From 03e6ae850ce718c008636bd8db093f453e62ccf3 Mon Sep 17 00:00:00 2001
From: Andrew Butcher <abutcher@redhat.com>
Date: Thu, 12 Nov 2015 10:46:25 -0500
Subject: Refactor named certificates.

---
 roles/openshift_master/templates/master.yaml.v1.j2 | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

(limited to 'roles/openshift_master')

diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index bb12a0a0f..2a37c06d9 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -27,9 +27,6 @@ corsAllowedOrigins:
 {% for custom_origin in openshift.master.custom_cors_origins | default("") %}
   - {{ custom_origin }}
 {% endfor %}
-{% for name in (named_certificates | map(attribute='names')) | list | oo_flatten %}
-  - {{ name }}
-{% endfor %}
 {% if 'disabled_features' in openshift.master %}
 disabledFeatures: {{ openshift.master.disabled_features | to_json }}
 {% endif %}
@@ -144,9 +141,9 @@ servingInfo:
   keyFile: master.server.key
   maxRequestsInFlight: 500
   requestTimeoutSeconds: 3600
-{% if named_certificates %}
+{% if openshift.master.named_certificates %}
   namedCertificates:
-{% for named_certificate in named_certificates %}
+{% for named_certificate in openshift.master.named_certificates %}
   - certFile: {{ named_certificate['certfile'] }}
     keyFile: {{ named_certificate['keyfile'] }}
     names:
-- 
cgit v1.2.3


From 3cbe7df8461e5514773e416d137980ce9bedf33d Mon Sep 17 00:00:00 2001
From: Jason DeTiberus <jdetiber@redhat.com>
Date: Mon, 16 Nov 2015 16:01:54 -0500
Subject: Refactor master identity provider configuration

- Remote template in favor of a filter plugin
- Add additional validation for identity provider config
- Add mappingMethod attribute for identity providers, default to 'claim'
---
 filter_plugins/openshift_master.py                 | 469 +++++++++++++++++++++
 roles/openshift_master/tasks/main.yml              |  16 +-
 roles/openshift_master/templates/master.yaml.v1.j2 |  19 +-
 .../templates/v1_partials/oauthConfig.j2           |  93 ----
 4 files changed, 498 insertions(+), 99 deletions(-)
 create mode 100644 filter_plugins/openshift_master.py
 delete mode 100644 roles/openshift_master/templates/v1_partials/oauthConfig.j2

(limited to 'roles/openshift_master')

