blob: b6d40306761d729aeca79ff0e85f8f2f41d6b49f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
---
- fail:
msg: "openshift_ca_host variable must be defined for this role"
when: openshift_ca_host is not defined
- fail:
msg: "Both 'certfile' and 'keyfile' keys must be supplied when configuring openshift_master_ca_certificate"
when: openshift_master_ca_certificate is defined and ('certfile' not in openshift_master_ca_certificate or 'keyfile' not in openshift_master_ca_certificate)
- name: Install the base package for admin tooling
action: "{{ ansible_pkg_mgr }} name={{ openshift.common.service_type }}{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }} state=present"
when: not openshift.common.is_containerized | bool
register: install_result
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Reload generated facts
openshift_facts:
when: install_result | changed
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Create openshift_ca_config_dir if it does not exist
file:
path: "{{ openshift_ca_config_dir }}"
state: directory
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Determine if CA must be created
stat:
path: "{{ openshift_ca_config_dir }}/{{ item }}"
register: g_master_ca_stat_result
with_items:
- ca-bundle.crt
- ca.crt
- ca.key
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- set_fact:
master_ca_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
else False in (g_master_ca_stat_result.results
| oo_collect(attribute='stat.exists')
| list) }}"
run_once: true
- name: Retain original serviceaccount keys
copy:
src: "{{ item }}"
dest: "{{ item }}.keep"
remote_src: true
with_items:
- "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
- "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
when: openshift_certificates_redeploy | default(false) | bool
- name: Deploy master ca certificate
copy:
src: "{{ item.src }}"
dest: "{{ openshift_ca_config_dir }}/{{ item.dest }}"
force: "{{ true if openshift_certificates_redeploy_ca | default(false) | bool else false }}"
with_items:
- src: "{{ (openshift_master_ca_certificate | default({'certfile':none})).certfile }}"
dest: ca.crt
- src: "{{ (openshift_master_ca_certificate | default({'keyfile':none})).keyfile }}"
dest: ca.key
when: openshift_master_ca_certificate is defined
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Create ca serial
copy:
content: "1"
dest: "{{ openshift_ca_config_dir }}/ca.serial.txt"
force: "{{ true if openshift_certificates_redeploy | default(false) | bool else false }}"
when: openshift_master_ca_certificate is defined
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Create the master certificates if they do not already exist
command: >
{{ openshift.common.client_binary }} adm create-master-certs
{% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
--certificate-authority {{ named_ca_certificate }}
{% endfor %}
--hostnames={{ openshift_master_hostnames | join(',') }}
--master={{ openshift.master.api_url }}
--public-master={{ openshift.master.public_api_url }}
--cert-dir={{ openshift_ca_config_dir }}
--overwrite=false
when: master_ca_missing | bool
delegate_to: "{{ openshift_ca_host }}"
run_once: true
- name: Restore original serviceaccount keys
copy:
src: "{{ item }}.keep"
dest: "{{ item }}"
remote_src: true
with_items:
- "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
- "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
when: openshift_certificates_redeploy | default(false) | bool
- name: Remove backup serviceaccount keys
file:
path: "{{ item }}.keep"
state: absent
with_items:
- "{{ openshift_ca_config_dir }}/serviceaccounts.private.key"
- "{{ openshift_ca_config_dir }}/serviceaccounts.public.key"
when: openshift_certificates_redeploy | default(false) | bool
|
