summaryrefslogtreecommitdiffstats
path: root/roles/openshift_hosted/tasks
diff options
context:
space:
mode:
authorAndrew Butcher <abutcher@redhat.com>2016-04-11 15:45:26 -0400
committerAndrew Butcher <abutcher@redhat.com>2016-04-11 15:45:26 -0400
commit4ac07696f3db92d1361290c3a0d7b7637d3d1994 (patch)
tree58ec00b29f982a9cd78b80bcf4aed1763a91bec3 /roles/openshift_hosted/tasks
parent1bc6b51585c23670fdc08a1df6a89d35cd0b8149 (diff)
downloadopenshift-4ac07696f3db92d1361290c3a0d7b7637d3d1994.tar.gz
openshift-4ac07696f3db92d1361290c3a0d7b7637d3d1994.tar.bz2
openshift-4ac07696f3db92d1361290c3a0d7b7637d3d1994.tar.xz
openshift-4ac07696f3db92d1361290c3a0d7b7637d3d1994.zip
Add support for creating secure router.
* Move openshift_router to openshift_hosted role which will eventually contain registry, metrics and logging. * Adds option for specifying an openshift_hosted_router_certificate cert and key pair. * Removes dependency on node label variables and retrieves the node list from the API s.t. this role can be applied to any cluster with existing nodes. I've added an openshift_hosted playbook that occurs after node install to account for this. * Infrastructure nodes are selected using openshift_hosted_router_selector which is based on deployment type by default; openshift-enterprise -> "region=infra" and online -> "type=infra".
Diffstat (limited to 'roles/openshift_hosted/tasks')
-rw-r--r--roles/openshift_hosted/tasks/main.yml3
-rw-r--r--roles/openshift_hosted/tasks/router.yml64
2 files changed, 67 insertions, 0 deletions
diff --git a/roles/openshift_hosted/tasks/main.yml b/roles/openshift_hosted/tasks/main.yml
new file mode 100644
index 000000000..d42a4e365
--- /dev/null
+++ b/roles/openshift_hosted/tasks/main.yml
@@ -0,0 +1,3 @@
+---
+
+- include: router.yml
diff --git a/roles/openshift_hosted/tasks/router.yml b/roles/openshift_hosted/tasks/router.yml
new file mode 100644
index 000000000..6a36f74b2
--- /dev/null
+++ b/roles/openshift_hosted/tasks/router.yml
@@ -0,0 +1,64 @@
+---
+- fail:
+ msg: "Both 'certfile' and 'keyfile' keys must be specified when supplying the openshift_hosted_router_certificate variable."
+ when: openshift_hosted_router_certificate is defined and ('certfile' not in openshift_hosted_router_certificate or 'keyfile' not in openshift_hosted_router_certificate)
+
+- name: Read router certificate and key
+ slurp:
+ src: "{{ item }}"
+ register: openshift_router_certificate_output
+ with_items:
+ - "{{ openshift_hosted_router_certificate.certfile }}"
+ - "{{ openshift_hosted_router_certificate.keyfile }}"
+ delegate_to: localhost
+ when: openshift_hosted_router_certificate is defined
+
+- name: Persist certificate contents
+ openshift_facts:
+ role: hosted
+ openshift_env:
+ openshift_hosted_router_certificate_contents: "{% for certificate in openshift_router_certificate_output.results -%}{{ certificate.content | b64decode }}{% endfor -%}"
+ when: openshift_hosted_router_certificate is defined
+
+- name: Create PEM certificate
+ copy:
+ content: "{{ openshift.hosted.router.certificate.contents }}"
+ dest: "{{ openshift_master_config_dir }}/openshift-router.pem"
+ mode: 0600
+ when: openshift.hosted.router.certificate | default(None) != None
+
+- name: Retrieve list of openshift nodes
+ command: >
+ {{ openshift.common.client_binary }} --api-version='v1' -o json
+ get nodes -n default --config={{ openshift.common.config_base }}/master/admin.kubeconfig
+ register: openshift_hosted_router_nodes_json
+ when: openshift.hosted.router.replicas | default(None) == None
+
+- name: Collect nodes matching router selector
+ set_fact:
+ openshift_hosted_router_nodes: >
+ {{ (openshift_hosted_router_nodes_json.stdout|from_json)['items']
+ | oo_oc_nodes_matching_selector(openshift.hosted.router.selector) }}
+ when: openshift.hosted.router.replicas | default(None) == None
+
+- name: Create OpenShift router
+ command: >
+ {{ openshift.common.admin_binary }} router --create
+ {% if openshift.hosted.router.replicas | default(None) != None -%}
+ --replicas={{ openshift.hosted.router.replicas }}
+ {% else -%}
+ --replicas={{ openshift_hosted_router_nodes | length }}
+ {% endif %}
+ {% if openshift.hosted.router.certificate | default(None) != None -%}
+ --default-cert={{ openshift_master_config_dir }}/openshift-router.pem
+ {% endif -%}
+ --namespace=default
+ --service-account=router
+ --selector='{{ openshift.hosted.router.selector }}'
+ --credentials={{ openshift_master_config_dir }}/openshift-router.kubeconfig
+ {% if openshift.hosted.router.registryurl | default(None)!= None -%}
+ --images='{{ openshift.hosted.router.registryurl }}'
+ {% endif -%}
+ register: openshift_hosted_router_results
+ changed_when: "'service exists' not in openshift_hosted_router_results.stdout"
+ when: openshift.hosted.router.replicas | default(None) != None or (openshift_hosted_router_nodes is defined and openshift_hosted_router_nodes | length > 0)