - keys: "/openshift.io/leases/controllers"
+ ttl: "{{ controllerLeaseTTL }}s"
diff --git a/roles/etcd_migrate/tasks/check.yml b/roles/etcd_migrate/tasks/check.yml
index b66696b55..0804d9e1c 100644
--- a/roles/etcd_migrate/tasks/check.yml
+++ b/roles/etcd_migrate/tasks/check.yml
@@ -1,7 +1,4 @@
---
-- fail:
- msg: "Currently etcd v3 migration is unsupported while we test it more thoroughly"
- when: not openshift_enable_unsupported_configurations | default(false) | bool
# Check the cluster is healthy
- include: check_cluster_health.yml
diff --git a/roles/etcd_migrate/tasks/clean_data.yml b/roles/etcd_migrate/tasks/clean_data.yml
new file mode 100644
index 000000000..95a0e7c0a
--- /dev/null
+++ b/roles/etcd_migrate/tasks/clean_data.yml
@@ -0,0 +1,5 @@
+---
+- name: Remove member data
+ file:
+ path: /var/lib/etcd/member
+ state: absent
diff --git a/roles/etcd_migrate/tasks/main.yml b/roles/etcd_migrate/tasks/main.yml
index 409b0b613..e82f6a6b4 100644
--- a/roles/etcd_migrate/tasks/main.yml
+++ b/roles/etcd_migrate/tasks/main.yml
@@ -1,8 +1,8 @@
---
- name: Fail if invalid r_etcd_migrate_action provided
fail:
- msg: "etcd_migrate role can only be called with 'check' or 'migrate' or 'configure'"
- when: r_etcd_migrate_action not in ['check', 'migrate', 'configure']
+ msg: "etcd_migrate role can only be called with 'check', 'migrate', 'configure', 'add_ttls', or 'clean_data'"
+ when: r_etcd_migrate_action not in ['check', 'migrate', 'configure', 'add_ttls', 'clean_data']
- name: Include main action task file
include: "{{ r_etcd_migrate_action }}.yml"
diff --git a/roles/etcd_migrate/tasks/migrate.yml b/roles/etcd_migrate/tasks/migrate.yml
index b2cf6d20a..173de77f4 100644
--- a/roles/etcd_migrate/tasks/migrate.yml
+++ b/roles/etcd_migrate/tasks/migrate.yml
@@ -3,62 +3,45 @@
- set_fact:
l_etcd_service: "{{ 'etcd_container' if openshift.common.is_containerized else 'etcd' }}"
-- name: Disable etcd members
- service:
- name: "{{ l_etcd_service }}"
- state: stopped
-
-# Should we skip all TTL keys? https://bugzilla.redhat.com/show_bug.cgi?id=1389773
- name: Migrate etcd data
command: >
etcdctl migrate --data-dir={{ etcd_data_dir }}
environment:
ETCDCTL_API: 3
register: l_etcdctl_migrate
-
# TODO(jchaloup): If any of the members fails, we need to restore all members to v2 from the pre-migrate backup
- name: Check the etcd v2 data are correctly migrated
fail:
msg: "Failed to migrate a member"
when: "'finished transforming keys' not in l_etcdctl_migrate.stdout and 'no v2 keys to migrate' not in l_etcdctl_migrate.stdout"
-
- name: Migration message
debug:
msg: "Etcd migration finished with: {{ l_etcdctl_migrate.stdout }}"
-
-- name: Enable etcd member
- service:
+- name: Set ETCD_FORCE_NEW_CLUSTER=true on first etcd host
+ lineinfile:
+ line: "ETCD_FORCE_NEW_CLUSTER=true"
+ dest: /etc/etcd/etcd.conf
+- name: Start etcd
+ systemd:
name: "{{ l_etcd_service }}"
state: started
+- name: Unset ETCD_FORCE_NEW_CLUSTER=true on first etcd host
+ lineinfile:
+ line: "ETCD_FORCE_NEW_CLUSTER=true"
+ dest: /etc/etcd/etcd.conf
+ state: absent
+- name: Restart first etcd host
+ systemd:
+ name: "{{ l_etcd_service }}"
+ state: restarted
-- name: Wait for cluster to become healthy after migration
+- name: Wait for cluster to become healthy after bringing up first member
command: >
etcdctl --cert-file {{ etcd_peer_cert_file }} --key-file {{ etcd_peer_key_file }} --ca-file {{ etcd_peer_ca_file }} --endpoint https://{{ etcd_peer }}:{{ etcd_client_port }} cluster-health
register: l_etcd_migrate_health
until: l_etcd_migrate_health.rc == 0
retries: 3
delay: 30
- run_once: true
-
-# NOTE: /usr/local/bin may be removed from the PATH by ansible hence why
-# it's added to the environment in this task.
-- name: Re-introduce leases (as a replacement for key TTLs)
- command: >
- oadm migrate etcd-ttl \
- --cert {{ r_etcd_common_master_peer_cert_file }} \
- --key {{ r_etcd_common_master_peer_key_file }} \
- --cacert {{ r_etcd_common_master_peer_ca_file }} \
- --etcd-address 'https://{{ etcd_peer }}:{{ etcd_client_port }}' \
- --ttl-keys-prefix {{ item }} \
- --lease-duration 1h
- environment:
- ETCDCTL_API: 3
- PATH: "/usr/local/bin:/var/usrlocal/bin:{{ ansible_env.PATH }}"
- with_items:
- - "/kubernetes.io/events"
- - "/kubernetes.io/masterleases"
- delegate_to: "{{ groups.oo_first_master[0] }}"
- run_once: true
- set_fact:
r_etcd_migrate_success: true
diff --git a/roles/openshift_cli/library/openshift_container_binary_sync.py b/roles/openshift_cli/library/openshift_container_binary_sync.py
index c47203211..b40c49701 100644
--- a/roles/openshift_cli/library/openshift_container_binary_sync.py
+++ b/roles/openshift_cli/library/openshift_container_binary_sync.py
@@ -133,6 +133,11 @@ class BinarySyncer(object):
dest_path = os.path.join(self.bin_dir, binary_name)
incoming_checksum = self.module.run_command(['sha256sum', src_path])[1]
if not os.path.exists(dest_path) or self.module.run_command(['sha256sum', dest_path])[1] != incoming_checksum:
+
+ # See: https://github.com/openshift/openshift-ansible/issues/4965
+ if os.path.islink(dest_path):
+ os.unlink(dest_path)
+ self.output.append('Removed old symlink {} before copying binary.'.format(dest_path))
shutil.move(src_path, dest_path)
self.output.append("Moved %s to %s." % (src_path, dest_path))
self.changed = True
diff --git a/roles/openshift_health_checker/openshift_checks/etcd_traffic.py b/roles/openshift_health_checker/openshift_checks/etcd_traffic.py
index cc1b14d8a..b4c8957e9 100644
--- a/roles/openshift_health_checker/openshift_checks/etcd_traffic.py
+++ b/roles/openshift_health_checker/openshift_checks/etcd_traffic.py
@@ -14,8 +14,8 @@ class EtcdTraffic(OpenShiftCheck):
group_names = self.get_var("group_names", default=[])
valid_group_names = "etcd" in group_names
- version = self.get_var("openshift", "common", "short_version")
- valid_version = version in ("3.4", "3.5", "1.4", "1.5")
+ version = self.get_major_minor_version(self.get_var("openshift_image_tag"))
+ valid_version = version in ((3, 4), (3, 5))
return super(EtcdTraffic, self).is_active() and valid_group_names and valid_version
diff --git a/roles/openshift_health_checker/test/etcd_traffic_test.py b/roles/openshift_health_checker/test/etcd_traffic_test.py
index f4316c423..fae3e578d 100644
