From 296ee5ee346c843eb69786e1ab997e72870839ff Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Wed, 15 Nov 2017 13:12:12 -0500
Subject: Install web console server

---
 files/origin-components/console-config.yaml   |  21 +++++
 files/origin-components/console-template.yaml | 114 ++++++++++++++++++++++++++
 2 files changed, 135 insertions(+)
 create mode 100644 files/origin-components/console-config.yaml
 create mode 100644 files/origin-components/console-template.yaml

(limited to 'files')

diff --git a/files/origin-components/console-config.yaml b/files/origin-components/console-config.yaml
new file mode 100644
index 000000000..8f3f87c0b
--- /dev/null
+++ b/files/origin-components/console-config.yaml
@@ -0,0 +1,21 @@
+kind: AssetConfig
+apiVersion: v1
+extensionDevelopment: false
+extensionProperties: null
+extensionScripts: null
+extensionStylesheets: null
+extensions: null
+loggingPublicURL: ""
+logoutURL: ""
+masterPublicURL: https://127.0.0.1:8443
+metricsPublicURL: ""
+publicURL: https://127.0.0.1:8443/console/
+servingInfo:
+  bindAddress: 0.0.0.0:8443
+  bindNetwork: tcp4
+  certFile: /var/serving-cert/tls.crt
+  clientCA: ""
+  keyFile: /var/serving-cert/tls.key
+  maxRequestsInFlight: 0
+  namedCertificates: null
+  requestTimeoutSeconds: 0
\ No newline at end of file
diff --git a/files/origin-components/console-template.yaml b/files/origin-components/console-template.yaml
new file mode 100644
index 000000000..b2a6569fd
--- /dev/null
+++ b/files/origin-components/console-template.yaml
@@ -0,0 +1,114 @@
+apiVersion: template.openshift.io/v1
+kind: Template
+metadata:
+  name: openshift-web-console
+  annotations:
+    openshift.io/display-name: OpenShift Web Console
+    description: The server for the OpenShift web console.
+    iconClass: icon-openshift
+    tags: openshift,infra
+    openshift.io/documentation-url: https://github.com/openshift/origin-web-console-server
+    openshift.io/support-url: https://access.redhat.com
+    openshift.io/provider-display-name: Red Hat, Inc.
+parameters:
+- name: IMAGE
+  value: openshift/origin-web-console:latest
+- name: NAMESPACE
+  value: openshift-web-console
+- name: LOGLEVEL
+  value: "0"
+- name: API_SERVER_CONFIG
+- name: NODE_SELECTOR
+  value: "{}"
+- name: REPLICA_COUNT
+  value: "1"
+objects:
+
+# to create the web console server
+- apiVersion: apps/v1beta1
+  kind: Deployment
+  metadata:
+    namespace: ${NAMESPACE}
+    name: webconsole
+    labels:
+      app: openshift-web-console
+      webconsole: "true"
+  spec:
+    replicas: "${{REPLICA_COUNT}}"
+    strategy:
+      type: Recreate
+    template:
+      metadata:
+        name: webconsole
+        labels:
+          webconsole: "true"
+      spec:
+        serviceAccountName: webconsole
+        containers:
+        - name: webconsole
+          image: ${IMAGE}
+          imagePullPolicy: IfNotPresent
+          command:
+          - "/usr/bin/origin-web-console"
+          - "--audit-log-path=-"
+          - "--config=/var/webconsole-config/webconsole-config.yaml"
+          ports:
+          - containerPort: 8443
+          volumeMounts:
+          - mountPath: /var/serving-cert
+            name: serving-cert
+          - mountPath: /var/webconsole-config
+            name: webconsole-config
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8443
+              scheme: HTTPS
+        nodeSelector: "${{NODE_SELECTOR}}"
+        volumes:
+        - name: serving-cert
+          secret:
+            defaultMode: 420
+            secretName: webconsole-serving-cert
+        - name: webconsole-config
+          configMap:
+            defaultMode: 420
+            name: webconsole-config
+
+# to create the config for the web console
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    namespace: ${NAMESPACE}
+    name: webconsole-config
+    labels:
+      app: openshift-web-console
+  data:
+    webconsole-config.yaml: ${API_SERVER_CONFIG}
+
+# to be able to assign powers to the process
+- apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    namespace: ${NAMESPACE}
+    name: webconsole
+    labels:
+      app: openshift-web-console
+
+# to be able to expose web console inside the cluster
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: ${NAMESPACE}
+    name: webconsole
+    labels:
+      app: openshift-web-console
+    annotations:
+      service.alpha.openshift.io/serving-cert-secret-name: webconsole-serving-cert
+  spec:
+    selector:
+      webconsole: "true"
+    ports:
+    - name: https
+      port: 443
+      targetPort: 8443
-- 
cgit v1.2.3


