From 296ee5ee346c843eb69786e1ab997e72870839ff Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Wed, 15 Nov 2017 13:12:12 -0500
Subject: Install web console server

---
 roles/openshift_web_console/tasks/install.yml | 79 +++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 roles/openshift_web_console/tasks/install.yml

(limited to 'roles/openshift_web_console/tasks/install.yml')

diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
new file mode 100644
index 000000000..8120c13e3
--- /dev/null
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -0,0 +1,79 @@
+---
+# Fact setting
+- name: Set default image variables based on deployment type
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ openshift_deployment_type | default(deployment_type) }}.yml"
+    - "default_images.yml"
+
+- name: Set openshift_web_console facts
+  set_fact:
+    openshift_web_console_prefix: "{{ openshift_web_console_prefix | default(__openshift_web_console_prefix) }}"
+    openshift_web_console_version: "{{ openshift_web_console_version | default(__openshift_web_console_version) }}"
+    openshift_web_console_image_name: "{{ openshift_web_console_image_name | default(__openshift_web_console_image_name) }}"
+    # Default the replica count to the number of masters.
+    openshift_web_console_replica_count: "{{ openshift_web_console_replica_count | default(groups.oo_masters_to_config | length) }}"
+
+- name: Ensure openshift-web-console project exists
+  oc_project:
+    name: openshift-web-console
+    state: present
+
+- name: Make temp directory for asset config files
+  command: mktemp -d /tmp/console-ansible-XXXXXX
+  register: mktemp
+  changed_when: False
+  become: no
+
+- name: Copy asset config template to temp directory
+  copy:
+    src: "{{ __console_files_location }}/{{ item }}"
+    dest: "{{ mktemp.stdout }}/{{ item }}"
+  with_items:
+    - "{{ __console_template_file }}"
+    - "{{ __console_config_file }}"
+
+- name: Update asset config properties
+  yedit:
+    src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
+    edits:
+      - key: logoutURL
+        value: "{{ openshift.master.logout_url | default('') }}"
+      - key: publicURL
+        # Must have a trailing slash
+        value: "{{ openshift.master.public_console_url }}/"
+      - key: masterPublicURL
+        value: "{{ openshift.master.public_api_url }}"
+
+- slurp:
+    src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
+  register: config
+
+- name: Apply template file
+  shell: >
+    {{ openshift_client_binary }} process -f "{{ mktemp.stdout }}/{{ __console_template_file }}"
+    --param API_SERVER_CONFIG="{{ config['content'] | b64decode }}"
+    --param IMAGE="{{ openshift_web_console_prefix }}{{ openshift_web_console_image_name }}:{{ openshift_web_console_version }}"
+    --param NODE_SELECTOR={{ openshift_web_console_nodeselector | to_json | quote }}
+    --param REPLICA_COUNT="{{ openshift_web_console_replica_count }}"
+    | {{ openshift_client_binary }} apply -f -
+
+- name: Verify that the web console is running
+  command: >
+    curl -k https://webconsole.openshift-web-console.svc/healthz
+  args:
+    # Disables the following warning:
+    # Consider using get_url or uri module rather than running curl
+    warn: no
+  register: console_health
+  until: console_health.stdout == 'ok'
+  retries: 120
+  delay: 1
+  changed_when: false
+
+- name: Remove temp directory
+  file:
+    state: absent
+    name: "{{ mktemp.stdout }}"
+  changed_when: False
+  become: no
-- 
cgit v1.2.3


From 3b07acdcd41e215dedc4d4c7c7303b807e59333d Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 9 Jan 2018 14:11:16 -0500
Subject: Remove become statements

This commit removes become:no statements that break
the installer in various ways.
---
 .../openshift-cluster/upgrades/create_service_signer_cert.yml     | 2 --
 .../common/openshift-cluster/upgrades/upgrade_control_plane.yml   | 2 --
 playbooks/init/evaluate_groups.yml                                | 1 -
 playbooks/openshift-etcd/private/embedded2external.yml            | 2 --
 playbooks/openshift-etcd/private/migrate.yml                      | 2 --
 playbooks/openshift-etcd/private/redeploy-ca.yml                  | 2 --
 playbooks/openshift-etcd/private/upgrade_backup.yml               | 1 -
 playbooks/openshift-master/private/redeploy-openshift-ca.yml      | 2 --
 playbooks/openshift-master/private/tasks/restart_hosts.yml        | 1 -
 playbooks/openshift-master/private/validate_restart.yml           | 2 --
 playbooks/openshift-master/scaleup.yml                            | 1 -
 playbooks/openshift-node/private/setup.yml                        | 1 -
 playbooks/openshift-node/scaleup.yml                              | 1 -
 .../openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py | 1 -
 roles/openshift_certificate_expiry/tasks/main.yml                 | 2 --
 roles/openshift_expand_partition/README.md                        | 2 --
 roles/openshift_logging/tasks/generate_jks.yaml                   | 6 ------
 roles/openshift_logging/tasks/main.yaml                           | 2 --
 roles/openshift_logging_fluentd/tasks/label_and_wait.yaml         | 1 -
 roles/openshift_master_certificates/tasks/main.yml                | 2 --
 roles/openshift_named_certificates/tasks/main.yml                 | 1 -
 roles/openshift_storage_nfs_lvm/README.md                         | 8 +++-----
 roles/openshift_web_console/tasks/install.yml                     | 2 --
 roles/openshift_web_console/tasks/update_asset_config.yml         | 2 --
 roles/template_service_broker/tasks/install.yml                   | 2 --
 roles/template_service_broker/tasks/remove.yml                    | 2 --
 26 files changed, 3 insertions(+), 50 deletions(-)