--- a/roles/openshift_health_checker/test/etcd_traffic_test.py
+++ b/roles/openshift_health_checker/test/etcd_traffic_test.py
@@ -8,7 +8,7 @@ from openshift_checks.etcd_traffic import EtcdTraffic
(['masters'], "3.6", False),
(['nodes'], "3.4", False),
(['etcd'], "3.4", True),
- (['etcd'], "3.5", True),
+ (['etcd'], "1.5", True),
(['etcd'], "3.1", False),
(['masters', 'nodes'], "3.5", False),
(['masters', 'etcd'], "3.5", True),
@@ -17,9 +17,7 @@ from openshift_checks.etcd_traffic import EtcdTraffic
def test_is_active(group_names, version, is_active):
task_vars = dict(
group_names=group_names,
- openshift=dict(
- common=dict(short_version=version),
- ),
+ openshift_image_tag=version,
)
assert EtcdTraffic(task_vars=task_vars).is_active() == is_active
diff --git a/roles/openshift_hosted/tasks/registry/registry.yml b/roles/openshift_hosted/tasks/registry/registry.yml
index dcd9c87fc..6f012aed1 100644
--- a/roles/openshift_hosted/tasks/registry/registry.yml
+++ b/roles/openshift_hosted/tasks/registry/registry.yml
@@ -43,9 +43,6 @@
openshift_hosted_registry_images: "{{ openshift.hosted.registry.registryurl | default('openshift3/ose-${component}:${version}')}}"
openshift_hosted_registry_volumes: []
openshift_hosted_registry_env_vars: {}
- openshift_hosted_registry_routecertificates: "{{ ('routecertificates' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routecertificates, {}) }}"
- openshift_hosted_registry_routehost: "{{ ('routehost' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routehost, False) }}"
- openshift_hosted_registry_routetermination: "{{ ('routetermination' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routetermination, 'passthrough') }}"
openshift_hosted_registry_edits:
# These edits are being specified only to prevent 'changed' on rerun
- key: spec.strategy.rollingParams
diff --git a/roles/openshift_hosted/tasks/registry/secure.yml b/roles/openshift_hosted/tasks/registry/secure.yml
index 29c164f52..a18e6eea9 100644
--- a/roles/openshift_hosted/tasks/registry/secure.yml
+++ b/roles/openshift_hosted/tasks/registry/secure.yml
@@ -1,65 +1,68 @@
---
-- name: Set fact docker_registry_route_hostname
+- name: Configure facts for docker-registry
set_fact:
- docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}"
+ openshift_hosted_registry_routecertificates: "{{ ('routecertificates' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routecertificates, {}) }}"
+ openshift_hosted_registry_routehost: "{{ ('routehost' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routehost, False) }}"
+ openshift_hosted_registry_routetermination: "{{ ('routetermination' in openshift.hosted.registry.keys()) | ternary(openshift.hosted.registry.routetermination, 'passthrough') }}"
-- name: Get the certificate contents for registry
- copy:
- backup: True
- dest: "/etc/origin/master/named_certificates/{{ item.value | basename }}"
- src: "{{ item.value }}"
- when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
- with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+- name: Include reencrypt route configuration
+ include: secure/reencrypt.yml
+ static: no
+ when: openshift_hosted_registry_routetermination == 'reencrypt'
-# When certificates are defined we will create the reencrypt
-# docker-registry route
-- name: Create a reencrypt route for docker-registry
- oc_route:
- name: docker-registry
- namespace: "{{ openshift_hosted_registry_namespace }}"
- service_name: docker-registry
- tls_termination: "{{ openshift_hosted_registry_routetermination }}"
- host: "{{ openshift_hosted_registry_routehost | default(docker_registry_route_hostname) }}"
- cert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
- key_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
- cacert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
- dest_cacert_path: /etc/origin/master/ca.crt
- when:
- - "'cafile' in openshift_hosted_registry_routecertificates"
- - "'certfile' in openshift_hosted_registry_routecertificates"
- - "'keyfile' in openshift_hosted_registry_routecertificates"
+- name: Include passthrough route configuration
+ include: secure/passthrough.yml
+ static: no
+ when: openshift_hosted_registry_routetermination == 'passthrough'
-# When routetermination is passthrough we will create the route
-- name: Create passthrough route for docker-registry
+- name: Fetch the docker-registry route
oc_route:
name: docker-registry
- namespace: "{{ openshift_hosted_registry_namespace }}"
- service_name: docker-registry
- tls_termination: "{{ openshift_hosted_registry_routetermination }}"
- host: "{{ openshift_hosted_registry_routehost | ternary(openshift_hosted_registry_routehost, docker_registry_route_hostname) }}"
- when: openshift_hosted_registry_routetermination == 'passthrough'
+ namespace: default
+ state: list
+ register: docker_registry_route
-- name: Retrieve registry service IP
+- name: Retrieve registry service for the clusterip
oc_service:
namespace: "{{ openshift_hosted_registry_namespace }}"
name: docker-registry
state: list
- register: docker_registry_service_ip
+ register: docker_registry_service
-- name: Create registry certificates
+- name: Generate self-signed docker-registry certificates
oc_adm_ca_server_cert:
signer_cert: "{{ openshift_master_config_dir }}/ca.crt"
signer_key: "{{ openshift_master_config_dir }}/ca.key"
signer_serial: "{{ openshift_master_config_dir }}/ca.serial.txt"
hostnames:
- - "{{ docker_registry_service_ip.results.clusterip }}"
- - "{{ openshift_hosted_registry_name }}.default.svc"
- - "{{ openshift_hosted_registry_name }}.default.svc.{{ openshift.common.dns_domain }}"
- - "{{ docker_registry_route_hostname }}"
- cert: "{{ openshift_master_config_dir }}/registry.crt"
- key: "{{ openshift_master_config_dir }}/registry.key"
+ - "{{ docker_registry_service.results.clusterip }}"
+ - "{{ docker_registry_route.results[0].spec.host }}"
+ cert: "{{ docker_registry_cert_path }}"
+ key: "{{ docker_registry_key_path }}"
expire_days: "{{ openshift_hosted_registry_cert_expire_days if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool else omit }}"
- register: server_cert_out
+ register: registry_self_cert
+ when: docker_registry_self_signed
+
+# Setting up REGISTRY_HTTP_TLS_CLIENTCAS as the cacert doesn't seem to work.
