Add support for creating secure router.

* Move openshift_router to openshift_hosted role which will eventually
  contain registry, metrics and logging.
* Adds option for specifying an openshift_hosted_router_certificate
  cert and key pair.
* Removes dependency on node label variables and retrieves the node
  list from the API s.t. this role can be applied to any cluster with
  existing nodes. I've added an openshift_hosted playbook that occurs
  after node install to account for this.
* Infrastructure nodes are selected using
  openshift_hosted_router_selector which is based on deployment type
  by default; openshift-enterprise -> "region=infra" and online ->
  "type=infra".

17 files changed, 411 insertions, 131 deletions

diff --git a/filter_plugins/oo_filters.py b/filter_plugins/oo_filters.py
index e9aacb187..127bd69cf 100644
--- a/filter_plugins/oo_filters.py
+++ b/filter_plugins/oo_filters.py
@@ -299,6 +299,69 @@ class FilterModule(object):
         return [x for x in data if x.has_key(filter_attr) and x[filter_attr]]
 
     @staticmethod
+    def oo_oc_nodes_matching_selector(nodes, selector):
+        """ Filters a list of nodes by selector.
+
+            Examples:
+                nodes = [{"kind": "Node", "metadata": {"name": "node1.example.com",
+                          "labels": {"kubernetes.io/hostname": "node1.example.com",
+                          "color": "green"}}},
+                         {"kind": "Node", "metadata": {"name": "node2.example.com",
+                          "labels": {"kubernetes.io/hostname": "node2.example.com",
+                          "color": "red"}}}]
+                selector = 'color=green'
+                returns = ['node1.example.com']
+            Args:
+                nodes (list[dict]): list of node definitions
+                selector (str): "label=value" node selector to filter `nodes` by
+            Returns:
+                list[str]: nodes filtered by selector
+        """
+        if not isinstance(nodes, list):
+            raise errors.AnsibleFilterError("failed expects nodes to be a list, got {0}".format(type(nodes)))
+        if not isinstance(selector, basestring):
+            raise errors.AnsibleFilterError("failed expects selector to be a string")
+        if not re.match('.*=.*', selector):
+            raise errors.AnsibleFilterError("failed selector does not match \"label=value\" format")
+        label = selector.split('=')[0]
+        value = selector.split('=')[1]
+        return FilterModule.oo_oc_nodes_with_label(nodes, label, value)
+
+    @staticmethod
+    def oo_oc_nodes_with_label(nodes, label, value):
+        """ Filters a list of nodes by label, value.
+
+            Examples:
+                nodes = [{"kind": "Node", "metadata": {"name": "node1.example.com",
+                          "labels": {"kubernetes.io/hostname": "node1.example.com",
+                          "color": "green"}}},
+                         {"kind": "Node", "metadata": {"name": "node2.example.com",
+                          "labels": {"kubernetes.io/hostname": "node2.example.com",
+                          "color": "red"}}}]
+                label = 'color'
+                value = 'green'
+                returns = ['node1.example.com']
+            Args:
+                nodes (list[dict]): list of node definitions
+                label (str): label to filter `nodes` by
+                value (str): value of `label` to filter `nodes` by
+            Returns:
+                list[str]: nodes filtered by selector
+        """
+        if not isinstance(nodes, list):
+            raise errors.AnsibleFilterError("failed expects nodes to be a list")
+        if not isinstance(label, basestring):
+            raise errors.AnsibleFilterError("failed expects label to be a string")
+        if not isinstance(value, basestring):
+            raise errors.AnsibleFilterError("failed expects value to be a string")
+        matching_nodes = []
+        for node in nodes:
+            if label in node['metadata']['labels']:
+                if node['metadata']['labels'][label] == value:
+                    matching_nodes.append(node['metadata']['name'])
+        return matching_nodes
+
+    @staticmethod
     def oo_nodes_with_label(nodes, label, value=None):
         """ Filters a list of nodes by label and value (if provided)
 
