Switched Heapster to use certificates generated by OpenShift

3 files changed, 17 insertions, 41 deletions

diff --git a/roles/openshift_metrics/tasks/generate_heapster_certificates.yaml b/roles/openshift_metrics/tasks/generate_heapster_certificates.yaml
deleted file mode 100644
index ced2df1d0..000000000
--- a/roles/openshift_metrics/tasks/generate_heapster_certificates.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-- name: generate heapster key/cert
-  command: >
-    {{ openshift.common.admin_binary }} ca create-server-cert
-    --config={{ mktemp.stdout }}/admin.kubeconfig
-    --key='{{ mktemp.stdout }}/heapster.key'
-    --cert='{{ mktemp.stdout }}/heapster.cert'
-    --hostnames=heapster
-    --signer-cert='{{ mktemp.stdout }}/ca.crt'
-    --signer-key='{{ mktemp.stdout }}/ca.key'
-    --signer-serial='{{ mktemp.stdout }}/ca.serial.txt'
-
-- when: "'secret/heapster-secrets' not in metrics_secrets.stdout_lines"
-  block:
-  - name: read files for the heapster secret
-    slurp: src={{ item }}
-    register: heapster_secret
-    with_items:
-    - "{{ mktemp.stdout }}/heapster.cert"
-    - "{{ mktemp.stdout }}/heapster.key"
-    - "{{ client_ca }}"
-    vars:
-      custom_ca: "{{ mktemp.stdout }}/heapster_client_ca.crt"
-      default_ca: "{{ openshift.common.config_base }}/master/ca-bundle.crt"
-      client_ca: "{{ custom_ca|exists|ternary(custom_ca, default_ca) }}"
-  - name: generate heapster secret template
-    template:
-      src: secret.j2
-      dest: "{{ mktemp.stdout }}/templates/heapster_secrets.yaml"
-      force: no
-    vars:
-      name: heapster-secrets
-      labels:
-        metrics-infra: heapster
-      data:
-        heapster.cert: "{{ heapster_secret.results[0].content }}"
-        heapster.key: "{{ heapster_secret.results[1].content }}"
-        heapster.client-ca: "{{ heapster_secret.results[2].content }}"
-        heapster.allowed-users: >
-          {{ openshift_metrics_heapster_allowed_users|b64encode }}
diff --git a/roles/openshift_metrics/tasks/generate_heapster_secrets.yaml b/roles/openshift_metrics/tasks/generate_heapster_secrets.yaml
new file mode 100644
index 000000000..e81d90ae7
--- /dev/null
+++ b/roles/openshift_metrics/tasks/generate_heapster_secrets.yaml
@@ -0,0 +1,14 @@
+---
+- name: generate heapster secret template
+  template:
+    src: secret.j2
+    dest: "{{ mktemp.stdout }}/templates/heapster_secrets.yaml"
+    force: no
+  vars:
+    name: heapster-secrets
+    labels:
+      metrics-infra: heapster
+    data:
+      heapster.allowed-users: >
+        {{ openshift_metrics_heapster_allowed_users|b64encode }}
+  when: "'secret/heapster-secrets' not in metrics_secrets.stdout_lines"
diff --git a/roles/openshift_metrics/tasks/install_heapster.yaml b/roles/openshift_metrics/tasks/install_heapster.yaml
index 8d27c4930..d13b96be1 100644
--- a/roles/openshift_metrics/tasks/install_heapster.yaml
+++ b/roles/openshift_metrics/tasks/install_heapster.yaml
@@ -41,6 +41,8 @@
       - {port: 80, targetPort: http-endpoint}
     selector:
       name: "{{obj_name}}"
+    annotations:
+      service.alpha.openshift.io/serving-cert-secret-name: heapster-certs
     labels:
       metrics-infra: "{{obj_name}}"
       name: "{{obj_name}}"
@@ -64,4 +66,4 @@
         namespace: "{{ openshift_metrics_project }}"
   changed_when: no
 
-- include: generate_heapster_certificates.yaml
+- include: generate_heapster_secrets.yaml