summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/etcd/tasks/main.yml24
-rw-r--r--roles/etcd_client_certificates/meta/main.yml2
-rw-r--r--roles/etcd_client_certificates/tasks/main.yml24
-rw-r--r--roles/etcd_server_certificates/tasks/main.yml43
-rw-r--r--roles/openshift_ca/tasks/main.yml63
-rw-r--r--roles/openshift_etcd_server_certificates/meta/main.yml16
-rw-r--r--roles/openshift_hosted/templates/registry_config.j27
-rw-r--r--roles/openshift_master/tasks/main.yml34
-rw-r--r--roles/openshift_master/templates/master.yaml.v1.j24
-rw-r--r--roles/openshift_master_certificates/tasks/main.yml54
-rw-r--r--roles/openshift_node/templates/node.yaml.v1.j24
-rw-r--r--roles/openshift_node_certificates/tasks/main.yml9
12 files changed, 202 insertions, 82 deletions
diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml
index 75d40216d..ba4136327 100644
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -58,30 +58,6 @@
group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
mode: 0700
-- name: Validate permissions on certificate files
- file:
- path: "{{ item }}"
- mode: 0600
- owner: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
- group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
- when: etcd_url_scheme == 'https'
- with_items:
- - "{{ etcd_ca_file }}"
- - "{{ etcd_cert_file }}"
- - "{{ etcd_key_file }}"
-
-- name: Validate permissions on peer certificate files
- file:
- path: "{{ item }}"
- mode: 0600
- owner: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
- group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
- when: etcd_peer_url_scheme == 'https'
- with_items:
- - "{{ etcd_peer_ca_file }}"
- - "{{ etcd_peer_cert_file }}"
- - "{{ etcd_peer_key_file }}"
-
- name: Write etcd global config file
template:
src: etcd.conf.j2
diff --git a/roles/etcd_client_certificates/meta/main.yml b/roles/etcd_client_certificates/meta/main.yml
index 713c78c70..efebdb599 100644
--- a/roles/etcd_client_certificates/meta/main.yml
+++ b/roles/etcd_client_certificates/meta/main.yml
@@ -13,4 +13,4 @@ galaxy_info:
- cloud
- system
dependencies:
-- role: etcd_ca
+- role: etcd_common
diff --git a/roles/etcd_client_certificates/tasks/main.yml b/roles/etcd_client_certificates/tasks/main.yml
index b86afb81c..275aa0a63 100644
--- a/roles/etcd_client_certificates/tasks/main.yml
+++ b/roles/etcd_client_certificates/tasks/main.yml
@@ -1,4 +1,19 @@
---
+- name: Ensure CA certificate exists on etcd_ca_host
+ stat:
+ path: "{{ etcd_ca_cert }}"
+ register: g_ca_cert_stat_result
+ delegate_to: "{{ etcd_ca_host }}"
+ run_once: true
+
+- fail:
+ msg: >
+ CA certificate {{ etcd_ca_cert }} doesn't exist on CA host
+ {{ etcd_ca_host }}. Apply 'etcd_ca' role to
+ {{ etcd_ca_host }}.
+ when: not g_ca_cert_stat_result.stat.exists | bool
+ run_once: true
+
- name: Check status of external etcd certificatees
stat:
path: "{{ etcd_cert_config_dir }}/{{ item }}"
@@ -7,11 +22,14 @@
- "{{ etcd_cert_prefix }}client.key"
- "{{ etcd_cert_prefix }}ca.crt"
register: g_external_etcd_cert_stat_result
+ when: not etcd_certificates_redeploy | default(false) | bool
- set_fact:
- etcd_client_certs_missing: "{{ False in (g_external_etcd_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
+ etcd_client_certs_missing: "{{ true if etcd_certificates_redeploy | default(false) | bool
+ else (False in (g_external_etcd_cert_stat_result.results
+ | default({})
+ | oo_collect(attribute='stat.exists')
+ | list)) }}"
- name: Ensure generated_certs directory present
file:
diff --git a/roles/etcd_server_certificates/tasks/main.yml b/roles/etcd_server_certificates/tasks/main.yml
index f11b51453..27bd2a88d 100644
--- a/roles/etcd_server_certificates/tasks/main.yml
+++ b/roles/etcd_server_certificates/tasks/main.yml
@@ -7,11 +7,14 @@
- "{{ etcd_cert_prefix }}peer.crt"
- "{{ etcd_cert_prefix }}ca.crt"
register: g_etcd_server_cert_stat_result
+ when: not etcd_certificates_redeploy | default(false) | bool
- set_fact:
- etcd_server_certs_missing: "{{ False in (g_etcd_server_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
+ etcd_server_certs_missing: "{{ true if etcd_certificates_redeploy | default(false) | bool
+ else (False in (g_etcd_server_cert_stat_result.results
+ | default({})
+ | oo_collect(attribute='stat.exists')
+ | list)) }}"
- name: Ensure generated_certs directory present
file:
@@ -69,6 +72,8 @@
when: etcd_server_certs_missing | bool
delegate_to: "{{ etcd_ca_host }}"
+# Certificates must be signed serially in order to avoid competing
+# for the serial file.