+# If we need to set up a cacert, bundle it with the cert.
+- when: docker_registry_cacert_path is defined
+ block:
+ - name: Retrieve certificate files to generate certificate bundle
+ slurp:
+ src: "{{ item }}"
+ with_items:
+ - "{{ docker_registry_cert_path }}"
+ - "{{ docker_registry_cacert_path }}"
+ register: certificate_files
+
+ - name: Generate certificate bundle
+ copy:
+ content: "{{ certificate_files.results | map(attribute='content') | map('b64decode') | join('') }}"
+ dest: "{{ openshift_master_config_dir }}/named_certificates/docker-registry.pem"
+
+ - name: Reset the certificate path to use the bundle
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/named_certificates/docker-registry.pem"
- name: Create the secret for the registry certificates
oc_secret:
@@ -67,9 +70,9 @@
namespace: "{{ openshift_hosted_registry_namespace }}"
files:
- name: registry.crt
- path: "{{ openshift_master_config_dir }}/registry.crt"
+ path: "{{ docker_registry_cert_path }}"
- name: registry.key
- path: "{{ openshift_master_config_dir }}/registry.key"
+ path: "{{ docker_registry_key_path }}"
register: create_registry_certificates_secret_out
- name: Add the secret to the registry's pod service accounts
@@ -99,9 +102,15 @@
value: HTTPS
action: put
+- name: Detect if there has been certificate changes
+ set_fact:
+ registry_cert_changed: true
+ when: ( registry_self_cert is defined and registry_self_cert.changed ) or
+ create_registry_certificates_secret_out.changed
+
- name: Update openshift_hosted facts with secure registry variables
set_fact:
openshift_hosted_registry_volumes: "{{ openshift_hosted_registry_volumes | union(registry_secure_volume_mounts) }}"
openshift_hosted_registry_env_vars: "{{ openshift_hosted_registry_env_vars | combine(registry_secure_env_vars) }}"
openshift_hosted_registry_edits: "{{ openshift_hosted_registry_edits | union(registry_secure_edits) }}"
- openshift_hosted_registry_force: "{{ openshift_hosted_registry_force | union([server_cert_out.changed]) | union([create_registry_certificates_secret_out.changed]) }}"
+ openshift_hosted_registry_force: "{{ openshift_hosted_registry_force | union([registry_cert_changed | default(false)]) }}"
diff --git a/roles/openshift_hosted/tasks/registry/secure/passthrough.yml b/roles/openshift_hosted/tasks/registry/secure/passthrough.yml
new file mode 100644
index 000000000..5b44fda10
--- /dev/null
+++ b/roles/openshift_hosted/tasks/registry/secure/passthrough.yml
@@ -0,0 +1,45 @@
+---
+# Generate a self-signed certificate when there is no user-supplied certificate
+- name: Configure self-signed certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key"
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
+ docker_registry_self_signed: true
+ when:
+ - "'certfile' not in openshift_hosted_registry_routecertificates"
+ - "'keyfile' not in openshift_hosted_registry_routecertificates"
+
+# Retrieve user supplied certificate files if they are provided
+- when:
+ - "'certfile' in openshift_hosted_registry_routecertificates"
+ - "'keyfile' in openshift_hosted_registry_routecertificates"
+ block:
+ - name: Configure provided certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
+ docker_registry_self_signed: false
+
+ # Since we end up bundling the cert, cacert and key in a .pem file, the 'cafile'
+ # is optional
+ - name: Configure provided ca certificate file path
+ set_fact:
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
+ when: "'cafile' in openshift_hosted_registry_routecertificates"
+
+ - name: Retrieve provided certificate files
+ copy:
+ backup: True
+ dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}"
+ src: "{{ item.value }}"
+ when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
+ with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+
+- name: Configure a passthrough route for docker-registry
+ oc_route:
+ name: docker-registry
+ namespace: "{{ openshift_hosted_registry_namespace }}"
+ service_name: docker-registry
+ tls_termination: "{{ openshift_hosted_registry_routetermination }}"
+ host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}"
diff --git a/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml b/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml
new file mode 100644
index 000000000..48e5b0fba
--- /dev/null
+++ b/roles/openshift_hosted/tasks/registry/secure/reencrypt.yml
@@ -0,0 +1,38 @@
+---
+- name: Validate route termination configuration
+ fail:
+ msg: >
+ When 'openshift_hosted_registry_routetermination' is 'reencrypt', you must
+ provide certificate files with 'openshift_hosted_registry_routecertificates'
+ when: ('certfile' not in openshift_hosted_registry_routecertificates) or
+ ('keyfile' not in openshift_hosted_registry_routecertificates) or
+ ('cafile' not in openshift_hosted_registry_routecertificates)
+
+- name: Configure self-signed certificate file paths
+ set_fact:
+ docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt"
+ docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key"
+ docker_registry_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
+ docker_registry_self_signed: true
+
+- name: Retrieve provided certificate files
+ copy:
+ backup: True
+ dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}"
+ src: "{{ item.value }}"
+ when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
+ with_dict: "{{ openshift_hosted_registry_routecertificates }}"
+
+# Encrypt with the provided certificate and provide the dest_cacert for the
+# self-signed certificate at the endpoint
+- name: Configure a reencrypt route for docker-registry
+ oc_route:
+ name: docker-registry
+ namespace: "{{ openshift_hosted_registry_namespace }}"
+ service_name: docker-registry
+ tls_termination: "{{ openshift_hosted_registry_routetermination }}"
+ host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}"
+ cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
+ key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
+ cacert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
+ dest_cacert_path: "{{ openshift_master_config_dir }}/ca.crt"
diff --git a/roles/openshift_hosted/tasks/registry/storage/object_storage.yml b/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
index 8aaba0f3c..8553a8098 100644
--- a/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
+++ b/roles/openshift_hosted/tasks/registry/storage/object_storage.yml
@@ -2,7 +2,7 @@
- include: s3.yml
when: openshift.hosted.registry.storage.provider == 's3'
-- name: Ensure the resgistry secret exists
+- name: Ensure the registry secret exists
oc_secret:
name: "{{ registry_config_secret_name }}"
state: present
@@ -10,6 +10,19 @@
- path: /tmp/config.yml
data: "{{ lookup('template', 'registry_config.j2') }}"