From 75f245f01bd3f1d96c87f0d8a2ebe8a13f86c7ec Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Tue, 9 Jan 2018 08:41:51 -0500
Subject: Update web console template

Update the web console template based on changes in

https://github.com/openshift/origin/pull/17575
---
 files/origin-components/console-template.yaml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'files')

diff --git a/files/origin-components/console-template.yaml b/files/origin-components/console-template.yaml
index b2a6569fd..7bf2d0cf4 100644
--- a/files/origin-components/console-template.yaml
+++ b/files/origin-components/console-template.yaml
@@ -14,6 +14,7 @@ parameters:
 - name: IMAGE
   value: openshift/origin-web-console:latest
 - name: NAMESPACE
+  # This namespace cannot be changed. Only `openshift-web-console` is supported.
   value: openshift-web-console
 - name: LOGLEVEL
   value: "0"
@@ -51,6 +52,7 @@ objects:
           command:
           - "/usr/bin/origin-web-console"
           - "--audit-log-path=-"
+          - "-v=${LOGLEVEL}"
           - "--config=/var/webconsole-config/webconsole-config.yaml"
           ports:
           - containerPort: 8443
@@ -64,15 +66,20 @@ objects:
               path: /healthz
               port: 8443
               scheme: HTTPS
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8443
+              scheme: HTTPS
         nodeSelector: "${{NODE_SELECTOR}}"
         volumes:
         - name: serving-cert
           secret:
-            defaultMode: 420
+            defaultMode: 400
             secretName: webconsole-serving-cert
         - name: webconsole-config
           configMap:
-            defaultMode: 420
+            defaultMode: 440
             name: webconsole-config
 
 # to create the config for the web console
-- 
cgit v1.2.3


From c6e5d479976a306d38446c60d648150ed56c7211 Mon Sep 17 00:00:00 2001
From: Eric Wolinetz <ewolinet@redhat.com>
Date: Wed, 11 Oct 2017 09:08:50 -0500
Subject: Updating tsb image names and template

---
 files/origin-components/apiserver-template.yaml             | 6 +++---
 roles/template_service_broker/vars/default_images.yml       | 2 +-
 roles/template_service_broker/vars/openshift-enterprise.yml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'files')

diff --git a/files/origin-components/apiserver-template.yaml b/files/origin-components/apiserver-template.yaml
index 035e4734b..4dd9395d0 100644
--- a/files/origin-components/apiserver-template.yaml
+++ b/files/origin-components/apiserver-template.yaml
@@ -4,7 +4,7 @@ metadata:
   name: template-service-broker-apiserver
 parameters:
 - name: IMAGE
-  value: openshift/origin:latest
+  value: openshift/origin-template-service-broker:latest
 - name: NAMESPACE
   value: openshift-template-service-broker
 - name: LOGLEVEL
@@ -40,14 +40,14 @@ objects:
           image: ${IMAGE}
           imagePullPolicy: IfNotPresent
           command:
-          - "/usr/bin/openshift"
+          - "/usr/bin/template-service-broker"
           - "start"
           - "template-service-broker"
           - "--secure-port=8443"
           - "--audit-log-path=-"
           - "--tls-cert-file=/var/serving-cert/tls.crt"
           - "--tls-private-key-file=/var/serving-cert/tls.key"
-          - "--loglevel=${LOGLEVEL}"
+          - "--v=${LOGLEVEL}"
           - "--config=/var/apiserver-config/apiserver-config.yaml"
           ports:
           - containerPort: 8443
diff --git a/roles/template_service_broker/vars/default_images.yml b/roles/template_service_broker/vars/default_images.yml
index 77afe1f43..662d65d9f 100644
--- a/roles/template_service_broker/vars/default_images.yml
+++ b/roles/template_service_broker/vars/default_images.yml
@@ -1,4 +1,4 @@
 ---
 __template_service_broker_prefix: "docker.io/openshift/"
 __template_service_broker_version: "latest"
-__template_service_broker_image_name: "origin"
+__template_service_broker_image_name: "origin-template-service-broker"
diff --git a/roles/template_service_broker/vars/openshift-enterprise.yml b/roles/template_service_broker/vars/openshift-enterprise.yml
index dfab1e01b..16a08e72f 100644
--- a/roles/template_service_broker/vars/openshift-enterprise.yml
+++ b/roles/template_service_broker/vars/openshift-enterprise.yml
@@ -1,4 +1,4 @@
 ---
 __template_service_broker_prefix: "registry.access.redhat.com/openshift3/"
 __template_service_broker_version: "v3.7"
-__template_service_broker_image_name: "ose"
+__template_service_broker_image_name: "ose-template-service-broker"
-- 
cgit v1.2.3