- name: Sign and create the peer crt
delegated_serial_command:
command: >
@@ -136,3 +141,35 @@
changed_when: False
when: etcd_server_certs_missing | bool
delegate_to: localhost
+
+- name: Validate permissions on certificate files
+ file:
+ path: "{{ item }}"
+ mode: 0600
+ owner: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ when: etcd_url_scheme == 'https'
+ with_items:
+ - "{{ etcd_ca_file }}"
+ - "{{ etcd_cert_file }}"
+ - "{{ etcd_key_file }}"
+
+- name: Validate permissions on peer certificate files
+ file:
+ path: "{{ item }}"
+ mode: 0600
+ owner: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ when: etcd_peer_url_scheme == 'https'
+ with_items:
+ - "{{ etcd_peer_ca_file }}"
+ - "{{ etcd_peer_cert_file }}"
+ - "{{ etcd_peer_key_file }}"
+
+- name: Validate permissions on the config dir
+ file:
+ path: "{{ etcd_conf_dir }}"
+ state: directory
+ owner: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ group: "{{ 'etcd' if not etcd_is_containerized | bool else omit }}"
+ mode: 0700
diff --git a/roles/openshift_ca/tasks/main.yml b/roles/openshift_ca/tasks/main.yml
index e1bf7dcad..bb89b65a6 100644
--- a/roles/openshift_ca/tasks/main.yml
+++ b/roles/openshift_ca/tasks/main.yml
@@ -3,6 +3,10 @@
msg: "openshift_ca_host variable must be defined for this role"
when: openshift_ca_host is not defined
+- fail:
+ msg: "Both 'certfile' and 'keyfile' keys must be supplied when configuring openshift_master_ca_certificate"
+ when: openshift_master_ca_certificate is defined and ('certfile' not in openshift_master_ca_certificate or 'keyfile' not in openshift_master_ca_certificate)
+
- name: Install the base package for admin tooling
action: "{{ ansible_pkg_mgr }} name={{ openshift.common.service_type }}{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }} state=present"
when: not openshift.common.is_containerized | bool
@@ -35,9 +39,43 @@
run_once: true
- set_fact:
- master_ca_missing: "{{ False in (g_master_ca_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
+ master_ca_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
+ else False in (g_master_ca_stat_result.results
+ | oo_collect(attribute='stat.exists')
+ | list) }}"
+ run_once: true
+
+- name: Retain original serviceaccount keys
+ copy:
+ src: "{{ item }}"
+ dest: "{{ item }}.keep"
+ remote_src: true
+ with_items:
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
+ when: openshift_certificates_redeploy | default(false) | bool
+
+- name: Deploy master ca certificate
+ copy:
+ src: "{{ item.src }}"
+ dest: "{{ openshift_ca_config_dir }}/{{ item.dest }}"
+ force: "{{ true if openshift_certificates_redeploy_ca | default(false) | bool else false }}"
+ with_items:
+ - src: "{{ (openshift_master_ca_certificate | default({'certfile':none})).certfile }}"
+ dest: ca.crt
+ - src: "{{ (openshift_master_ca_certificate | default({'keyfile':none})).keyfile }}"
+ dest: ca.key
+ when: openshift_master_ca_certificate is defined
+ delegate_to: "{{ openshift_ca_host }}"
+ run_once: true
+
+- name: Create ca serial
+ copy:
+ content: "1"
+ dest: "{{ openshift_ca_config_dir }}/ca.serial.txt"
+ force: "{{ true if openshift_certificates_redeploy | default(false) | bool else false }}"
+ when: openshift_master_ca_certificate is defined
+ delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Create the master certificates if they do not already exist
@@ -54,3 +92,22 @@
when: master_ca_missing | bool
delegate_to: "{{ openshift_ca_host }}"
run_once: true
+
+- name: Restore original serviceaccount keys
+ copy:
+ src: "{{ item }}.keep"
+ dest: "{{ item }}"
+ remote_src: true
+ with_items:
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
+ when: openshift_certificates_redeploy | default(false) | bool
+
+- name: Remove backup serviceaccount keys
+ file:
+ path: "{{ item }}.keep"
+ state: absent
+ with_items:
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
+ - "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
+ when: openshift_certificates_redeploy | default(false) | bool
diff --git a/roles/openshift_etcd_server_certificates/meta/main.yml b/roles/openshift_etcd_server_certificates/meta/main.yml
new file mode 100644
index 000000000..7750f14af
--- /dev/null
+++ b/roles/openshift_etcd_server_certificates/meta/main.yml
@@ -0,0 +1,16 @@
+---
+galaxy_info:
+ author: Jason DeTiberus
+ description: OpenShift Etcd Server Certificates
+ company: Red Hat, Inc.