@@ -601,36 +664,38 @@ class FilterModule(object):
 
         if persistent_volumes == None:
             persistent_volumes = []
-        for component in hostvars['openshift']['hosted']:
-            kind = hostvars['openshift']['hosted'][component]['storage']['kind']
-            create_pv = hostvars['openshift']['hosted'][component]['storage']['create_pv']
-            if kind != None and create_pv:
-                if kind == 'nfs':
-                    host = hostvars['openshift']['hosted'][component]['storage']['host']
-                    if host == None:
-                        if len(groups['oo_nfs_to_config']) > 0:
-                            host = groups['oo_nfs_to_config'][0]
+        if 'hosted' in hostvars['openshift']:
+            for component in hostvars['openshift']['hosted']:
+                if 'storage' in hostvars['openshift']['hosted'][component]:
+                    kind = hostvars['openshift']['hosted'][component]['storage']['kind']
+                    create_pv = hostvars['openshift']['hosted'][component]['storage']['create_pv']
+                    if kind != None and create_pv:
+                        if kind == 'nfs':
+                            host = hostvars['openshift']['hosted'][component]['storage']['host']
+                            if host == None:
+                                if len(groups['oo_nfs_to_config']) > 0:
+                                    host = groups['oo_nfs_to_config'][0]
+                                else:
+                                    raise errors.AnsibleFilterError("|failed no storage host detected")
+                            directory = hostvars['openshift']['hosted'][component]['storage']['nfs']['directory']
+                            volume = hostvars['openshift']['hosted'][component]['storage']['volume']['name']
+                            path = directory + '/' + volume
+                            size = hostvars['openshift']['hosted'][component]['storage']['volume']['size']
+                            access_modes = hostvars['openshift']['hosted'][component]['storage']['access_modes']
+                            persistent_volume = dict(
+                                name="{0}-volume".format(volume),
+                                capacity=size,
+                                access_modes=access_modes,
+                                storage=dict(
+                                    nfs=dict(
+                                        server=host,
+                                        path=path)))
+                            persistent_volumes.append(persistent_volume)
                         else:
-                            raise errors.AnsibleFilterError("|failed no storage host detected")
-                    directory = hostvars['openshift']['hosted'][component]['storage']['nfs']['directory']
-                    volume = hostvars['openshift']['hosted'][component]['storage']['volume']['name']
-                    path = directory + '/' + volume
-                    size = hostvars['openshift']['hosted'][component]['storage']['volume']['size']
-                    access_modes = hostvars['openshift']['hosted'][component]['storage']['access_modes']
-                    persistent_volume = dict(
-                        name="{0}-volume".format(volume),
-                        capacity=size,
-                        access_modes=access_modes,
-                        storage=dict(
-                            nfs=dict(
-                                server=host,
-                                path=path)))
-                    persistent_volumes.append(persistent_volume)
-                else:
-                    msg = "|failed invalid storage kind '{0}' for component '{1}'".format(
-                        kind,
-                        component)
-                    raise errors.AnsibleFilterError(msg)
+                            msg = "|failed invalid storage kind '{0}' for component '{1}'".format(
+                                kind,
+                                component)
+                            raise errors.AnsibleFilterError(msg)
         return persistent_volumes
 
     @staticmethod
@@ -645,18 +710,20 @@ class FilterModule(object):
 
         if persistent_volume_claims == None:
             persistent_volume_claims = []
-        for component in hostvars['openshift']['hosted']:
-            kind = hostvars['openshift']['hosted'][component]['storage']['kind']
-            create_pv = hostvars['openshift']['hosted'][component]['storage']['create_pv']
-            if kind != None and create_pv:
-                volume = hostvars['openshift']['hosted'][component]['storage']['volume']['name']
-                size = hostvars['openshift']['hosted'][component]['storage']['volume']['size']
-                access_modes = hostvars['openshift']['hosted'][component]['storage']['access_modes']
-                persistent_volume_claim = dict(
-                    name="{0}-claim".format(volume),
-                    capacity=size,
-                    access_modes=access_modes)
-                persistent_volume_claims.append(persistent_volume_claim)
+        if 'hosted' in hostvars['openshift']:
+            for component in hostvars['openshift']['hosted']:
+                if 'storage' in hostvars['openshift']['hosted'][component]:
+                    kind = hostvars['openshift']['hosted'][component]['storage']['kind']
+                    create_pv = hostvars['openshift']['hosted'][component]['storage']['create_pv']
+                    if kind != None and create_pv:
+                        volume = hostvars['openshift']['hosted'][component]['storage']['volume']['name']
+                        size = hostvars['openshift']['hosted'][component]['storage']['volume']['size']
+                        access_modes = hostvars['openshift']['hosted'][component]['storage']['access_modes']
+                        persistent_volume_claim = dict(
+                            name="{0}-claim".format(volume),
+                            capacity=size,
+                            access_modes=access_modes)
+                        persistent_volume_claims.append(persistent_volume_claim)
         return persistent_volume_claims
 
