okd/playbooks/common/openshift-master/config.yml

---
- name: Set master facts and determine if external etcd certs need to be generated
  hosts: oo_masters_to_config
  vars:
    t_oo_option_master_debug_level: "{{ lookup('oo_option', 'openshift_master_debug_level') }}"

  pre_tasks:
  - name: Check for RPM generated config marker file .config_managed
    stat:
      path: /etc/origin/.config_managed
    register: rpmgenerated_config

  - name: Remove RPM generated config files if present
    file:
      path: "/etc/origin/{{ item }}"
      state: absent
    when: rpmgenerated_config.stat.exists == true and deployment_type in ['openshift-enterprise', 'atomic-enterprise']
    with_items:
    - master
    - node
    - .config_managed

  - set_fact:
      openshift_master_pod_eviction_timeout: "{{ lookup('oo_option', 'openshift_master_pod_eviction_timeout') | default(none, true) }}"
    when: openshift_master_pod_eviction_timeout is not defined

  - set_fact:
      openshift_master_etcd_port: "{{ (etcd_client_port | default('2379')) if (groups.oo_etcd_to_config is defined and groups.oo_etcd_to_config) else none }}"
      openshift_master_etcd_hosts: "{{ hostvars
                                       | oo_select_keys(groups['oo_etcd_to_config']
                                                        | default([]))
                                       | oo_collect('openshift.common.hostname')
                                       | default(none, true) }}"

  - set_fact:
      openshift_master_debug_level: "{{ t_oo_option_master_debug_level }}"
    when: openshift_master_debug_level is not defined and t_oo_option_master_debug_level != ""

  - set_fact:
      openshift_master_default_subdomain: "{{ lookup('oo_option', 'openshift_master_default_subdomain') | default(None, true) }}"
    when: openshift_master_default_subdomain is not defined
  - set_fact:
      openshift_hosted_metrics_deploy: "{{ lookup('oo_option', 'openshift_hosted_metrics_deploy') | default(false, true) }}"
    when: openshift_hosted_metrics_deploy is not defined
  - set_fact:
      openshift_hosted_metrics_duration: "{{ lookup('oo_option', 'openshift_hosted_metrics_duration') | default(7) }}"
    when: openshift_hosted_metrics_duration is not defined
  - set_fact:
      openshift_hosted_metrics_resolution: "{{ lookup('oo_option', 'openshift_hosted_metrics_resolution') | default(10) }}"
    when: openshift_hosted_metrics_resolution is not defined
  roles:
  - openshift_facts
  post_tasks:
  - openshift_facts:
      role: master
      local_facts:
        api_port: "{{ openshift_master_api_port | default(None) }}"
        api_url: "{{ openshift_master_api_url | default(None) }}"
        api_use_ssl: "{{ openshift_master_api_use_ssl | default(None) }}"
        controllers_port: "{{ openshift_master_controllers_port | default(None) }}"
        public_api_url: "{{ openshift_master_public_api_url | default(None) }}"
        cluster_hostname: "{{ openshift_master_cluster_hostname | default(None) }}"
        cluster_public_hostname: "{{ openshift_master_cluster_public_hostname | default(None) }}"
        console_path: "{{ openshift_master_console_path | default(None) }}"
        console_port: "{{ openshift_master_console_port | default(None) }}"
        console_url: "{{ openshift_master_console_url | default(None) }}"
        console_use_ssl: "{{ openshift_master_console_use_ssl | default(None) }}"
        public_console_url: "{{ openshift_master_public_console_url | default(None) }}"
        ha: "{{ openshift_master_ha | default(groups.oo_masters | length > 1) }}"
        master_count: "{{ openshift_master_count | default(groups.oo_masters | length) }}"
  - openshift_facts:
      role: hosted
      openshift_env:
        openshift_hosted_registry_storage_kind: 'nfs'
    when: openshift_hosted_registry_storage_kind is not defined and groups.oo_nfs_to_config is defined and groups.oo_nfs_to_config | length > 0
  - name: Check status of external etcd certificatees
    stat:
      path: "{{ openshift.common.config_base }}/master/{{ item }}"
    with_items:
    - master.etcd-client.crt
    - master.etcd-ca.crt
    register: g_external_etcd_cert_stat_result
  - set_fact:
      etcd_client_certs_missing: "{{ g_external_etcd_cert_stat_result.results
                                    | oo_collect(attribute='stat.exists')
                                    | list | intersect([false])}}"
      etcd_cert_subdir: openshift-master-{{ openshift.common.hostname }}
      etcd_cert_config_dir: "{{ openshift.common.config_base }}/master"
      etcd_cert_prefix: master.etcd-
      etcd_hostname: "{{ openshift.common.hostname }}"
      etcd_ip: "{{ openshift.common.ip }}"
    when: groups.oo_etcd_to_config is defined and groups.oo_etcd_to_config

