diff options
Diffstat (limited to 'playbooks')
| -rw-r--r-- | playbooks/common/openshift-cluster/node_docker_ca.yml | 124 | ||||
| -rw-r--r-- | playbooks/common/openshift-cluster/openshift_hosted.yml | 103 |
2 files changed, 125 insertions, 102 deletions
diff --git a/playbooks/common/openshift-cluster/node_docker_ca.yml b/playbooks/common/openshift-cluster/node_docker_ca.yml new file mode 100644 index 000000000..6482c827b --- /dev/null +++ b/playbooks/common/openshift-cluster/node_docker_ca.yml @@ -0,0 +1,124 @@ +--- +- name: Configure CA certificate for secure registry + hosts: oo_nodes_to_config + tags: + - hosted + tasks: + - name: Create temp directory for kubeconfig + command: mktemp -d /tmp/openshift-ansible-XXXXXX + register: mktemp + when: openshift_hosted_manage_registry | default(true) | bool + changed_when: false + delegate_to: "{{ groups.oo_first_master.0 }}" + run_once: true + + - set_fact: + openshift_hosted_kubeconfig: "{{ mktemp.stdout }}/admin.kubeconfig" + when: openshift_hosted_manage_registry | default(true) | bool + delegate_to: "{{ groups.oo_first_master.0 }}" + run_once: true + + - name: Copy the admin client config(s) + command: > + cp {{ openshift.common.config_base }}/master/admin.kubeconfig {{ openshift_hosted_kubeconfig }} + when: openshift_hosted_manage_registry | default(true) | bool + changed_when: false + delegate_to: "{{ groups.oo_first_master.0 }}" + run_once: true + + - name: Retrieve docker-registry route + command: > + {{ openshift.common.client_binary }} get route docker-registry + -o jsonpath='{.spec.host}' + --config={{ openshift_hosted_kubeconfig }} + -n default + register: docker_registry_route + when: openshift_hosted_manage_registry | default(true) | bool + changed_when: false + delegate_to: "{{ groups.oo_first_master.0 }}" + run_once: true + + - name: Retrieve registry service IP + command: > + {{ openshift.common.client_binary }} get svc/docker-registry + -o jsonpath='{.spec.clusterIP}' + --config={{ openshift_hosted_kubeconfig }} + -n default + register: docker_registry_service_ip + when: openshift_hosted_manage_registry | default(true) | bool + changed_when: false + delegate_to: "{{ groups.oo_first_master.0 }}" + run_once: true + + - name: Create registry CA directories + file: + path: "/etc/docker/certs.d/{{ item }}" + state: directory + with_items: + - "{{ docker_registry_service_ip.stdout }}:5000" + - "{{ docker_registry_route.stdout }}" + - "docker-registry.default.svc.cluster.local:5000" + when: openshift_hosted_manage_registry | default(true) | bool + + - name: Copy CA to registry CA directories + copy: + src: "{{ openshift.common.config_base }}/node/ca.crt" + dest: "/etc/docker/certs.d/{{ item }}" + remote_src: yes + force: yes + with_items: + - "{{ docker_registry_service_ip.stdout }}:5000" + - "{{ docker_registry_route.stdout }}" + - "docker-registry.default.svc.cluster.local:5000" + when: openshift_hosted_manage_registry | default(true) | bool + notify: + - Wait for docker-registry deployment + - Wait for registry-console deployment + - Restart docker + + handlers: + # Restarting docker before deployments have begun will block the + # deployments from ever starting so try waiting for the registry to + # become available. + - name: Wait for docker-registry deployment + command: > + {{ openshift.common.client_binary }} get dc/docker-registry + -o jsonpath='{.status.availableReplicas}' + --config={{ openshift_hosted_kubeconfig }} + -n default + register: l_docker_registry_available_replicas + until: l_docker_registry_available_replicas.stdout | default("0") != "0" + retries: 30 + delay: 1 + failed_when: false + changed_when: false + + - name: Wait for registry-console deployment + command: > + {{ openshift.common.client_binary }} get dc/registry-console + -o jsonpath='{.status.availableReplicas}' + --config={{ openshift_hosted_kubeconfig }} + -n default + register: l_registry_console_available_replicas + until: l_registry_console_available_replicas.stdout | default("0") != "0" + retries: 30 + delay: 1 + failed_when: false + changed_when: false + + - name: Restart docker + service: + name: docker + state: restarted + +- name: Delete temp directory + hosts: oo_first_master + tags: + - hosted + tasks: + - name: Delete