     @staticmethod
@@ -768,5 +835,7 @@ class FilterModule(object):
             "oo_pods_match_component": self.oo_pods_match_component,
             "oo_get_hosts_from_hostvars": self.oo_get_hosts_from_hostvars,
             "oo_image_tag_to_rpm_version": self.oo_image_tag_to_rpm_version,
-            "oo_merge_dicts": self.oo_merge_dicts
+            "oo_merge_dicts": self.oo_merge_dicts,
+            "oo_oc_nodes_matching_selector": self.oo_oc_nodes_matching_selector,
+            "oo_oc_nodes_with_label": self.oo_oc_nodes_with_label
         }
diff --git a/inventory/byo/hosts.aep.example b/inventory/byo/hosts.aep.example
index 43b646c93..aeae38018 100644
--- a/inventory/byo/hosts.aep.example
+++ b/inventory/byo/hosts.aep.example
@@ -173,9 +173,47 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # glusterfs plugin dependencies will be installed, if available.
 #osn_storage_plugin_deps=['ceph','glusterfs','iscsi']
 
-# default selectors for router and registry services
-# openshift_router_selector='region=infra'
-# openshift_registry_selector='region=infra'
+# OpenShift Router Options
+#
+# An OpenShift router will be created during install if there are
+# nodes present with labels matching the default router selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Router selector (optional)
+# Router will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_hosted_router_selector='region=infra'
+#
+# Router replicas (optional)
+# Unless specified, openshift-ansible will calculate the replica count
+# based on the number of nodes matching the openshift router selector.
+#openshift_hosted_router_replicas=2
+#
+# Router certificate (optional)
+# Provide local certificate paths which will be configured as the
+# router's default certificate.
+#openshift_hosted_router_certificate={"certfile": "/path/to/router.crt", "keyfile": "/path/to/router.key"}
+
+# Openshift Registry Options
+#
+# An OpenShift registry will be created during install if there are
+# nodes present with labels matching the default registry selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Registry selector (optional)
+# Registry will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_registry_selector='region=infra'
 
 # Configure the multi-tenant SDN plugin (default is 'redhat/openshift-ovs-subnet')
 # os_sdn_network_plugin_name='redhat/openshift-ovs-multitenant'
diff --git a/inventory/byo/hosts.origin.example b/inventory/byo/hosts.origin.example
index 8b8dbade0..9395e6890 100644
--- a/inventory/byo/hosts.origin.example
+++ b/inventory/byo/hosts.origin.example
@@ -178,9 +178,47 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # glusterfs plugin dependencies will be installed, if available.
 #osn_storage_plugin_deps=['ceph','glusterfs','iscsi']
 
-# default selectors for router and registry services
-# openshift_router_selector='region=infra'
-# openshift_registry_selector='region=infra'
+# OpenShift Router Options
+#
+# An OpenShift router will be created during install if there are
+# nodes present with labels matching the default router selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Router selector (optional)
+# Router will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_hosted_router_selector='region=infra'
+#
+# Router replicas (optional)
+# Unless specified, openshift-ansible will calculate the replica count
+# based on the number of nodes matching the openshift router selector.
+#openshift_hosted_router_replicas=2
+#
+# Router certificate (optional)
+# Provide local certificate paths which will be configured as the
+# router's default certificate.
+#openshift_hosted_router_certificate={"certfile": "/path/to/router.crt", "keyfile": "/path/to/router.key"}
+
+# Openshift Registry Options
+#
+# An OpenShift registry will be created during install if there are
+# nodes present with labels matching the default registry selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Registry selector (optional)
+# Registry will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_registry_selector='region=infra'
 