diff --git a/filter_plugins/openshift_master.py b/filter_plugins/openshift_master.py
new file mode 100644
index 000000000..76fe610a0
--- /dev/null
+++ b/filter_plugins/openshift_master.py
@@ -0,0 +1,469 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# vim: expandtab:tabstop=4:shiftwidth=4
+'''
+Custom filters for use in openshift-master
+'''
+import copy
+import sys
+import yaml
+
+from ansible import errors
+from ansible.runner.filter_plugins.core import bool as ansible_bool
+
+
+class IdentityProviderBase(object):
+    """ IdentityProviderBase
+
+        Attributes:
+            name (str): Identity provider Name
+            login (bool): Is this identity provider a login provider?
+            challenge (bool): Is this identity provider a challenge provider?
+            provider (dict): Provider specific config
+            _idp (dict): internal copy of the IDP dict passed in
+            _required (list): List of lists of strings for required attributes
+            _optional (list): List of lists of strings for optional attributes
+            _allow_additional (bool): Does this provider support attributes
+                not in _required and _optional
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    # disabling this check since the number of instance attributes are
+    # necessary for this class
+    # pylint: disable=too-many-instance-attributes
+    def __init__(self, api_version, idp):
+        if api_version not in ['v1']:
+            raise errors.AnsibleFilterError("|failed api version {0} unknown".format(api_version))
+
+        self._idp = copy.deepcopy(idp)
+
+        if 'name' not in self._idp:
+            raise errors.AnsibleFilterError("|failed identity provider missing a name")
+
+        if 'kind' not in self._idp:
+            raise errors.AnsibleFilterError("|failed identity provider missing a kind")
+
+        self.name = self._idp.pop('name')
+        self.login = ansible_bool(self._idp.pop('login', False))
+        self.challenge = ansible_bool(self._idp.pop('challenge', False))
+        self.provider = dict(apiVersion=api_version, kind=self._idp.pop('kind'))
+
+        self._required = [['mappingMethod', 'mapping_method']]
+        self._optional = []
+        self._allow_additional = True
+
+    @staticmethod
+    def validate_idp_list(idp_list):
+        ''' validates a list of idps '''
+        login_providers = [x.name for x in idp_list if x.login]
+        if len(login_providers) > 1:
+            raise errors.AnsibleFilterError("|failed multiple providers are "
+                                            "not allowed for login. login "
+                                            "providers: {0}".format(', '.join(login_providers)))
+
+        names = [x.name for x in idp_list]
+        if len(set(names)) != len(names):
+            raise errors.AnsibleFilterError("|failed more than one provider configured with the same name")
+
+        for idp in idp_list:
+            idp.validate()
+
+    def validate(self):
+        ''' validate an instance of this idp class '''
+        valid_mapping_methods = ['add', 'claim', 'generate', 'lookup']
+        if self.provider['mappingMethod'] not in valid_mapping_methods:
+            raise errors.AnsibleFilterError("|failed unkown mapping method "
+                                            "for provider {0}".format(self.__class__.__name__))
+
+    @staticmethod
+    def get_default(key):
+        ''' get a default value for a given key '''
+        if key == 'mappingMethod':
+            return 'claim'
+        else:
+            return None
+
+    def set_provider_item(self, items, required=False):
+        ''' set a provider item based on the list of item names provided. '''
+        for item in items:
+            provider_key = items[0]
+            if item in self._idp:
+                self.provider[provider_key] = self._idp.pop(item)
+                break
+        else:
+            default = self.get_default(provider_key)
+            if default is not None:
+                self.provider[provider_key] = default
+            elif required:
+                raise errors.AnsibleFilterError("|failed provider {0} missing "
+                                                "required key {1}".format(self.__class__.__name__, provider_key))
+
+    def set_provider_items(self):
+        ''' set the provider items for this idp '''
+        for items in self._required:
+            self.set_provider_item(items, True)
+        for items in self._optional:
+            self.set_provider_item(items)
+        if self._allow_additional:
+            for key in self._idp.keys():
+                self.set_provider_item([key])
+        else:
+            if len(self._idp) > 0:
+                raise errors.AnsibleFilterError("|failed provider {0} "
+                                                "contains unknown keys "
+                                                "{1}".format(self.__class__.__name__, ', '.join(self._idp.keys())))
+
+    def to_dict(self):
+        ''' translate this idp to a dictionary '''
+        return dict(name=self.name, challenge=self.challenge,
+                    login=self.login, provider=self.provider)
+
+
+class LDAPPasswordIdentityProvider(IdentityProviderBase):
+    """ LDAPPasswordIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['attributes'], ['url'], ['insecure']]
+        self._optional += [['ca'],
+                           ['bindDN', 'bind_dn'],
+                           ['bindPassword', 'bind_password']]
+
+        self._idp['insecure'] = ansible_bool(self._idp.pop('insecure', False))
+
+        if 'attributes' in self._idp and 'preferred_username' in self._idp['attributes']:
+            pref_user = self._idp['attributes'].pop('preferred_username')
+            self._idp['attributes']['preferredUsername'] = pref_user
+
+    def validate(self):
+        ''' validate this idp instance '''
+        IdentityProviderBase.validate(self)
+        if not isinstance(self.provider['attributes'], dict):
+            raise errors.AnsibleFilterError("|failed attributes for provider "
+                                            "{0} must be a dictionary".format(self.__class__.__name__))
+
+        attrs = ['id', 'email', 'name', 'preferredUsername']
+        for attr in attrs:
+            if attr in self.provider['attributes'] and not isinstance(self.provider['attributes'][attr], list):
+                raise errors.AnsibleFilterError("|failed {0} attribute for "
+                                                "provider {1} must be a list".format(attr, self.__class__.__name__))
+
+        unknown_attrs = set(self.provider['attributes'].keys()) - set(attrs)
+        if len(unknown_attrs) > 0:
+            raise errors.AnsibleFilterError("|failed provider {0} has unknown "
+                                            "attributes: {1}".format(self.__class__.__name__, ', '.join(unknown_attrs)))
+
+
+class KeystonePasswordIdentityProvider(IdentityProviderBase):
+    """ KeystoneIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['url'], ['domainName', 'domain_name']]
+        self._optional += [['ca'], ['certFile', 'cert_file'], ['keyFile', 'key_file']]
+
+
+class RequestHeaderIdentityProvider(IdentityProviderBase):
+    """ RequestHeaderIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['headers']]
+        self._optional += [['challengeURL', 'challenge_url'],
+                           ['loginURL', 'login_url'],
+                           ['clientCA', 'client_ca']]
+
+    def validate(self):
+        ''' validate this idp instance '''
+        IdentityProviderBase.validate(self)
+        if not isinstance(self.provider['headers'], list):
+            raise errors.AnsibleFilterError("|failed headers for provider {0} "
+                                            "must be a list".format(self.__class__.__name__))
+
+
+class AllowAllPasswordIdentityProvider(IdentityProviderBase):
+    """ AllowAllPasswordIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+
+
+class DenyAllPasswordIdentityProvider(IdentityProviderBase):
+    """ DenyAllPasswordIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+
+
+class HTPasswdPasswordIdentityProvider(IdentityProviderBase):
+    """ HTPasswdPasswordIdentity
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['file', 'filename', 'fileName', 'file_name']]
+
+    @staticmethod
+    def get_default(key):
+        if key == 'file':
+            return '/etc/origin/htpasswd'
+        else:
+            return IdentityProviderBase.get_default(key)
+
+
+class BasicAuthPasswordIdentityProvider(IdentityProviderBase):
+    """ BasicAuthPasswordIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['ca'], ['certFile', 'cert_file'], ['keyFile', 'key_file']]
+        self._optional += [['key']]
+
+
+class IdentityProviderOauthBase(IdentityProviderBase):
+    """ IdentityProviderOauthBase
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderBase.__init__(self, api_version, idp)
+        self._allow_additional = False
+        self._required += [['clientID', 'client_id'], ['clientSecret', 'client_secret']]
+
+    def validate(self):
+        ''' validate this idp instance '''
+        IdentityProviderBase.validate(self)
+        if self.challenge:
+            raise errors.AnsibleFilterError("|failed provider {0} does not "
+                                            "allow challenge authentication".format(self.__class__.__name__))
+
+
+class OpenIDIdentityProvider(IdentityProviderOauthBase):
+    """ OpenIDIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderOauthBase.__init__(self, api_version, idp)
+        self._required += [['claims'], ['urls']]
+        self._optional += [['ca'],
+                           ['extraScopes'],
+                           ['extraAuthorizeParameters']]
+        if 'claims' in self._idp and 'preferred_username' in self._idp['claims']:
+            pref_user = self._idp['claims'].pop('preferred_username')
+            self._idp['claims']['preferredUsername'] = pref_user
+        if 'urls' in self._idp and 'user_info' in self._idp['urls']:
+            user_info = self._idp['urls'].pop('user_info')
+            self._idp['urls']['userInfo'] = user_info
+        if 'extra_scopes' in self._idp:
+            self._idp['extraScopes'] = self._idp.pop('extra_scopes')
+        if 'extra_authorize_parameters' in self._idp:
+            self._idp['extraAuthorizeParameters'] = self._idp.pop('extra_authorize_parameters')
+
+        if 'extraAuthorizeParameters' in self._idp:
+            if 'include_granted_scopes' in self._idp['extraAuthorizeParameters']:
+                val = ansible_bool(self._idp['extraAuthorizeParameters'].pop('include_granted_scopes'))
+                self._idp['extraAuthorizeParameters']['include_granted_scopes'] = val
+
+
+    def validate(self):
+        ''' validate this idp instance '''
+        IdentityProviderOauthBase.validate(self)
+        if not isinstance(self.provider['claims'], dict):
+            raise errors.AnsibleFilterError("|failed claims for provider {0} "
+                                            "must be a dictionary".format(self.__class__.__name__))
+
+        if 'extraScopes' not in self.provider['extraScopes'] and not isinstance(self.provider['extraScopes'], list):
+            raise errors.AnsibleFilterError("|failed extraScopes for provider "
+                                            "{0} must be a list".format(self.__class__.__name__))
+        if ('extraAuthorizeParameters' not in self.provider['extraAuthorizeParameters']
+                and not  isinstance(self.provider['extraAuthorizeParameters'], dict)):
+            raise errors.AnsibleFilterError("|failed extraAuthorizeParameters "
+                                            "for provider {0} must be a dictionary".format(self.__class__.__name__))
+
+        required_claims = ['id']
+        optional_claims = ['email', 'name', 'preferredUsername']
+        all_claims = required_claims + optional_claims
+
+        for claim in required_claims:
+            if claim in required_claims and claim not in self.provider['claims']:
+                raise errors.AnsibleFilterError("|failed {0} claim missing "
+                                                "for provider {1}".format(claim, self.__class__.__name__))
+
+        for claim in all_claims:
+            if claim in self.provider['claims'] and not isinstance(self.provider['claims'][claim], list):
+                raise errors.AnsibleFilterError("|failed {0} claims for "
+                                                "provider {1} must be a list".format(claim, self.__class__.__name__))
+
+        unknown_claims = set(self.provider['claims'].keys()) - set(all_claims)
+        if len(unknown_claims) > 0:
+            raise errors.AnsibleFilterError("|failed provider {0} has unknown "
+                                            "claims: {1}".format(self.__class__.__name__, ', '.join(unknown_claims)))
+
+        if not isinstance(self.provider['urls'], dict):
+            raise errors.AnsibleFilterError("|failed urls for provider {0} "
+                                            "must be a dictionary".format(self.__class__.__name__))
+
+        required_urls = ['authorize', 'token']
+        optional_urls = ['userInfo']
+        all_urls = required_urls + optional_urls
+
+        for url in required_urls:
+            if url not in self.provider['urls']:
+                raise errors.AnsibleFilterError("|failed {0} url missing for "
+                                                "provider {1}".format(url, self.__class__.__name__))
+
+        unknown_urls = set(self.provider['urls'].keys()) - set(all_urls)
+        if len(unknown_urls) > 0:
+            raise errors.AnsibleFilterError("|failed provider {0} has unknown "
+                                            "urls: {1}".format(self.__class__.__name__, ', '.join(unknown_urls)))
+
+
+class GoogleIdentityProvider(IdentityProviderOauthBase):
+    """ GoogleIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    def __init__(self, api_version, idp):
+        IdentityProviderOauthBase.__init__(self, api_version, idp)
+        self._optional += [['hostedDomain', 'hosted_domain']]
+
+
+class GitHubIdentityProvider(IdentityProviderOauthBase):
+    """ GitHubIdentityProvider
+
+        Attributes:
+
+        Args:
+            api_version(str): OpenShift config version
+            idp (dict): idp config dict
+
+        Raises:
+            AnsibleFilterError:
+    """
+    pass
+
+
+class FilterModule(object):
+    ''' Custom ansible filters for use by the openshift_master role'''
+
+    @staticmethod
+    def translate_idps(idps, api_version):
+        ''' Translates a list of dictionaries into a valid identityProviders config '''
+        idp_list = []
+
+        if not isinstance(idps, list):
+            raise errors.AnsibleFilterError("|failed expects to filter on a list of identity providers")
+        for idp in idps:
+            if not isinstance(idp, dict):
+                raise errors.AnsibleFilterError("|failed identity providers must be a list of dictionaries")
+
+            cur_module = sys.modules[__name__]
+            idp_class = getattr(cur_module, idp['kind'], None)
+            idp_inst = idp_class(api_version, idp) if idp_class is not None else IdentityProviderBase(api_version, idp)
+            idp_inst.set_provider_items()
+            idp_list.append(idp_inst)
+
+
+        IdentityProviderBase.validate_idp_list(idp_list)
+        return yaml.safe_dump([idp.to_dict() for idp in idp_list], default_flow_style=False)
+
+
+    def filters(self):
+        ''' returns a mapping of filters to methods '''
+        return {"translate_idps": self.translate_idps}
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 185bfb8f3..ed174dbfc 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -1,13 +1,16 @@
 ---
-# TODO: add validation for openshift_master_identity_providers
 # TODO: add ability to configure certificates given either a local file to
 #       point to or certificate contents, set in default cert locations.
 