From f64e26c3e753efb741f622c2a0130b979656d2f7 Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Thu, 11 Jan 2018 09:39:54 -0500
Subject: Use webconsole.config.openshift.io/v1 API group

---
 files/origin-components/console-config.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'files')

diff --git a/files/origin-components/console-config.yaml b/files/origin-components/console-config.yaml
index 8f3f87c0b..e104e8028 100644
--- a/files/origin-components/console-config.yaml
+++ b/files/origin-components/console-config.yaml
@@ -1,5 +1,5 @@
-kind: AssetConfig
-apiVersion: v1
+kind: WebConsoleConfiguration
+apiVersion: webconsole.config.openshift.io/v1
 extensionDevelopment: false
 extensionProperties: null
 extensionScripts: null
@@ -18,4 +18,4 @@ servingInfo:
   keyFile: /var/serving-cert/tls.key
   maxRequestsInFlight: 0
   namedCertificates: null
-  requestTimeoutSeconds: 0
\ No newline at end of file
+  requestTimeoutSeconds: 0
-- 
cgit v1.2.3


From 486b746324171edd691fd1682ef1221825157e62 Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Thu, 11 Jan 2018 15:24:37 -0500
Subject: Add console RBAC template

---
 files/origin-components/console-rbac-template.yaml | 38 ++++++++++++++++++++++
 roles/openshift_web_console/tasks/install.yml      | 13 +++++---
 roles/openshift_web_console/vars/main.yml          |  1 +
 3 files changed, 48 insertions(+), 4 deletions(-)
 create mode 100644 files/origin-components/console-rbac-template.yaml

(limited to 'files')

diff --git a/files/origin-components/console-rbac-template.yaml b/files/origin-components/console-rbac-template.yaml
new file mode 100644
index 000000000..9ee117199
--- /dev/null
+++ b/files/origin-components/console-rbac-template.yaml
@@ -0,0 +1,38 @@
+apiVersion: template.openshift.io/v1
+kind: Template
+metadata:
+  name: web-console-server-rbac
+parameters:
+- name: NAMESPACE
+  # This namespace cannot be changed. Only `openshift-web-console` is supported.
+  value: openshift-web-console
+objects:
+
+
+# allow grant powers to the webconsole server for cluster inspection
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: ClusterRole
+  metadata:
+    name: system:openshift:web-console-server
+  rules:
+  - apiGroups:
+    - "servicecatalog.k8s.io"
+    resources:
+    - clusterservicebrokers
+    verbs:
+    - get
+    - list
+    - watch
+
+# Grant the service account for the web console
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: ClusterRoleBinding
+  metadata:
+    name: system:openshift:web-console-server
+  roleRef:
+    kind: ClusterRole
+    name: system:openshift:web-console-server
+  subjects:
+  - kind: ServiceAccount
+    namespace: ${NAMESPACE}
+    name: webconsole
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 12916961b..287d8973d 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -21,20 +21,21 @@
     node_selector:
       - ""
 
-- name: Make temp directory for asset config files
+- name: Make temp directory for the web console config files
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
 
-- name: Copy asset config template to temp directory
+- name: Copy the web console config template to temp directory
   copy:
     src: "{{ __console_files_location }}/{{ item }}"
     dest: "{{ mktemp.stdout }}/{{ item }}"
   with_items:
     - "{{ __console_template_file }}"
+    - "{{ __console_rbac_file }}"
     - "{{ __console_config_file }}"
 
-- name: Update asset config properties
+- name: Update the web console config properties
   yedit:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
     edits:
@@ -50,7 +51,11 @@
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
   register: config
 
