summaryrefslogtreecommitdiffstats
path: root/roles/openshift_master/tasks/main.yml
blob: 680e4a4ffdf2b9a8261c9856952f1336e1a9caaa (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
---
# TODO: add ability to configure certificates given either a local file to
#       point to or certificate contents, set in default cert locations.

# Authentication Variable Validation
# TODO: validate the different identity provider kinds as well
- fail:
    msg: >
      Invalid OAuth grant method: {{ openshift_master_oauth_grant_method }}
  when:
  - openshift_master_oauth_grant_method is defined
  - openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods

- name: Open up firewall ports
  import_tasks: firewall.yml

- name: Install Master package
  package:
    name: "{{ openshift_service_type }}-master{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
    state: present
  when:
  - not openshift_is_containerized | bool
  register: result
  until: result is succeeded

- name: Create r_openshift_master_data_dir
  file:
    path: "{{ r_openshift_master_data_dir }}"
    state: directory
    mode: 0755
    owner: root
    group: root
  when:
  - openshift_is_containerized | bool

- name: Reload systemd units
  command: systemctl daemon-reload
  when:
  - openshift_is_containerized | bool

- name: Re-gather package dependent master facts
  openshift_facts:

- name: Create config parent directory if it does not exist
  file:
    path: "{{ openshift_master_config_dir }}"
    state: directory

- name: Create the policy file if it does not already exist
  command: >
    {{ openshift_client_binary }} adm create-bootstrap-policy-file
      --filename={{ openshift_master_policy }}
  args:
    creates: "{{ openshift_master_policy }}"
  notify:
  - restart master api
  - restart master controllers

- name: Create the scheduler config
  copy:
    content: "{{ scheduler_config | to_nice_json }}"
    dest: "{{ openshift_master_scheduler_conf }}"
    backup: true
  notify:
  - restart master api
  - restart master controllers

- name: Install httpd-tools if needed
  package: name=httpd-tools state=present
  when:
  - item.kind == 'HTPasswdPasswordIdentityProvider'
  - not openshift_is_atomic | bool
  with_items: "{{ openshift.master.identity_providers }}"
  register: result
  until: result is succeeded

- name: Ensure htpasswd directory exists
  file:
    path: "{{ item.filename | dirname }}"
    state: directory
  when:
  - item.kind == 'HTPasswdPasswordIdentityProvider'
  with_items: "{{ openshift.master.identity_providers }}"

- name: Create the htpasswd file if needed
  template:
    dest: "{{ item.filename }}"
    src: htpasswd.j2
    backup: yes
  when:
  - item.kind == 'HTPasswdPasswordIdentityProvider'
  - openshift.master.manage_htpasswd | bool
  with_items: "{{ openshift.master.identity_providers }}"

- name: Ensure htpasswd file exists
  copy:
    dest: "{{ item.filename }}"
    force: no
    content: ""
    mode: 0600
  when:
  - item.kind == 'HTPasswdPasswordIdentityProvider'
  with_items: "{{ openshift.master.identity_providers }}"

- name: Create the ldap ca file if needed
  copy:
    dest: "{{ item.ca if 'ca' in item and '/' in item.ca else openshift_master_config_dir ~ '/' ~ item.ca | default('ldap_ca.crt') }}"
    content: "{{ openshift.master.ldap_ca }}"
    mode: 0600
    backup: yes
  when:
  - openshift.master.ldap_ca is defined
  - item.kind == 'LDAPPasswordIdentityProvider'
  with_items: "{{ openshift.master.identity_providers }}"

- name: Create the openid ca file if needed
  copy:
    dest: "{{ item.ca if 'ca' in item and '/' in item.ca else openshift_master_config_dir ~ '/' ~ item.ca | default('openid_ca.crt') }}"
    content: "{{ openshift.master.openid_ca }}"
    mode: 0600
    backup: yes
  when:
  - openshift.master.openid_ca is defined
  - item.kind == 'OpenIDIdentityProvider'
  - item.ca | default('') != ''
  with_items: "{{ openshift.master.identity_providers }}"