-- assert:
-    that:
-    - openshift_master_oauth_grant_method in openshift_master_valid_grant_methods
-  when: openshift_master_oauth_grant_method is defined
+# Authentication Variable Validation
+# TODO: validate the different identity provider kinds as well
+- fail:
+    msg: >
+      Invalid OAuth grant method: {{ openshift_master_oauth_grant_method }}
+  when: openshift_master_oauth_grant_method is defined and openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods
+
 
+# HA Variable Validation
 - fail:
     msg: "openshift_master_cluster_method must be set to either 'native' or 'pacemaker' for multi-master installations"
   when: openshift_master_ha | bool and ((openshift_master_cluster_method is not defined) or (openshift_master_cluster_method is defined and openshift_master_cluster_method not in ["native", "pacemaker"]))
@@ -172,6 +175,9 @@
   - restart master
   - restart master api
 
+- set_fact:
+    translated_identity_providers: "{{ openshift_master_identity_providers | translate_idps('v1') }}"
+
 # TODO: add the validate parameter when there is a validation command to run
 - name: Create master config
   template:
diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index 2a37c06d9..9f4a17f0a 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -107,7 +107,24 @@ networkConfig:
 {% endif %}
 # serviceNetworkCIDR must match kubernetesMasterConfig.servicesSubnet
   serviceNetworkCIDR: {{ openshift.master.portal_net }}
-{% include 'v1_partials/oauthConfig.j2' %}
+oauthConfig:
+  assetPublicURL: {{ openshift.master.public_console_url }}/
+  grantConfig:
+    method: {{ openshift.master.oauth_grant_method }}
+  identityProviders:
+{% for line in translated_identity_providers.splitlines() %}
+  {{ line }}
+{% endfor %}
+  masterCA: ca.crt
+  masterPublicURL: {{ openshift.master.public_api_url }}
+  masterURL: {{ openshift.master.api_url }}
+  sessionConfig:
+    sessionMaxAgeSeconds: {{ openshift.master.session_max_seconds }}
+    sessionName: {{ openshift.master.session_name }}
+    sessionSecretsFile: {{ openshift.master.session_secrets_file }}
+  tokenConfig:
+    accessTokenMaxAgeSeconds: {{ openshift.master.access_token_max_seconds }}
+    authorizeTokenMaxAgeSeconds: {{ openshift.master.auth_token_max_seconds }}
 pauseControllers: false
 policyConfig:
   bootstrapPolicyFile: {{ openshift_master_policy }}
diff --git a/roles/openshift_master/templates/v1_partials/oauthConfig.j2 b/roles/openshift_master/templates/v1_partials/oauthConfig.j2
deleted file mode 100644
index 8a4f5a746..000000000
--- a/roles/openshift_master/templates/v1_partials/oauthConfig.j2
+++ /dev/null
@@ -1,93 +0,0 @@
-{% macro identity_provider_config(identity_provider) %}
-      apiVersion: v1
-      kind: {{ identity_provider.kind }}
-{% if identity_provider.kind == 'HTPasswdPasswordIdentityProvider' %}
-      file: {{ identity_provider.filename }}
-{% elif identity_provider.kind == 'BasicAuthPasswordIdentityProvider' %}
-      url: {{ identity_provider.url }}
-{% for key in ('ca', 'certFile', 'keyFile') %}
-{% if key in identity_provider %}
-      {{ key }}: "{{ identity_provider[key] }}"
-{% endif %}
-{% endfor %}
-{% elif identity_provider.kind == 'LDAPPasswordIdentityProvider' %}
-      attributes:
-{% for attribute_key in identity_provider.attributes %}
-        {{ attribute_key }}:
-{% for attribute_value in identity_provider.attributes[attribute_key] %}
-        - {{ attribute_value }}
-{% endfor %}
-{% endfor %}
-{% for key in ('bindDN', 'bindPassword', 'ca') %}
-      {{ key }}: "{{ identity_provider[key] }}"
-{% endfor %}
-{% for key in ('insecure', 'url') %}
-      {{ key }}: {{ identity_provider[key] }}
-{% endfor %}
-{% elif identity_provider.kind == 'RequestHeaderIdentityProvider' %}
-      headers: {{ identity_provider.headers }}
-{% if 'clientCA' in identity_provider %}
-      clientCA: {{ identity_provider.clientCA }}
-{% endif %}
-{% elif identity_provider.kind == 'GitHubIdentityProvider' %}
-      clientID: {{ identity_provider.clientID }}
-      clientSecret: {{ identity_provider.clientSecret }}
-{% elif identity_provider.kind == 'GoogleIdentityProvider' %}
-      clientID: {{ identity_provider.clientID }}
-      clientSecret: {{ identity_provider.clientSecret }}
-{% if 'hostedDomain' in identity_provider %}
-      hostedDomain: {{ identity_provider.hostedDomain }}
-{% endif %}
-{% elif identity_provider.kind == 'OpenIDIdentityProvider' %}
-      clientID: {{ identity_provider.clientID }}
-      clientSecret: {{ identity_provider.clientSecret }}
-      claims:
-        id: identity_provider.claims.id
-{% for claim_key in ('preferredUsername', 'name', 'email') %}
-{% if claim_key in identity_provider.claims %}
-        {{ claim_key }}: {{ identity_provider.claims[claim_key] }}
-{% endif %}
-{% endfor %}
-      urls:
-        authorize: {{ identity_provider.urls.authorize }}
-        token: {{ identity_provider.urls.token }}
-{% if 'userInfo' in identity_provider.urls %}
-        userInfo: {{ identity_provider.userInfo }}
-{% endif %}
-{% if 'extraScopes' in identity_provider %}
-      extraScopes:
-{% for scope in identity_provider.extraScopes %}
-      - {{ scope }}
-{% endfor %}
-{% endif %}
-{% if 'extraAuthorizeParameters' in identity_provider %}
-      extraAuthorizeParameters:
-{% for param_key, param_value in identity_provider.extraAuthorizeParameters.iteritems() %}
-        {{ param_key }}: {{ param_value }}
-{% endfor %}
-{% endif %}
-{% endif %}
-{% endmacro %}
-oauthConfig:
-  assetPublicURL: {{ openshift.master.public_console_url }}/
-  grantConfig:
-    method: {{ openshift.master.oauth_grant_method }}
-  identityProviders:
-{% for identity_provider in openshift.master.identity_providers %}
-  - name: {{ identity_provider.name }}
-    challenge: {{ identity_provider.challenge }}
-    login: {{ identity_provider.login }}
-    provider:
-{{ identity_provider_config(identity_provider) }}
-{%- endfor %}
-  masterCA: ca.crt
-  masterPublicURL: {{ openshift.master.public_api_url }}
-  masterURL: {{ openshift.master.api_url }}
-  sessionConfig:
-    sessionMaxAgeSeconds: {{ openshift.master.session_max_seconds }}
-    sessionName: {{ openshift.master.session_name }}
-    sessionSecretsFile: {{ openshift.master.session_secrets_file }}
-  tokenConfig:
-    accessTokenMaxAgeSeconds: {{ openshift.master.access_token_max_seconds }}
-    authorizeTokenMaxAgeSeconds: {{ openshift.master.auth_token_max_seconds }}
-{# Comment to preserve newline after authorizeTokenMaxAgeSeconds #}
-- 
cgit v1.2.3


From 783309075eb284f7c605817502418773e3463992 Mon Sep 17 00:00:00 2001
From: Jason DeTiberus <jdetiber@redhat.com>
Date: Mon, 23 Nov 2015 11:54:35 -0500
Subject: Use the identity_providers from openshift_facts instead of always
 using the inventory variable

---
 roles/openshift_master/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'roles/openshift_master')

diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index ed174dbfc..2cf2a53c4 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -176,7 +176,7 @@
   - restart master api
 
 - set_fact:
-    translated_identity_providers: "{{ openshift_master_identity_providers | translate_idps('v1') }}"
+    translated_identity_providers: "{{ openshift.master.identity_providers | translate_idps('v1') }}"
 
 # TODO: add the validate parameter when there is a validation command to run
 - name: Create master config
-- 
cgit v1.2.3


From af009a7a51d7b6f5799a14c452cc7db92727135e Mon Sep 17 00:00:00 2001
From: Adam Miller <admiller@redhat.com>
Date: Wed, 18 Nov 2015 16:19:19 -0600
Subject: Fedora changes:

  - ansible bootstrap playbook for Fedora 23+
  - add conditionals to handle yum vs dnf
  - add Fedora OpenShift COPR
  - update BYO host README for repo configs and fedora bootstrap

Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml

rebase on master, update package cache refresh handler for yum vs dnf

Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml
---
 README_origin.md                                   | 15 ++++++++
 inventory/byo/hosts.example                        |  4 +++
 playbooks/adhoc/bootstrap-fedora.yml               |  5 +++
 playbooks/adhoc/uninstall.yml                      | 34 +++++++++++++++++-
 roles/ansible/tasks/main.yml                       |  7 ++++
 roles/cockpit/tasks/main.yml                       | 12 +++++++
 roles/copr_cli/tasks/main.yml                      |  6 ++++
 roles/docker/tasks/main.yml                        |  5 +++
 roles/etcd/README.md                               |  2 +-
 roles/etcd/tasks/main.yml                          |  5 +++
 roles/flannel/README.md                            |  3 +-
 roles/flannel/tasks/main.yml                       |  6 ++++
 roles/fluentd_master/tasks/main.yml                |  7 ++++
 roles/fluentd_node/tasks/main.yml                  |  7 ++++
 roles/haproxy/tasks/main.yml                       |  7 ++++
 roles/kube_nfs_volumes/tasks/main.yml              |  5 +++
 roles/kube_nfs_volumes/tasks/nfs.yml               |  5 +++
 roles/openshift_ansible_inventory/tasks/main.yml   | 10 ++++++
 roles/openshift_expand_partition/README.md         |  2 +-
 roles/openshift_expand_partition/tasks/main.yml    |  5 +++
 roles/openshift_facts/tasks/main.yml               |  7 ++++
 roles/openshift_master/tasks/main.yml              | 20 +++++++++--
 roles/openshift_master_ca/tasks/main.yml           |  6 ++++
 roles/openshift_node/tasks/main.yml                | 13 ++++++-
 .../openshift_node/tasks/storage_plugins/ceph.yml  |  7 ++++
 .../tasks/storage_plugins/glusterfs.yml            |  7 ++++
 .../repos/maxamillion-fedora-openshift-fedora.repo |  8 +++++
 roles/openshift_repos/handlers/main.yml            |  5 ++-
 roles/openshift_repos/tasks/main.yaml              | 42 +++++++++++++++++-----
 roles/openshift_storage_nfs_lvm/tasks/nfs.yml      |  5 +++
 roles/os_env_extras/tasks/main.yaml                |  7 ++++
 roles/os_firewall/tasks/firewall/firewalld.yml     |  8 +++++
 roles/os_firewall/tasks/firewall/iptables.yml      | 11 ++++++
 roles/os_update_latest/tasks/main.yml              |  5 +++
 roles/yum_repos/README.md                          |  2 +-
 utils/site_assets/oo-install-bootstrap.sh          |  9 ++++-
 36 files changed, 296 insertions(+), 18 deletions(-)
 create mode 100644 playbooks/adhoc/bootstrap-fedora.yml
 create mode 100644 roles/openshift_repos/files/fedora-origin/repos/maxamillion-fedora-openshift-fedora.repo

(limited to 'roles/openshift_master')

diff --git a/README_origin.md b/README_origin.md
index cb213a93a..343ecda3d 100644
--- a/README_origin.md
+++ b/README_origin.md
@@ -39,6 +39,12 @@ subscription-manager repos \
 ```
 * Configuration of router is not automated yet
 * Configuration of docker-registry is not automated yet
+* Fedora 23+ doesn't come with python2 and will need a quick bootstrap. Setup
+  your inventory as described below and run the following (substituting the
+  `$PATH_TO_INVENTORY_FILE` with the actual path to your inventory file):
+```sh
+ansible-playbook ./playbooks/adhoc/bootstrap-fedora.yml -i $PATH_TO_INVENTORY_FILE
+```
 
 ## Configuring the host inventory
 [Ansible docs](http://docs.ansible.com/intro_inventory.html)
@@ -59,6 +65,7 @@ nodes
 
 # Set variables common for all OSEv3 hosts
 [OSv3:vars]
+
 # SSH user, this user should allow ssh based auth without requiring a password
 ansible_ssh_user=root
 
@@ -75,6 +82,14 @@ osv3-master.example.com
 [nodes]
 osv3-master.example.com
 osv3-node[1:2].example.com
+
+# host group for etcd
+[etcd]
+osv3-etcd[1:3].example.com
+
+[lb]
+osv3-lb.example.com
+
 ```
 
 The hostnames above should resolve both from the hosts themselves and
diff --git a/inventory/byo/hosts.example b/inventory/byo/hosts.example
index 1a67cc290..29d81d64f 100644
--- a/inventory/byo/hosts.example
+++ b/inventory/byo/hosts.example
@@ -36,6 +36,10 @@ deployment_type=atomic-enterprise
 # Origin copr repo
 #openshift_additional_repos=[{'id': 'openshift-origin-copr', 'name': 'OpenShift Origin COPR', 'baseurl': 'https://copr-be.cloud.fedoraproject.org/results/maxamillion/origin-next/epel-7-$basearch/', 'enabled': 1, 'gpgcheck': 1, gpgkey: 'https://copr-be.cloud.fedoraproject.org/results/maxamillion/origin-next/pubkey.gpg'}]
 
+# Origin Fedora copr repo
+# Use this if you are installing on Fedora
+#openshift_additional_repos=[{'id': 'fedora-openshift-origin-copr', 'name': 'OpenShift Origin COPR for Fedora', 'baseurl': 'https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/fedora-$releasever-$basearch/', 'enabled': 1, 'gpgcheck': 1, gpgkey: 'https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/pubkey.gpg'}]
+
 # htpasswd auth
 openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true', 'challenge': 'true', 'kind': 'HTPasswdPasswordIdentityProvider', 'filename': '/etc/openshift/htpasswd'}]
 
diff --git a/playbooks/adhoc/bootstrap-fedora.yml b/playbooks/adhoc/bootstrap-fedora.yml
new file mode 100644
index 000000000..de9f36c8a
--- /dev/null
+++ b/playbooks/adhoc/bootstrap-fedora.yml
@@ -0,0 +1,5 @@
+- hosts: OSv3
+  gather_facts: false
+  tasks:
+    - name: install python and deps for ansible modules
+      raw: dnf install -y python2 python2-dnf libselinux-python libsemanage-python
diff --git a/playbooks/adhoc/uninstall.yml b/playbooks/adhoc/uninstall.yml
index 1f1ada3f0..08a2ea6fb 100644
--- a/playbooks/adhoc/uninstall.yml
+++ b/playbooks/adhoc/uninstall.yml
@@ -48,7 +48,39 @@
         - pcsd
 
     - yum: name={{ item }} state=absent
-      when: not is_atomic | bool
+      when: ansible_pkg_mgr == "yum" and not is_atomic | bool
+      with_items:
+        - atomic-enterprise
+        - atomic-enterprise-master
+        - atomic-enterprise-node
+        - atomic-enterprise-sdn-ovs
+        - atomic-openshift
+        - atomic-openshift-clients
+        - atomic-openshift-master
+        - atomic-openshift-node
+        - atomic-openshift-sdn-ovs
+        - corosync
+        - etcd
+        - openshift
+        - openshift-master
+        - openshift-node
+        - openshift-sdn
+        - openshift-sdn-ovs
+        - openvswitch
+        - origin
+        - origin-clients
+        - origin-master
+        - origin-node
+        - origin-sdn-ovs
+        - pacemaker
+        - pcs
+        - tuned-profiles-atomic-enterprise-node
+        - tuned-profiles-atomic-openshift-node
+        - tuned-profiles-openshift-node
+        - tuned-profiles-origin-node
+
+    - dnf: name={{ item }} state=absent
+      when: ansible_pkg_mgr == "dnf" and not is_atomic | bool
       with_items:
         - atomic-enterprise
         - atomic-enterprise-master
diff --git a/roles/ansible/tasks/main.yml b/roles/ansible/tasks/main.yml
index 5d20a3b35..f79273824 100644
--- a/roles/ansible/tasks/main.yml
+++ b/roles/ansible/tasks/main.yml
@@ -5,6 +5,13 @@
   yum:
     pkg: ansible
     state: installed
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install Ansible
+  dnf:
+    pkg: ansible
+    state: installed
+  when: ansible_pkg_mgr == "dnf"
 