-- name: Apply template file
+- name: Reconcile with the web console RBAC file
+  shell: >
+    {{ openshift_client_binary }} process -f "{{ mktemp.stdout }}/{{ __console_rbac_file }}" | {{ openshift_client_binary }} auth reconcile -f -
+
+- name: Apply the web console template file
   shell: >
     {{ openshift_client_binary }} process -f "{{ mktemp.stdout }}/{{ __console_template_file }}"
     --param API_SERVER_CONFIG="{{ config['content'] | b64decode }}"
diff --git a/roles/openshift_web_console/vars/main.yml b/roles/openshift_web_console/vars/main.yml
index 80bc56a17..e91048e38 100644
--- a/roles/openshift_web_console/vars/main.yml
+++ b/roles/openshift_web_console/vars/main.yml
@@ -2,4 +2,5 @@
 __console_files_location: "../../../files/origin-components/"
 
 __console_template_file: "console-template.yaml"
+__console_rbac_file: "console-rbac-template.yaml"
 __console_config_file: "console-config.yaml"
-- 
cgit v1.2.3


From b498f10bf3e0c755dba6ce45913bd163475989fb Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Mon, 15 Jan 2018 09:06:16 -0500
Subject: Update console config for API changes

---
 files/origin-components/console-config.yaml        | 41 ++++++++++---
 roles/openshift_logging/tasks/install_logging.yaml |  9 ++-
 roles/openshift_metrics/tasks/install_metrics.yaml |  9 ++-
 roles/openshift_web_console/tasks/install.yml      | 29 ++++++++-
 .../tasks/update_asset_config.yml                  | 68 ---------------------
 .../tasks/update_console_config.yml                | 71 ++++++++++++++++++++++
 6 files changed, 144 insertions(+), 83 deletions(-)
 delete mode 100644 roles/openshift_web_console/tasks/update_asset_config.yml
 create mode 100644 roles/openshift_web_console/tasks/update_console_config.yml

(limited to 'files')