register: registry_config_out
+ when: openshift_hosted_registry_storage_gcs_keyfile is not defined
+
+- name: Ensure the registry secret exists for GCS
+ oc_secret:
+ name: "{{ registry_config_secret_name }}"
+ state: present
+ contents:
+ - path: /tmp/config.yml
+ data: "{{ lookup('template', 'registry_config.j2') }}"
+ - path: /tmp/gcs.json
+ data: "{{ lookup('file', openshift_hosted_registry_storage_gcs_keyfile) | string }}"
+ register: registry_config_out
+ when: openshift_hosted_registry_storage_gcs_keyfile is defined
- name: Add secrets to registry service account
oc_serviceaccount_secret:
diff --git a/roles/openshift_hosted/tasks/registry/storage/registry_config_secret.j2 b/roles/openshift_hosted/tasks/registry/storage/registry_config_secret.j2
deleted file mode 120000
index b9e82c1ea..000000000
--- a/roles/openshift_hosted/tasks/registry/storage/registry_config_secret.j2
+++ /dev/null
@@ -1 +0,0 @@
-../../../templates/registry_config_secret.j2 \ No newline at end of file
diff --git a/roles/openshift_hosted/templates/registry_config.j2 b/roles/openshift_hosted/templates/registry_config.j2
index fc9272679..61da452de 100644
--- a/roles/openshift_hosted/templates/registry_config.j2
+++ b/roles/openshift_hosted/templates/registry_config.j2
@@ -60,7 +60,7 @@ storage:
gcs:
bucket: {{ openshift_hosted_registry_storage_gcs_bucket }}
{% if openshift_hosted_registry_storage_gcs_keyfile is defined %}
- keyfile: {{ openshift_hosted_registry_storage_gcs_keyfile }}
+ keyfile: /etc/registry/gcs.json
{% endif -%}
{% if openshift_hosted_registry_storage_gcs_rootdirectory is defined %}
rootdirectory: {{ openshift_hosted_registry_storage_gcs_rootdirectory }}
diff --git a/roles/openshift_hosted/templates/registry_config_secret.j2 b/roles/openshift_hosted/templates/registry_config_secret.j2
deleted file mode 100644
index ca68544ec..000000000
--- a/roles/openshift_hosted/templates/registry_config_secret.j2
+++ /dev/null
@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
- name: registry-config
- annotations:
- provider: {{ openshift.hosted.registry.storage.provider }}
-data:
- config.yml: {{ registry_config }}
diff --git a/roles/openshift_logging_elasticsearch/tasks/main.yaml b/roles/openshift_logging_elasticsearch/tasks/main.yaml
index 5593fac3a..28c3ffd96 100644
--- a/roles/openshift_logging_elasticsearch/tasks/main.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/main.yaml
@@ -107,9 +107,16 @@
- openshift_logging_elasticsearch_kibana_index_mode in __kibana_index_modes
msg: "The openshift_logging_elasticsearch_kibana_index_mode '{{ openshift_logging_elasticsearch_kibana_index_mode }}' only supports one of: {{ __kibana_index_modes | join(', ') }}"
+- assert:
+ that:
+ - "{{ openshift_logging_es_log_appenders | length > 0 }}"
+ msg: "The openshift_logging_es_log_appenders '{{ openshift_logging_es_log_appenders }}' has an unrecognized option and only supports the following as a list: {{ __es_log_appenders | join(', ') }}"
+
- template:
src: elasticsearch-logging.yml.j2
dest: "{{ tempdir }}/elasticsearch-logging.yml"
+ vars:
+ root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
when: es_logging_contents is undefined
changed_when: no
diff --git a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2 b/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
index 38948ba2f..c7b2b2721 100644
--- a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
+++ b/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
@@ -1,14 +1,26 @@
# you can override this using by setting a system property, for example -Des.logger.level=DEBUG
es.logger.level: INFO
-rootLogger: ${es.logger.level}, console, file
+rootLogger: ${es.logger.level}, {{root_logger}}
logger:
# log action execution errors for easier debugging
action: WARN
+
+ #
+ # deprecation logging, turn to DEBUG to see them
+ deprecation: WARN, deprecation_log_file
+
# reduce the logging for aws, too much is logged under the default INFO
com.amazonaws: WARN
+
io.fabric8.elasticsearch: ${PLUGIN_LOGLEVEL}
io.fabric8.kubernetes: ${PLUGIN_LOGLEVEL}
+ # aws will try to do some sketchy JMX stuff, but its not needed.
+ com.amazonaws.jmx.SdkMBeanRegistrySupport: ERROR
+ com.amazonaws.metrics.AwsSdkMetrics: ERROR
+
+ org.apache.http: INFO
+
# gateway
#gateway: DEBUG
#index.gateway: DEBUG
@@ -28,13 +40,14 @@ logger:
additivity:
index.search.slowlog: false
index.indexing.slowlog: false
+ deprecation: false
appender:
console:
type: console
layout:
type: consolePattern
- conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+ conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %.1000m%n"
# need this filter until https://github.com/openshift/origin/issues/14515 is fixed
filter:
1:
@@ -67,6 +80,14 @@ appender:
#type: pattern
#conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+ deprecation_log_file:
+ type: dailyRollingFile
+ file: ${path.logs}/${cluster.name}_deprecation.log
+ datePattern: "'.'yyyy-MM-dd"
+ layout:
+ type: pattern
+ conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+
index_search_slow_log_file:
type: dailyRollingFile
file: ${path.logs}/${cluster.name}_index_search_slowlog.log
diff --git a/roles/openshift_logging_elasticsearch/vars/main.yml b/roles/openshift_logging_elasticsearch/vars/main.yml
index 5b4b226e8..20fa63543 100644
--- a/roles/openshift_logging_elasticsearch/vars/main.yml
+++ b/roles/openshift_logging_elasticsearch/vars/main.yml
@@ -2,7 +2,7 @@
__latest_es_version: "3_5"
__allowed_es_versions: ["3_5", "3_6"]
__allowed_es_types: ["data-master", "data-client", "master", "client"]
-
+__es_log_appenders: ['file', 'console']
__kibana_index_modes: ["unique", "shared_ops"]
# TODO: integrate these
diff --git a/roles/openshift_logging_kibana/defaults/main.yml b/roles/openshift_logging_kibana/defaults/main.yml
index b2556fd71..14787a62b 100644
--- a/roles/openshift_logging_kibana/defaults/main.yml
+++ b/roles/openshift_logging_kibana/defaults/main.yml
@@ -26,7 +26,7 @@ openshift_logging_kibana_ops_deployment: false
# Proxy settings
openshift_logging_kibana_proxy_debug: false
openshift_logging_kibana_proxy_cpu_limit: null
-openshift_logging_kibana_proxy_memory_limit: 96Mi
+openshift_logging_kibana_proxy_memory_limit: 256Mi
#The absolute path on the control node to the cert file to use
#for the public facing kibana certs
diff --git a/roles/openshift_master/handlers/main.yml b/roles/openshift_master/handlers/main.yml
index ce7688581..d5094c2c9 100644
--- a/roles/openshift_master/handlers/main.yml
+++ b/roles/openshift_master/handlers/main.yml
@@ -1,12 +1,21 @@
---
- name: restart master api
- systemd: name={{ openshift.common.service_type }}-master-api state=restarted
- when: (not (master_api_service_status_changed | default(false) | bool)) and openshift.master.cluster_method == 'native'