- name: Create the request header ca file if needed
  copy:
    dest: "{{ item.clientCA if 'clientCA' in item and '/' in item.clientCA else openshift_master_config_dir ~ '/' ~ item.clientCA | default('request_header_ca.crt') }}"
    content: "{{ openshift.master.request_header_ca }}"
    mode: 0600
    backup: yes
  when:
  - openshift.master.request_header_ca is defined
  - item.kind == 'RequestHeaderIdentityProvider'
  - item.clientCA | default('') != ''
  with_items: "{{ openshift.master.identity_providers }}"

- name: Include push_via_dns.yml
  include_tasks: push_via_dns.yml

- name: Set fact of all etcd host IPs
  openshift_facts:
    role: common
    local_facts:
      no_proxy_etcd_host_ips: "{{ openshift_no_proxy_etcd_host_ips }}"

- name: Update journald config
  include_tasks: journald.yml

- name: Install the systemd units
  include_tasks: systemd_units.yml

- name: Install Master system container
  include_tasks: system_container.yml
  when:
  - openshift_is_containerized | bool
  - l_is_master_system_container | bool

- name: Create session secrets file
  template:
    dest: "{{ openshift.master.session_secrets_file }}"
    src: sessionSecretsFile.yaml.v1.j2
    owner: root
    group: root
    mode: 0600
  when:
  - openshift.master.session_auth_secrets is defined
  - openshift.master.session_encryption_secrets is defined
  notify:
  - restart master api

- set_fact:
    # translate_idps is a custom filter in role lib_utils
    translated_identity_providers: "{{ openshift.master.identity_providers | translate_idps('v1') }}"

# TODO: add the validate parameter when there is a validation command to run
- name: Create master config
  template:
    dest: "{{ openshift_master_config_file }}"
    src: master.yaml.v1.j2
    backup: true
    owner: root
    group: root
    mode: 0600
  notify:
  - restart master api
  - restart master controllers

- include_tasks: bootstrap_settings.yml
  when: openshift_master_bootstrap_enabled | default(False)

- include_tasks: set_loopback_context.yml

- name: Start and enable master api on first master
  systemd:
    name: "{{ openshift_service_type }}-master-api"
    enabled: yes
    state: started
  when:
  - inventory_hostname == openshift_master_hosts[0]
  register: l_start_result
  until: not (l_start_result is failed)
  retries: 1
  delay: 60

- name: Dump logs from master-api if it failed
  command: journalctl --no-pager -n 100 -u {{ openshift_service_type }}-master-api
  when:
  - l_start_result is failed

- set_fact:
    master_api_service_status_changed: "{{ l_start_result is changed }}"
  when:
  - inventory_hostname == openshift_master_hosts[0]

- pause:
    seconds: 15
  when:
  - openshift_master_ha | bool

- name: Start and enable master api all masters
  systemd:
    name: "{{ openshift_service_type }}-master-api"
    enabled: yes
    state: started
  when:
  - inventory_hostname != openshift_master_hosts[0]
  register: l_start_result
  until: not (l_start_result is failed)
  retries: 1
  delay: 60

- name: Dump logs from master-api if it failed
  command: journalctl --no-pager -n 100 -u {{ openshift_service_type }}-master-api
  when:
  - l_start_result is failed

- set_fact:
    master_api_service_status_changed: "{{ l_start_result is changed }}"
  when:
  - inventory_hostname != openshift_master_hosts[0]

# A separate wait is required here for native HA since notifies will
# be resolved after all tasks in the role.
- include_tasks: check_master_api_is_ready.yml
  when:
  - master_api_service_status_changed | bool

- name: Start and enable master controller service
  systemd:
    name: "{{ openshift_service_type }}-master-controllers"
    enabled: yes
    state: started
  register: l_start_result
  until: not (l_start_result is failed)
  retries: 1
  delay: 60

- name: Dump logs from master-controllers if it failed
  command: journalctl --no-pager -n 100 -u {{ openshift_service_type }}-master-controllers
  when:
  - l_start_result is failed

- name: Set fact master_controllers_service_status_changed
  set_fact:
    master_controllers_service_status_changed: "{{ l_start_result is changed }}"

- name: node bootstrap settings
  include_tasks: bootstrap.yml
  when: openshift_master_bootstrap_enabled | default(False)