- name: Create temp directory for syncing certs
  hosts: localhost
  connection: local
  become: no
  gather_facts: no
  tasks:
  - name: Create local temp directory for syncing certs
    local_action: command mktemp -d /tmp/openshift-ansible-XXXXXXX
    register: g_master_mktemp
    changed_when: False

- name: Configure etcd certificates
  hosts: oo_first_etcd
  vars:
    etcd_generated_certs_dir: /etc/etcd/generated_certs
    etcd_needing_client_certs: "{{ hostvars
                                   | oo_select_keys(groups['oo_masters_to_config'])
                                   | default([])
                                   | oo_filter_list(filter_attr='etcd_client_certs_missing') }}"
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
  roles:
  - openshift_etcd_certificates
  post_tasks:
  - name: Create a tarball of the etcd certs
    command: >
      tar -czvf {{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}.tgz
        -C {{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }} .
    args:
      creates: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}.tgz"
    with_items: "{{ etcd_needing_client_certs | default([]) }}"
  - name: Retrieve the etcd cert tarballs
    fetch:
      src: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}.tgz"
      dest: "{{ sync_tmpdir }}/"
      flat: yes
      fail_on_missing: yes
      validate_checksum: yes
    with_items: "{{ etcd_needing_client_certs | default([]) }}"

- name: Copy the external etcd certs to the masters
  hosts: oo_masters_to_config
  vars:
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
  tasks:
  - name: Ensure certificate directory exists
    file:
      path: "{{ openshift.common.config_base }}/master"
      state: directory
    when: etcd_client_certs_missing is defined and etcd_client_certs_missing
  - name: Unarchive the tarball on the master
    unarchive:
      src: "{{ sync_tmpdir }}/{{ etcd_cert_subdir }}.tgz"
      dest: "{{ etcd_cert_config_dir }}"
    when: etcd_client_certs_missing is defined and etcd_client_certs_missing
  - file:
      path: "{{ etcd_cert_config_dir }}/{{ item }}"
      owner: root
      group: root
      mode: 0600
    with_items:
    - master.etcd-client.crt
    - master.etcd-client.key
    - master.etcd-ca.crt
    when: etcd_client_certs_missing is defined and etcd_client_certs_missing