 - include: config.yml
   vars:
diff --git a/roles/cockpit/tasks/main.yml b/roles/cockpit/tasks/main.yml
index 875cbad21..8410e7c90 100644
--- a/roles/cockpit/tasks/main.yml
+++ b/roles/cockpit/tasks/main.yml
@@ -8,6 +8,18 @@
     - cockpit-shell
     - cockpit-bridge
     - "{{ cockpit_plugins }}"
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install cockpit-ws
+  dnf:
+    name: "{{ item }}"
+    state: present
+  with_items:
+    - cockpit-ws
+    - cockpit-shell
+    - cockpit-bridge
+    - "{{ cockpit_plugins }}"
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Enable cockpit-ws
   service:
diff --git a/roles/copr_cli/tasks/main.yml b/roles/copr_cli/tasks/main.yml
index f7ef1c26e..f8496199d 100644
--- a/roles/copr_cli/tasks/main.yml
+++ b/roles/copr_cli/tasks/main.yml
@@ -2,3 +2,9 @@
 - yum:
     name: copr-cli
     state: present
+  when: ansible_pkg_mgr == "yum"
+
+- dnf:
+    name: copr-cli
+    state: present
+  when: ansible_pkg_mgr == "dnf"
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index 96949230d..dd4401389 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -2,6 +2,11 @@
 # tasks file for docker
 - name: Install docker
   yum: pkg=docker
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install docker
+  dnf: pkg=docker
+  when: ansible_pkg_mgr == "dnf"
 
 - name: enable and start the docker service
   service: name=docker enabled=yes state=started
diff --git a/roles/etcd/README.md b/roles/etcd/README.md
index 88e4ff874..329a926c0 100644
--- a/roles/etcd/README.md
+++ b/roles/etcd/README.md
@@ -7,7 +7,7 @@ Requirements
 ------------
 
 This role assumes it's being deployed on a RHEL/Fedora based host with package
-named 'etcd' available via yum.
+named 'etcd' available via yum or dnf (conditionally).
 
 Role Variables
 --------------
diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml
index fcbdecd37..efaab5f31 100644
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -9,6 +9,11 @@
 
 - name: Install etcd
   yum: pkg=etcd-2.* state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install etcd
+  dnf: pkg=etcd* state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Validate permissions on the config dir
   file:
diff --git a/roles/flannel/README.md b/roles/flannel/README.md
index b8aa830ac..8f271aada 100644
--- a/roles/flannel/README.md
+++ b/roles/flannel/README.md
@@ -7,7 +7,8 @@ Requirements
 ------------
 
 This role assumes it's being deployed on a RHEL/Fedora based host with package
-named 'flannel' available via yum, in version superior to 0.3.
+named 'flannel' available via yum or dnf (conditionally), in version superior
+to 0.3.
 
 Role Variables
 --------------
diff --git a/roles/flannel/tasks/main.yml b/roles/flannel/tasks/main.yml
index acfb009ec..86e1bc96e 100644
--- a/roles/flannel/tasks/main.yml
+++ b/roles/flannel/tasks/main.yml
@@ -2,6 +2,12 @@
 - name: Install flannel
   sudo: true
   yum: pkg=flannel state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install flannel
+  sudo: true
+  dnf: pkg=flannel state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Set flannel etcd url
   sudo: true
diff --git a/roles/fluentd_master/tasks/main.yml b/roles/fluentd_master/tasks/main.yml
index 55cd94460..43c499b4d 100644
--- a/roles/fluentd_master/tasks/main.yml
+++ b/roles/fluentd_master/tasks/main.yml
@@ -4,6 +4,13 @@
   yum:
     name: 'http://packages.treasuredata.com/2/redhat/7/x86_64/td-agent-2.2.0-0.x86_64.rpm'
     state: present
+  when: ansible_pkg_mgr == "yum"
+
+- name: download and install td-agent
+  dnf:
+    name: 'http://packages.treasuredata.com/2/redhat/7/x86_64/td-agent-2.2.0-0.x86_64.rpm'
+    state: present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Verify fluentd plugin installed
   command: '/opt/td-agent/embedded/bin/gem query -i fluent-plugin-kubernetes'
diff --git a/roles/fluentd_node/tasks/main.yml b/roles/fluentd_node/tasks/main.yml
index f9ef30b83..827a1c075 100644
--- a/roles/fluentd_node/tasks/main.yml
+++ b/roles/fluentd_node/tasks/main.yml
@@ -4,6 +4,13 @@
   yum:
     name: 'http://packages.treasuredata.com/2/redhat/7/x86_64/td-agent-2.2.0-0.x86_64.rpm'
     state: present
+  when: ansible_pkg_mgr == "yum"
+
+- name: download and install td-agent
+  dnf:
+    name: 'http://packages.treasuredata.com/2/redhat/7/x86_64/td-agent-2.2.0-0.x86_64.rpm'
+    state: present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Verify fluentd plugin installed
   command: '/opt/td-agent/embedded/bin/gem query -i fluent-plugin-kubernetes'
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
index 5638b7313..5d015fadd 100644
--- a/roles/haproxy/tasks/main.yml
+++ b/roles/haproxy/tasks/main.yml
@@ -3,6 +3,13 @@
   yum:
     pkg: haproxy
     state: present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install haproxy
+  dnf:
+    pkg: haproxy
+    state: present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Configure haproxy
   template:
diff --git a/roles/kube_nfs_volumes/tasks/main.yml b/roles/kube_nfs_volumes/tasks/main.yml
index d1dcf261a..3fcb9fd18 100644
--- a/roles/kube_nfs_volumes/tasks/main.yml
+++ b/roles/kube_nfs_volumes/tasks/main.yml
@@ -1,6 +1,11 @@
 ---
 - name: Install pyparted (RedHat/Fedora)
   yum: name=pyparted,python-httplib2 state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install pyparted (RedHat/Fedora)
+  dnf: name=pyparted,python-httplib2 state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: partition the drives
   partitionpool: disks={{ disks }} force={{ force }} sizes={{ sizes }}
diff --git a/roles/kube_nfs_volumes/tasks/nfs.yml b/roles/kube_nfs_volumes/tasks/nfs.yml
index 559fcf17c..a58a7b824 100644
--- a/roles/kube_nfs_volumes/tasks/nfs.yml
+++ b/roles/kube_nfs_volumes/tasks/nfs.yml
@@ -1,6 +1,11 @@
 ---
 - name: Install NFS server on Fedora/Red Hat
   yum: name=nfs-utils state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install NFS server on Fedora/Red Hat
+  dnf: name=nfs-utils state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Start rpcbind on Fedora/Red Hat
   service: name=rpcbind state=started enabled=yes
diff --git a/roles/openshift_ansible_inventory/tasks/main.yml b/roles/openshift_ansible_inventory/tasks/main.yml
index f6919dada..2b99f8bcd 100644
--- a/roles/openshift_ansible_inventory/tasks/main.yml
+++ b/roles/openshift_ansible_inventory/tasks/main.yml
@@ -2,6 +2,16 @@
 - yum:
     name: "{{ item }}"
     state: present
+  when: ansible_pkg_mgr == "yum"
+  with_items:
+  - openshift-ansible-inventory
+  - openshift-ansible-inventory-aws
+  - openshift-ansible-inventory-gce
+
+- dnf:
+    name: "{{ item }}"
+    state: present
+  when: ansible_pkg_mgr == "dnf"
   with_items:
   - openshift-ansible-inventory
   - openshift-ansible-inventory-aws
diff --git a/roles/openshift_expand_partition/README.md b/roles/openshift_expand_partition/README.md
index cd394e1ba..aed4ec871 100644
--- a/roles/openshift_expand_partition/README.md
+++ b/roles/openshift_expand_partition/README.md
@@ -8,7 +8,7 @@ partition, and then expanding the file system on the partition.
 