(limited to 'roles/openshift_web_console/tasks/install.yml')

diff --git a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
index 372a39e74..00a731cb0 100644
--- a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
+++ b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
@@ -2,7 +2,6 @@
 - name: Create local temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -65,7 +64,6 @@
 - name: Delete local temp directory
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Delete local temp directory
diff --git a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
index 50be0dee0..412075d41 100644
--- a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
+++ b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
@@ -108,7 +108,6 @@
 - name: Gate on master update
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       master_update_completed: "{{ hostvars
@@ -242,7 +241,6 @@
 - name: Gate on reconcile
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       reconcile_completed: "{{ hostvars
diff --git a/playbooks/init/evaluate_groups.yml b/playbooks/init/evaluate_groups.yml
index 8087f6ffc..c4cd226c9 100644
--- a/playbooks/init/evaluate_groups.yml
+++ b/playbooks/init/evaluate_groups.yml
@@ -2,7 +2,6 @@
 - name: Populate config host groups
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Load group name mapping variables
diff --git a/playbooks/openshift-etcd/private/embedded2external.yml b/playbooks/openshift-etcd/private/embedded2external.yml
index b71eaacd0..917cfc800 100644
--- a/playbooks/openshift-etcd/private/embedded2external.yml
+++ b/playbooks/openshift-etcd/private/embedded2external.yml
@@ -89,7 +89,6 @@
     local_action: command mktemp -d /tmp/etcd_backup-XXXXXXX
     register: g_etcd_client_mktemp
     changed_when: False
-    become: no
 
   - import_role:
       name: etcd
@@ -116,7 +115,6 @@
   - name: Delete temporary directory
     local_action: file path="{{ g_etcd_client_mktemp.stdout }}" state=absent
     changed_when: False
-    become: no
 
 # 7. force new cluster from the backup
 - name: Force new etcd cluster
diff --git a/playbooks/openshift-etcd/private/migrate.yml b/playbooks/openshift-etcd/private/migrate.yml
index 0a2ac7f1a..3f8b44032 100644
--- a/playbooks/openshift-etcd/private/migrate.yml
+++ b/playbooks/openshift-etcd/private/migrate.yml
@@ -2,7 +2,6 @@
 - name: Check if the master has embedded etcd
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tags:
   - always
@@ -53,7 +52,6 @@
 - name: Gate on etcd backup
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       etcd_backup_completed: "{{ hostvars
diff --git a/playbooks/openshift-etcd/private/redeploy-ca.yml b/playbooks/openshift-etcd/private/redeploy-ca.yml
index 7b0d99255..e6dd87de1 100644
--- a/playbooks/openshift-etcd/private/redeploy-ca.yml
+++ b/playbooks/openshift-etcd/private/redeploy-ca.yml
@@ -26,7 +26,6 @@
 - name: Create temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -74,7 +73,6 @@
 - name: Delete temporary directory on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file:
diff --git a/playbooks/openshift-etcd/private/upgrade_backup.yml b/playbooks/openshift-etcd/private/upgrade_backup.yml
index 97b6edba5..081c024fc 100644
--- a/playbooks/openshift-etcd/private/upgrade_backup.yml
+++ b/playbooks/openshift-etcd/private/upgrade_backup.yml
@@ -14,7 +14,6 @@
 - name: Gate on etcd backup
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       etcd_backup_completed: "{{ hostvars
diff --git a/playbooks/openshift-master/private/redeploy-openshift-ca.yml b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
index 9d3c12ba1..f649af976 100644
--- a/playbooks/openshift-master/private/redeploy-openshift-ca.yml
+++ b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
@@ -125,7 +125,6 @@
 - name: Create temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -264,7 +263,6 @@
 - name: Delete temporary directory on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file:
diff --git a/playbooks/openshift-master/private/tasks/restart_hosts.yml b/playbooks/openshift-master/private/tasks/restart_hosts.yml
index a5dbe0590..76e1ea5f3 100644
--- a/playbooks/openshift-master/private/tasks/restart_hosts.yml
+++ b/playbooks/openshift-master/private/tasks/restart_hosts.yml
@@ -27,7 +27,6 @@
       delay=10
       timeout=600
       port="{{ ansible_port | default(ansible_ssh_port | default(22,boolean=True),boolean=True) }}"
-  become: no
 
