main.yml 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309
  1. ---
  2. # TODO: add ability to configure certificates given either a local file to
  3. # point to or certificate contents, set in default cert locations.
  4. # Authentication Variable Validation
  5. # TODO: validate the different identity provider kinds as well
  6. - fail:
  7. msg: >
  8. Invalid OAuth grant method: {{ openshift_master_oauth_grant_method }}
  9. when: openshift_master_oauth_grant_method is defined and openshift_master_oauth_grant_method not in openshift_master_valid_grant_methods
  10. # HA Variable Validation
  11. - fail:
  12. msg: "openshift_master_cluster_method must be set to either 'native' or 'pacemaker' for multi-master installations"
  13. when: openshift.master.ha | bool and ((openshift.master.cluster_method is not defined) or (openshift.master.cluster_method is defined and openshift.master.cluster_method not in ["native", "pacemaker"]))
  14. - fail:
  15. msg: "'native' high availability is not supported for the requested OpenShift version"
  16. when: openshift.master.ha | bool and openshift.master.cluster_method == "native" and not openshift.common.version_gte_3_1_or_1_1 | bool
  17. - fail:
  18. msg: "openshift_master_cluster_password must be set for multi-master installations"
  19. when: openshift.master.ha | bool and openshift.master.cluster_method == "pacemaker" and (openshift_master_cluster_password is not defined or not openshift_master_cluster_password)
  20. - fail:
  21. msg: "Pacemaker based HA is not supported at this time when used with containerized installs"
  22. when: openshift.master.ha | bool and openshift.master.cluster_method == "pacemaker" and openshift.common.is_containerized | bool
  23. - name: Open up firewall ports
  24. include: firewall.yml
  25. static: yes
  26. - name: Install Master package
  27. package:
  28. name: "{{ openshift.common.service_type }}-master{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
  29. state: present
  30. when: not openshift.common.is_containerized | bool
  31. - name: Create openshift.common.data_dir
  32. file:
  33. path: "{{ openshift.common.data_dir }}"
  34. state: directory
  35. mode: 0755
  36. owner: root
  37. group: root
  38. when: openshift.common.is_containerized | bool
  39. - name: Reload systemd units
  40. command: systemctl daemon-reload
  41. when: openshift.common.is_containerized | bool and install_result | changed
  42. - name: Re-gather package dependent master facts
  43. openshift_facts:
  44. - name: Create config parent directory if it does not exist
  45. file:
  46. path: "{{ openshift_master_config_dir }}"
  47. state: directory
  48. - name: Create the policy file if it does not already exist
  49. command: >
  50. {{ openshift.common.client_binary }} adm create-bootstrap-policy-file
  51. --filename={{ openshift_master_policy }}
  52. args:
  53. creates: "{{ openshift_master_policy }}"
  54. notify:
  55. - restart master api
  56. - restart master controllers
  57. - name: Create the scheduler config
  58. copy:
  59. content: "{{ scheduler_config | to_nice_json }}"
  60. dest: "{{ openshift_master_scheduler_conf }}"
  61. backup: true
  62. notify:
  63. - restart master api
  64. - restart master controllers
  65. - name: Install httpd-tools if needed
  66. package: name=httpd-tools state=present
  67. when: (item.kind == 'HTPasswdPasswordIdentityProvider') and
  68. not openshift.common.is_atomic | bool
  69. with_items: "{{ openshift.master.identity_providers }}"
  70. - name: Ensure htpasswd directory exists
  71. file:
  72. path: "{{ item.filename | dirname }}"
  73. state: directory
  74. when: item.kind == 'HTPasswdPasswordIdentityProvider'
  75. with_items: "{{ openshift.master.identity_providers }}"
  76. - name: Create the htpasswd file if needed
  77. template:
  78. dest: "{{ item.filename }}"
  79. src: htpasswd.j2
  80. backup: yes
  81. when: item.kind == 'HTPasswdPasswordIdentityProvider' and openshift.master.manage_htpasswd | bool
  82. with_items: "{{ openshift.master.identity_providers }}"
  83. - name: Ensure htpasswd file exists
  84. copy:
  85. dest: "{{ item.filename }}"
  86. force: no
  87. content: ""
  88. mode: 0600