 * A machine with a disk that is not fully utilized
 
-* cloud-utils-growpart rpm (either installed or avialable via yum)
+* cloud-utils-growpart rpm (either installed or avialable via yum or dnf)
 
 * The partition you are expanding needs to be at the end of the partition list
 
diff --git a/roles/openshift_expand_partition/tasks/main.yml b/roles/openshift_expand_partition/tasks/main.yml
index 8bc399070..42e7903fd 100644
--- a/roles/openshift_expand_partition/tasks/main.yml
+++ b/roles/openshift_expand_partition/tasks/main.yml
@@ -1,6 +1,11 @@
 ---
 - name: Ensure growpart is installed
   yum: pkg=cloud-utils-growpart state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Ensure growpart is installed
+  dnf: pkg=cloud-utils-growpart state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Grow the partitions
   command: "growpart {{oep_drive}} {{oep_partition}}"
diff --git a/roles/openshift_facts/tasks/main.yml b/roles/openshift_facts/tasks/main.yml
index 913f0dc78..2e889d7d5 100644
--- a/roles/openshift_facts/tasks/main.yml
+++ b/roles/openshift_facts/tasks/main.yml
@@ -8,6 +8,13 @@
 
 - name: Ensure PyYaml is installed
   yum: pkg={{ item }} state=installed
+  when: ansible_pkg_mgr == "yum"
+  with_items:
+    - PyYAML
+
+- name: Ensure PyYaml is installed
+  dnf: pkg={{ item }} state=installed
+  when: ansible_pkg_mgr == "dnf"
   with_items:
     - PyYAML
 
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 2cf2a53c4..9d7880041 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -79,6 +79,12 @@
 
 - name: Install Master package
   yum: pkg={{ openshift.common.service_type }}-master{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "yum"
+  register: install_result
+
+- name: Install Master package
+  dnf: pkg={{ openshift.common.service_type }}-master{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "dnf"
   register: install_result
 
 # TODO: These values need to be configurable
@@ -118,7 +124,12 @@
 
 - name: Install httpd-tools if needed
   yum: pkg=httpd-tools state=present
-  when: item.kind == 'HTPasswdPasswordIdentityProvider'
+  when: (ansible_pkg_mgr == "yum") and (item.kind == 'HTPasswdPasswordIdentityProvider')
+  with_items: openshift.master.identity_providers
+
+- name: Install httpd-tools if needed
+  dnf: pkg=httpd-tools state=present
+  when: (ansible_pkg_mgr == "dnf") and (item.kind == 'HTPasswdPasswordIdentityProvider')
   with_items: openshift.master.identity_providers
 
 - name: Ensure htpasswd directory exists
@@ -263,7 +274,12 @@
 
 - name: Install cluster packages
   yum: pkg=pcs state=present
-  when: openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
+  when: (ansible_pkg_mgr == "yum") and openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
+  register: install_result
+
+- name: Install cluster packages
+  dnf: pkg=pcs state=present
+  when: (ansible_pkg_mgr == "dnf") and openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
   register: install_result
 
 - name: Start and enable cluster service
diff --git a/roles/openshift_master_ca/tasks/main.yml b/roles/openshift_master_ca/tasks/main.yml
index 314f068e7..caac13be3 100644
--- a/roles/openshift_master_ca/tasks/main.yml
+++ b/roles/openshift_master_ca/tasks/main.yml
@@ -1,6 +1,12 @@
 ---
 - name: Install the base package for admin tooling
   yum: pkg={{ openshift.common.service_type }}{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "yum"
+  register: install_result
+
+- name: Install the base package for admin tooling
+  dnf: pkg={{ openshift.common.service_type }}{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "dnf"
   register: install_result
 
 - name: Reload generated facts
diff --git a/roles/openshift_node/tasks/main.yml b/roles/openshift_node/tasks/main.yml
index 42d984a09..36bcc1a90 100644
--- a/roles/openshift_node/tasks/main.yml
+++ b/roles/openshift_node/tasks/main.yml
@@ -40,12 +40,23 @@
 # problems because the rpms don't pin the version properly.
 - name: Install Node package
   yum: pkg={{ openshift.common.service_type }}-node{{ openshift_version  }},tuned-profiles-{{ openshift.common.service_type }}-node{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "yum"
+  register: node_install_result
+
+- name: Install Node package
+  dnf: pkg={{ openshift.common.service_type }}-node{{ openshift_version  }},tuned-profiles-{{ openshift.common.service_type }}-node{{ openshift_version  }} state=present
+  when: ansible_pkg_mgr == "dnf"
   register: node_install_result
 
 - name: Install sdn-ovs package
   yum: pkg={{ openshift.common.service_type }}-sdn-ovs{{ openshift_version }} state=present
   register: sdn_install_result
-  when: openshift.common.use_openshift_sdn
+  when: ansible_pkg_mgr == "yum" and openshift.common.use_openshift_sdn
+
+- name: Install sdn-ovs package
+  dnf: pkg={{ openshift.common.service_type }}-sdn-ovs{{ openshift_version }} state=present
+  register: sdn_install_result
+  when: ansible_pkg_mgr == "dnf" and openshift.common.use_openshift_sdn
 
 # TODO: add the validate parameter when there is a validation command to run
 - name: Create the Node config
diff --git a/roles/openshift_node/tasks/storage_plugins/ceph.yml b/roles/openshift_node/tasks/storage_plugins/ceph.yml
index b6936618a..b5146dcac 100644
--- a/roles/openshift_node/tasks/storage_plugins/ceph.yml
+++ b/roles/openshift_node/tasks/storage_plugins/ceph.yml
@@ -3,3 +3,10 @@
   yum:
     pkg: ceph-common
     state: installed
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install Ceph storage plugin dependencies
+  dnf:
+    pkg: ceph-common
+    state: installed
+  when: ansible_pkg_mgr == "dnf"
diff --git a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
index decf4f49d..a357023e1 100644
--- a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
+++ b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
@@ -3,6 +3,13 @@
   yum:
     pkg: glusterfs-fuse
     state: installed
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install GlusterFS storage plugin dependencies
+  dnf:
+    pkg: glusterfs-fuse
+    state: installed
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Set sebooleans to allow gluster storage plugin access from containers
   seboolean:
diff --git a/roles/openshift_repos/files/fedora-origin/repos/maxamillion-fedora-openshift-fedora.repo b/roles/openshift_repos/files/fedora-origin/repos/maxamillion-fedora-openshift-fedora.repo
new file mode 100644
index 000000000..bc0435d82
--- /dev/null
+++ b/roles/openshift_repos/files/fedora-origin/repos/maxamillion-fedora-openshift-fedora.repo
@@ -0,0 +1,8 @@
+[maxamillion-fedora-openshift]
+name=Copr repo for fedora-openshift owned by maxamillion
+baseurl=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/fedora-$releasever-$basearch/
+skip_if_unavailable=True
+gpgcheck=1
+gpgkey=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/pubkey.gpg
+enabled=1
+enabled_metadata=1
\ No newline at end of file
diff --git a/roles/openshift_repos/handlers/main.yml b/roles/openshift_repos/handlers/main.yml
index 26558a455..fed4ab2f0 100644
--- a/roles/openshift_repos/handlers/main.yml
+++ b/roles/openshift_repos/handlers/main.yml
@@ -1,3 +1,6 @@
 ---
-- name: refresh package cache
+- name: refresh yum cache
   command: yum clean all
+
+- name: refresh dnf cache
+  command: dnf clean all
diff --git a/roles/openshift_repos/tasks/main.yaml b/roles/openshift_repos/tasks/main.yaml
index 66be0cb7b..c55b5df89 100644
--- a/roles/openshift_repos/tasks/main.yaml
+++ b/roles/openshift_repos/tasks/main.yaml
@@ -14,38 +14,64 @@
   yum:
     pkg: libselinux-python
     state: present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Ensure libselinux-python is installed
+  dnf:
+    pkg: libselinux-python
+    state: present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Create any additional repos that are defined
   template:
     src: yum_repo.j2
     dest: /etc/yum.repos.d/openshift_additional.repo
   when: openshift_additional_repos | length > 0
-  notify: refresh package cache
+  notify: refresh yum cache
 
 - name: Remove the additional repos if no longer defined
   file:
     dest: /etc/yum.repos.d/openshift_additional.repo
     state: absent
   when: openshift_additional_repos | length == 0
-  notify: refresh package cache
+  notify: refresh yum cache
 