 # Now that ssh is back up we can wait for API on the remote system,
 # avoiding some potential connection issues from local system:
diff --git a/playbooks/openshift-master/private/validate_restart.yml b/playbooks/openshift-master/private/validate_restart.yml
index 1077d0b9c..60b0e5bb6 100644
--- a/playbooks/openshift-master/private/validate_restart.yml
+++ b/playbooks/openshift-master/private/validate_restart.yml
@@ -21,7 +21,6 @@
 - name: Create temp file on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - local_action: command mktemp
@@ -38,7 +37,6 @@
 - name: Cleanup temp file on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file: path="{{ hostvars.localhost.mktemp.stdout }}" state=absent
diff --git a/playbooks/openshift-master/scaleup.yml b/playbooks/openshift-master/scaleup.yml
index f717cd0e9..7d31340a2 100644
--- a/playbooks/openshift-master/scaleup.yml
+++ b/playbooks/openshift-master/scaleup.yml
@@ -4,7 +4,6 @@
 - name: Ensure there are new_masters or new_nodes
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - fail:
diff --git a/playbooks/openshift-node/private/setup.yml b/playbooks/openshift-node/private/setup.yml
index 802dce37e..41c323f2b 100644
--- a/playbooks/openshift-node/private/setup.yml
+++ b/playbooks/openshift-node/private/setup.yml
@@ -8,7 +8,6 @@
 
 - name: Evaluate node groups
   hosts: localhost
-  become: no
   connection: local
   tasks:
   - name: Evaluate oo_containerized_master_nodes
diff --git a/playbooks/openshift-node/scaleup.yml b/playbooks/openshift-node/scaleup.yml
index bdfd3d3e6..cf13692ae 100644
--- a/playbooks/openshift-node/scaleup.yml
+++ b/playbooks/openshift-node/scaleup.yml
@@ -4,7 +4,6 @@
 - name: Ensure there are new_nodes
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - fail:
diff --git a/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py b/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
index a2bc9ecdb..58b228fee 100644
--- a/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
+++ b/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
@@ -31,7 +31,6 @@ certificates
 Example playbook usage:
 
   - name: Generate expiration results JSON
-    become: no
     run_once: yes
     delegate_to: localhost
     when: openshift_certificate_expiry_save_json_results|bool
diff --git a/roles/openshift_certificate_expiry/tasks/main.yml b/roles/openshift_certificate_expiry/tasks/main.yml
index b5234bd1e..8dea2c07f 100644
--- a/roles/openshift_certificate_expiry/tasks/main.yml
+++ b/roles/openshift_certificate_expiry/tasks/main.yml
@@ -7,7 +7,6 @@
   register: check_results
 
 - name: Generate expiration report HTML
-  become: no
   run_once: yes
   template:
     src: cert-expiry-table.html.j2
@@ -21,7 +20,6 @@
   when: openshift_certificate_expiry_save_json_results|bool
 
 - name: Generate results JSON file
-  become: no
   run_once: yes
   template:
     src: save_json_results.j2
diff --git a/roles/openshift_expand_partition/README.md b/roles/openshift_expand_partition/README.md
index c9c7b378c..402c3dc3e 100644
--- a/roles/openshift_expand_partition/README.md
+++ b/roles/openshift_expand_partition/README.md
@@ -45,7 +45,6 @@ space on /dev/xvda, and the file system will be expanded to fill the new
 partition space.
 