diff --git a/files/origin-components/console-config.yaml b/files/origin-components/console-config.yaml
index e104e8028..901518b28 100644
--- a/files/origin-components/console-config.yaml
+++ b/files/origin-components/console-config.yaml
@@ -1,5 +1,34 @@
-kind: WebConsoleConfiguration
 apiVersion: webconsole.config.openshift.io/v1
+kind: WebConsoleConfiguration
+clusterInfo:
+  consolePublicURL: https://127.0.0.1:8443/console/
+  loggingPublicURL: ""
+  logoutPublicURL: ""
+  masterPublicURL: https://127.0.0.1:8443
+  metricsPublicURL: ""
+# TODO: The new extensions properties cannot be set until
+# origin-web-console-server has been updated with the API changes since
+# `extensions` in the old asset config was an array.
+#extensions:
+#  scriptURLs: []
+#  stylesheetURLs: []
+#  properties: null
+features:
+  inactivityTimeoutMinutes: 0
+servingInfo:
+  bindAddress: 0.0.0.0:8443
+  bindNetwork: tcp4
+  certFile: /var/serving-cert/tls.crt
+  clientCA: ""
+  keyFile: /var/serving-cert/tls.key
+  maxRequestsInFlight: 0
+  namedCertificates: null
+  requestTimeoutSeconds: 0
+
+# START deprecated properties
+# These properties have been renamed and will be removed from the install
+# in a future pull. Keep both the old and new properties for now so that
+# the install is not broken while the origin-web-console image is updated.
 extensionDevelopment: false
 extensionProperties: null
 extensionScripts: null
@@ -10,12 +39,4 @@ logoutURL: ""
 masterPublicURL: https://127.0.0.1:8443
 metricsPublicURL: ""
 publicURL: https://127.0.0.1:8443/console/
-servingInfo:
-  bindAddress: 0.0.0.0:8443
-  bindNetwork: tcp4
-  certFile: /var/serving-cert/tls.crt
-  clientCA: ""
-  keyFile: /var/serving-cert/tls.key
-  maxRequestsInFlight: 0
-  namedCertificates: null
-  requestTimeoutSeconds: 0
+# END deprecated properties
diff --git a/roles/openshift_logging/tasks/install_logging.yaml b/roles/openshift_logging/tasks/install_logging.yaml
index ebd2d747b..ff62b6136 100644
--- a/roles/openshift_logging/tasks/install_logging.yaml
+++ b/roles/openshift_logging/tasks/install_logging.yaml
@@ -321,9 +321,14 @@
 - name: Add Kibana route information to web console asset config
   include_role:
     name: openshift_web_console
-    tasks_from: update_asset_config.yml
+    tasks_from: update_console_config.yml
   vars:
-    asset_config_edits:
+    console_config_edits:
+    - key: clusterInfo#loggingPublicURL
+      value: "https://{{ openshift_logging_kibana_hostname }}"
+    # Continue to set the old deprecated property until the
+    # origin-web-console image is updated for the new name.
+    # This will be removed in a future pull.
     - key: loggingPublicURL
       value: "https://{{ openshift_logging_kibana_hostname }}"
   when: openshift_web_console_install | default(true) | bool
diff --git a/roles/openshift_metrics/tasks/install_metrics.yaml b/roles/openshift_metrics/tasks/install_metrics.yaml
index 0866fe0d2..4a63d081e 100644
--- a/roles/openshift_metrics/tasks/install_metrics.yaml
+++ b/roles/openshift_metrics/tasks/install_metrics.yaml
@@ -74,9 +74,14 @@
 - name: Add metrics route information to web console asset config
   include_role:
     name: openshift_web_console
-    tasks_from: update_asset_config.yml
+    tasks_from: update_console_config.yml
   vars:
-    asset_config_edits:
+    console_config_edits:
+      - key: clusterInfo#metricsPublicURL
+        value: "https://{{ openshift_metrics_hawkular_hostname}}/hawkular/metrics"
+      # Continue to set the old deprecated property until the
+      # origin-web-console image is updated for the new name.
+      # This will be removed in a future pull.
       - key: metricsPublicURL
         value: "https://{{ openshift_metrics_hawkular_hostname}}/hawkular/metrics"
   when: openshift_web_console_install | default(true) | bool
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 287d8973d..50e72657f 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -39,13 +39,40 @@
   yedit:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
     edits:
-      - key: logoutURL
+      - key: clusterInfo#consolePublicURL
+        # Must have a trailing slash
+        value: "{{ openshift.master.public_console_url }}/"
+      - key: clusterInfo#masterPublicURL
+        value: "{{ openshift.master.public_api_url }}"
+      - key: clusterInfo#logoutPublicURL
         value: "{{ openshift.master.logout_url | default('') }}"
+      - key: features#inactivityTimeoutMinutes
+        value: "{{ openshift_web_console_inactivity_timeout_minutes | default(0) }}"
+
+      # TODO: The new extensions properties cannot be set until
+      # origin-web-console-server has been updated with the API changes since
+      # `extensions` in the old asset config was an array.
+
+      # - key: extensions#scriptURLs
+      #   value: "{{ openshift_web_console_extension_script_urls | default([]) }}"
+      # - key: extensions#stylesheetURLs
+      #   value: "{{ openshift_web_console_extension_stylesheet_urls | default([]) }}"
+      # - key: extensions#properties
+      #   value: "{{ openshift_web_console_extension_properties | default({}) }}"
+
+      # DEPRECATED PROPERTIES
+      # These properties have been renamed and will be removed from the install
+      # in a future pull. Keep both the old and new properties for now so that
+      # the install is not broken while the origin-web-console image is updated.
       - key: publicURL
         # Must have a trailing slash
         value: "{{ openshift.master.public_console_url }}/"
+      - key: logoutURL
+        value: "{{ openshift.master.logout_url | default('') }}"
       - key: masterPublicURL
         value: "{{ openshift.master.public_api_url }}"
+    separator: '#'
+    state: present
 