- notify: Verify API Server
+ systemd:
+ name: "{{ openshift.common.service_type }}-master-api"
+ state: restarted
+ when:
+ - not (master_api_service_status_changed | default(false) | bool)
+ - openshift.master.cluster_method == 'native'
+ notify:
+ - Verify API Server
- name: restart master controllers
- systemd: name={{ openshift.common.service_type }}-master-controllers state=restarted
- when: (not (master_controllers_service_status_changed | default(false) | bool)) and openshift.master.cluster_method == 'native'
+ systemd:
+ name: "{{ openshift.common.service_type }}-master-controllers"
+ state: restarted
+ when:
+ - not (master_controllers_service_status_changed | default(false) | bool)
+ - openshift.master.cluster_method == 'native'
- name: Verify API Server
# Using curl here since the uri module requires python-httplib2 and
@@ -23,8 +32,8 @@
# Disables the following warning:
# Consider using get_url or uri module rather than running curl
warn: no
- register: api_available_output
- until: api_available_output.stdout == 'ok'
+ register: l_api_available_output
+ until: l_api_available_output.stdout == 'ok'
retries: 120
delay: 1
changed_when: false
diff --git a/roles/openshift_master/tasks/clean_systemd_units.yml b/roles/openshift_master/tasks/clean_systemd_units.yml
index 590692c10..e641f84d4 100644
--- a/roles/openshift_master/tasks/clean_systemd_units.yml
+++ b/roles/openshift_master/tasks/clean_systemd_units.yml
@@ -1,5 +1,9 @@
---
- name: Disable master service
- systemd: name={{ openshift.common.service_type }}-master state=stopped enabled=no masked=yes
+ systemd:
+ name: "{{ openshift.common.service_type }}-master"
+ state: stopped
+ enabled: no
+ masked: yes
ignore_errors: true
diff --git a/roles/openshift_master/tasks/firewall.yml b/roles/openshift_master/tasks/firewall.yml
index e51eeb56e..38afb6764 100644
--- a/roles/openshift_master/tasks/firewall.yml
+++ b/roles/openshift_master/tasks/firewall.yml
@@ -7,7 +7,8 @@
action: add
protocol: "{{ item.port.split('/')[1] }}"
port: "{{ item.port.split('/')[0] }}"
- when: item.cond | default(True)
+ when:
+ - item.cond | default(True)
with_items: "{{ r_openshift_master_os_firewall_allow }}"
- name: Remove iptables rules
@@ -16,7 +17,8 @@
action: remove
protocol: "{{ item.port.split('/')[1] }}"
port: "{{ item.port.split('/')[0] }}"
- when: item.cond | default(True)
+ when:
+ - item.cond | default(True)
with_items: "{{ r_openshift_master_os_firewall_deny }}"
- when: r_openshift_master_firewall_enabled | bool and r_openshift_master_use_firewalld | bool
@@ -27,7 +29,8 @@
permanent: true
immediate: true
state: enabled
- when: item.cond | default(True)
+ when:
+ - item.cond | default(True)
with_items: "{{ r_openshift_master_os_firewall_allow }}"
- name: Remove firewalld allow rules
@@ -36,5 +39,6 @@
permanent: true
immediate: true
state: disabled
- when: item.cond | default(True)
+ when:
+ - item.cond | default(True)
with_items: "{{ r_openshift_master_os_firewall_deny }}"
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index b1412c3d9..a11471891 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -7,21 +7,34 @@
- fail:
msg: >
Invalid OAuth grant method: {{ openshift_master_oauth_grant_method }}
- when: openshift_master_oauth_grant_method is defined and openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods
+ when:
+ - openshift_master_oauth_grant_method is defined
+ - openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods
# HA Variable Validation
- fail:
msg: "openshift_master_cluster_method must be set to either 'native' or 'pacemaker' for multi-master installations"
- when: openshift.master.ha | bool and ((openshift.master.cluster_method is not defined) or (openshift.master.cluster_method is defined and openshift.master.cluster_method not in ["native", "pacemaker"]))
+ when:
+ - openshift.master.ha | bool
+ - (openshift.master.cluster_method is not defined) or (openshift.master.cluster_method is defined and openshift.master.cluster_method not in ["native", "pacemaker"])
- fail:
msg: "'native' high availability is not supported for the requested OpenShift version"
- when: openshift.master.ha | bool and openshift.master.cluster_method == "native" and not openshift.common.version_gte_3_1_or_1_1 | bool
+ when:
+ - openshift.master.ha | bool
+ - openshift.master.cluster_method == "native"
+ - not openshift.common.version_gte_3_1_or_1_1 | bool
- fail:
msg: "openshift_master_cluster_password must be set for multi-master installations"
- when: openshift.master.ha | bool and openshift.master.cluster_method == "pacemaker" and (openshift_master_cluster_password is not defined or not openshift_master_cluster_password)
+ when:
+ - openshift.master.ha | bool
+ - openshift.master.cluster_method == "pacemaker"
+ - openshift_master_cluster_password is not defined or not openshift_master_cluster_password
- fail:
msg: "Pacemaker based HA is not supported at this time when used with containerized installs"
- when: openshift.master.ha | bool and openshift.master.cluster_method == "pacemaker" and openshift.common.is_containerized | bool
+ when:
+ - openshift.master.ha | bool
+ - openshift.master.cluster_method == "pacemaker"
+ - openshift.common.is_containerized | bool
- name: Open up firewall ports
include: firewall.yml
@@ -31,7 +44,8 @@
package:
name: "{{ openshift.common.service_type }}-master{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
state: present
- when: not openshift.common.is_containerized | bool
+ when:
+ - not openshift.common.is_containerized | bool
- name: Create openshift.common.data_dir
file:
@@ -40,11 +54,13 @@
mode: 0755
owner: root
group: root
- when: openshift.common.is_containerized | bool
+ when:
+ - openshift.common.is_containerized | bool
- name: Reload systemd units
command: systemctl daemon-reload
- when: openshift.common.is_containerized | bool and install_result | changed
+ when:
+ - openshift.common.is_containerized | bool
- name: Re-gather package dependent master facts
openshift_facts:
@@ -61,8 +77,8 @@
args:
creates: "{{ openshift_master_policy }}"
notify:
- - restart master api
- - restart master controllers
+ - restart master api
+ - restart master controllers
- name: Create the scheduler config
copy:
@@ -70,20 +86,22 @@
dest: "{{ openshift_master_scheduler_conf }}"
backup: true
notify:
- - restart master api
- - restart master controllers
+ - restart master api
+ - restart master controllers
- name: Install httpd-tools if needed
package: name=httpd-tools state=present
- when: (item.kind == 'HTPasswdPasswordIdentityProvider') and
- not openshift.common.is_atomic | bool
+ when:
+ - item.kind == 'HTPasswdPasswordIdentityProvider'
+ - not openshift.common.is_atomic | bool