  89. when: item.kind == 'HTPasswdPasswordIdentityProvider'
  90. with_items: "{{ openshift.master.identity_providers }}"
  91. - name: Create the ldap ca file if needed
  92. copy:
  93. dest: "{{ item.ca if 'ca' in item and '/' in item.ca else openshift_master_config_dir ~ '/' ~ item.ca | default('ldap_ca.crt') }}"
  94. content: "{{ openshift.master.ldap_ca }}"
  95. mode: 0600
  96. backup: yes
  97. when: openshift.master.ldap_ca is defined and item.kind == 'LDAPPasswordIdentityProvider'
  98. with_items: "{{ openshift.master.identity_providers }}"
  99. - name: Create the openid ca file if needed
  100. copy:
  101. dest: "{{ item.ca if 'ca' in item and '/' in item.ca else openshift_master_config_dir ~ '/' ~ item.ca | default('openid_ca.crt') }}"
  102. content: "{{ openshift.master.openid_ca }}"
  103. mode: 0600
  104. backup: yes
  105. when: openshift.master.openid_ca is defined and item.kind == 'OpenIDIdentityProvider' and item.ca | default('') != ''
  106. with_items: "{{ openshift.master.identity_providers }}"
  107. - name: Create the request header ca file if needed
  108. copy:
  109. dest: "{{ item.clientCA if 'clientCA' in item and '/' in item.clientCA else openshift_master_config_dir ~ '/' ~ item.clientCA | default('request_header_ca.crt') }}"
  110. content: "{{ openshift.master.request_header_ca }}"
  111. mode: 0600
  112. backup: yes
  113. when: openshift.master.request_header_ca is defined and item.kind == 'RequestHeaderIdentityProvider' and item.clientCA | default('') != ''
  114. with_items: "{{ openshift.master.identity_providers }}"
  115. # This is an ugly hack to verify settings are in a file without modifying them with lineinfile.
  116. # The template file will stomp any other settings made.
  117. - block:
  118. - name: check whether our docker-registry setting exists in the env file
  119. command: "awk '/^OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000/' /etc/sysconfig/{{ openshift.common.service_type }}-master"
  120. failed_when: false
  121. changed_when: false
  122. register: already_set
  123. - set_fact:
  124. openshift_push_via_dns: "{{ (openshift_use_dnsmasq | default(true) and openshift.common.version_gte_3_6) or (already_set.stdout is defined and already_set.stdout | match('OPENSHIFT_DEFAULT_REGISTRY=docker-registry.default.svc:5000')) }}"
  125. - name: Set fact of all etcd host IPs
  126. openshift_facts:
  127. role: common
  128. local_facts:
  129. no_proxy_etcd_host_ips: "{{ openshift_no_proxy_etcd_host_ips }}"
  130. - name: Remove the legacy master service if it exists
  131. include: clean_systemd_units.yml
  132. - name: Install the systemd units
  133. include: systemd_units.yml
  134. - name: Install Master system container
  135. include: system_container.yml
  136. when: openshift.common.is_containerized | bool and openshift.common.is_master_system_container | bool
  137. - name: Create session secrets file
  138. template:
  139. dest: "{{ openshift.master.session_secrets_file }}"
  140. src: sessionSecretsFile.yaml.v1.j2
  141. owner: root
  142. group: root
  143. mode: 0600
  144. when: openshift.master.session_auth_secrets is defined and openshift.master.session_encryption_secrets is defined
  145. notify:
  146. - restart master api
  147. - set_fact:
  148. translated_identity_providers: "{{ openshift.master.identity_providers | translate_idps('v1', openshift.common.version, openshift.common.deployment_type) }}"
  149. # TODO: add the validate parameter when there is a validation command to run
  150. - name: Create master config
  151. template:
  152. dest: "{{ openshift_master_config_file }}"
  153. src: master.yaml.v1.j2
  154. backup: true
  155. owner: root
  156. group: root
  157. mode: 0600
  158. notify:
  159. - restart master api
  160. - restart master controllers
  161. - include: set_loopback_context.yml
  162. when: openshift.common.version_gte_3_2_or_1_2
  163. - name: Start and enable master api on first master
  164. systemd:
  165. name: "{{ openshift.common.service_type }}-master-api"
  166. enabled: yes
  167. state: started
  168. when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
  169. register: start_result
  170. until: not start_result | failed
