From 8db66f0929fecb26b3c4e71fe0797f20df13007a Mon Sep 17 00:00:00 2001
From: ewolinetz <ewolinet@redhat.com>
Date: Fri, 13 Jan 2017 15:04:57 -0600
Subject: Using oc_apply task for idempotent

---
 roles/openshift_logging/tasks/generate_certs.yaml | 46 +++++++++++++++++++++++
 1 file changed, 46 insertions(+)

(limited to 'roles/openshift_logging/tasks/generate_certs.yaml')

diff --git a/roles/openshift_logging/tasks/generate_certs.yaml b/roles/openshift_logging/tasks/generate_certs.yaml
index 5e6498ad7..e16071e46 100644
--- a/roles/openshift_logging/tasks/generate_certs.yaml
+++ b/roles/openshift_logging/tasks/generate_certs.yaml
@@ -162,10 +162,56 @@
   changed_when: no
   when: not elasticsearch_jks.stat.exists or not logging_es_jks.stat.exists or not system_admin_jks.stat.exists or not truststore_jks.stat.exists
 
+# check for secret/logging-kibana-proxy
+- command: >
+    {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig get secret/logging-kibana-proxy -n {{openshift_logging_namespace}} -o jsonpath='{.data.oauth-secret}'
+  register: kibana_secret_oauth_check
+  ignore_errors: yes
+  changed_when: no
+  check_mode: no
+
+- command: >
+    {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig get secret/logging-kibana-proxy -n {{openshift_logging_namespace}} -o jsonpath='{.data.session-secret}'
+  register: kibana_secret_session_check
+  ignore_errors: yes
+  changed_when: no
+  check_mode: no
+
+# check for oauthclient secret
+- command: >
+    {{ openshift.common.client_binary }} --config={{ mktemp.stdout }}/admin.kubeconfig get oauthclient/kibana-proxy -n {{openshift_logging_namespace}} -o jsonpath='{.secret}'
+  register: oauth_secret_check
+  ignore_errors: yes
+  changed_when: no
+  check_mode: no
+
+# set or generate as needed
 - name: Generate proxy session
   set_fact: session_secret={{'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'|random_word(200)}}
   check_mode: no
+  when:
+    - kibana_secret_session_check.stdout is not defined or kibana_secret_session_check.stdout == ''
+
+- name: Generate proxy session
+  set_fact: session_secret={{kibana_secret_session_check.stdout | b64decode }}
+  check_mode: no
+  when:
+    - kibana_secret_session_check.stdout is defined
+    - kibana_secret_session_check.stdout != ''
 
 - name: Generate oauth client secret
   set_fact: oauth_secret={{'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'|random_word(64)}}
   check_mode: no
+  when: kibana_secret_oauth_check.stdout is not defined or kibana_secret_oauth_check.stdout == ''
+    or oauth_secret_check.stdout is not defined or oauth_secret_check.stdout == ''
+    or kibana_secret_oauth_check.stdout | b64decode != oauth_secret_check.stdout
+
+- name: Generate oauth client secret
+  set_fact: oauth_secret={{kibana_secret_oauth_check.stdout | b64decode}}
+  check_mode: no
+  when:
+    - kibana_secret_oauth_check is defined
+    - kibana_secret_oauth_check.stdout != ''
+    - oauth_secret_check.stdout is defined
+    - oauth_secret_check.stdout != ''
+    - kibana_secret_oauth_check.stdout | b64decode == oauth_secret_check.stdout
-- 
cgit v1.2.1