with_items: "{{ openshift.master.identity_providers }}"
- name: Ensure htpasswd directory exists
file:
path: "{{ item.filename | dirname }}"
state: directory
- when: item.kind == 'HTPasswdPasswordIdentityProvider'
+ when:
+ - item.kind == 'HTPasswdPasswordIdentityProvider'
with_items: "{{ openshift.master.identity_providers }}"
- name: Create the htpasswd file if needed
@@ -91,7 +109,9 @@
dest: "{{ item.filename }}"
src: htpasswd.j2
backup: yes
- when: item.kind == 'HTPasswdPasswordIdentityProvider' and openshift.master.manage_htpasswd | bool
+ when:
+ - item.kind == 'HTPasswdPasswordIdentityProvider'
+ - openshift.master.manage_htpasswd | bool
with_items: "{{ openshift.master.identity_providers }}"
- name: Ensure htpasswd file exists
@@ -100,7 +120,8 @@
force: no
content: ""
mode: 0600
- when: item.kind == 'HTPasswdPasswordIdentityProvider'
+ when:
+ - item.kind == 'HTPasswdPasswordIdentityProvider'
with_items: "{{ openshift.master.identity_providers }}"
- name: Create the ldap ca file if needed
@@ -109,7 +130,9 @@
content: "{{ openshift.master.ldap_ca }}"
mode: 0600
backup: yes
- when: openshift.master.ldap_ca is defined and item.kind == 'LDAPPasswordIdentityProvider'
+ when:
+ - openshift.master.ldap_ca is defined
+ - item.kind == 'LDAPPasswordIdentityProvider'
with_items: "{{ openshift.master.identity_providers }}"
- name: Create the openid ca file if needed
@@ -118,7 +141,10 @@
content: "{{ openshift.master.openid_ca }}"
mode: 0600
backup: yes
- when: openshift.master.openid_ca is defined and item.kind == 'OpenIDIdentityProvider' and item.ca | default('') != ''
+ when:
+ - openshift.master.openid_ca is defined
+ - item.kind == 'OpenIDIdentityProvider'
+ - item.ca | default('') != ''
with_items: "{{ openshift.master.identity_providers }}"
- name: Create the request header ca file if needed
@@ -127,20 +153,23 @@
content: "{{ openshift.master.request_header_ca }}"
mode: 0600
backup: yes
- when: openshift.master.request_header_ca is defined and item.kind == 'RequestHeaderIdentityProvider' and item.clientCA | default('') != ''
+ when:
+ - openshift.master.request_header_ca is defined
+ - item.kind == 'RequestHeaderIdentityProvider'
+ - item.clientCA | default('') != ''
with_items: "{{ openshift.master.identity_providers }}"
# This is an ugly hack to verify settings are in a file without modifying them with lineinfile.
# The template file will stomp any other settings made.
- block:
- - name: check whether our docker-registry setting exists in the env file
- command: "awk '/^OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000/' /etc/sysconfig/{{ openshift.common.service_type }}-master"
- failed_when: false
- changed_when: false
- register: already_set
+ - name: check whether our docker-registry setting exists in the env file
+ command: "awk '/^OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000/' /etc/sysconfig/{{ openshift.common.service_type }}-master"
+ failed_when: false
+ changed_when: false
+ register: l_already_set
- - set_fact:
- openshift_push_via_dns: "{{ (openshift_use_dnsmasq | default(true) and openshift.common.version_gte_3_6) or (already_set.stdout is defined and already_set.stdout | match('OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000')) }}"
+ - set_fact:
+ openshift_push_via_dns: "{{ (openshift_use_dnsmasq | default(true) and openshift.common.version_gte_3_6) or (l_already_set.stdout is defined and l_already_set.stdout | match('OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000')) }}"
- name: Set fact of all etcd host IPs
openshift_facts:
@@ -156,7 +185,9 @@
- name: Install Master system container
include: system_container.yml
- when: openshift.common.is_containerized | bool and openshift.common.is_master_system_container | bool
+ when:
+ - openshift.common.is_containerized | bool
+ - openshift.common.is_master_system_container | bool
- name: Create session secrets file
template:
@@ -165,9 +196,11 @@
owner: root
group: root
mode: 0600
- when: openshift.master.session_auth_secrets is defined and openshift.master.session_encryption_secrets is defined
+ when:
+ - openshift.master.session_auth_secrets is defined
+ - openshift.master.session_encryption_secrets is defined
notify:
- - restart master api
+ - restart master api
- set_fact:
translated_identity_providers: "{{ openshift.master.identity_providers | translate_idps('v1', openshift.common.version, openshift.common.deployment_type) }}"
@@ -182,53 +215,66 @@
group: root
mode: 0600
notify:
- - restart master api
- - restart master controllers
+ - restart master api
+ - restart master controllers
- include: set_loopback_context.yml
- when: openshift.common.version_gte_3_2_or_1_2
+ when:
+ - openshift.common.version_gte_3_2_or_1_2
- name: Start and enable master api on first master
systemd:
name: "{{ openshift.common.service_type }}-master-api"
enabled: yes
state: started
- when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
- register: start_result
- until: not start_result | failed
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname == openshift_master_hosts[0]
+ register: l_start_result
+ until: not l_start_result | failed
retries: 1
delay: 60
- name: Dump logs from master-api if it failed
command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-api
- when: start_result | failed
+ when:
+ - l_start_result | failed
- set_fact:
- master_api_service_status_changed: "{{ start_result | changed }}"
- when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
+ master_api_service_status_changed: "{{ l_start_result | changed }}"
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname == openshift_master_hosts[0]
- pause:
seconds: 15
- when: openshift.master.ha | bool and openshift.master.cluster_method == 'native'
+ when:
+ - openshift.master.ha | bool
+ - openshift.master.cluster_method == 'native'
- name: Start and enable master api all masters
systemd:
name: "{{ openshift.common.service_type }}-master-api"
enabled: yes
state: started
- when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
- register: start_result
- until: not start_result | failed
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname != openshift_master_hosts[0]
+ register: l_start_result
+ until: not l_start_result | failed
retries: 1
delay: 60
- name: Dump logs from master-api if it failed
command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-api
- when: start_result | failed
+ when:
+ - l_start_result | failed
- set_fact:
- master_api_service_status_changed: "{{ start_result | changed }}"
- when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
+ master_api_service_status_changed: "{{ l_start_result | changed }}"
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname != openshift_master_hosts[0]