# Must be run before generating master certs which involved openshift_cli role and needs
# to pull down the correct docker container:
- name: Determine openshift_version to configure on first master
  hosts: oo_first_master
  any_errors_fatal: true
  # We do initial seeding of openshift_version if possible with these tasks. The openshift_docker role
  # will make absolutely sure it's set to a specific version after this.
  pre_tasks:
  - debug: var=openshift.common
  - debug: var=openshift_image_tag
  - debug: var=openshift_release
  - name: Determine version to configure if containerized and release specified
    set_fact:
      openshift_version: "{{ openshift_release }}"
    when: openshift.common.is_containerized | bool and openshift_release is defined
# TODO: what should we do for rpm installs and openshift_release here?
  - name: Determine container version to configure when openshift_image_tag specified
    set_fact:
      openshift_version: "{{ openshift_image_tag.split('v',1)[1] }}"
    when: openshift.common.is_containerized | bool and openshift_image_tag is defined
  - name: Determine rpm version to configure when openshift_pkg_version specified
    set_fact:
      # Expects a leading "-" in inventory, strip it off here, and ignore a trailing release,
      # openshift_version should always just be "3.2" or "3.2.0.44"
      openshift_version: "{{ openshift_pkg_version[1:].split('-')[0] }}"
    when: not openshift.common.is_containerized | bool and openshift_pkg_version is defined
  - name: Use openshift.common.version fact as version to configure if already installed
    set_fact:
      openshift_version: "{{ openshift.common.version }}"
    when: openshift.common.version is defined
  - debug: var=openshift_version
  roles:
  - openshift_docker

# Re-use pre-existing version fact if present, if not use the first master's
# openshift_version calculated above.
- name: Determine openshift_version to configure on remaining masters
  hosts: oo_masters_to_config[1:]
  any_errors_fatal: true
  tasks:
  - set_fact:
      openshift_version: "{{ hostvars[groups.oo_first_master.0].openshift_version }}"
    when: openshift.common.version is not defined
  - set_fact:
      openshift_version: "{{ openshift.common.version }}"
    when: openshift.common.version is defined
  - debug: var=openshift_version
  post_tasks:
  - fail:

- name: Determine if master certificates need to be generated
  hosts: oo_first_master:oo_masters_to_config
  tasks:
  - set_fact:
      openshift_master_certs_no_etcd:
      - admin.crt
      - master.kubelet-client.crt
      - "{{ 'master.proxy-client.crt' if openshift.common.version_gte_3_1_or_1_1 else omit }}"
      - master.server.crt
      - openshift-master.crt
      - openshift-registry.crt
      - openshift-router.crt
      - etcd.server.crt
      openshift_master_certs_etcd:
      - master.etcd-client.crt

  - set_fact:
      openshift_master_certs: "{{ (openshift_master_certs_no_etcd | union(openshift_master_certs_etcd)) if (groups.oo_etcd_to_config is defined and groups.oo_etcd_to_config) else openshift_master_certs_no_etcd }}"

  - name: Check status of master certificates
    stat:
      path: "{{ openshift.common.config_base }}/master/{{ item }}"
    with_items: "{{ openshift_master_certs }}"
    register: g_master_cert_stat_result
  - set_fact:
      master_certs_missing: "{{ False in (g_master_cert_stat_result.results
                                | oo_collect(attribute='stat.exists')
                                | list ) }}"
      master_cert_subdir: master-{{ openshift.common.hostname }}
      master_cert_config_dir: "{{ openshift.common.config_base }}/master"
  - set_fact:
      openshift_infra_nodes: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_config'])
                                 | oo_nodes_with_label('region', 'infra')
                                 | oo_collect('inventory_hostname') }}"
    when: openshift_infra_nodes is not defined and groups.oo_nodes_to_config | default([]) | length > 0

- name: Configure master certificates
  hosts: oo_first_master
  vars:
    master_generated_certs_dir: "{{ openshift.common.config_base }}/generated-configs"
    masters_needing_certs: "{{ hostvars
                               | oo_select_keys(groups['oo_masters_to_config'] | difference(groups['oo_first_master']))
                               | oo_filter_list(filter_attr='master_certs_missing') }}"
    master_hostnames: "{{ hostvars
                               | oo_select_keys(groups['oo_masters_to_config'])
                               | oo_collect('openshift.common.all_hostnames')
                               | oo_flatten | unique }}"
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
    openshift_docker_hosted_registry_network: "{{ hostvars[groups.oo_first_master.0].openshift.common.portal_net }}"
  roles:
  - openshift_master_certificates
  post_tasks:
  - name: Remove generated etcd client certs when using external etcd
    file:
      path: "{{ master_generated_certs_dir }}/{{ item.0.master_cert_subdir }}/{{ item.1 }}"
      state: absent
    when: groups.oo_etcd_to_config is defined and groups.oo_etcd_to_config
    with_nested:
    - "{{ masters_needing_certs | default([]) }}"
    - - master.etcd-client.crt
      - master.etcd-client.key

