diff options
| author | Jeff Cantrill <jcantrill@users.noreply.github.com> | 2017-02-23 14:33:53 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-23 14:33:53 -0500 |
| commit | dab7c7d035d0a934d9d7f809ddcbfb34913042a4 (patch) | |
| tree | c475404220d937ff4f4395233697c82f0af3e4dc | |
| parent | bb7985f751eab9c9e987e85f00a1918f0f9594c8 (diff) | |
| parent | 9e76a034e60ad6cbe8c1a4bb4b2175a596856b8f (diff) | |
| download | openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.gz openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.bz2 openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.tar.xz openshift-dab7c7d035d0a934d9d7f809ddcbfb34913042a4.zip | |
Merge pull request #3470 from wshearn/logging_insecureedgeterminationpolicy
Add insecure edge termination policy for kibana.
| -rw-r--r-- | roles/openshift_logging/README.md | 1 | ||||
| -rw-r--r-- | roles/openshift_logging/defaults/main.yml | 1 | ||||
| -rw-r--r-- | roles/openshift_logging/tasks/generate_routes.yaml | 1 | ||||
| -rw-r--r-- | roles/openshift_logging/templates/route_reencrypt.j2 | 3 |
4 files changed, 6 insertions, 0 deletions
diff --git a/roles/openshift_logging/README.md b/roles/openshift_logging/README.md index c90a5bf20..14b80304d 100644 --- a/roles/openshift_logging/README.md +++ b/roles/openshift_logging/README.md @@ -46,6 +46,7 @@ When both `openshift_logging_install_logging` and `openshift_logging_upgrade_log - `openshift_logging_kibana_proxy_memory_limit`: The amount of memory to allocate to Kibana proxy or unset if not specified. - `openshift_logging_kibana_replica_count`: The number of replicas Kibana should be scaled up to. Defaults to 1. - `openshift_logging_kibana_nodeselector`: A map of labels (e.g. {"node":"infra","region":"west"} to select the nodes where the pod will land. +- `openshift_logging_kibana_edge_term_policy`: Insecure Edge Termination Policy. Defaults to Redirect. - `openshift_logging_fluentd_nodeselector`: The node selector that the Fluentd daemonset uses to determine where to deploy to. Defaults to '"logging-infra-fluentd": "true"'. - `openshift_logging_fluentd_cpu_limit`: The CPU limit for Fluentd pods. Defaults to '100m'. diff --git a/roles/openshift_logging/defaults/main.yml b/roles/openshift_logging/defaults/main.yml index 9b3c17da1..5440a3647 100644 --- a/roles/openshift_logging/defaults/main.yml +++ b/roles/openshift_logging/defaults/main.yml @@ -26,6 +26,7 @@ openshift_logging_kibana_proxy_debug: false openshift_logging_kibana_proxy_cpu_limit: null openshift_logging_kibana_proxy_memory_limit: null openshift_logging_kibana_replica_count: 1 +openshift_logging_kibana_edge_term_policy: Redirect #The absolute path on the control node to the cert file to use #for the public facing kibana certs diff --git a/roles/openshift_logging/tasks/generate_routes.yaml b/roles/openshift_logging/tasks/generate_routes.yaml index 3c462378b..7af17a708 100644 --- a/roles/openshift_logging/tasks/generate_routes.yaml +++ b/roles/openshift_logging/tasks/generate_routes.yaml @@ -26,6 +26,7 @@ tls_cert: "{{kibana_cert | default('') | b64decode}}" tls_ca_cert: "{{kibana_ca | b64decode}}" tls_dest_ca_cert: "{{key_pairs | entry_from_named_pair('ca_file')| b64decode }}" + edge_term_policy: "{{openshift_logging_kibana_edge_term_policy | default('') }}" labels: component: support logging-infra: support diff --git a/roles/openshift_logging/templates/route_reencrypt.j2 b/roles/openshift_logging/templates/route_reencrypt.j2 index 341ffdd84..cf8a9e65f 100644 --- a/roles/openshift_logging/templates/route_reencrypt.j2 +++ b/roles/openshift_logging/templates/route_reencrypt.j2 @@ -28,6 +28,9 @@ spec: {{ line }} {% endfor %} termination: reencrypt +{% if edge_term_policy is defined and edge_term_policy | length > 0 %} + insecureEdgeTerminationPolicy: {{ edge_term_policy }} +{% endif %} to: kind: Service name: {{ service_name }} |