# A separate wait is required here for native HA since notifies will
# be resolved after all tasks in the role.
@@ -243,67 +289,80 @@
--cacert {{ openshift.common.config_base }}/master/ca.crt
{% endif %}
{{ openshift.master.api_url }}/healthz/ready
- register: api_available_output
- until: api_available_output.stdout == 'ok'
+ register: l_api_available_output
+ until: l_api_available_output.stdout == 'ok'
retries: 120
delay: 1
run_once: true
changed_when: false
- when: openshift.master.cluster_method == 'native' and master_api_service_status_changed | bool
+ when:
+ - openshift.master.cluster_method == 'native'
+ - master_api_service_status_changed | bool
- name: Start and enable master controller on first master
systemd:
name: "{{ openshift.common.service_type }}-master-controllers"
enabled: yes
state: started
- when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
- register: start_result
- until: not start_result | failed
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname == openshift_master_hosts[0]
+ register: l_start_result
+ until: not l_start_result | failed
retries: 1
delay: 60
- name: Dump logs from master-controllers if it failed
command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-controllers
- when: start_result | failed
+ when:
+ - l_start_result | failed
- name: Wait for master controller service to start on first master
pause:
seconds: 15
- when: openshift.master.cluster_method == 'native'
+ when:
+ - openshift.master.cluster_method == 'native'
- name: Start and enable master controller on all masters
systemd:
name: "{{ openshift.common.service_type }}-master-controllers"
enabled: yes
state: started
- when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
- register: start_result
- until: not start_result | failed
+ when:
+ - openshift.master.cluster_method == 'native'
+ - inventory_hostname != openshift_master_hosts[0]
+ register: l_start_result
+ until: not l_start_result | failed
retries: 1
delay: 60
- name: Dump logs from master-controllers if it failed
command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-controllers
- when: start_result | failed
+ when:
+ - l_start_result | failed
- set_fact:
- master_controllers_service_status_changed: "{{ start_result | changed }}"
- when: openshift.master.cluster_method == 'native'
+ master_controllers_service_status_changed: "{{ l_start_result | changed }}"
+ when:
+ - openshift.master.cluster_method == 'native'
- name: Install cluster packages
package: name=pcs state=present
- when: openshift.master.cluster_method == 'pacemaker'
- and not openshift.common.is_containerized | bool
- register: install_result
+ when:
+ - openshift.master.cluster_method == 'pacemaker'
+ - not openshift.common.is_containerized | bool
+ register: l_install_result
- name: Start and enable cluster service
systemd:
name: pcsd
enabled: yes
state: started
- when: openshift.master.cluster_method == 'pacemaker'
- and not openshift.common.is_containerized | bool
+ when:
+ - openshift.master.cluster_method == 'pacemaker'
+ - not openshift.common.is_containerized | bool
- name: Set the cluster user password
shell: echo {{ openshift_master_cluster_password | quote }} | passwd --stdin hacluster
- when: install_result | changed
+ when:
+ - l_install_result | changed
diff --git a/roles/openshift_master/tasks/set_loopback_context.yml b/roles/openshift_master/tasks/set_loopback_context.yml
index 9c3fb31dc..308b2f4cd 100644
--- a/roles/openshift_master/tasks/set_loopback_context.yml
+++ b/roles/openshift_master/tasks/set_loopback_context.yml
@@ -4,7 +4,7 @@
{{ openshift.common.client_binary }} config view
--config={{ openshift_master_loopback_config }}
changed_when: false
- register: loopback_config
+ register: l_loopback_config
- command: >
{{ openshift.common.client_binary }} config set-cluster
@@ -12,7 +12,8 @@
--embed-certs=true --server={{ openshift.master.loopback_api_url }}
{{ openshift.master.loopback_cluster_name }}
--config={{ openshift_master_loopback_config }}
- when: loopback_context_string not in loopback_config.stdout
+ when:
+ - loopback_context_string not in l_loopback_config.stdout
register: set_loopback_cluster
- command: >
@@ -21,11 +22,13 @@
--namespace=default --user={{ openshift.master.loopback_user }}
{{ openshift.master.loopback_context_name }}
--config={{ openshift_master_loopback_config }}
- when: set_loopback_cluster | changed
- register: set_loopback_context
+ when:
+ - set_loopback_cluster | changed
+ register: l_set_loopback_context
- command: >
{{ openshift.common.client_binary }} config use-context {{ openshift.master.loopback_context_name }}
--config={{ openshift_master_loopback_config }}
- when: set_loopback_context | changed
+ when:
+ - l_set_loopback_context | changed
register: set_current_context
diff --git a/roles/openshift_master/tasks/system_container.yml b/roles/openshift_master/tasks/system_container.yml
index 8d343336f..91332acfb 100644
--- a/roles/openshift_master/tasks/system_container.yml
+++ b/roles/openshift_master/tasks/system_container.yml
@@ -2,13 +2,12 @@
- name: Pre-pull master system container image
command: >
atomic pull --storage=ostree {{ 'docker:' if openshift.common.system_images_registry == 'docker' else openshift.common.system_images_registry + '/' }}{{ openshift.master.master_system_image }}:{{ openshift_image_tag }}
- register: pull_result
- changed_when: "'Pulling layer' in pull_result.stdout"
+ register: l_pull_result
+ changed_when: "'Pulling layer' in l_pull_result.stdout"
- name: Check Master system container package
command: >
atomic containers list --no-trunc -a -f container={{ openshift.common.service_type }}-master
- register: result
# HA
- name: Install or Update HA api master system container
@@ -17,7 +16,7 @@
image: "{{ 'docker:' if openshift.common.system_images_registry == 'docker' else openshift.common.system_images_registry + '/' }}{{ openshift.master.master_system_image }}:{{ openshift_image_tag }}"
state: latest
values:
- - COMMAND=api
+ - COMMAND=api
- name: Install or Update HA controller master system container
oc_atomic_container:
@@ -25,4 +24,4 @@
image: "{{ 'docker:' if openshift.common.system_images_registry == 'docker' else openshift.common.system_images_registry + '/' }}{{ openshift.master.master_system_image }}:{{ openshift_image_tag }}"
state: latest
values:
- - COMMAND=controllers
+ - COMMAND=controllers
diff --git a/roles/openshift_master/tasks/systemd_units.yml b/roles/openshift_master/tasks/systemd_units.yml
index 723bdb0c4..72c231e52 100644
--- a/roles/openshift_master/tasks/systemd_units.yml
+++ b/roles/openshift_master/tasks/systemd_units.yml
@@ -12,15 +12,18 @@
set_fact:
containerized_svc_dir: "/etc/systemd/system"
ha_svc_template_path: "docker-cluster"
- when: openshift.common.is_containerized | bool
+ when:
+ - openshift.common.is_containerized | bool
# This is the image used for both HA and non-HA clusters:
- name: Pre-pull master image
command: >
docker pull {{ openshift.master.master_image }}:{{ openshift_image_tag }}
- register: pull_result
- changed_when: "'Downloaded newer image' in pull_result.stdout"
- when: openshift.common.is_containerized | bool and not openshift.common.is_master_system_container | bool
+ register: l_pull_result
+ changed_when: "'Downloaded newer image' in l_pull_result.stdout"