     - hosts: mynodes
-      become: no
       remote_user: root
       gather_facts: no
       roles:
@@ -68,7 +67,6 @@ partition space.
 * Create an ansible playbook, say `expandvar.yaml`:
     ```
     - hosts: mynodes
-      become: no
       remote_user: root
       gather_facts: no
       roles:
diff --git a/roles/openshift_logging/tasks/generate_jks.yaml b/roles/openshift_logging/tasks/generate_jks.yaml
index d6ac88dcc..6e3204589 100644
--- a/roles/openshift_logging/tasks/generate_jks.yaml
+++ b/roles/openshift_logging/tasks/generate_jks.yaml
@@ -24,25 +24,21 @@
   local_action: file path="{{local_tmp.stdout}}/elasticsearch.jks" state=touch mode="u=rw,g=r,o=r"
   when: elasticsearch_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/logging-es.jks" state=touch mode="u=rw,g=r,o=r"
   when: logging_es_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/system.admin.jks" state=touch mode="u=rw,g=r,o=r"
   when: system_admin_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/truststore.jks" state=touch mode="u=rw,g=r,o=r"
   when: truststore_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: pulling down signing items from host
   fetch:
@@ -61,12 +57,10 @@
   vars:
     - top_dir: "{{local_tmp.stdout}}"
   when: not elasticsearch_jks.stat.exists or not logging_es_jks.stat.exists or not system_admin_jks.stat.exists or not truststore_jks.stat.exists
-  become: no
 
 - name: Run JKS generation script
   local_action: script generate-jks.sh {{local_tmp.stdout}} {{openshift_logging_namespace}}
   check_mode: no
-  become: no
   when: not elasticsearch_jks.stat.exists or not logging_es_jks.stat.exists or not system_admin_jks.stat.exists or not truststore_jks.stat.exists
 
 - name: Pushing locally generated JKS certs to remote host...
diff --git a/roles/openshift_logging/tasks/main.yaml b/roles/openshift_logging/tasks/main.yaml
index 9949bb95d..1d8f2c53a 100644
--- a/roles/openshift_logging/tasks/main.yaml
+++ b/roles/openshift_logging/tasks/main.yaml
@@ -17,7 +17,6 @@
   register: local_tmp
   changed_when: False
   check_mode: no
-  become: no
 
 - include_tasks: install_logging.yaml
   when:
@@ -31,4 +30,3 @@
   local_action: file path="{{local_tmp.stdout}}" state=absent
   tags: logging_cleanup
   changed_when: False
-  become: no
diff --git a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
index 1cef6c25e..2721438f0 100644
--- a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
+++ b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
@@ -8,4 +8,3 @@
 
 # wait half a second between labels
 - local_action: command sleep {{ openshift_logging_fluentd_label_delay | default('.5') }}
-  become: no
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index 00cabe574..a80950cde 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -120,7 +120,6 @@
   register: g_master_certs_mktemp
   changed_when: False
   when: master_certs_missing | bool
-  become: no
 
 - name: Create a tarball of the master certs
   command: >
@@ -157,7 +156,6 @@
   local_action: file path="{{ g_master_certs_mktemp.stdout }}" state=absent
   changed_when: False
   when: master_certs_missing | bool
-  become: no
 
 - name: Lookup default group for ansible_ssh_user
   command: "/usr/bin/id -g {{ ansible_ssh_user | quote }}"
diff --git a/roles/openshift_named_certificates/tasks/main.yml b/roles/openshift_named_certificates/tasks/main.yml
index ad5472445..021fa8385 100644
--- a/roles/openshift_named_certificates/tasks/main.yml
+++ b/roles/openshift_named_certificates/tasks/main.yml
@@ -3,7 +3,6 @@
     parsed_named_certificates: "{{ named_certificates | lib_utils_oo_parse_named_certificates(named_certs_dir, internal_hostnames) }}"
   when: named_certificates | length > 0
   delegate_to: localhost
-  become: no
   run_once: true
 
 - openshift_facts:
diff --git a/roles/openshift_storage_nfs_lvm/README.md b/roles/openshift_storage_nfs_lvm/README.md
index cc674d3fd..a11219f6d 100644
--- a/roles/openshift_storage_nfs_lvm/README.md
+++ b/roles/openshift_storage_nfs_lvm/README.md
@@ -1,7 +1,7 @@
 # openshift_storage_nfs_lvm
 
 This role is useful to create and export nfs disks for openshift persistent volumes.
-It does so by creating lvm partitions on an already setup pv/vg, creating xfs 
+It does so by creating lvm partitions on an already setup pv/vg, creating xfs
 filesystem on each partition, mounting the partitions, exporting the mounts via NFS
 and creating a json file for each mount that an openshift master can use to
 create persistent volumes.
@@ -20,7 +20,7 @@ create persistent volumes.
 osnl_nfs_export_options: "*(rw,sync,all_squash)"
 
 # Directory, where the created partitions should be mounted. They will be
-# mounted as <osnl_mount_dir>/<lvm volume name> 
+# mounted as <osnl_mount_dir>/<lvm volume name>
 osnl_mount_dir: /exports/openshift
 
 # Volume Group to use.
@@ -64,11 +64,10 @@ None
 ## Example Playbook
 
 With this playbook, 2 5Gig lvm partitions are created, named stg5g0003 and stg5g0004
-Both of them are mounted into `/exports/openshift` directory.  Both directories are 
+Both of them are mounted into `/exports/openshift` directory.  Both directories are
 exported via NFS.  json files are created in /root.
 
     - hosts: nfsservers
-      become: no
       remote_user: root
       gather_facts: no
       roles:
@@ -94,7 +93,6 @@ exported via NFS.  json files are created in /root.
 * Create an ansible playbook, say `setupnfs.yaml`:
     ```
     - hosts: nfsservers
-      become: no
       remote_user: root
       gather_facts: no
       roles:
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 8120c13e3..8ee95e36b 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -23,7 +23,6 @@
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - name: Copy asset config template to temp directory
   copy:
@@ -76,4 +75,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
diff --git a/roles/openshift_web_console/tasks/update_asset_config.yml b/roles/openshift_web_console/tasks/update_asset_config.yml
index 36e37e35d..0992b32e1 100644
--- a/roles/openshift_web_console/tasks/update_asset_config.yml
+++ b/roles/openshift_web_console/tasks/update_asset_config.yml
@@ -30,7 +30,6 @@
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - name: Copy asset config to temp file
   copy:
@@ -55,7 +54,6 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
 
 # There's currently no command to trigger a rollout for a k8s deployment
 # without changing the pod spec. Add an annotation to force a rollout after
diff --git a/roles/template_service_broker/tasks/install.yml b/roles/template_service_broker/tasks/install.yml
index 765263db5..604e94602 100644
--- a/roles/template_service_broker/tasks/install.yml
+++ b/roles/template_service_broker/tasks/install.yml
@@ -21,7 +21,6 @@
 - command: mktemp -d /tmp/tsb-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - copy:
     src: "{{ __tsb_files_location }}/{{ item }}"
@@ -86,4 +85,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
diff --git a/roles/template_service_broker/tasks/remove.yml b/roles/template_service_broker/tasks/remove.yml
index 8b4d798db..db1b558e4 100644
--- a/roles/template_service_broker/tasks/remove.yml
+++ b/roles/template_service_broker/tasks/remove.yml
@@ -2,7 +2,6 @@
 - command: mktemp -d /tmp/tsb-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - copy:
     src: "{{ __tsb_files_location }}/{{ item }}"
@@ -32,4 +31,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
-- 
cgit v1.2.3


From 104e9790324c54cd32592182d4869f2404695e44 Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Tue, 9 Jan 2018 15:34:55 -0500
Subject: Bug 1532787 - Add empty node selector to openshift-web-console
 namespace

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1532787
---
 roles/openshift_web_console/tasks/install.yml | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'roles/openshift_web_console/tasks/install.yml')

diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 8120c13e3..6f8b563e8 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -18,6 +18,8 @@
   oc_project:
     name: openshift-web-console
     state: present
+    node_selector:
+      - ""
 
 - name: Make temp directory for asset config files
   command: mktemp -d /tmp/console-ansible-XXXXXX
-- 
cgit v1.2.3


From 486b746324171edd691fd1682ef1221825157e62 Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Thu, 11 Jan 2018 15:24:37 -0500
Subject: Add console RBAC template

---
 files/origin-components/console-rbac-template.yaml | 38 ++++++++++++++++++++++
 roles/openshift_web_console/tasks/install.yml      | 13 +++++---
 roles/openshift_web_console/vars/main.yml          |  1 +
 3 files changed, 48 insertions(+), 4 deletions(-)
 create mode 100644 files/origin-components/console-rbac-template.yaml

(limited to 'roles/openshift_web_console/tasks/install.yml')

diff --git a/files/origin-components/console-rbac-template.yaml b/files/origin-components/console-rbac-template.yaml
new file mode 100644
index 000000000..9ee117199
--- /dev/null
+++ b/files/origin-components/console-rbac-template.yaml
@@ -0,0 +1,38 @@
+apiVersion: template.openshift.io/v1
+kind: Template
+metadata:
+  name: web-console-server-rbac
+parameters:
+- name: NAMESPACE
+  # This namespace cannot be changed. Only `openshift-web-console` is supported.
+  value: openshift-web-console
+objects:
+
+
+# allow grant powers to the webconsole server for cluster inspection
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: ClusterRole
+  metadata:
+    name: system:openshift:web-console-server
+  rules:
+  - apiGroups:
+    - "servicecatalog.k8s.io"
+    resources:
+    - clusterservicebrokers
+    verbs:
+    - get
+    - list
+    - watch
+
+# Grant the service account for the web console
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: ClusterRoleBinding
+  metadata:
+    name: system:openshift:web-console-server
+  roleRef:
+    kind: ClusterRole
+    name: system:openshift:web-console-server
+  subjects:
+  - kind: ServiceAccount
+    namespace: ${NAMESPACE}
+    name: webconsole
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 12916961b..287d8973d 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -21,20 +21,21 @@
     node_selector:
       - ""
 
-- name: Make temp directory for asset config files
+- name: Make temp directory for the web console config files
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
 
-- name: Copy asset config template to temp directory
+- name: Copy the web console config template to temp directory
   copy:
     src: "{{ __console_files_location }}/{{ item }}"
     dest: "{{ mktemp.stdout }}/{{ item }}"
   with_items:
     - "{{ __console_template_file }}"
+    - "{{ __console_rbac_file }}"
     - "{{ __console_config_file }}"
 
-- name: Update asset config properties
+- name: Update the web console config properties
   yedit:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
     edits:
@@ -50,7 +51,11 @@
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
   register: config
 
-- name: Apply template file
+- name: Reconcile with the web console RBAC file
+  shell: >
+    {{ openshift_client_binary }} process -f "{{ mktemp.stdout }}/{{ __console_rbac_file }}" | {{ openshift_client_binary }} auth reconcile -f -
+
+- name: Apply the web console template file
   shell: >
     {{ openshift_client_binary }} process -f "{{ mktemp.stdout }}/{{ __console_template_file }}"
     --param API_SERVER_CONFIG="{{ config['content'] | b64decode }}"
diff --git a/roles/openshift_web_console/vars/main.yml b/roles/openshift_web_console/vars/main.yml
index 80bc56a17..e91048e38 100644
--- a/roles/openshift_web_console/vars/main.yml
+++ b/roles/openshift_web_console/vars/main.yml
@@ -2,4 +2,5 @@
 __console_files_location: "../../../files/origin-components/"
 
 __console_template_file: "console-template.yaml"
+__console_rbac_file: "console-rbac-template.yaml"
 __console_config_file: "console-config.yaml"
-- 
cgit v1.2.3


From b498f10bf3e0c755dba6ce45913bd163475989fb Mon Sep 17 00:00:00 2001
From: Samuel Padgett <spadgett@redhat.com>
Date: Mon, 15 Jan 2018 09:06:16 -0500
Subject: Update console config for API changes

---
 files/origin-components/console-config.yaml        | 41 ++++++++++---
 roles/openshift_logging/tasks/install_logging.yaml |  9 ++-
 roles/openshift_metrics/tasks/install_metrics.yaml |  9 ++-
 roles/openshift_web_console/tasks/install.yml      | 29 ++++++++-
 .../tasks/update_asset_config.yml                  | 68 ---------------------
 .../tasks/update_console_config.yml                | 71 ++++++++++++++++++++++
 6 files changed, 144 insertions(+), 83 deletions(-)
 delete mode 100644 roles/openshift_web_console/tasks/update_asset_config.yml
 create mode 100644 roles/openshift_web_console/tasks/update_console_config.yml

(limited to 'roles/openshift_web_console/tasks/install.yml')

diff --git a/files/origin-components/console-config.yaml b/files/origin-components/console-config.yaml
index e104e8028..901518b28 100644
--- a/files/origin-components/console-config.yaml
+++ b/files/origin-components/console-config.yaml
@@ -1,5 +1,34 @@
-kind: WebConsoleConfiguration
 apiVersion: webconsole.config.openshift.io/v1
+kind: WebConsoleConfiguration
+clusterInfo:
+  consolePublicURL: https://127.0.0.1:8443/console/
+  loggingPublicURL: ""
+  logoutPublicURL: ""
+  masterPublicURL: https://127.0.0.1:8443
+  metricsPublicURL: ""
+# TODO: The new extensions properties cannot be set until
+# origin-web-console-server has been updated with the API changes since
+# `extensions` in the old asset config was an array.
+#extensions:
+#  scriptURLs: []
+#  stylesheetURLs: []
+#  properties: null
+features:
+  inactivityTimeoutMinutes: 0
+servingInfo:
+  bindAddress: 0.0.0.0:8443
+  bindNetwork: tcp4
+  certFile: /var/serving-cert/tls.crt
+  clientCA: ""
+  keyFile: /var/serving-cert/tls.key
+  maxRequestsInFlight: 0
+  namedCertificates: null
+  requestTimeoutSeconds: 0
+
+# START deprecated properties
+# These properties have been renamed and will be removed from the install
+# in a future pull. Keep both the old and new properties for now so that
+# the install is not broken while the origin-web-console image is updated.
 extensionDevelopment: false
 extensionProperties: null
 extensionScripts: null
@@ -10,12 +39,4 @@ logoutURL: ""
 masterPublicURL: https://127.0.0.1:8443
 metricsPublicURL: ""
 publicURL: https://127.0.0.1:8443/console/
-servingInfo:
-  bindAddress: 0.0.0.0:8443
-  bindNetwork: tcp4
-  certFile: /var/serving-cert/tls.crt
-  clientCA: ""
-  keyFile: /var/serving-cert/tls.key
-  maxRequestsInFlight: 0
-  namedCertificates: null
-  requestTimeoutSeconds: 0
+# END deprecated properties
diff --git a/roles/openshift_logging/tasks/install_logging.yaml b/roles/openshift_logging/tasks/install_logging.yaml
index ebd2d747b..ff62b6136 100644
--- a/roles/openshift_logging/tasks/install_logging.yaml
+++ b/roles/openshift_logging/tasks/install_logging.yaml
@@ -321,9 +321,14 @@
 - name: Add Kibana route information to web console asset config
   include_role:
     name: openshift_web_console
-    tasks_from: update_asset_config.yml
+    tasks_from: update_console_config.yml
   vars:
-    asset_config_edits:
+    console_config_edits:
+    - key: clusterInfo#loggingPublicURL
+      value: "https://{{ openshift_logging_kibana_hostname }}"
+    # Continue to set the old deprecated property until the
+    # origin-web-console image is updated for the new name.
+    # This will be removed in a future pull.
     - key: loggingPublicURL
       value: "https://{{ openshift_logging_kibana_hostname }}"
   when: openshift_web_console_install | default(true) | bool
diff --git a/roles/openshift_metrics/tasks/install_metrics.yaml b/roles/openshift_metrics/tasks/install_metrics.yaml
index 0866fe0d2..4a63d081e 100644
--- a/roles/openshift_metrics/tasks/install_metrics.yaml
+++ b/roles/openshift_metrics/tasks/install_metrics.yaml
@@ -74,9 +74,14 @@
 - name: Add metrics route information to web console asset config
   include_role:
     name: openshift_web_console
-    tasks_from: update_asset_config.yml
+    tasks_from: update_console_config.yml
   vars:
-    asset_config_edits:
+    console_config_edits:
+      - key: clusterInfo#metricsPublicURL
+        value: "https://{{ openshift_metrics_hawkular_hostname}}/hawkular/metrics"
+      # Continue to set the old deprecated property until the
+      # origin-web-console image is updated for the new name.
+      # This will be removed in a future pull.
       - key: metricsPublicURL
         value: "https://{{ openshift_metrics_hawkular_hostname}}/hawkular/metrics"
   when: openshift_web_console_install | default(true) | bool
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 287d8973d..50e72657f 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -39,13 +39,40 @@
   yedit:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
     edits:
-      - key: logoutURL
+      - key: clusterInfo#consolePublicURL
+        # Must have a trailing slash
+        value: "{{ openshift.master.public_console_url }}/"
+      - key: clusterInfo#masterPublicURL
+        value: "{{ openshift.master.public_api_url }}"
+      - key: clusterInfo#logoutPublicURL
         value: "{{ openshift.master.logout_url | default('') }}"
+      - key: features#inactivityTimeoutMinutes
+        value: "{{ openshift_web_console_inactivity_timeout_minutes | default(0) }}"
+
+      # TODO: The new extensions properties cannot be set until
+      # origin-web-console-server has been updated with the API changes since
+      # `extensions` in the old asset config was an array.
+
+      # - key: extensions#scriptURLs
+      #   value: "{{ openshift_web_console_extension_script_urls | default([]) }}"
+      # - key: extensions#stylesheetURLs
+      #   value: "{{ openshift_web_console_extension_stylesheet_urls | default([]) }}"
+      # - key: extensions#properties
+      #   value: "{{ openshift_web_console_extension_properties | default({}) }}"
+
+      # DEPRECATED PROPERTIES
+      # These properties have been renamed and will be removed from the install
+      # in a future pull. Keep both the old and new properties for now so that
+      # the install is not broken while the origin-web-console image is updated.
       - key: publicURL
         # Must have a trailing slash
         value: "{{ openshift.master.public_console_url }}/"
+      - key: logoutURL
+        value: "{{ openshift.master.logout_url | default('') }}"
       - key: masterPublicURL
         value: "{{ openshift.master.public_api_url }}"
+    separator: '#'
+    state: present
 
 - slurp:
     src: "{{ mktemp.stdout }}/{{ __console_config_file }}"
diff --git a/roles/openshift_web_console/tasks/update_asset_config.yml b/roles/openshift_web_console/tasks/update_asset_config.yml
deleted file mode 100644
index 21b293bed..000000000
--- a/roles/openshift_web_console/tasks/update_asset_config.yml
+++ /dev/null
@@ -1,68 +0,0 @@
----
-# This task updates asset config values in the webconsole-config config map in
-# the openshift-web-console namespace. The values to set are pased in the
-# variable `asset_config_edits`, which is an array of objects with `key` and
-# `value` properties in the same format as `yedit` module `edits`. Only
-# properties passed are updated.
-#
-# Note that this triggers a redeployment on the console and a brief downtime
-# since it uses a `Recreate` strategy.
-#
-# Example usage:
-#
-# - include_role:
-#     name: openshift_web_console
-#     tasks_from: update_asset_config.yml
-#   vars:
-#     asset_config_edits:
-#       - key: loggingPublicURL
-#         value: "https://{{ openshift_logging_kibana_hostname }}"
-#   when: openshift_web_console_install | default(true) | bool
-
-- name: Read web console config map
-  oc_configmap:
-    namespace: openshift-web-console
-    name: webconsole-config
-    state: list
-  register: webconsole_config
-
-- name: Make temp directory
-  command: mktemp -d /tmp/console-ansible-XXXXXX
-  register: mktemp_console
-  changed_when: False
-
-- name: Copy asset config to temp file
-  copy:
-    content: "{{webconsole_config.results.results[0].data['webconsole-config.yaml']}}"
-    dest: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-
-- name: Change asset config properties
-  yedit:
-    src: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-    edits: "{{asset_config_edits}}"
-
-- name: Update web console config map
-  oc_configmap:
-    namespace: openshift-web-console
-    name: webconsole-config
-    state: present
-    from_file:
-      webconsole-config.yaml: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
-
-- name: Remove temp directory
-  file:
-    state: absent
-    name: "{{ mktemp_console.stdout }}"
-  changed_when: False
-
-# There's currently no command to trigger a rollout for a k8s deployment
-# without changing the pod spec. Add an annotation to force a rollout after
-# the config map has been edited.
-- name: Rollout updated web console deployment
-  oc_edit:
-    kind: deployments
-    name: webconsole
-    namespace: openshift-web-console
-    separator: '#'
-    content:
-      spec#template#metadata#annotations#installer-triggered-rollout: "{{ ansible_date_time.iso8601_micro }}"
diff --git a/roles/openshift_web_console/tasks/update_console_config.yml b/roles/openshift_web_console/tasks/update_console_config.yml
new file mode 100644
index 000000000..e347c0193
--- /dev/null
+++ b/roles/openshift_web_console/tasks/update_console_config.yml
@@ -0,0 +1,71 @@
+---
+# This task updates asset config values in the webconsole-config config map in
+# the openshift-web-console namespace. The values to set are pased in the
+# variable `console_config_edits`, which is an array of objects with `key` and
+# `value` properties in the same format as `yedit` module `edits`. Only
+# properties passed are updated. The separator for nested properties is `#`.
+#
+# Note that this triggers a redeployment on the console and a brief downtime
+# since it uses a `Recreate` strategy.
+#
+# Example usage:
+#
+# - include_role:
+#     name: openshift_web_console
+#     tasks_from: update_console_config.yml
+#   vars:
+#     console_config_edits:
+#       - key: clusterInfo#loggingPublicURL
+#         value: "https://{{ openshift_logging_kibana_hostname }}"
+#   when: openshift_web_console_install | default(true) | bool
+
+- name: Read web console config map
+  oc_configmap:
+    namespace: openshift-web-console
+    name: webconsole-config
+    state: list
+  register: webconsole_config
+
+- name: Make temp directory
+  command: mktemp -d /tmp/console-ansible-XXXXXX
+  register: mktemp_console
+  changed_when: False
+
+- name: Copy web console config to temp file
+  copy:
+    content: "{{webconsole_config.results.results[0].data['webconsole-config.yaml']}}"
+    dest: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+
+- name: Change web console config properties
+  yedit:
+    src: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+    edits: "{{console_config_edits}}"
+    separator: '#'
+    state: present
+
+- name: Update web console config map
+  oc_configmap:
+    namespace: openshift-web-console
+    name: webconsole-config
+    state: present
+    from_file:
+      webconsole-config.yaml: "{{ mktemp_console.stdout }}/webconsole-config.yaml"
+
+- name: Remove temp directory
+  file:
+    state: absent
+    name: "{{ mktemp_console.stdout }}"
+  changed_when: False
+
+# TODO: Only rollout if config has changed.
+# There's currently no command to trigger a rollout for a k8s deployment
+# without changing the pod spec. Add an annotation to force a rollout after
+# the config map has been edited.
+- name: Rollout updated web console deployment
+  oc_edit:
+    kind: deployments
+    name: webconsole
+    namespace: openshift-web-console
+    separator: '#'
+    content:
+      spec#template#metadata#annotations#installer-triggered-rollout: "{{ ansible_date_time.iso8601_micro }}"
-- 
cgit v1.2.3