 # Configure the multi-tenant SDN plugin (default is 'redhat/openshift-ovs-subnet')
 # os_sdn_network_plugin_name='redhat/openshift-ovs-multitenant'
diff --git a/inventory/byo/hosts.ose.example b/inventory/byo/hosts.ose.example
index 4c6aae0bd..d11fa91e5 100644
--- a/inventory/byo/hosts.ose.example
+++ b/inventory/byo/hosts.ose.example
@@ -174,9 +174,47 @@ openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true',
 # glusterfs plugin dependencies will be installed, if available.
 #osn_storage_plugin_deps=['ceph','glusterfs']
 
-# default selectors for router and registry services
-# openshift_router_selector='region=infra'
-# openshift_registry_selector='region=infra'
+# OpenShift Router Options
+#
+# An OpenShift router will be created during install if there are
+# nodes present with labels matching the default router selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Router selector (optional)
+# Router will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_hosted_router_selector='region=infra'
+#
+# Router replicas (optional)
+# Unless specified, openshift-ansible will calculate the replica count
+# based on the number of nodes matching the openshift router selector.
+#openshift_hosted_router_replicas=2
+#
+# Router certificate (optional)
+# Provide local certificate paths which will be configured as the
+# router's default certificate.
+#openshift_hosted_router_certificate={"certfile": "/path/to/router.crt", "keyfile": "/path/to/router.key"}
+
+# Openshift Registry Options
+#
+# An OpenShift registry will be created during install if there are
+# nodes present with labels matching the default registry selector,
+# "region=infra". Set openshift_node_labels per node as needed in
+# order to label nodes.
+#
+# Example:
+# [nodes]
+# node.example.com openshift_node_labels="{'region': 'infra'}"
+#
+# Registry selector (optional)
+# Registry will only be created if nodes matching this label are present.
+# Default value: 'region=infra'
+#openshift_registry_selector='region=infra'
 
 # Configure the multi-tenant SDN plugin (default is 'redhat/openshift-ovs-subnet')
 # os_sdn_network_plugin_name='redhat/openshift-ovs-multitenant'
diff --git a/playbooks/common/openshift-cluster/additional_config.yml b/playbooks/common/openshift-cluster/additional_config.yml
index 1ac78468a..44bf962c9 100644
--- a/playbooks/common/openshift-cluster/additional_config.yml
+++ b/playbooks/common/openshift-cluster/additional_config.yml
@@ -49,8 +49,6 @@
     openshift_serviceaccounts_namespace: default
     openshift_serviceaccounts_sccs:
     - privileged
-  - role: openshift_router
-    when: deploy_infra | bool
   - role: openshift_registry
     registry_volume_claim: "{{ openshift.hosted.registry.storage.volume.name }}-claim"
     when: deploy_infra | bool and attach_registry_volume | bool
diff --git a/playbooks/common/openshift-cluster/config.yml b/playbooks/common/openshift-cluster/config.yml
index 2411e7360..6f908fa7f 100644
--- a/playbooks/common/openshift-cluster/config.yml
+++ b/playbooks/common/openshift-cluster/config.yml
@@ -34,3 +34,5 @@
 - include: additional_config.yml
 
 - include: ../openshift-node/config.yml
+
+- include: openshift_hosted.yml
diff --git a/playbooks/common/openshift-cluster/openshift_hosted.yml b/playbooks/common/openshift-cluster/openshift_hosted.yml
new file mode 100644
index 000000000..1cbc0f544
--- /dev/null
+++ b/playbooks/common/openshift-cluster/openshift_hosted.yml
@@ -0,0 +1,5 @@
+- name: Create Hosted Resources
+  hosts: oo_first_master
+  roles:
+  - role: openshift_hosted
+    openshift_hosted_router_registryurl: "{{ hostvars[groups.oo_first_master.0].openshift.master.registry_url }}"
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
index 32e608e86..92d650550 100755
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -63,7 +63,16 @@ def migrate_local_facts(facts):
     migrated_facts = copy.deepcopy(facts)
     return migrate_docker_facts(migrated_facts)
 