+ license: Apache License, Version 2.0
+ min_ansible_version: 2.1
+ platforms:
+ - name: EL
+ versions:
+ - 7
+ categories:
+ - cloud
+dependencies:
+- role: openshift_etcd_facts
+- role: etcd_server_certificates
diff --git a/roles/openshift_hosted/templates/registry_config.j2 b/roles/openshift_hosted/templates/registry_config.j2
index ea5626642..71539775d 100644
--- a/roles/openshift_hosted/templates/registry_config.j2
+++ b/roles/openshift_hosted/templates/registry_config.j2
@@ -58,6 +58,10 @@ auth:
openshift:
realm: openshift
middleware:
+{% if openshift.common.version_gte_3_3_or_1_3 | bool %}
+ registry:
+ - name: openshift
+{% endif -%}
repository:
- name: openshift
options:
@@ -69,4 +73,7 @@ middleware:
baseurl: {{ openshift.hosted.registry.storage.s3.cloudfront.baseurl }}
privatekey: {{ openshift.hosted.registry.storage.s3.cloudfront.privatekeyfile }}
keypairid: {{ openshift.hosted.registry.storage.s3.cloudfront.keypairid }}
+{% elif openshift.common.version_gte_3_3_or_1_3 | bool %}
+ storage:
+ - name: openshift
{% endif -%}
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index e1efb4c2b..6259fd996 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -277,37 +277,3 @@
- name: Set the cluster user password
shell: echo {{ openshift_master_cluster_password | quote }} | passwd --stdin hacluster
when: install_result | changed
-
-- name: Lookup default group for ansible_ssh_user
- command: "/usr/bin/id -g {{ ansible_ssh_user }}"
- changed_when: false
- register: _ansible_ssh_user_gid
-
-- set_fact:
- client_users: "{{ [ansible_ssh_user, 'root'] | unique }}"
-
-- name: Create the client config dir(s)
- file:
- path: "~{{ item }}/.kube"
- state: directory
- mode: 0700
- owner: "{{ item }}"
- group: "{{ 'root' if item == 'root' else _ansible_ssh_user_gid.stdout }}"
- with_items: "{{ client_users }}"
-
-# TODO: Update this file if the contents of the source file are not present in
-# the dest file, will need to make sure to ignore things that could be added
-- name: Copy the admin client config(s)
- command: cp {{ openshift_master_config_dir }}/admin.kubeconfig ~{{ item }}/.kube/config
- args:
- creates: ~{{ item }}/.kube/config
- with_items: "{{ client_users }}"
-
-- name: Update the permissions on the admin client config(s)
- file:
- path: "~{{ item }}/.kube/config"
- state: file
- mode: 0700
- owner: "{{ item }}"
- group: "{{ 'root' if item == 'root' else _ansible_ssh_user_gid.stdout }}"
- with_items: "{{ client_users }}"
diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index a5f346543..31e86f5bd 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -136,7 +136,7 @@ masterClients:
acceptContentTypes: application/vnd.kubernetes.protobuf,application/json
contentType: application/vnd.kubernetes.protobuf
burst: 400
- ops: 200
+ qps: 200
{% endif %}
externalKubernetesKubeConfig: ""
{% if openshift.common.version_gte_3_3_or_1_3 | bool %}
@@ -144,7 +144,7 @@ masterClients:
acceptContentTypes: application/vnd.kubernetes.protobuf,application/json
contentType: application/vnd.kubernetes.protobuf
burst: 600
- ops: 300
+ qps: 300
{% endif %}
openshiftLoopbackKubeConfig: openshift-master.kubeconfig
masterPublicURL: {{ openshift.master.public_api_url }}
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index 9ed082d9f..aafb06f93 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -21,18 +21,22 @@
with_items:
- "{{ openshift_master_certs }}"
register: g_master_cert_stat_result
+ when: not openshift_certificates_redeploy | default(false) | bool
- set_fact:
- master_certs_missing: "{{ False in (g_master_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
+ master_certs_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
+ else (False in (g_master_cert_stat_result.results
+ | default({})
+ | oo_collect(attribute='stat.exists')
+ | list)) }}"
+
- name: Ensure the generated_configs directory present