temp directory + file: + name: "{{ mktemp.stdout }}" + state: absent + when: openshift_hosted_manage_registry | default(true) | bool + changed_when: False diff --git a/playbooks/common/openshift-cluster/openshift_hosted.yml b/playbooks/common/openshift-cluster/openshift_hosted.yml index 044de2c94..ea9ba14e1 100644 --- a/playbooks/common/openshift-cluster/openshift_hosted.yml +++ b/playbooks/common/openshift-cluster/openshift_hosted.yml @@ -65,105 +65,4 @@ openshift_hosted_logging_elasticsearch_ops_pvc_prefix: "{{ 'logging-es' if openshift.hosted.logging.storage_kind | default(none) is not none else '' }}" - role: cockpit-ui - when: openshift.common.version_gte_3_3_or_1_3 | bool - -- name: Configure all masters for logging - serial: 1 - handlers: - - include: ../../../roles/openshift_master/handlers/main.yml - static: yes - hosts: oo_masters - tasks: - - openshift_facts: - role: master - local_facts: - logging_public_url: "https://{{ openshift_hosted_logging_hostname | default('kibana.' ~ openshift_master_default_subdomain) }}" - when: openshift.hosted.logging.deploy | default(openshift.common.version_gte_3_3_or_1_3) - - modify_yaml: - dest: "{{ openshift.common.config_base }}/master/master-config.yaml" - yaml_key: assetConfig.loggingPublicURL - yaml_value: "{{ openshift.master.logging_public_url }}" - notify: restart master - when: openshift.hosted.logging.deploy | default(openshift.common.version_gte_3_3_or_1_3) - -- name: Configure CA certificate for secure registry - hosts: oo_nodes_to_config - tags: - - hosted - tasks: - - name: Create temp directory for kubeconfig - command: mktemp -d /tmp/openshift-ansible-XXXXXX - register: mktemp - when: openshift.common.version_gte_3_3_or_1_3 | bool - changed_when: false - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - - set_fact: - openshift_hosted_kubeconfig: "{{ mktemp.stdout }}/admin.kubeconfig" - when: openshift.common.version_gte_3_3_or_1_3 | bool - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - - name: Copy the admin client config(s) - command: > - cp {{ openshift.common.config_base }}/master/admin.kubeconfig {{ openshift_hosted_kubeconfig }} - when: openshift.common.version_gte_3_3_or_1_3 | bool - changed_when: false - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - - name: Retrieve docker-registry route - command: > - {{ openshift.common.client_binary }} get route docker-registry - --template='{{ '{{' }} .spec.host {{ '}}' }}' - --config={{ openshift_hosted_kubeconfig }} - -n default - register: docker_registry_route - when: openshift.common.version_gte_3_3_or_1_3 | bool - changed_when: false - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - - name: Retrieve registry service IP - command: > - {{ openshift.common.client_binary }} get service docker-registry - --template='{{ '{{' }} .spec.clusterIP {{ '}}' }}' - --config={{ openshift_hosted_kubeconfig }} - -n default - register: docker_registry_service_ip - when: openshift.common.version_gte_3_3_or_1_3 | bool - changed_when: false - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - - name: Create registry CA directories - file: - path: "/etc/docker/certs.d/{{ item }}" - state: directory - with_items: - - "{{ docker_registry_service_ip.stdout }}:5000" - - "{{ docker_registry_route.stdout }}" - - "docker-registry.default.svc.cluster.local:5000" - when: openshift.common.version_gte_3_3_or_1_3 | bool - - name: Copy CA to registry CA directories - copy: - src: "{{ openshift.common.config_base }}/node/ca.crt" - dest: "/etc/docker/certs.d/{{ item }}" - remote_src: yes - force: yes - with_items: - - "{{ docker_registry_service_ip.stdout }}:5000" - - "{{ docker_registry_route.stdout }}" - - "docker-registry.default.svc.cluster.local:5000" - when: openshift.common.version_gte_3_3_or_1_3 | bool - notify: - - Restart docker - - name: Delete temp directory - file: - name: "{{ mktemp.stdout }}" - state: absent - when: openshift.common.version_gte_3_3_or_1_3 | bool - changed_when: False - delegate_to: "{{ groups.oo_first_master.0 }}" - run_once: true - handlers: - - name: Restart docker - service: - name: docker - state: restarted + when: ( openshift.common.version_gte_3_3_or_1_3 | bool ) and ( openshift_hosted_manage_registry | default(true) | bool ) |