-
+def migrate_hosted_facts(facts):
+    """ Apply migrations for master facts """
+    if 'master' in facts:
+        if 'router_selector' in facts['master']:
+            if 'hosted' not in facts:
+                facts['hosted'] = {}
+            if 'router' not in facts['hosted']:
+                facts['hosted']['router'] = {}
+            facts['hosted']['router']['selector'] = facts['master'].pop('router_selector')
+    return facts
 
 def first_ip(network):
     """ Return the first IPv4 address in network
@@ -394,7 +403,7 @@ def set_node_schedulability(facts):
                 facts['node']['schedulable'] = True
     return facts
 
-def set_master_selectors(facts):
+def set_selectors(facts):
     """ Set selectors facts if not already present in facts dict
         Args:
             facts (dict): existing facts
@@ -403,16 +412,21 @@ def set_master_selectors(facts):
             facts if they were not already present
 
     """
+    deployment_type = facts['common']['deployment_type']
+    if deployment_type == 'online':
+        selector = "type=infra"
+    else:
+        selector = "region=infra"
+
+    if 'hosted' not in facts:
+        facts['hosted'] = {}
+    if 'router' not in facts['hosted']:
+        facts['hosted']['router'] = {}
+    if 'selector' not in facts['hosted']['router'] or facts['hosted']['router']['selector'] in [None, 'None']:
+        facts['hosted']['router']['selector'] = selector
+
     if 'master' in facts:
         if 'infra_nodes' in facts['master']:
-            deployment_type = facts['common']['deployment_type']
-            if deployment_type == 'online':
-                selector = "type=infra"
-            else:
-                selector = "region=infra"
-
-            if 'router_selector' not in facts['master']:
-                facts['master']['router_selector'] = selector
             if 'registry_selector' not in facts['master']:
                 facts['master']['registry_selector'] = selector
     return facts
@@ -1479,7 +1493,7 @@ class OpenShiftFacts(object):
         facts = set_flannel_facts_if_unset(facts)
         facts = set_nuage_facts_if_unset(facts)
         facts = set_node_schedulability(facts)
-        facts = set_master_selectors(facts)
+        facts = set_selectors(facts)
         facts = set_metrics_facts_if_unset(facts)
         facts = set_identity_providers_if_unset(facts)
         facts = set_sdn_facts_if_unset(facts, self.system_facts)
@@ -1573,23 +1587,25 @@ class OpenShiftFacts(object):
         if 'cloudprovider' in roles:
             defaults['cloudprovider'] = dict(kind=None)
 
-        defaults['hosted'] = dict(
-            registry=dict(
-                storage=dict(
-                    kind=None,
-                    volume=dict(
-                        name='registry',
-                        size='5Gi'
-                    ),
-                    nfs=dict(
-                        directory='/exports',
-                        options='*(rw,root_squash)'),
-                    host=None,
-                    access_modes=['ReadWriteMany'],
-                    create_pv=True
-                )
+        if 'hosted' in roles or self.role == 'hosted':
+            defaults['hosted'] = dict(
+                registry=dict(
+                    storage=dict(
+                        kind=None,
+                        volume=dict(
+                            name='registry',
+                            size='5Gi'
+                        ),
+                        nfs=dict(
+                            directory='/exports',
+                            options='*(rw,root_squash)'),
+                        host=None,
+                        access_modes=['ReadWriteMany'],
+                        create_pv=True
+                    )
+                ),
+                router=dict()
             )
-        )
 