 - slurp:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
diff --git a/roles/openshift_web_console/tasks/update_asset_config.yml b/roles/openshift_web_console/tasks/update_asset_config.yml
deleted file mode 100644
index 21b293bed..000000000
--- a/roles/openshift_web_console/tasks/update_asset_config.yml
+++ /dev/null
@@ -1,68 +0,0 @@
----
-# This task updates asset config values in the webconsole-config config map in
-# the openshift-web-console namespace. The values to set are pased in the
-# variable `asset_config_edits`, which is an array of objects with `key` and
-# `value` properties in the same format as `yedit` module `edits`. Only
-# properties passed are updated.
-#
-# Note that this triggers a redeployment on the console and a brief downtime
-# since it uses a `Recreate` strategy.
-#
-# Example usage:
-#
-# - include_role:
-#     name: openshift_web_console
-#     tasks_from: update_asset_config.yml
-#   vars:
-#     asset_config_edits:
-#       - key: loggingPublicURL
-#         value: "https://{{ openshift_logging_kibana_hostname }}"
-#   when: openshift_web_console_install | default(true) | bool
-
-- name: Read web console config map
-  oc_configmap:
-    namespace: openshift-web-console
-    name: webconsole-config
-    state: list
-  register: webconsole_config
-
-- name: Make temp directory
-  command: mktemp -d /tmp/console-ansible-XXXXXX
-  register: mktemp_console
-  changed_when: False
-
-- name: Copy asset config to temp file
-  copy:
-    content: "{{webconsole_config.results.results[0].data['webconsole-config.yaml']}}"
-    dest: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-
-- name: Change asset config properties
-  yedit:
-    src: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-    edits: "{{asset_config_edits}}"
-
-- name: Update web console config map
-  oc_configmap:
-    namespace: openshift-web-console
-    name: webconsole-config
-    state: present
-    from_file:
-      webconsole-config.yaml: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-
-- name: Remove temp directory
-  file:
-    state: absent
-    name: "{{ mktemp_console.stdout }}"
-  changed_when: False
-
-# There's currently no command to trigger a rollout for a k8s deployment
-# without changing the pod spec. Add an annotation to force a rollout after
-# the config map has been edited.
-- name: Rollout updated web console deployment
-  oc_edit:
-    kind: deployments
-    name: webconsole
-    namespace: openshift-web-console
-    separator: '#'
-    content:
-      spec#template#metadata#annotations#installer-triggered-rollout: "{{ ansible_date_time.iso8601_micro }}"
diff --git a/roles/openshift_web_console/tasks/update_console_config.yml b/roles/openshift_web_console/tasks/update_console_config.yml
new file mode 100644
index 000000000..e347c0193
--- /dev/null
+++ b/roles/openshift_web_console/tasks/update_console_config.yml
@@ -0,0 +1,71 @@
+---
+# This task updates asset config values in the webconsole-config config map in
+# the openshift-web-console namespace. The values to set are pased in the
+# variable `console_config_edits`, which is an array of objects with `key` and
+# `value` properties in the same format as `yedit` module `edits`. Only
+# properties passed are updated. The separator for nested properties is `#`.
+#
+# Note that this triggers a redeployment on the console and a brief downtime
+# since it uses a `Recreate` strategy.
+#
+# Example usage:
+#
+# - include_role:
+#     name: openshift_web_console
+#     tasks_from: update_console_config.yml
+#   vars:
+#     console_config_edits:
+#       - key: clusterInfo#loggingPublicURL
+#         value: "https://{{ openshift_logging_kibana_hostname }}"
+#   when: openshift_web_console_install | default(true) | bool
+
+- name: Read web console config map
+  oc_configmap:
+    namespace: openshift-web-console
+    name: webconsole-config
+    state: list
+  register: webconsole_config
+
+- name: Make temp directory
+  command: mktemp -d /tmp/console-ansible-XXXXXX
+  register: mktemp_console
+  changed_when: False
+
+- name: Copy web console config to temp file
+  copy:
+    content: "{{webconsole_config.results.results[0].data['webconsole-config.yaml']}}"
+    dest: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+
+- name: Change web console config properties
+  yedit:
+    src: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+    edits: "{{console_config_edits}}"
+    separator: '#'
+    state: present
+
+- name: Update web console config map
+  oc_configmap:
+    namespace: openshift-web-console
+    name: webconsole-config
+    state: present
+    from_file:
+      webconsole-config.yaml: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+
+- name: Remove temp directory
+  file:
+    state: absent
+    name: "{{ mktemp_console.stdout }}"
+  changed_when: False
+
+# TODO: Only rollout if config has changed.
+# There's currently no command to trigger a rollout for a k8s deployment
+# without changing the pod spec. Add an annotation to force a rollout after
+# the config map has been edited.
+- name: Rollout updated web console deployment
+  oc_edit:
+    kind: deployments
+    name: webconsole
+    namespace: openshift-web-console
+    separator: '#'
+    content:
+      spec#template#metadata#annotations#installer-triggered-rollout: "{{ ansible_date_time.iso8601_micro }}"
-- 
cgit v1.2.3