+ when:
+ - openshift.common.is_containerized | bool
+ - not openshift.common.is_master_system_container | bool
- name: Create the ha systemd unit files
template:
@@ -32,23 +35,26 @@
with_items:
- api
- controllers
- register: create_ha_unit_files
+ register: l_create_ha_unit_files
- command: systemctl daemon-reload
- when: create_ha_unit_files | changed
+ when:
+ - l_create_ha_unit_files | changed
# end workaround for missing systemd unit files
- name: Preserve Master API Proxy Config options
command: grep PROXY /etc/sysconfig/{{ openshift.common.service_type }}-master-api
- register: master_api_proxy
- when: openshift.master.cluster_method == "native"
+ register: l_master_api_proxy
+ when:
+ - openshift.master.cluster_method == "native"
failed_when: false
changed_when: false
- name: Preserve Master API AWS options
command: grep AWS_ /etc/sysconfig/{{ openshift.common.service_type }}-master-api
register: master_api_aws
- when: openshift.master.cluster_method == "native"
+ when:
+ - openshift.master.cluster_method == "native"
failed_when: false
changed_when: false
@@ -57,22 +63,27 @@
src: "{{ ha_svc_template_path }}/atomic-openshift-master-api.j2"
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-api
backup: true
- when: openshift.master.cluster_method == "native"
+ when:
+ - openshift.master.cluster_method == "native"
notify:
- restart master api
- name: Restore Master API Proxy Config Options
- when: openshift.master.cluster_method == "native"
- and master_api_proxy.rc == 0 and 'http_proxy' not in openshift.common and 'https_proxy' not in openshift.common
+ when:
+ - openshift.master.cluster_method == "native"
+ - l_master_api_proxy.rc == 0
+ - "'http_proxy' not in openshift.common"
+ - "'https_proxy' not in openshift.common"
lineinfile:
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-api
line: "{{ item }}"
- with_items: "{{ master_api_proxy.stdout_lines | default([]) }}"
+ with_items: "{{ l_master_api_proxy.stdout_lines | default([]) }}"
- name: Restore Master API AWS Options
- when: openshift.master.cluster_method == "native"
- and master_api_aws.rc == 0 and
- not (openshift_cloudprovider_kind is defined and openshift_cloudprovider_kind == 'aws' and openshift_cloudprovider_aws_access_key is defined and openshift_cloudprovider_aws_secret_key is defined)
+ when:
+ - openshift.master.cluster_method == "native"
+ - master_api_aws.rc == 0
+ - not (openshift_cloudprovider_kind is defined and openshift_cloudprovider_kind == 'aws' and openshift_cloudprovider_aws_access_key is defined and openshift_cloudprovider_aws_secret_key is defined)
lineinfile:
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-api
line: "{{ item }}"
@@ -82,14 +93,16 @@
- name: Preserve Master Controllers Proxy Config options
command: grep PROXY /etc/sysconfig/{{ openshift.common.service_type }}-master-controllers
register: master_controllers_proxy
- when: openshift.master.cluster_method == "native"
+ when:
+ - openshift.master.cluster_method == "native"
failed_when: false
changed_when: false
- name: Preserve Master Controllers AWS options
command: grep AWS_ /etc/sysconfig/{{ openshift.common.service_type }}-master-controllers
register: master_controllers_aws
- when: openshift.master.cluster_method == "native"
+ when:
+ - openshift.master.cluster_method == "native"
failed_when: false
changed_when: false
@@ -98,7 +111,8 @@
src: "{{ ha_svc_template_path }}/atomic-openshift-master-controllers.j2"
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-controllers
backup: true
- when: openshift.master.cluster_method == "native"
+ when:
+ - openshift.master.cluster_method == "native"
notify:
- restart master controllers
@@ -107,14 +121,18 @@
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-controllers
line: "{{ item }}"
with_items: "{{ master_controllers_proxy.stdout_lines | default([]) }}"
- when: openshift.master.cluster_method == "native"
- and master_controllers_proxy.rc == 0 and 'http_proxy' not in openshift.common and 'https_proxy' not in openshift.common
+ when:
+ - openshift.master.cluster_method == "native"
+ - master_controllers_proxy.rc == 0
+ - "'http_proxy' not in openshift.common"
+ - "'https_proxy' not in openshift.common"
- name: Restore Master Controllers AWS Options
lineinfile:
dest: /etc/sysconfig/{{ openshift.common.service_type }}-master-controllers
line: "{{ item }}"
with_items: "{{ master_controllers_aws.stdout_lines | default([]) }}"
- when: openshift.master.cluster_method == "native"
- and master_controllers_aws.rc == 0 and
- not (openshift_cloudprovider_kind is defined and openshift_cloudprovider_kind == 'aws' and openshift_cloudprovider_aws_access_key is defined and openshift_cloudprovider_aws_secret_key is defined)
+ when:
+ - openshift.master.cluster_method == "native"
+ - master_controllers_aws.rc == 0
+ - not (openshift_cloudprovider_kind is defined and openshift_cloudprovider_kind == 'aws' and openshift_cloudprovider_aws_access_key is defined and openshift_cloudprovider_aws_secret_key is defined)
diff --git a/roles/openshift_node_dnsmasq/meta/main.yml b/roles/openshift_node_dnsmasq/meta/main.yml
index 18e04e06d..84035b88c 100644
--- a/roles/openshift_node_dnsmasq/meta/main.yml
+++ b/roles/openshift_node_dnsmasq/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
- cloud
dependencies:
- role: openshift_common
+- role: openshift_node_facts
diff --git a/roles/openshift_node_dnsmasq/templates/origin-dns.conf.j2 b/roles/openshift_node_dnsmasq/templates/origin-dns.conf.j2
index 779b4d2f5..ef3ba2880 100644
--- a/roles/openshift_node_dnsmasq/templates/origin-dns.conf.j2
+++ b/roles/openshift_node_dnsmasq/templates/origin-dns.conf.j2
@@ -4,4 +4,4 @@ no-negcache
max-cache-ttl=1
enable-dbus
bind-interfaces
-listen-address={{ ansible_default_ipv4.address }}
+listen-address={{ openshift.node.dns_ip }}
diff --git a/roles/openshift_repos/meta/main.yml b/roles/openshift_repos/meta/main.yml
deleted file mode 100644
index 1b043863b..000000000
--- a/roles/openshift_repos/meta/main.yml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-galaxy_info:
- author: TODO
- description: OpenShift Repositories
- company: Red Hat, Inc.
- license: Apache License, Version 2.0
- min_ansible_version: 1.7
- platforms:
- - name: EL
- versions:
- - 7
- categories:
- - cloud
-dependencies:
-- role: openshift_sanitize_inventory
diff --git a/roles/rhel_subscribe/tasks/enterprise.yml b/roles/rhel_subscribe/tasks/enterprise.yml
index ea0c42150..39d59db70 100644
--- a/roles/rhel_subscribe/tasks/enterprise.yml
+++ b/roles/rhel_subscribe/tasks/enterprise.yml
@@ -7,7 +7,7 @@
when: deployment_type == 'enterprise'
- set_fact:
- default_ose_version: '3.5'
+ default_ose_version: '3.6'
when: deployment_type in ['atomic-enterprise', 'openshift-enterprise']
- set_fact:
@@ -16,7 +16,7 @@
- fail:
msg: "{{ ose_version }} is not a valid version for {{ deployment_type }} deployment type"
when: ( deployment_type == 'enterprise' and ose_version not in ['3.0'] ) or
- ( deployment_type in ['atomic-enterprise', 'openshift-enterprise'] and ose_version not in ['3.1', '3.2', '3.3', '3.4', '3.5'] )
+ ( deployment_type in ['atomic-enterprise', 'openshift-enterprise'] and ose_version not in ['3.1', '3.2', '3.3', '3.4', '3.5', '3.6'] )
- name: Enable RHEL repositories
command: subscription-manager repos \