         return defaults
 
diff --git a/roles/openshift_hosted/README.md b/roles/openshift_hosted/README.md
new file mode 100644
index 000000000..633ec0937
--- /dev/null
+++ b/roles/openshift_hosted/README.md
@@ -0,0 +1,55 @@
+OpenShift Hosted
+================
+
+OpenShift Hosted Resources
+
+* OpenShift Router
+
+Requirements
+------------
+
+This role requires a running OpenShift cluster with nodes labeled to
+match the openshift_hosted_router_selector (default: region=infra).
+
+Role Variables
+--------------
+
+From this role:
+
+| Name                                | Default value                            | Description                                                                                                          |
+|-------------------------------------|------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
+| openshift_hosted_router_certificate | None                                     | Dictionary containing "certfile" and "keyfile" keys with values containing paths to local certificate files.         |
+| openshift_hosted_router_registryurl | 'openshift3/ose-${component}:${version}' | The image to base the OpenShift router on.                                                                           |
+| openshift_hosted_router_replicas    | Number of nodes matching selector        | The number of replicas to configure.                                                                                 |
+| openshift_hosted_router_selector    | region=infra                             | Node selector used when creating router. The OpenShift router will only be deployed to nodes matching this selector. |
+
+Dependencies
+------------
+
+* openshift_common
+* openshift_hosted_facts
+
+Example Playbook
+----------------
+
+```
+- name: Create hosted resources
+  hosts: oo_first_master
+  roles:
+  - role: openshift_hosted
+    openshift_hosted_router_certificate:
+      certfile: /path/to/my-router.crt
+      keyfile: /path/to/my-router.key
+    openshift_hosted_router_registryurl: 'registry.access.redhat.com/openshift3/ose-haproxy-router:v3.0.2.0'
+    openshift_hosted_router_selector: 'type=infra'
+```
+
+License
+-------
+
+Apache License, Version 2.0
+
+Author Information
+------------------
+
+Red Hat openshift@redhat.com
diff --git a/roles/openshift_router/handlers/main.yml b/roles/openshift_hosted/handlers/main.yml
index e69de29bb..e69de29bb 100644
--- a/roles/openshift_router/handlers/main.yml
+++ b/roles/openshift_hosted/handlers/main.yml
diff --git a/roles/openshift_router/meta/main.yml b/roles/openshift_hosted/meta/main.yml
index c2b0777b5..75dfc24c3 100644
--- a/roles/openshift_router/meta/main.yml
+++ b/roles/openshift_hosted/meta/main.yml
@@ -11,5 +11,6 @@ galaxy_info:
     - 7
   categories:
   - cloud
-  dependencies:
-  - openshift_facts
+dependencies:
+- openshift_common
+- openshift_hosted_facts
diff --git a/roles/openshift_hosted/tasks/main.yml b/roles/openshift_hosted/tasks/main.yml
new file mode 100644
index 000000000..d42a4e365
--- /dev/null
+++ b/roles/openshift_hosted/tasks/main.yml
@@ -0,0 +1,3 @@
+---
+
+- include: router.yml
diff --git a/roles/openshift_hosted/tasks/router.yml b/roles/openshift_hosted/tasks/router.yml
new file mode 100644
index 000000000..6a36f74b2
--- /dev/null
+++ b/roles/openshift_hosted/tasks/router.yml
@@ -0,0 +1,64 @@
+---
+- fail:
+    msg: "Both 'certfile' and 'keyfile' keys must be specified when supplying the openshift_hosted_router_certificate variable."
+  when: openshift_hosted_router_certificate is defined and ('certfile' not in openshift_hosted_router_certificate or 'keyfile' not in openshift_hosted_router_certificate)
+
+- name: Read router certificate and key
+  slurp:
+    src: "{{ item }}"
+  register: openshift_router_certificate_output
+  with_items:
+  - "{{ openshift_hosted_router_certificate.certfile }}"
+  - "{{ openshift_hosted_router_certificate.keyfile }}"
+  delegate_to: localhost
+  when: openshift_hosted_router_certificate is defined
+
+- name: Persist certificate contents
+  openshift_facts:
+    role: hosted
+    openshift_env:
+      openshift_hosted_router_certificate_contents: "{% for certificate in openshift_router_certificate_output.results -%}{{ certificate.content | b64decode }}{% endfor -%}"
+  when: openshift_hosted_router_certificate is defined
+