  171. retries: 1
  172. delay: 60
  173. - name: Dump logs from master-api if it failed
  174. command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-api
  175. when: start_result | failed
  176. - set_fact:
  177. master_api_service_status_changed: "{{ start_result | changed }}"
  178. when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
  179. - pause:
  180. seconds: 15
  181. when: openshift.master.ha | bool and openshift.master.cluster_method == 'native'
  182. - name: Start and enable master api all masters
  183. systemd:
  184. name: "{{ openshift.common.service_type }}-master-api"
  185. enabled: yes
  186. state: started
  187. when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
  188. register: start_result
  189. until: not start_result | failed
  190. retries: 1
  191. delay: 60
  192. - name: Dump logs from master-api if it failed
  193. command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-api
  194. when: start_result | failed
  195. - set_fact:
  196. master_api_service_status_changed: "{{ start_result | changed }}"
  197. when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
  198. # A separate wait is required here for native HA since notifies will
  199. # be resolved after all tasks in the role.
  200. - name: Wait for API to become available
  201. # Using curl here since the uri module requires python-httplib2 and
  202. # wait_for port doesn't provide health information.
  203. command: >
  204. curl --silent --tlsv1.2
  205. {% if openshift.common.version_gte_3_2_or_1_2 | bool %}
  206. --cacert {{ openshift.common.config_base }}/master/ca-bundle.crt
  207. {% else %}
  208. --cacert {{ openshift.common.config_base }}/master/ca.crt
  209. {% endif %}
  210. {{ openshift.master.api_url }}/healthz/ready
  211. register: api_available_output
  212. until: api_available_output.stdout == 'ok'
  213. retries: 120
  214. delay: 1
  215. run_once: true
  216. changed_when: false
  217. when: openshift.master.cluster_method == 'native' and master_api_service_status_changed | bool
  218. - name: Start and enable master controller on first master
  219. systemd:
  220. name: "{{ openshift.common.service_type }}-master-controllers"
  221. enabled: yes
  222. state: started
  223. when: openshift.master.cluster_method == 'native' and inventory_hostname == openshift_master_hosts[0]
  224. register: start_result
  225. until: not start_result | failed
  226. retries: 1
  227. delay: 60
  228. - name: Dump logs from master-controllers if it failed
  229. command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-controllers
  230. when: start_result | failed
  231. - name: Wait for master controller service to start on first master
  232. pause:
  233. seconds: 15
  234. when: openshift.master.cluster_method == 'native'
  235. - name: Start and enable master controller on all masters
  236. systemd:
  237. name: "{{ openshift.common.service_type }}-master-controllers"
  238. enabled: yes
  239. state: started
  240. when: openshift.master.cluster_method == 'native' and inventory_hostname != openshift_master_hosts[0]
  241. register: start_result
  242. until: not start_result | failed
  243. retries: 1
  244. delay: 60
  245. - name: Dump logs from master-controllers if it failed
  246. command: journalctl --no-pager -n 100 -u {{ openshift.common.service_type }}-master-controllers
  247. when: start_result | failed
  248. - set_fact:
  249. master_controllers_service_status_changed: "{{ start_result | changed }}"
  250. when: openshift.master.cluster_method == 'native'
  251. - name: Install cluster packages
  252. package: name=pcs state=present
  253. when: openshift.master.cluster_method == 'pacemaker'
  254. and not openshift.common.is_containerized | bool
  255. register: install_result
  256. - name: Start and enable cluster service
  257. systemd:
  258. name: pcsd
  259. enabled: yes
  260. state: started
  261. when: openshift.master.cluster_method == 'pacemaker'
  262. and not openshift.common.is_containerized | bool
  263. - name: Set the cluster user password
  264. shell: echo {{ openshift_master_cluster_password | quote }} | passwd --stdin hacluster
  265. when: install_result | changed