file:
path: "{{ openshift_master_generated_config_dir }}"
state: directory
mode: 0700
- when: master_certs_missing | bool
+ when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
delegate_to: "{{ openshift_ca_host }}"
- file:
@@ -43,7 +47,7 @@
- ca.crt
- ca.key
- ca.serial.txt
- when: master_certs_missing | bool
+ when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
delegate_to: "{{ openshift_ca_host }}"
- name: Create the master certificates if they do not already exist
@@ -57,7 +61,7 @@
--public-master={{ openshift.master.public_api_url }}
--cert-dir={{ openshift_master_generated_config_dir }}
--overwrite=false
- when: master_certs_missing | bool
+ when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
delegate_to: "{{ openshift_ca_host }}"
- file:
@@ -67,7 +71,7 @@
force: true
with_items:
- "{{ hostvars[inventory_hostname] | certificates_to_synchronize }}"
- when: master_certs_missing | bool
+ when: master_certs_missing | bool and inventory_hostname != openshift_ca_host
delegate_to: "{{ openshift_ca_host }}"
- name: Remove generated etcd client certs when using external etcd
@@ -124,3 +128,39 @@
when: master_certs_missing | bool
delegate_to: localhost
become: no
+
+- name: Lookup default group for ansible_ssh_user
+ command: "/usr/bin/id -g {{ ansible_ssh_user }}"
+ changed_when: false
+ register: _ansible_ssh_user_gid
+
+- set_fact:
+ client_users: "{{ [ansible_ssh_user, 'root'] | unique }}"
+
+- name: Create the client config dir(s)
+ file:
+ path: "~{{ item }}/.kube"
+ state: directory
+ mode: 0700
+ owner: "{{ item }}"
+ group: "{{ 'root' if item == 'root' else _ansible_ssh_user_gid.stdout }}"
+ with_items: "{{ client_users }}"
+
+# TODO: Update this file if the contents of the source file are not present in
+# the dest file, will need to make sure to ignore things that could be added
+- name: Copy the admin client config(s)
+ copy:
+ src: "{{ openshift_master_config_dir }}/admin.kubeconfig"
+ dest: "~{{ item }}/.kube/config"
+ remote_src: yes
+ force: "{{ openshift_certificates_redeploy | default(false) }}"
+ with_items: "{{ client_users }}"
+
+- name: Update the permissions on the admin client config(s)
+ file:
+ path: "~{{ item }}/.kube/config"
+ state: file
+ mode: 0700
+ owner: "{{ item }}"
+ group: "{{ 'root' if item == 'root' else _ansible_ssh_user_gid.stdout }}"
+ with_items: "{{ client_users }}"
diff --git a/roles/openshift_node/templates/node.yaml.v1.j2 b/roles/openshift_node/templates/node.yaml.v1.j2
index 4e13d9052..414f0d5e3 100644
--- a/roles/openshift_node/templates/node.yaml.v1.j2
+++ b/roles/openshift_node/templates/node.yaml.v1.j2
@@ -16,8 +16,8 @@ kubeletArguments: {{ openshift.node.kubelet_args | default(None) | to_padded_yam
masterClientConnectionOverrides:
acceptContentTypes: application/vnd.kubernetes.protobuf,application/json
contentType: application/vnd.kubernetes.protobuf
- burst: 40
- ops: 20
+ burst: 200
+ qps: 100
{% endif %}
masterKubeConfig: system:node:{{ openshift.common.hostname }}.kubeconfig
{% if openshift.common.use_openshift_sdn | bool and not openshift.common.version_gte_3_3_or_1_3 | bool %}
diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml
index 8768fb0c2..fef7caab8 100644
--- a/roles/openshift_node_certificates/tasks/main.yml
+++ b/roles/openshift_node_certificates/tasks/main.yml
@@ -25,11 +25,14 @@
- server.key
- server.crt
register: g_node_cert_stat_result
+ when: not openshift_certificates_redeploy | default(false) | bool
- set_fact:
- node_certs_missing: "{{ False in (g_node_cert_stat_result.results
- | oo_collect(attribute='stat.exists')
- | list) }}"
+ node_certs_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
+ else (False in (g_node_cert_stat_result.results
+ | default({})
+ | oo_collect(attribute='stat.exists')
+ | list)) }}"
- name: Create openshift_generated_configs_dir if it does not exist
file: