openshift_facts role/module refactor default settings

- Add openshift_facts role and module
  - Created new role openshift_facts that contains an openshift_facts module
  - Refactor openshift_* roles to use openshift_facts instead of relying on
    defaults
  - Refactor playbooks to use openshift_facts
  - Cleanup inventory group_vars

- Update defaults
  - update openshift_master role firewall defaults
    - remove etcd peer port, since we will not be supporting clustered embedded
      etcd
    - remove 8444 since console now runs on the api port by default
    - add 8444 and 7001 to disabled services to ensure removal if updating

- Add new role os_env_extras_node that is a subset of the docker role
  - previously, we were starting/enabling docker which was causing issues with some
  installations
  - Does not install or start docker, since the openshift-node role will
    handle that for us
  - Only adds root to the dockerroot group
  - Update playbooks to use ops_env_extras_node role instead of docker role

- os_firewall bug fixes
  - ignore ip6tables for now, since we are not configuring any ipv6 rules
  - if installing package do a daemon-reload before starting/enabling service

- Add aws support to bin/cluster

- Add list action to bin/cluster

- Add update action to bin/cluster

- cleanup some stray debug statements

- some variable renaming for clarity

39 files changed, 729 insertions, 313 deletions

diff --git a/roles/openshift_common/README.md b/roles/openshift_common/README.md
index 880d66e2c..14c2037e4 100644
--- a/roles/openshift_common/README.md
+++ b/roles/openshift_common/README.md
@@ -12,17 +12,20 @@ rhel-7-server-extra-rpms, and rhel-7-server-ose-beta-rpms repos.
 Role Variables
 --------------
 
-| Name                          | Default value                |                                        |
-|-------------------------------|------------------------------|----------------------------------------|
-| openshift_debug_level         | 0                            | Global openshift debug log verbosity   |
-| openshift_hostname            | UNDEF (Required)             | hostname to use for this instance |
-| openshift_public_ip           | UNDEF (Required)             | Public IP address to use for this host |
-| openshift_env                 | default                      | Envrionment name if multiple OpenShift instances |
+| Name                      | Default value     |                                             |
+|---------------------------|-------------------|---------------------------------------------|
+| openshift_cluster_id      | default           | Cluster name if multiple OpenShift clusters |
+| openshift_debug_level     | 0                 | Global openshift debug log verbosity        |
+| openshift_hostname        | UNDEF             | Internal hostname to use for this host (this value will set the hostname on the system) |
+| openshift_ip              | UNDEF             | Internal IP address to use for this host    |
+| openshift_public_hostname | UNDEF             | Public hostname to use for this host        |
+| openshift_public_ip       | UNDEF             | Public IP address to use for this host      |
 
 Dependencies
 ------------
 
 os_firewall
+openshift_facts
 openshift_repos
 
 Example Playbook
@@ -38,4 +41,4 @@ Apache License, Version 2.0
 Author Information
 ------------------
 
-TODO
+Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/openshift_common/defaults/main.yml b/roles/openshift_common/defaults/main.yml
index 22b2c6ffd..4d3e0fe9e 100644
--- a/roles/openshift_common/defaults/main.yml
+++ b/roles/openshift_common/defaults/main.yml
@@ -1,2 +1,3 @@
 ---
+openshift_cluster_id: 'default'
 openshift_debug_level: 0
diff --git a/roles/openshift_common/meta/main.yml b/roles/openshift_common/meta/main.yml
index cee4dd337..81363ec68 100644
--- a/roles/openshift_common/meta/main.yml
+++ b/roles/openshift_common/meta/main.yml
@@ -13,4 +13,5 @@ galaxy_info:
   - cloud
 dependencies:
 - { role: os_firewall }
+- { role: openshift_facts }
 - { role: openshift_repos }
diff --git a/roles/openshift_common/tasks/main.yml b/roles/openshift_common/tasks/main.yml
index 07737a71f..941190534 100644
--- a/roles/openshift_common/tasks/main.yml
+++ b/roles/openshift_common/tasks/main.yml
@@ -1,19 +1,16 @@
 ---
-- name: Set hostname
-  hostname: name={{ openshift_hostname }}
+- name: Set common OpenShift facts
+  openshift_facts:
+    role: 'common'
+    local_facts:
+      cluster_id: "{{ openshift_cluster_id | default('default') }}"
+      debug_level: "{{ openshift_debug_level | default(0) }}"
+      hostname: "{{ openshift_hostname | default(None) }}"
+      ip: "{{ openshift_ip | default(None) }}"
+      public_hostname: "{{ openshift_public_hostname | default(None) }}"
+      public_ip: "{{ openshift_public_ip | default(None) }}"
+      use_openshift_sdn: "{{ openshift_use_openshift_sdn | default(None) }}"
 
-- name: Configure local facts file
-  file: path=/etc/ansible/facts.d/ state=directory mode=0750
+- name: Set hostname
+  hostname: name={{ openshift.common.hostname }}
 
-- name: Set common OpenShift facts
-  include: set_facts.yml
-  facts:
-  - section: common
-    option: env
-    value: "{{ openshift_env | default('default') }}"
-  - section: common
-    option: host_type
-    value: "{{ openshift_host_type }}"
-  - section: common
-    option: debug_level
-    value: "{{ openshift_debug_level }}"
diff --git a/roles/openshift_common/tasks/set_facts.yml b/roles/openshift_common/tasks/set_facts.yml
deleted file mode 100644
index 349eecd1d..000000000
--- a/roles/openshift_common/tasks/set_facts.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-- name: "Setting local_facts"
-  ini_file:
-    dest: /etc/ansible/facts.d/openshift.fact
-    mode: 0640
-    section: "{{ item.section }}"
-    option: "{{ item.option }}"
-    value: "{{ item.value }}"
-  with_items: facts
diff --git a/roles/openshift_common/vars/main.yml b/roles/openshift_common/vars/main.yml
index 623aed9bf..50816d319 100644
--- a/roles/openshift_common/vars/main.yml
+++ b/roles/openshift_common/vars/main.yml
@@ -1,6 +1,7 @@
 ---
-openshift_master_credentials_dir: /var/lib/openshift/openshift.local.certificates/admin/
-
 # TODO: Upstream kubernetes only supports iptables currently, if this changes,
 # then these variable should be moved to defaults
+# TODO: it might be possible to still use firewalld if we wire up the created
+# chains with the public zone (or the zone associated with the correct
+# interfaces)
 os_firewall_use_firewalld: False
diff --git a/roles/openshift_facts/README.md b/roles/openshift_facts/README.md
new file mode 100644
index 000000000..2fd50e236
--- /dev/null
+++ b/roles/openshift_facts/README.md
@@ -0,0 +1,34 @@
+OpenShift Facts
+===============
+
+Provides the openshift_facts module
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+None
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+TODO
+
+License
+-------
+
+Apache License, Version 2.0
+
+Author Information
+------------------
+
+Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
new file mode 100755
index 000000000..0dd343443
--- /dev/null
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -0,0 +1,482 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# vim: expandtab:tabstop=4:shiftwidth=4
+
+DOCUMENTATION = '''
+---
+module: openshift_facts
+short_description: OpenShift Facts
+author: Jason DeTiberus
+requirements: [ ]
+'''
+EXAMPLES = '''
+'''
+
+import ConfigParser
+import copy
+
+class OpenShiftFactsUnsupportedRoleError(Exception):
+    pass
+
+class OpenShiftFactsFileWriteError(Exception):
+    pass
+
+class OpenShiftFacts():
+    known_roles = ['common', 'master', 'node', 'master_sdn', 'node_sdn']
+
+    def __init__(self, role, filename, local_facts):
+        self.changed = False
+        self.filename = filename
+        if role not in self.known_roles:
+            raise OpenShiftFactsUnsupportedRoleError("Role %s is not supported by this module" % role)
+        self.role = role
+        self.facts = self.generate_facts(local_facts)
+
+    def generate_facts(self, local_facts):
+        local_facts = self.init_local_facts(local_facts)
+        roles = local_facts.keys()
+
+        defaults = self.get_defaults(roles)
+        provider_facts = self.init_provider_facts()
+        facts = self.apply_provider_facts(defaults, provider_facts, roles)
+
+        facts = self.merge_facts(facts, local_facts)
+        facts['current_config'] = self.current_config(facts)
+        self.set_url_facts_if_unset(facts)
+        return dict(openshift=facts)
+
+
+    def set_url_facts_if_unset(self, facts):
+        if 'master' in facts:
+            for (url_var, use_ssl, port, default) in [
+                    ('api_url',
+                        facts['master']['api_use_ssl'],
+                        facts['master']['api_port'],
+                        facts['common']['hostname']),
+                    ('public_api_url',
+                        facts['master']['api_use_ssl'],
+                        facts['master']['api_port'],
+                        facts['common']['public_hostname']),
+                    ('console_url',
+                        facts['master']['console_use_ssl'],
+                        facts['master']['console_port'],
+                        facts['common']['hostname']),
+                    ('public_console_url' 'console_use_ssl',
+                        facts['master']['console_use_ssl'],
+                        facts['master']['console_port'],
+                        facts['common']['public_hostname'])]:
+                if url_var not in facts['master']:
+                    scheme = 'https' if use_ssl else 'http'
+                    netloc = default
+                    if (scheme == 'https' and port != '443') or (scheme == 'http' and port != '80'):
+                        netloc = "%s:%s" % (netloc, port)
+                    facts['master'][url_var] = urlparse.urlunparse((scheme, netloc, '', '', '', ''))
+
+
+    # Query current OpenShift config and return a dictionary containing
+    # settings that may be valuable for determining actions that need to be
+    # taken in the playbooks/roles
+    def current_config(self, facts):
+        current_config=dict()
+        roles = [ role for role in facts if role not in ['common','provider'] ]
+        for role in roles:
+            if 'roles' in current_config:
+                current_config['roles'].append(role)
+            else:
+                current_config['roles'] = [role]
+
+            # TODO: parse the /etc/sysconfig/openshift-{master,node} config to
+            # determine the location of files.
+
+            # Query kubeconfig settings
+            kubeconfig_dir = '/var/lib/openshift/openshift.local.certificates'
+            if role == 'node':
+                kubeconfig_dir = os.path.join(kubeconfig_dir, "node-%s" % facts['common']['hostname'])
+
+            kubeconfig_path = os.path.join(kubeconfig_dir, '.kubeconfig')
+            if os.path.isfile('/usr/bin/openshift') and os.path.isfile(kubeconfig_path):
+                try:
+                    _, output, error = module.run_command(["/usr/bin/openshift", "ex",
+                                                           "config", "view", "-o",
+                                                           "json",
+                                                           "--kubeconfig=%s" % kubeconfig_path],
+                                                           check_rc=False)
+                    config = json.loads(output)
+
+                    try:
+                        for cluster in config['clusters']:
+                            config['clusters'][cluster]['certificate-authority-data'] = 'masked'
+                    except KeyError:
+                        pass
+                    try:
+                        for user in config['users']:
+                            config['users'][user]['client-certificate-data'] = 'masked'
+                            config['users'][user]['client-key-data'] = 'masked'
+                    except KeyError:
+                        pass
+
+                    current_config['kubeconfig'] = config
+                except Exception:
+                    pass
+
+        return current_config
+
+
+    def apply_provider_facts(self, facts, provider_facts, roles):
+        if not provider_facts:
+            return facts
+
+        use_openshift_sdn = provider_facts.get('use_openshift_sdn')
+        if isinstance(use_openshift_sdn, bool):
+            facts['common']['use_openshift_sdn'] = use_openshift_sdn
+
+        common_vars = [('hostname', 'ip'), ('public_hostname', 'public_ip')]
+        for h_var, ip_var in common_vars:
+            ip_value = provider_facts['network'].get(ip_var)
+            if ip_value:
+                facts['common'][ip_var] = ip_value
+
+            facts['common'][h_var] = self.choose_hostname([provider_facts['network'].get(h_var)], facts['common'][ip_var])
+
+        if 'node' in roles:
+            ext_id = provider_facts.get('external_id')
+            if ext_id:
+                facts['node']['external_id'] = ext_id
+
+        facts['provider'] = provider_facts
+        return facts
+
+    def hostname_valid(self, hostname):
+        if (not hostname or
+                hostname.startswith('localhost') or
+                hostname.endswith('localdomain') or
+                len(hostname.split('.')) < 2):
+            return False
+
+        return True
+
+    def choose_hostname(self, hostnames=[], fallback=''):
+        hostname = fallback
+
+        ips = [ i for i in hostnames if i is not None and re.match(r'\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z', i) ]
+        hosts = [ i for i in hostnames if i is not None and i not in set(ips) ]
+
+        for host_list in (hosts, ips):
+            for h in host_list:
+                if self.hostname_valid(h):
+                    return h
+
+        return hostname
+
+    def get_defaults(self, roles):
+        hardware_facts = self.get_hardware_facts()
+        net_facts = self.get_net_facts()
+        base_facts = self.get_base_facts()
+
+        defaults = dict()
+
+        common = dict(use_openshift_sdn=True)
+        ip = net_facts['default_ipv4']['address']
+        common['ip'] = ip
+        common['public_ip'] = ip
+
+        rc, output, error = module.run_command(['hostname', '-f'])
+        hostname_f = output.strip() if rc == 0 else ''
+        hostname_values = [hostname_f, base_facts['nodename'], base_facts['fqdn']]
+        hostname = self.choose_hostname(hostname_values)
+
+        common['hostname'] = hostname
+        common['public_hostname'] = hostname
+        defaults['common'] = common
+
+        if 'master' in roles:
+            # TODO: provide for a better way to override just the port, or just
+            # the urls, instead of forcing both, also to override the hostname
+            # without having to re-generate these urls later
+            master = dict(api_use_ssl=True, api_port='8443',
+                    console_use_ssl=True, console_path='/console',
+                    console_port='8443', etcd_use_ssl=False,
+                    etcd_port='4001')
+            defaults['master'] = master
+
+        if 'node' in roles:
+            node = dict(external_id=common['hostname'], pod_cidr='',
+                        labels={}, annotations={})
+            node['resources_cpu'] = hardware_facts['processor_cores']
+            node['resources_memory'] = int(int(hardware_facts['memtotal_mb']) * 1024 * 1024 * 0.75)
+            defaults['node'] = node
+
+        return defaults
+
+    def merge_facts(self, orig, new):
+        facts = dict()
+        for key, value in orig.iteritems():
+            if key in new:
+                if isinstance(value, dict):
+                    facts[key] = self.merge_facts(value, new[key])
+                else:
+                    facts[key] = copy.copy(new[key])
+            else:
+                facts[key] = copy.deepcopy(value)
+        new_keys = set(new.keys()) - set(orig.keys())
+        for key in new_keys:
+            facts[key] = copy.deepcopy(new[key])
+        return facts
+
+    def query_metadata(self, metadata_url, headers=None, expect_json=False):
+        r, info = fetch_url(module, metadata_url, headers=headers)
+        if info['status'] != 200:
+            module.fail_json(msg='Failed to query metadata', result=r,
+                             info=info)
+        if expect_json:
+            return module.from_json(r.read())
+        else:
+            return [line.strip() for line in r.readlines()]
+
+    def walk_metadata(self, metadata_url, headers=None, expect_json=False):
+        metadata = dict()
+
+        for line in self.query_metadata(metadata_url, headers, expect_json):
+            if line.endswith('/') and not line == 'public-keys/':
+                key = line[:-1]
+                metadata[key]=self.walk_metadata(metadata_url + line, headers,
+                                                 expect_json)
+            else:
+                results = self.query_metadata(metadata_url + line, headers,
+                                              expect_json)
+                if len(results) == 1:
+                    metadata[line] = results.pop()
+                else:
+                    metadata[line] = results
+        return metadata
+
+    def get_provider_metadata(self, metadata_url, supports_recursive=False,
+                          headers=None, expect_json=False):
+        if supports_recursive:
+            metadata = self.query_metadata(metadata_url, headers, expect_json)
+        else:
+            metadata = self.walk_metadata(metadata_url, headers, expect_json)
+        return metadata
+
+    def get_hardware_facts(self):
+        if not hasattr(self, 'hardware_facts'):
+            self.hardware_facts = Hardware().populate()
+        return self.hardware_facts
+
+    def get_base_facts(self):
+        if not hasattr(self, 'base_facts'):
+            self.base_facts = Facts().populate()
+        return self.base_facts
+
+    def get_virt_facts(self):
+        if not hasattr(self, 'virt_facts'):
+            self.virt_facts = Virtual().populate()
+        return self.virt_facts
+
+    def get_net_facts(self):
+        if not hasattr(self, 'net_facts'):
+            self.net_facts = Network(module).populate()
+        return self.net_facts
+
+    def guess_host_provider(self):
+        # TODO: cloud provider facts should probably be submitted upstream
+        virt_facts = self.get_virt_facts()
+        hardware_facts = self.get_hardware_facts()
+        product_name = hardware_facts['product_name']
+        product_version = hardware_facts['product_version']
+        virt_type = virt_facts['virtualization_type']
+        virt_role = virt_facts['virtualization_role']
+        provider = None
+        metadata = None
+
+        # TODO: this is not exposed through module_utils/facts.py in ansible,
+        # need to create PR for ansible to expose it
+        bios_vendor = get_file_content('/sys/devices/virtual/dmi/id/bios_vendor')
+        if bios_vendor == 'Google':
+            provider = 'gce'
+            metadata_url = 'http://metadata.google.internal/computeMetadata/v1/?recursive=true'
+            headers = {'Metadata-Flavor': 'Google'}
+            metadata = self.get_provider_metadata(metadata_url, True, headers,
+                                                  True)
+
+            # Filter sshKeys and serviceAccounts from gce metadata
+            metadata['project']['attributes'].pop('sshKeys', None)
+            metadata['instance'].pop('serviceAccounts', None)
+        elif virt_type == 'xen' and virt_role == 'guest' and re.match(r'.*\.amazon$', product_version):
+            provider = 'ec2'
+            metadata_url = 'http://169.254.169.254/latest/meta-data/'
+            metadata = self.get_provider_metadata(metadata_url)
+        elif re.search(r'OpenStack', product_name):
+            provider = 'openstack'
+            metadata_url = 'http://169.254.169.254/openstack/latest/meta_data.json'
+            metadata = self.get_provider_metadata(metadata_url, True, None, True)
+            ec2_compat_url = 'http://169.254.169.254/latest/meta-data/'
+            metadata['ec2_compat'] = self.get_provider_metadata(ec2_compat_url)
+
+            # Filter public_keys  and random_seed from openstack metadata
+            metadata.pop('public_keys', None)
+            metadata.pop('random_seed', None)
+        return dict(name=provider, metadata=metadata)
+
+    def normalize_provider_facts(self, provider, metadata):
+        if provider is None or metadata is None:
+            return {}
+
+        # TODO: test for ipv6_enabled where possible (gce, aws do not support)
+        # and configure ipv6 facts if available
+
+        # TODO: add support for setting user_data if available
+
+        facts = dict(name=provider, metadata=metadata)
+        network = dict(interfaces=[], ipv6_enabled=False)
+        if provider == 'gce':
+            for interface in metadata['instance']['networkInterfaces']:
+                int_info = dict(ips=[interface['ip']], network_type=provider)
+                int_info['public_ips'] = [ ac['externalIp'] for ac in interface['accessConfigs'] ]
+                int_info['public_ips'].extend(interface['forwardedIps'])
+                _, _, network_id = interface['network'].rpartition('/')
+                int_info['network_id'] = network_id
+                network['interfaces'].append(int_info)
+            _, _, zone = metadata['instance']['zone'].rpartition('/')
+            facts['zone'] = zone
+            facts['external_id'] = metadata['instance']['id']
+
+            # Default to no sdn for GCE deployments
+            facts['use_openshift_sdn'] = False
+
+            # GCE currently only supports a single interface
+            network['ip'] = network['interfaces'][0]['ips'][0]
+            network['public_ip'] = network['interfaces'][0]['public_ips'][0]
+            network['hostname'] = metadata['instance']['hostname']
+
+            # TODO: attempt to resolve public_hostname
+            network['public_hostname'] = network['public_ip']
+        elif provider == 'ec2':
+            for interface in sorted(metadata['network']['interfaces']['macs'].values(),
+                                    key=lambda x: x['device-number']):
+                int_info = dict()
+                var_map = {'ips': 'local-ipv4s', 'public_ips': 'public-ipv4s'}
+                for ips_var, int_var in var_map.iteritems():
+                    ips = interface[int_var]
+                    int_info[ips_var] = [ips] if isinstance(ips, basestring) else ips
+                int_info['network_type'] = 'vpc' if 'vpc-id' in interface else 'classic'
+                int_info['network_id'] = interface['subnet-id'] if int_info['network_type'] == 'vpc' else None
+                network['interfaces'].append(int_info)
+            facts['zone'] = metadata['placement']['availability-zone']
+            facts['external_id'] = metadata['instance-id']
+
+            # TODO: actually attempt to determine default local and public ips
+            # by using the ansible default ip fact and the ipv4-associations
+            # form the ec2 metadata
+            network['ip'] = metadata['local-ipv4']
+            network['public_ip'] = metadata['public-ipv4']
+
+            # TODO: verify that local hostname makes sense and is resolvable
+            network['hostname'] = metadata['local-hostname']
+
+            # TODO: verify that public hostname makes sense and is resolvable
+            network['public_hostname'] = metadata['public-hostname']
+        elif provider == 'openstack':
+            # openstack ec2 compat api does not support network interfaces and
+            # the version tested on did not include the info in the openstack
+            # metadata api, should be updated if neutron exposes this.
+
+            facts['zone'] = metadata['availability_zone']
+            facts['external_id'] = metadata['uuid']
+            network['ip'] = metadata['ec2_compat']['local-ipv4']
+            network['public_ip'] = metadata['ec2_compat']['public-ipv4']
+
+            # TODO: verify local hostname makes sense and is resolvable
+            network['hostname'] = metadata['hostname']
+
+            # TODO: verify that public hostname makes sense and is resolvable
+            network['public_hostname'] = metadata['ec2_compat']['public-hostname']
+
+        facts['network'] = network
+        return facts
+
+    def init_provider_facts(self):
+        provider_info = self.guess_host_provider()
+        provider_facts = self.normalize_provider_facts(
+                provider_info.get('name'),
+                provider_info.get('metadata')
+        )
+        return provider_facts
+
+    def get_facts(self):
+        # TODO: transform facts into cleaner format (openshift_<blah> instead
+        # of openshift.<blah>
+        return self.facts
+
+    def init_local_facts(self, facts={}):
+        changed = False
+
+        local_facts = ConfigParser.SafeConfigParser()
+        local_facts.read(self.filename)
+
+        section = self.role
+        if not local_facts.has_section(section):
+            local_facts.add_section(section)
+            changed = True
+
+        for key, value in facts.iteritems():
+            if isinstance(value, bool):
+                value = str(value)
+            if not value:
+                continue
+            if not local_facts.has_option(section, key) or local_facts.get(section, key) != value:
+                local_facts.set(section, key, value)
+                changed = True
+
+        if changed and not module.check_mode:
+            try:
+                fact_dir = os.path.dirname(self.filename)
+                if not os.path.exists(fact_dir):
+                    os.makedirs(fact_dir)
+                with open(self.filename, 'w') as fact_file:
+                        local_facts.write(fact_file)
+            except (IOError, OSError) as e:
+                raise OpenShiftFactsFileWriteError("Could not create fact file: %s, error: %s" % (self.filename, e))
+        self.changed = changed
+
+        role_facts = dict()
+        for section in local_facts.sections():
+            role_facts[section] = dict()
+            for opt, val in local_facts.items(section):
+                role_facts[section][opt] = val
+        return role_facts
+
+
+def main():
+    global module
+    module = AnsibleModule(
+            argument_spec = dict(
+                    role=dict(default='common',
+                              choices=OpenShiftFacts.known_roles,
+                              required=False),
+                    local_facts=dict(default={}, type='dict', required=False),
+            ),
+            supports_check_mode=True,
+            add_file_common_args=True,
+    )
+
+    role = module.params['role']
+    local_facts = module.params['local_facts']
+    fact_file = '/etc/ansible/facts.d/openshift.fact'
+
+    openshift_facts = OpenShiftFacts(role, fact_file, local_facts)
+
+    file_params = module.params.copy()
+    file_params['path'] = fact_file
+    file_args = module.load_file_common_arguments(file_params)
+    changed = module.set_fs_attributes_if_different(file_args,
+            openshift_facts.changed)
+
+    return module.exit_json(changed=changed,
+            ansible_facts=openshift_facts.get_facts())
+
+# import module snippets
+from ansible.module_utils.basic import *
+from ansible.module_utils.facts import *
+from ansible.module_utils.urls import *
+main()
diff --git a/roles/openshift_facts/meta/main.yml b/roles/openshift_facts/meta/main.yml
new file mode 100644
index 000000000..0be3afd24
--- /dev/null
+++ b/roles/openshift_facts/meta/main.yml
@@ -0,0 +1,15 @@
+---
+galaxy_info:
+  author: Jason DeTiberus
+  description:
+  company: Red Hat, Inc.
+  license: Apache License, Version 2.0
+  min_ansible_version: 1.8
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+  - system
+dependencies: []
diff --git a/roles/openshift_facts/tasks/main.yml b/roles/openshift_facts/tasks/main.yml
new file mode 100644
index 000000000..5a7d10d25
--- /dev/null
+++ b/roles/openshift_facts/tasks/main.yml
@@ -0,0 +1,3 @@
+---
+- name: Gather OpenShift facts
+  openshift_facts:
diff --git a/roles/openshift_master/README.md b/roles/openshift_master/README.md
index 2d898bc3b..9f9d0a613 100644
--- a/roles/openshift_master/README.md
+++ b/roles/openshift_master/README.md
@@ -13,20 +13,24 @@ Role Variables
 --------------
 
 From this role:
-| Name                                     | Default value         |
-|
-|------------------------------------------|-----------------------|----------------------------------------|
-| openshift_master_manage_service_externally | False                 | Should the openshift-master role manage the openshift-master service? |
-| openshift_master_debug_level               | openshift_debug_level | Verbosity of the debug logs for openshift-master |
-| openshift_node_ips                         | []                    | List of the openshift node ip addresses, that we want to pre-register to the system when openshift-master starts up |
-| openshift_registry_url                     | UNDEF (Optional)      | Default docker registry to use |
+| Name                                | Default value         |                                                  |
+|-------------------------------------|-----------------------|--------------------------------------------------|
+| openshift_master_debug_level        | openshift_debug_level | Verbosity of the debug logs for openshift-master |
+| openshift_node_ips                  | []                    | List of the openshift node ip addresses to pre-register when openshift-master starts up |
+| openshift_registry_url              | UNDEF                 | Default docker registry to use |
+| openshift_master_api_port           | UNDEF                 | |
+| openshift_master_console_port       | UNDEF                 | |
+| openshift_master_api_url            | UNDEF                 | |
+| openshift_master_console_url        | UNDEF                 | |
+| openshift_master_public_api_url     | UNDEF                 | |
+| openshift_master_public_console_url | UNDEF                 | |
 
 From openshift_common:
-| Name                          |  Default Value      |                     |
-|-------------------------------|---------------------|---------------------|
-| openshift_debug_level         | 0                   | Global openshift debug log verbosity |
-| openshift_public_ip           | UNDEF (Required)    | Public IP address to use for this host |
-| openshift_hostname            | UNDEF (Required)    | hostname to use for this instance |
+| Name                          | Default Value  |                                        |
+|-------------------------------|----------------|----------------------------------------|
+| openshift_debug_level         | 0              | Global openshift debug log verbosity   |
+| openshift_public_ip           | UNDEF          | Public IP address to use for this host |
+| openshift_hostname            | UNDEF          | hostname to use for this instance      |
 
 Dependencies
 ------------
diff --git a/roles/openshift_master/defaults/main.yml b/roles/openshift_master/defaults/main.yml
index 0159afbb5..87fb347a8 100644
--- a/roles/openshift_master/defaults/main.yml
+++ b/roles/openshift_master/defaults/main.yml
@@ -1,16 +1,17 @@
 ---
-openshift_master_manage_service_externally: false
-openshift_master_debug_level: "{{ openshift_debug_level | default(0) }}"
 openshift_node_ips: []
+
+# TODO: update setting these values based on the facts
+# TODO: update for console port change
 os_firewall_allow:
 - service: etcd embedded
   port: 4001/tcp
-- service: etcd peer
-  port: 7001/tcp
 - service: OpenShift api https
   port: 8443/tcp
-- service: OpenShift web console https
-  port: 8444/tcp
 os_firewall_deny:
 - service: OpenShift api http
   port: 8080/tcp
+- service: former OpenShift web console port
+  port: 8444/tcp
+- service: former etcd peer port
+  port: 7001/tcp
diff --git a/roles/openshift_master/handlers/main.yml b/roles/openshift_master/handlers/main.yml
index 503d08d41..6fd4dfb51 100644
--- a/roles/openshift_master/handlers/main.yml
+++ b/roles/openshift_master/handlers/main.yml
@@ -1,4 +1,3 @@
 ---
 - name: restart openshift-master
   service: name=openshift-master state=restarted
-  when: not openshift_master_manage_service_externally
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 52f5f694c..aa615df39 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -1,19 +1,37 @@
 ---
-# TODO: allow for overriding default ports where possible
-# TODO: if setting up multiple masters, will need to predistribute the certs
-# to the additional masters before starting openshift-master
+# TODO: actually have api_port, api_use_ssl, console_port, console_use_ssl,
+# etcd_use_ssl actually change the master config.
+
+- name: Set master OpenShift facts
+  openshift_facts:
+    role: 'master'
+    local_facts:
+      debug_level: "{{ openshift_master_debug_level | default(openshift.common.debug_level) }}"
+      api_port: "{{ openshift_master_api_port | default(None) }}"
+      api_url: "{{ openshift_master_api_url | default(None) }}"
+      api_use_ssl: "{{ openshift_master_api_use_ssl | default(None) }}"
+      public_api_url: "{{ openshift_master_public_api_url | default(None) }}"
+      console_port: "{{ openshift_master_console_port | default(None) }}"
+      console_url: "{{ openshift_master_console_url | default(None) }}"
+      console_use_ssl: "{{ openshift_master_console_use_ssl | default(None) }}"
+      public_console_url: "{{ openshift_master_public_console_url | default(None) }}"
+      etcd_use_ssl: "{{ openshift_master_etcd_use_ssl | default(None) }}"
 
 - name: Install OpenShift Master package
   yum: pkg=openshift-master state=installed
 
+# TODO: We should pre-generate the master config and point to the generated
+# config rather than setting command line flags here
 - name: Configure OpenShift settings
   lineinfile:
     dest: /etc/sysconfig/openshift-master
     regexp: '^OPTIONS='
-    line: "OPTIONS=\"--public-master={{ openshift_hostname }} {% if openshift_node_ips %} --nodes={{ openshift_node_ips | join(',') }} {% endif %} --loglevel={{ openshift_master_debug_level }}\""
+    line: "OPTIONS=\"--master={{ openshift.common.hostname }} --public-master={{ openshift.common.public_hostname }} {% if openshift_node_ips %} --nodes={{ openshift_node_ips | join(',') }} {% endif %} --loglevel={{ openshift.master.debug_level }}\""
   notify:
   - restart openshift-master
 
+# TODO: should this be populated by a fact based on the deployment type
+# (origin, online, enterprise)?
 - name: Set default registry url
   lineinfile:
     dest: /etc/sysconfig/openshift-master
@@ -23,34 +41,18 @@
   notify:
   - restart openshift-master
 
-- name: Set master OpenShift facts
-  include: "{{ role_path | dirname }}/openshift_common/tasks/set_facts.yml"
-  facts:
-  - section: master
-    option: debug_level
-    value: "{{ openshift_master_debug_level }}"
-  - section: master
-    option: public_ip
-    value: "{{ openshift_public_ip }}"
-  - section: master
-    option: externally_managed
-    value: "{{ openshift_master_manage_service_externally }}"
-
 - name: Start and enable openshift-master
   service: name=openshift-master enabled=yes state=started
-  when: not openshift_master_manage_service_externally
-  register: result
-
-- name: Disable openshift-master if openshift-master is managed externally
-  service: name=openshift-master enabled=false
-  when: openshift_master_manage_service_externally
 
 - name: Create .kube directory
   file:
     path: /root/.kube
     state: directory
     mode: 0700
+
+# TODO: Update this file if the contents of the source file are not present in
+# the dest file, will need to make sure to ignore things that could be added
 - name: Configure root user kubeconfig
-  command: cp /var/lib/openshift/openshift.local.certificates/admin/.kubeconfig /root/.kube/.kubeconfig
+  command: cp /var/lib/openshift/openshift.local.certificates/openshift-client/.kubeconfig /root/.kube/.kubeconfig
   args:
     creates: /root/.kube/.kubeconfig
diff --git a/roles/openshift_master/vars/main.yml b/roles/openshift_master/vars/main.yml
deleted file mode 100644
index 9a8c4bba2..000000000
--- a/roles/openshift_master/vars/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-openshift_host_type: master
diff --git a/roles/openshift_node/README.md b/roles/openshift_node/README.md
index c9b4eab34..83359f164 100644
--- a/roles/openshift_node/README.md
+++ b/roles/openshift_node/README.md
@@ -16,10 +16,7 @@ Role Variables
 From this role:
 | Name                                     | Default value         |                                        |
 |------------------------------------------|-----------------------|----------------------------------------|
-| openshift_node_manage_service_externally | False                 | Should the openshift-node role manage the openshift-node service? |
 | openshift_node_debug_level               | openshift_debug_level | Verbosity of the debug logs for openshift-node |
-| openshift_master_public_ips              | UNDEF (Required)      | List of the public IPs for the openhift-master hosts |
-| openshift_master_ips                     | UNDEF (Required)      | List of IP addresses for the openshift-master hosts to be used for node -> master communication |
 | openshift_registry_url                   | UNDEF (Optional)      | Default docker registry to use |
 
 From openshift_common:
diff --git a/roles/openshift_node/defaults/main.yml b/roles/openshift_node/defaults/main.yml
index 6dc73a96e..df7ec41b6 100644
--- a/roles/openshift_node/defaults/main.yml
+++ b/roles/openshift_node/defaults/main.yml
@@ -1,6 +1,4 @@
 ---
-openshift_node_manage_service_externally: false
-openshift_node_debug_level: "{{ openshift_debug_level | default(0) }}"
 os_firewall_allow:
 - service: OpenShift kubelet
   port: 10250/tcp
diff --git a/roles/openshift_node/handlers/main.yml b/roles/openshift_node/handlers/main.yml
index f7aa36d88..ca2992637 100644
--- a/roles/openshift_node/handlers/main.yml
+++ b/roles/openshift_node/handlers/main.yml
@@ -1,4 +1,4 @@
 ---
 - name: restart openshift-node
   service: name=openshift-node state=restarted
-  when: not openshift_node_manage_service_externally
+  when: not openshift.common.use_openshift_sdn|bool
diff --git a/roles/openshift_node/tasks/main.yml b/roles/openshift_node/tasks/main.yml
index c039e3f05..8cfef0e15 100644
--- a/roles/openshift_node/tasks/main.yml
+++ b/roles/openshift_node/tasks/main.yml
@@ -1,4 +1,12 @@
 ---
+# TODO: allow for overriding default ports where possible
+# TODO: trigger the external service when restart is needed
+- name: Set node OpenShift facts
+  openshift_facts:
+    role: 'node'
+    local_facts:
+      debug_level: "{{ openshift_node_debug_level | default(openshift.common.debug_level) }}"
+
 - name: Test if node certs and config exist
   stat: path={{ item }}
   failed_when: not result.stat.exists
@@ -23,7 +31,7 @@
   lineinfile:
     dest: /etc/sysconfig/openshift-node
     regexp: '^OPTIONS='
-    line: "OPTIONS=\"--hostname={{ openshift_hostname }} --loglevel={{ openshift_node_debug_level }} --create-certs=false\""
+    line: "OPTIONS=\"--hostname={{ openshift.common.hostname }} --loglevel={{ openshift.node.debug_level }} --create-certs=false\""
   notify:
   - restart openshift-node
 
@@ -36,23 +44,10 @@
   notify:
   - restart openshift-node
 
-- name: Set OpenShift node facts
-  include: "{{ role_path | dirname }}/openshift_common/tasks/set_facts.yml"
-  facts:
-  - section: node
-    option: debug_level
-    value: "{{ openshift_node_debug_level }}"
-  - section: node
-    option: public_ip
-    value: "{{ openshift_public_ip }}"
-  - section: node
-    option: externally_managed
-    value: "{{ openshift_node_manage_service_externally }}"
-
 - name: Start and enable openshift-node
   service: name=openshift-node enabled=yes state=started
-  when: not openshift_node_manage_service_externally
+  when: not openshift.common.use_openshift_sdn|bool
 
 - name: Disable openshift-node if openshift-node is managed externally
   service: name=openshift-node enabled=false
-  when: openshift_node_manage_service_externally
+  when: openshift.common.use_openshift_sdn|bool
diff --git a/roles/openshift_node/vars/main.yml b/roles/openshift_node/vars/main.yml
deleted file mode 100644
index 9841d52f9..000000000
--- a/roles/openshift_node/vars/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-openshift_host_type: node
diff --git a/roles/openshift_register_nodes/README.md b/roles/openshift_register_nodes/README.md
index 225dd44b9..b96faa044 100644
--- a/roles/openshift_register_nodes/README.md
+++ b/roles/openshift_register_nodes/README.md
@@ -1,38 +1,34 @@
-Role Name
-=========
+OpenShift Register Nodes
+========================
 
-A brief description of the role goes here.
+TODO
 
 Requirements
 ------------
 
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+TODO
 
 Role Variables
 --------------
 
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+TODO
 
 Dependencies
 ------------
 
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+TODO
 
 Example Playbook
 ----------------
 
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
+TODO
 
 License
 -------
 
-BSD
+Apache License Version 2.0
 
 Author Information
 ------------------
 
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+Jason DeTiberus (jdetiber@redhat.com)
diff --git a/roles/openshift_register_nodes/library/kubernetes_register_node.py b/roles/openshift_register_nodes/library/kubernetes_register_node.py
index 409215616..8ebeb087a 100644..100755
--- a/roles/openshift_register_nodes/library/kubernetes_register_node.py
+++ b/roles/openshift_register_nodes/library/kubernetes_register_node.py
@@ -214,7 +214,8 @@ class Node:
                              resources = NodeResources(version, cpu, memory),
                              cidr = podCIDR,
                              labels = labels,
-                             annotations = annotations
+                             annotations = annotations,
+                             externalID = externalID
                         )
         elif version == 'v1beta3':
             metadata = dict(name = name,
diff --git a/roles/openshift_register_nodes/meta/main.yml b/roles/openshift_register_nodes/meta/main.yml
index 7b1f0ef0a..e40a152c1 100644
--- a/roles/openshift_register_nodes/meta/main.yml
+++ b/roles/openshift_register_nodes/meta/main.yml
@@ -1,128 +1,17 @@
 ---
 galaxy_info:
-  author: your name
-  description: 
-  company: your company (optional)
-  # Some suggested licenses:
-  # - BSD (default)
-  # - MIT
-  # - GPLv2
-  # - GPLv3
-  # - Apache
-  # - CC-BY
-  license: license (GPLv2, CC-BY, etc)
-  min_ansible_version: 1.2
-  #
-  # Below are all platforms currently available. Just uncomment
-  # the ones that apply to your role. If you don't see your 
-  # platform on this list, let us know and we'll get it added!
-  #
-  #platforms:
-  #- name: EL
-  #  versions:
-  #  - all
-  #  - 5
-  #  - 6
-  #  - 7
-  #- name: GenericUNIX
-  #  versions:
-  #  - all
-  #  - any
-  #- name: Fedora
-  #  versions:
-  #  - all
-  #  - 16
-  #  - 17
-  #  - 18
-  #  - 19
-  #  - 20
-  #- name: SmartOS
-  #  versions:
-  #  - all
-  #  - any
-  #- name: opensuse
-  #  versions:
-  #  - all
-  #  - 12.1
-  #  - 12.2
-  #  - 12.3
-  #  - 13.1
-  #  - 13.2
-  #- name: Amazon
-  #  versions:
-  #  - all
-  #  - 2013.03
-  #  - 2013.09
-  #- name: GenericBSD
-  #  versions:
-  #  - all
-  #  - any
-  #- name: FreeBSD
-  #  versions:
-  #  - all
-  #  - 8.0
-  #  - 8.1
-  #  - 8.2
-  #  - 8.3
-  #  - 8.4
-  #  - 9.0
-  #  - 9.1
-  #  - 9.1
-  #  - 9.2
-  #- name: Ubuntu
-  #  versions:
-  #  - all
-  #  - lucid
-  #  - maverick
-  #  - natty
-  #  - oneiric
-  #  - precise
-  #  - quantal
-  #  - raring
-  #  - saucy
-  #  - trusty
-  #- name: SLES
-  #  versions:
-  #  - all
-  #  - 10SP3
-  #  - 10SP4
-  #  - 11
-  #  - 11SP1
-  #  - 11SP2
-  #  - 11SP3
-  #- name: GenericLinux
-  #  versions:
-  #  - all
-  #  - any
-  #- name: Debian
-  #  versions:
-  #  - all
-  #  - etch
-  #  - lenny
-  #  - squeeze
-  #  - wheezy
-  #
-  # Below are all categories currently available. Just as with
-  # the platforms above, uncomment those that apply to your role.
-  #
-  #categories:
-  #- cloud
-  #- cloud:ec2
-  #- cloud:gce
-  #- cloud:rax
-  #- clustering
-  #- database
-  #- database:nosql
-  #- database:sql
-  #- development
-  #- monitoring
-  #- networking
-  #- packaging
-  #- system
-  #- web
-dependencies: []
-  # List your role dependencies here, one per line. Only
-  # dependencies available via galaxy should be listed here.
-  # Be sure to remove the '[]' above if you add dependencies
-  # to this list.
-  
+  author: Jason DeTiberus
+  description:
+  company: Red Hat, Inc.
+  license: Apache License, Version 2.0
+  min_ansible_version: 1.8
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+  - system
+dependencies:
+- { role: openshift_facts }
+
diff --git a/roles/openshift_register_nodes/tasks/main.yml b/roles/openshift_register_nodes/tasks/main.yml
index 59216fc87..7319b88b1 100644
--- a/roles/openshift_register_nodes/tasks/main.yml
+++ b/roles/openshift_register_nodes/tasks/main.yml
@@ -1,18 +1,20 @@
 ---
-# TODO: support configuration for multiple masters, currently hardcoding
-# the info from the first master
+# TODO: support new create-config command to generate node certs and config
+# TODO: recreate master/node configs if settings that affect the configs
+# change (hostname, public_hostname, ip, public_ip, etc)
 
 # TODO: create a failed_when condition
 - name: Create node server certificates
   command: >
     /usr/bin/openshift admin create-server-cert
     --overwrite=false
-    --cert={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/server.crt
-    --key={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/server.key
-    --hostnames={{ [openshift_hostname, openshift_public_hostname, openshift_ip, openshift_public_ip]|join(",") }}
+    --cert={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/server.crt
+    --key={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/server.key
+    --hostnames={{ [item.openshift.common.hostname,
+                    item.openshift.common.public_hostname]|unique|join(",") }}
   args:
     chdir: "{{ openshift_cert_dir_parent }}"
-    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift_node_hostname }}/server.crt"
+    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift.common.hostname }}/server.crt"
   with_items: openshift_nodes
   register: server_cert_result
 
@@ -21,48 +23,42 @@
   command: >
     /usr/bin/openshift admin create-node-cert
     --overwrite=false
-    --cert={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/cert.crt
-    --key={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/key.key
-    --node-name={{ item.openshift_node_hostname }}
+    --cert={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/cert.crt
+    --key={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/key.key
+    --node-name={{ item.openshift.common.hostname }}
   args:
     chdir: "{{ openshift_cert_dir_parent }}"
-    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift_node_hostname }}/cert.crt"
+    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift.common.hostname }}/cert.crt"
   with_items: openshift_nodes
   register: node_cert_result
 
-# TODO: re-create kubeconfig if certs were regenerated, not just if
-# .kubeconfig doesn't exist
 # TODO: create a failed_when condition
 - name: Create kubeconfigs for nodes
   command: >
     /usr/bin/openshift admin create-kubeconfig
-    --client-certificate={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/cert.crt
-    --client-key={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/key.key
-    --kubeconfig={{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/.kubeconfig
-    --master={{ openshift_master_urls[0] }}
-    --public-master={{ openshift_master_public_urls[0] }}
+    --client-certificate={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/cert.crt
+    --client-key={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/key.key
+    --kubeconfig={{ openshift_cert_dir }}/node-{{ item.openshift.common.hostname }}/.kubeconfig
+    --master={{ openshift.master.api_url }}
+    --public-master={{ openshift.master.public_api_url }}
   args:
     chdir: "{{ openshift_cert_dir_parent }}"
-    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift_node_hostname }}/.kubeconfig"
+    creates: "{{ openshift_cert_dir_abs }}/node-{{ item.openshift.common.hostname }}/.kubeconfig"
   with_items: openshift_nodes
   register: kubeconfig_result
 
-# TODO: generate the node configs (openshift start node --write-config
-# --config='{{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/node.yaml'
-# --kubeconfig='{{ openshift_cert_dir }}/node-{{ item.openshift_node_hostname }}/.kubeconfig'
-# will need to modify the generated node config as needed
-# (servingInfo.{certFile,clientCA,keyFile})
-
 - name: Register unregistered nodes
   kubernetes_register_node:
-    name: "{{ item.openshift_node_name }}"
+    client_user: openshift-client
+    name: "{{ item.openshift.common.hostname }}"
     api_version: "{{ openshift_kube_api_version }}"
-    cpu: "{{ item.openshift_node_cpu if item.openshift_node_cpu else None }}"
-    memory: "{{ item.openshift_node_memory if item.openshift_node_memory else None }}"
-    pod_cidr: "{{ item.openshift_node_pod_cidr if item.openshift_node_pod_cidr else None }}"
-    host_ip: "{{ item.openshift_node_host_ip }}"
-    labels: "{{ item.openshift_node_labels if item.openshift_node_labels else {} }}"
-    annotations: "{{ item.openshift_node_annotations if item.openshift_node_annotations else {} }}"
+    cpu: "{{ item.openshift.node.resources_cpu | default(None) }}"
+    memory: "{{ item.openshift.node.resources_memory | default(None) }}"
+    pod_cidr: "{{ item.openshift.node.pod_cidr | default(None) }}"
+    host_ip: "{{ item.openshift.common.ip }}"
+    labels: "{{ item.openshift.node.labels | default({}) }}"
+    annotations: "{{ item.openshift.node.annotations | default({}) }}"
+    external_id: "{{ item.openshift.node.external_id }}"
     # TODO: support customizing other attributes such as: client_config,
     # client_cluster, client_context, client_user
     # TODO: update for v1beta3 changes after rebase: hostnames, external_ips,
diff --git a/roles/openshift_repos/defaults/main.yaml b/roles/openshift_repos/defaults/main.yaml
index 6fe2bf621..1730207f4 100644
--- a/roles/openshift_repos/defaults/main.yaml
+++ b/roles/openshift_repos/defaults/main.yaml
@@ -1,5 +1,7 @@
 ---
 # TODO: once we are able to configure/deploy origin using the openshift roles,
 # then we should default to origin
+
+# TODO: push the defaulting of these values to the openshift_facts module
 openshift_deployment_type: online
 openshift_additional_repos: {}
diff --git a/roles/openshift_repos/meta/main.yml b/roles/openshift_repos/meta/main.yml
index cc18c453c..0558b822c 100644
--- a/roles/openshift_repos/meta/main.yml
+++ b/roles/openshift_repos/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- { role: openshift_facts }
diff --git a/roles/openshift_repos/tasks/main.yaml b/roles/openshift_repos/tasks/main.yaml
index 6219c4906..bb1551d37 100644
--- a/roles/openshift_repos/tasks/main.yaml
+++ b/roles/openshift_repos/tasks/main.yaml
@@ -1,6 +1,12 @@
 ---
 # TODO: Add flag for enabling EPEL repo, default to false
 
+# TODO: Add subscription-management config, with parameters
+#       for username, password, poolid(name), and official repos to
+#       enable/disable. Might need to make a module that extends the
+#       subscription management module to take a poolid and enable/disable the
+#       proper repos correctly.
+
 - assert:
     that: openshift_deployment_type in known_openshift_deployment_types
 
diff --git a/roles/openshift_sdn_master/defaults/main.yml b/roles/openshift_sdn_master/defaults/main.yml
deleted file mode 100644
index da7655546..000000000
--- a/roles/openshift_sdn_master/defaults/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-openshift_sdn_master_debug_level: "{{ openshift_debug_level | default(0) }}"
diff --git a/roles/openshift_sdn_master/meta/main.yml b/roles/openshift_sdn_master/meta/main.yml
index e6e5514d1..5de32cc13 100644
--- a/roles/openshift_sdn_master/meta/main.yml
+++ b/roles/openshift_sdn_master/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- { role: openshift_common }
diff --git a/roles/openshift_sdn_master/tasks/main.yml b/roles/openshift_sdn_master/tasks/main.yml
index e1761afdc..f2d61043b 100644
--- a/roles/openshift_sdn_master/tasks/main.yml
+++ b/roles/openshift_sdn_master/tasks/main.yml
@@ -1,4 +1,13 @@
 ---
+# TODO: add task to set the sdn subnet if openshift-sdn-master hasn't been
+# started yet
+
+- name: Set master sdn OpenShift facts
+  openshift_facts:
+    role: 'master_sdn'
+    local_facts:
+      debug_level: "{{ openshift_master_sdn_debug_level | default(openshift.common.debug_level) }}"
+
 - name: Install openshift-sdn-master
   yum:
     pkg: openshift-sdn-master
@@ -8,17 +17,10 @@
   lineinfile:
     dest: /etc/sysconfig/openshift-sdn-master
     regexp: '^OPTIONS='
-    line: "OPTIONS=\"-v={{ openshift_sdn_master_debug_level }}\""
+    line: "OPTIONS=\"-v={{ openshift.master_sdn.debug_level }}\""
   notify:
   - restart openshift-sdn-master
 
-- name: Set openshift-sdn-master facts
-  include: "{{ role_path | dirname }}/openshift_common/tasks/set_facts.yml"
-  facts:
-  - section: sdn-master
-    option: debug_level
-    value: "{{ openshift_sdn_master_debug_level }}"
-
 - name: Enable openshift-sdn-master
   service:
     name: openshift-sdn-master
diff --git a/roles/openshift_sdn_node/README.md b/roles/openshift_sdn_node/README.md
index 2da2d74eb..e6b6a9503 100644
--- a/roles/openshift_sdn_node/README.md
+++ b/roles/openshift_sdn_node/README.md
@@ -17,12 +17,6 @@ From this role:
 | openshift_sdn_node_debug_level | openshift_debug_level | Verbosity of the debug logs for openshift-master |
 
 
-From openshift_node:
-| Name                  | Default value    |                                      |
-|-----------------------|------------------|--------------------------------------|
-| openshift_master_ips  | UNDEF (Required) | List of IP addresses for the openshift-master hosts to be used for node -> master communication |
-
-
 From openshift_common:
 | Name                          | Default value       |                                        |
 |-------------------------------|---------------------|----------------------------------------|
diff --git a/roles/openshift_sdn_node/defaults/main.yml b/roles/openshift_sdn_node/defaults/main.yml
deleted file mode 100644
index 9612d9d91..000000000
--- a/roles/openshift_sdn_node/defaults/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-openshift_sdn_node_debug_level: "{{ openshift_debug_level | default(0) }}"
diff --git a/roles/openshift_sdn_node/meta/main.yml b/roles/openshift_sdn_node/meta/main.yml
index ab45ff51e..ffe10f836 100644
--- a/roles/openshift_sdn_node/meta/main.yml
+++ b/roles/openshift_sdn_node/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- { role: openshift_common }
diff --git a/roles/openshift_sdn_node/tasks/main.yml b/roles/openshift_sdn_node/tasks/main.yml
index ff05a6972..729c28879 100644
--- a/roles/openshift_sdn_node/tasks/main.yml
+++ b/roles/openshift_sdn_node/tasks/main.yml
@@ -1,4 +1,10 @@
 ---
+- name: Set node sdn OpenShift facts
+  openshift_facts:
+    role: 'node_sdn'
+    local_facts:
+      debug_level: "{{ openshift_node_sdn_debug_level | default(openshift.common.debug_level) }}"
+
 - name: Install openshift-sdn-node
   yum:
     pkg: openshift-sdn-node
@@ -14,28 +20,19 @@
     backrefs: yes
   with_items:
     - regex: '^(OPTIONS=)'
-      line: '\1"-v={{ openshift_sdn_node_debug_level }} -hostname={{ openshift_hostname }}"'
+      line: '\1"-v={{ openshift.node_sdn.debug_level }} -hostname={{ openshift.common.hostname }}"'
     - regex: '^(MASTER_URL=)'
-      line: '\1"http://{{ openshift_master_ips | first }}:4001"'
+      line: '\1"{{ openshift_sdn_master_url }}"'
     - regex: '^(MINION_IP=)'
-      line: '\1"{{ openshift_public_ip }}"'
+      line: '\1"{{ openshift.common.ip }}"'
     # TODO lock down the insecure-registry config to a more sane value than
     # 0.0.0.0/0
     - regex: '^(DOCKER_OPTIONS=)'
       line: '\1"--insecure-registry=0.0.0.0/0 -b=lbr0 --mtu=1450 --selinux-enabled"'
   notify: restart openshift-sdn-node
 
-- name: Set openshift-sdn-node facts
-  include: "{{ role_path | dirname }}/openshift_common/tasks/set_facts.yml"
-  facts:
-  - section: sdn-node
-    option: debug_level
-    value: "{{ openshift_sdn_node_debug_level }}"
-
-# fixme: Once the openshift_cluster playbook is published state should be started
-# Always bounce service to pick up new credentials
 - name: Start and enable openshift-sdn-node
   service:
     name: openshift-sdn-node
     enabled: yes
-    state: restarted
+    state: started
diff --git a/roles/os_env_extras_node/tasks/main.yml b/roles/os_env_extras_node/tasks/main.yml
new file mode 100644
index 000000000..208065df2
--- /dev/null
+++ b/roles/os_env_extras_node/tasks/main.yml
@@ -0,0 +1,5 @@
+---
+# From the origin rpm there exists instructions on how to
+# setup origin properly.  The following steps come from there
+- name: Change root to be in the Docker group
+  user: name=root groups=dockerroot append=yes
diff --git a/roles/os_firewall/library/os_firewall_manage_iptables.py b/roles/os_firewall/library/os_firewall_manage_iptables.py
index 6a018d022..90588d2ae 100644..100755
--- a/roles/os_firewall/library/os_firewall_manage_iptables.py
+++ b/roles/os_firewall/library/os_firewall_manage_iptables.py
@@ -1,5 +1,6 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
+# vim: expandtab:tabstop=4:shiftwidth=4
 
 from subprocess import call, check_output
 
diff --git a/roles/os_firewall/meta/main.yml b/roles/os_firewall/meta/main.yml
index 7a8cef6c5..8592371e8 100644
--- a/roles/os_firewall/meta/main.yml
+++ b/roles/os_firewall/meta/main.yml
@@ -1,3 +1,4 @@
+---
 galaxy_info:
   author: Jason DeTiberus
   description: os_firewall
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml
index 469cfab6f..b6bddd5c5 100644
--- a/roles/os_firewall/tasks/firewall/firewalld.yml
+++ b/roles/os_firewall/tasks/firewall/firewalld.yml
@@ -3,6 +3,7 @@
   yum:
     name: firewalld
     state: present
+  register: install_result
 
 - name: Check if iptables-services is installed
   command: rpm -q iptables-services
@@ -20,6 +21,10 @@
   - ip6tables
   when: pkg_check.rc == 0
 
+- name: Reload systemd units
+  command: systemctl daemon-reload
+  when: install_result | changed
+
 - name: Start and enable firewalld service
   service:
     name: firewalld
diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml
index 87e77c083..7b5c00a9b 100644
--- a/roles/os_firewall/tasks/firewall/iptables.yml
+++ b/roles/os_firewall/tasks/firewall/iptables.yml
@@ -6,6 +6,7 @@
   with_items:
   - iptables
   - iptables-services
+  register: install_result
 
 - name: Check if firewalld is installed
   command: rpm -q firewalld
@@ -20,14 +21,15 @@
     enabled: no
   when: pkg_check.rc == 0
 
-- name: Start and enable iptables services
+- name: Reload systemd units
+  command: systemctl daemon-reload
+  when: install_result | changed
+
+- name: Start and enable iptables service
   service:
-    name: "{{ item }}"
+    name: iptables
     state: started
     enabled: yes
-  with_items:
-  - iptables
-  - ip6tables
   register: result
 
 - name: need to pause here, otherwise the iptables service starting can sometimes cause ssh to fail