+- name: Create PEM certificate
+  copy:
+    content: "{{ openshift.hosted.router.certificate.contents }}"
+    dest: "{{ openshift_master_config_dir }}/openshift-router.pem"
+    mode: 0600
+  when: openshift.hosted.router.certificate | default(None) != None
+
+- name: Retrieve list of openshift nodes
+  command: >
+    {{ openshift.common.client_binary }} --api-version='v1' -o json
+    get nodes -n default --config={{ openshift.common.config_base }}/master/admin.kubeconfig
+  register: openshift_hosted_router_nodes_json
+  when: openshift.hosted.router.replicas | default(None) == None
+
+- name: Collect nodes matching router selector
+  set_fact:
+    openshift_hosted_router_nodes: >
+      {{ (openshift_hosted_router_nodes_json.stdout|from_json)['items']
+         | oo_oc_nodes_matching_selector(openshift.hosted.router.selector) }}
+  when: openshift.hosted.router.replicas | default(None) == None
+
+- name: Create OpenShift router
+  command: >
+    {{ openshift.common.admin_binary }} router --create
+    {% if openshift.hosted.router.replicas | default(None) != None -%}
+    --replicas={{ openshift.hosted.router.replicas }}
+    {% else -%}
+    --replicas={{ openshift_hosted_router_nodes | length }}
+    {% endif %}
+    {% if openshift.hosted.router.certificate | default(None) != None -%}
+    --default-cert={{ openshift_master_config_dir }}/openshift-router.pem
+    {% endif -%}
+    --namespace=default
+    --service-account=router
+    --selector='{{ openshift.hosted.router.selector }}'
+    --credentials={{ openshift_master_config_dir }}/openshift-router.kubeconfig
+    {% if openshift.hosted.router.registryurl | default(None)!= None -%}
+    --images='{{ openshift.hosted.router.registryurl }}'
+    {% endif -%}
+  register: openshift_hosted_router_results
+  changed_when: "'service exists' not in openshift_hosted_router_results.stdout"
+  when: openshift.hosted.router.replicas | default(None) != None or (openshift_hosted_router_nodes is defined and openshift_hosted_router_nodes | length > 0)
diff --git a/roles/openshift_hosted/vars/main.yml b/roles/openshift_hosted/vars/main.yml
new file mode 100644
index 000000000..9967e26f4
--- /dev/null
+++ b/roles/openshift_hosted/vars/main.yml
@@ -0,0 +1,2 @@
+---
+openshift_master_config_dir: "{{ openshift.common.config_base }}/master"
diff --git a/roles/openshift_router/README.md b/roles/openshift_router/README.md
deleted file mode 100644
index d490e1038..000000000
--- a/roles/openshift_router/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-OpenShift Container Router
-==========================
-
-OpenShift Router service installation
-
-Requirements
-------------
-
-Running OpenShift cluster
-
-Role Variables
---------------
-
-From this role:
-| Name               | Default value                                         |                     |
-|--------------------|-------------------------------------------------------|---------------------|
-|                    |                                                       |                     |
-
-Dependencies
-------------
-
-Example Playbook
-----------------
-
-TODO
-
-License
--------
-
-Apache License, Version 2.0
-
-Author Information
-------------------
-
-Red Hat openshift@redhat.com
diff --git a/roles/openshift_router/tasks/main.yml b/roles/openshift_router/tasks/main.yml
deleted file mode 100644
index 40365d04d..000000000
--- a/roles/openshift_router/tasks/main.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-- name: Deploy OpenShift Router
-  command: >
-    {{ openshift.common.admin_binary }} router
-    --create --replicas={{ openshift.master.infra_nodes | length }}
-    --namespace=default
-    --service-account=router {{ ortr_selector }}
-    --credentials={{ openshift_master_config_dir }}/openshift-router.kubeconfig {{ ortr_images }}
-  register: ortr_results
-  changed_when: "'service exists' not in ortr_results.stdout"
diff --git a/roles/openshift_router/vars/main.yml b/roles/openshift_router/vars/main.yml
deleted file mode 100644
index bcac12068..000000000
--- a/roles/openshift_router/vars/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-openshift_master_config_dir: "{{ openshift.common.config_base }}/master"
-ortr_images: "--images='{{ openshift.master.registry_url }}'"
-ortr_selector: "--selector='{{ openshift.master.router_selector }}'"