-- name: Remove any yum repo files for other deployment types
+- name: Remove any yum repo files for other deployment types RHEL/CentOS
   file:
     path: "/etc/yum.repos.d/{{ item | basename }}"
     state: absent
   with_fileglob:
   - '*/repos/*'
-  when: not (item | search("/files/" ~ openshift_deployment_type ~ "/repos"))
-  notify: refresh package cache
+  when: not (item | search("/files/" ~ openshift_deployment_type ~ "/repos")) and
+        (ansible_os_family == "RedHat" and ansible_distribution != "Fedora")
+  notify: refresh yum cache
+
+- name: Remove any yum repo files for other deployment types Fedora
+  file:
+    path: "/etc/yum.repos.d/{{ item | basename }}"
+    state: absent
+  with_fileglob:
+  - '*/repos/*'
+  when: not (item | search("/files/fedora-" ~ openshift_deployment_type ~ "/repos")) and
+        (ansible_distribution == "Fedora")
+  notify: refresh dnf cache
 
 - name: Configure gpg keys if needed
   copy: src={{ item }} dest=/etc/pki/rpm-gpg/
   with_fileglob:
   - "{{ openshift_deployment_type }}/gpg_keys/*"
-  notify: refresh package cache
+  notify: refresh yum cache
 
-- name: Configure yum repositories
+- name: Configure yum repositories RHEL/CentOS
   copy: src={{ item }} dest=/etc/yum.repos.d/
   with_fileglob:
   - "{{ openshift_deployment_type }}/repos/*"
-  notify: refresh package cache
+  notify: refresh yum cache
+  when: (ansible_os_family == "RedHat" and ansible_distribution != "Fedora")
+
+- name: Configure yum repositories Fedora
+  copy: src={{ item }} dest=/etc/yum.repos.d/
+  with_fileglob:
+  - "fedora-{{ openshift_deployment_type }}/repos/*"
+  notify: refresh dnf cache
+  when: (ansible_distribution == "Fedora")
diff --git a/roles/openshift_storage_nfs_lvm/tasks/nfs.yml b/roles/openshift_storage_nfs_lvm/tasks/nfs.yml
index 65ae069df..bf23dfe98 100644
--- a/roles/openshift_storage_nfs_lvm/tasks/nfs.yml
+++ b/roles/openshift_storage_nfs_lvm/tasks/nfs.yml
@@ -1,6 +1,11 @@
 ---
 - name: Install NFS server
   yum: name=nfs-utils state=present
+  when: ansible_pkg_mgr == "yum"
+
+- name: Install NFS server
+  dnf: name=nfs-utils state=present
+  when: ansible_pkg_mgr == "dnf"
 
 - name: Start rpcbind
   service: name=rpcbind state=started enabled=yes
diff --git a/roles/os_env_extras/tasks/main.yaml b/roles/os_env_extras/tasks/main.yaml
index 96b12ad5b..29599559c 100644
--- a/roles/os_env_extras/tasks/main.yaml
+++ b/roles/os_env_extras/tasks/main.yaml
@@ -15,3 +15,10 @@
   yum:
     pkg: bash-completion
     state: installed
+  when: ansible_pkg_mgr == "yum"
+
+- name: Bash Completion
+  dnf:
+    pkg: bash-completion
+    state: installed
+  when: ansible_pkg_mgr == "dnf"
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml
index 5089eb3e0..cf2a2c733 100644
--- a/roles/os_firewall/tasks/firewall/firewalld.yml
+++ b/roles/os_firewall/tasks/firewall/firewalld.yml
@@ -3,6 +3,14 @@
   yum:
     name: firewalld
     state: present
+  when: ansible_pkg_mgr == "yum"
+  register: install_result
+
+- name: Install firewalld packages
+  dnf:
+    name: firewalld
+    state: present
+  when: ansible_pkg_mgr == "dnf"
   register: install_result
 
 - name: Check if iptables-services is installed
diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml
index 9af9d8d29..36d51504c 100644
--- a/roles/os_firewall/tasks/firewall/iptables.yml
+++ b/roles/os_firewall/tasks/firewall/iptables.yml
@@ -6,6 +6,17 @@
   with_items:
   - iptables
   - iptables-services
+  when: ansible_pkg_mgr == "yum"
+  register: install_result
+
+- name: Install iptables packages
+  dnf:
+    name: "{{ item }}"
+    state: present
+  with_items:
+  - iptables
+  - iptables-services
+  when: ansible_pkg_mgr == "dnf"
   register: install_result
 
 - name: Check if firewalld is installed
diff --git a/roles/os_update_latest/tasks/main.yml b/roles/os_update_latest/tasks/main.yml
index 4a2c3d47a..40eec8d35 100644
--- a/roles/os_update_latest/tasks/main.yml
+++ b/roles/os_update_latest/tasks/main.yml
@@ -1,3 +1,8 @@
 ---
 - name: Update all packages
   yum: name=* state=latest
+  when: ansible_pkg_mgr == "yum"
+
+- name: Update all packages
+  dnf: name=* state=latest
+  when: ansible_pkg_mgr == "dnf"
diff --git a/roles/yum_repos/README.md b/roles/yum_repos/README.md
index 51ecd5d34..908ab4972 100644
--- a/roles/yum_repos/README.md
+++ b/roles/yum_repos/README.md
@@ -6,7 +6,7 @@ This role allows easy deployment of yum repository config files.
 Requirements
 ------------
 
-Yum
+Yum or dnf
 
 Role Variables
 --------------
diff --git a/utils/site_assets/oo-install-bootstrap.sh b/utils/site_assets/oo-install-bootstrap.sh
index e1b2cec90..3847c029a 100755
--- a/utils/site_assets/oo-install-bootstrap.sh
+++ b/utils/site_assets/oo-install-bootstrap.sh
@@ -9,6 +9,13 @@ cmdlnargs="$@"
 : ${OO_INSTALL_LOG:=${TMPDIR}/INSTALLPKGNAME.log}
 [[ $TMPDIR != */ ]] && TMPDIR="${TMPDIR}/"
 
+if rpm -q dnf;
+then
+  PKG_MGR="dnf"
+else
+  PKG_MGR="yum"
+fi
+
 if [ $OO_INSTALL_CONTEXT != 'origin_vm' ]
 then
   clear
@@ -18,7 +25,7 @@ if [ -e /etc/redhat-release  ]
 then
   for i in python python-virtualenv openssh-clients gcc
   do
-    rpm -q $i  >/dev/null 2>&1 || { echo >&2 "Missing installation dependency detected.  Please run \"yum install ${i}\"."; exit 1; }
+    rpm -q $i  >/dev/null 2>&1 || { echo >&2 "Missing installation dependency detected.  Please run \"${PKG_MGR} install ${i}\"."; exit 1; }
   done
 fi
 for i in python virtualenv ssh gcc
-- 
cgit v1.2.3


From 63b69a9eb20fea3696963d4ce02eea14d5ef4c53 Mon Sep 17 00:00:00 2001
From: Andrew Butcher <abutcher@redhat.com>
Date: Wed, 2 Dec 2015 13:51:18 -0500
Subject: Configured master count should be 1 for pacemaker ha.

---
 roles/openshift_master/templates/master.yaml.v1.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'roles/openshift_master')

diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index 9f4a17f0a..cadb02fa3 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -83,7 +83,7 @@ kubernetesMasterConfig:
 {% endif %}
   apiServerArguments: {{ api_server_args if api_server_args is defined else 'null' }}
   controllerArguments: {{ controller_args if controller_args is defined else 'null' }}
-  masterCount: {{ openshift.master.master_count }}
+  masterCount: {{ openshift.master.master_count if openshift.master.cluster_method | default(None) == 'native' else 1 }}
   masterIP: {{ openshift.common.ip }}
   podEvictionTimeout: ""
   proxyClientInfo:
-- 
cgit v1.2.3


From 192ccc8e6e6f465351828f32e9dc43b840897b67 Mon Sep 17 00:00:00 2001
From: Andrew Butcher <abutcher@redhat.com>
Date: Tue, 1 Dec 2015 16:30:05 -0500
Subject: Refactor dns options and facts.

---
 inventory/byo/hosts.example                      |  3 +++
 playbooks/common/openshift-cluster/config.yml    |  3 ---
 playbooks/common/openshift-master/config.yml     | 16 ----------------
 roles/openshift_facts/library/openshift_facts.py |  8 ++++----
 roles/openshift_master/tasks/main.yml            |  8 +-------
 roles/openshift_node/tasks/main.yml              |  7 +------
 roles/openshift_node/templates/node.yaml.v1.j2   |  6 ++++--
 7 files changed, 13 insertions(+), 38 deletions(-)

(limited to 'roles/openshift_master')

diff --git a/inventory/byo/hosts.example b/inventory/byo/hosts.example
index 1a67cc290..dd8d8f855 100644
--- a/inventory/byo/hosts.example
+++ b/inventory/byo/hosts.example
@@ -154,6 +154,9 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # entries for the interfaces attached to the host.
 #openshift_set_hostname=True
 
+# Configure dnsIP in the node config
+#openshift_dns_ip=172.30.0.1
+
 # host group for masters
 [masters]
 ose3-master[1:3]-ansible.test.example.com
diff --git a/playbooks/common/openshift-cluster/config.yml b/playbooks/common/openshift-cluster/config.yml
index a8bd634d3..482fa8441 100644
--- a/playbooks/common/openshift-cluster/config.yml
+++ b/playbooks/common/openshift-cluster/config.yml
@@ -6,6 +6,3 @@
 - include: ../openshift-master/config.yml
 
 - include: ../openshift-node/config.yml
-  vars:
-    osn_cluster_dns_domain: "{{ hostvars[groups.oo_first_master.0].openshift.dns.domain }}"
-    osn_cluster_dns_ip: "{{ hostvars[groups.oo_first_master.0].cluster_dns_ip }}"
diff --git a/playbooks/common/openshift-master/config.yml b/playbooks/common/openshift-master/config.yml
index 1c8a92122..785a78497 100644
--- a/playbooks/common/openshift-master/config.yml
+++ b/playbooks/common/openshift-master/config.yml
@@ -353,22 +353,6 @@
   - role: openshift_cluster_metrics
     when: openshift.common.use_cluster_metrics | bool
 
-  # TODO: Setting the cluster dns ip should be pushed into openshift-facts
-- name: Determine cluster dns ip
-  hosts: oo_first_master
-  tasks:
-  - name: Get master service ip
-    # This command has to be on a single line.
-    command: "{{ openshift.common.client_binary }} -n default --config={{ openshift.common.config_base }}/master/admin.kubeconfig get -o template svc kubernetes --template=\\{\\{.spec.clusterIP\\}\\} --output-version=v1"
-    register: master_service_ip_output
-    when: openshift.common.version_greater_than_3_1_or_1_1 | bool
-  - set_fact:
-      cluster_dns_ip: "{{ hostvars[groups.oo_first_master.0].openshift.dns.ip }}"
-    when: not openshift.common.version_greater_than_3_1_or_1_1 | bool
-  - set_fact:
-      cluster_dns_ip: "{{ master_service_ip_output.stdout }}"
-    when: openshift.common.version_greater_than_3_1_or_1_1 | bool
-
 - name: Enable cockpit
   hosts: oo_first_master
   vars:
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
index b60e42c71..e937b742e 100755
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -528,9 +528,9 @@ def set_aggregate_facts(facts):
         internal_hostnames.add(facts['common']['hostname'])
         internal_hostnames.add(facts['common']['ip'])
 
+        cluster_domain = facts['common']['dns_domain']
+
         if 'master' in facts:
-            # FIXME: not sure why but facts['dns']['domain'] fails
-            cluster_domain = 'cluster.local'
             if 'cluster_hostname' in facts['master']:
                 all_hostnames.add(facts['master']['cluster_hostname'])
             if 'cluster_public_hostname' in facts['master']:
@@ -985,7 +985,7 @@ class OpenShiftFacts(object):
         Raises:
             OpenShiftFactsUnsupportedRoleError:
     """
-    known_roles = ['common', 'master', 'node', 'master_sdn', 'node_sdn', 'dns', 'etcd']
+    known_roles = ['common', 'master', 'node', 'master_sdn', 'node_sdn', 'etcd']
 
     def __init__(self, role, filename, local_facts, additive_facts_to_overwrite=False):
         self.changed = False
@@ -1056,6 +1056,7 @@ class OpenShiftFacts(object):
                       public_hostname=hostname)
         common['client_binary'] = 'oc' if os.path.isfile('/usr/bin/oc') else 'osc'
         common['admin_binary'] = 'oadm' if os.path.isfile('/usr/bin/oadm') else 'osadm'
+        common['dns_domain'] = 'cluster.local'
         defaults['common'] = common
 
         if 'master' in roles:
@@ -1076,7 +1077,6 @@ class OpenShiftFacts(object):
             node = dict(labels={}, annotations={}, portal_net='172.30.0.0/16',
                         iptables_sync_period='5s', set_node_ip=False)
             defaults['node'] = node
-
         return defaults
 
     def guess_host_provider(self):
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 2cf2a53c4..5d4ddfca0 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -81,14 +81,8 @@
   yum: pkg={{ openshift.common.service_type }}-master{{ openshift_version  }} state=present
   register: install_result
 
-# TODO: These values need to be configurable
-- name: Set dns facts
+- name: Re-gather package dependent master facts
   openshift_facts:
-    role: dns
-    local_facts:
-      ip: "{{ openshift_master_cluster_vip | default(openshift.common.ip, true) | default(None) }}"
-      domain: cluster.local
-  when: openshift.master.embedded_dns
 
 - name: Create config parent directory if it does not exist
   file:
diff --git a/roles/openshift_node/tasks/main.yml b/roles/openshift_node/tasks/main.yml
index 42d984a09..1d3ac7c09 100644
--- a/roles/openshift_node/tasks/main.yml
+++ b/roles/openshift_node/tasks/main.yml
@@ -1,11 +1,5 @@
 ---
 # TODO: allow for overriding default ports where possible
-- fail:
-    msg: This role requres that osn_cluster_dns_domain is set
-  when: osn_cluster_dns_domain is not defined or not osn_cluster_dns_domain
-- fail:
-    msg: This role requres that osn_cluster_dns_ip is set
-  when: osn_cluster_dns_ip is not defined or not osn_cluster_dns_ip
 - fail:
     msg: "SELinux is disabled, This deployment type requires that SELinux is enabled."
   when: (not ansible_selinux or ansible_selinux.status != 'enabled') and deployment_type in ['enterprise', 'online', 'atomic-enterprise', 'openshift-enterprise']
@@ -20,6 +14,7 @@
       hostname: "{{ openshift_hostname | default(none) }}"
       public_hostname: "{{ openshift_public_hostname | default(none) }}"
       deployment_type: "{{ openshift_deployment_type }}"
+      dns_ip: "{{ openshift_dns_ip | default(openshift_master_cluster_vip | default(None, true), true) }}"
   - role: node
     local_facts:
       annotations: "{{ openshift_node_annotations | default(none) }}"
diff --git a/roles/openshift_node/templates/node.yaml.v1.j2 b/roles/openshift_node/templates/node.yaml.v1.j2
index 41a303dee..23bd81f91 100644
--- a/roles/openshift_node/templates/node.yaml.v1.j2
+++ b/roles/openshift_node/templates/node.yaml.v1.j2
@@ -1,7 +1,9 @@
 allowDisabledDocker: false
 apiVersion: v1
-dnsDomain: {{ osn_cluster_dns_domain }}
-dnsIP: {{ osn_cluster_dns_ip }}
+dnsDomain: {{ openshift.common.dns_domain }}
+{% if 'dns_ip' in openshift.common %}
+dnsIP: {{ openshift.common.dns_ip }}
+{% endif %}
 dockerConfig:
   execHandlerName: ""
 iptablesSyncPeriod: "{{ openshift.node.iptables_sync_period }}"
-- 
cgit v1.2.3


From 6082cce51dc17472dd5a567399783574742ca7a6 Mon Sep 17 00:00:00 2001
From: Andrew Butcher <abutcher@redhat.com>
Date: Wed, 9 Dec 2015 10:13:29 -0500
Subject: Squash pcs install into one task.

---
 roles/openshift_master/tasks/main.yml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

(limited to 'roles/openshift_master')

diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 8a78f8f2a..011b5dedd 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -267,13 +267,8 @@
   when: openshift_master_ha | bool and openshift.master.cluster_method == 'native'
 
 - name: Install cluster packages
-  yum: pkg=pcs state=present
-  when: (ansible_pkg_mgr == "yum") and openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
-  register: install_result
-
-- name: Install cluster packages
-  dnf: pkg=pcs state=present
-  when: (ansible_pkg_mgr == "dnf") and openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
+  action: "{{ansible_pkg_mgr}} pkg=pcs state=present"
+  when: openshift_master_ha | bool and openshift.master.cluster_method == 'pacemaker'
   register: install_result
 
 - name: Start and enable cluster service
-- 
cgit v1.2.3