  - name: Create a tarball of the master certs
    command: >
      tar -czvf {{ master_generated_certs_dir }}/{{ item.master_cert_subdir }}.tgz
        -C {{ master_generated_certs_dir }}/{{ item.master_cert_subdir }} .
    args:
      creates: "{{ master_generated_certs_dir }}/{{ item.master_cert_subdir }}.tgz"
    with_items: "{{ masters_needing_certs | default([]) }}"

  - name: Retrieve the master cert tarball from the master
    fetch:
      src: "{{ master_generated_certs_dir }}/{{ item.master_cert_subdir }}.tgz"
      dest: "{{ sync_tmpdir }}/"
      flat: yes
      fail_on_missing: yes
      validate_checksum: yes
    with_items: "{{ masters_needing_certs | default([]) }}"

- name: Configure load balancers
  hosts: oo_lb_to_config
  vars:
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
    haproxy_limit_nofile: 100000
    haproxy_global_maxconn: 20000
    haproxy_default_maxconn: 20000
    haproxy_frontend_port: "{{ hostvars[groups.oo_first_master.0].openshift.master.api_port }}"
    haproxy_frontends:
    - name: atomic-openshift-api
      mode: tcp
      options:
      - tcplog
      binds:
      - "*:{{ hostvars[groups.oo_first_master.0].openshift.master.api_port }}"
      default_backend: atomic-openshift-api
    haproxy_backends:
    - name: atomic-openshift-api
      mode: tcp
      option: tcplog
      balance: source
      servers: "{{ hostvars | oo_select_keys(groups['oo_masters']) | oo_haproxy_backend_masters }}"
  roles:
  - role: openshift_facts
  - role: haproxy
    when: hostvars[groups.oo_first_master.0].openshift.master.ha | bool

- name: Check for cached session secrets
  hosts: oo_first_master
  roles:
  - role: openshift_facts
  post_tasks:
  - openshift_facts:
      role: master
      local_facts:
          session_auth_secrets: "{{ openshift_master_session_auth_secrets | default(openshift.master.session_auth_secrets | default(None)) }}"
          session_encryption_secrets: "{{ openshift_master_session_encryption_secrets | default(openshift.master.session_encryption_secrets | default(None)) }}"

- name: Generate master session secrets
  hosts: oo_first_master
  vars:
    g_session_secrets_present: "{{ (openshift.master.session_auth_secrets | default([]) and openshift.master.session_encryption_secrets | default([])) | length > 0 }}"
    g_session_auth_secrets: "{{ [ 24 | oo_generate_secret ] }}"
    g_session_encryption_secrets: "{{ [ 24 | oo_generate_secret ] }}"
  roles:
  - role: openshift_facts
  tasks:
  - openshift_facts:
      role: master
      local_facts:
        session_auth_secrets: "{{ g_session_auth_secrets }}"
        session_encryption_secrets: "{{ g_session_encryption_secrets }}"
    when: not g_session_secrets_present | bool

- name: Parse named certificates
  hosts: localhost
  connection: local
  become: no
  vars:
    internal_hostnames: "{{ hostvars[groups.oo_first_master.0].openshift.common.internal_hostnames }}"
    named_certificates: "{{ hostvars[groups.oo_first_master.0].openshift_master_named_certificates | default([]) }}"
    named_certificates_dir: "{{ hostvars[groups.oo_first_master.0].master_cert_config_dir }}/named_certificates/"
  tasks:
  - set_fact:
      parsed_named_certificates: "{{ named_certificates | oo_parse_named_certificates(named_certificates_dir, internal_hostnames) }}"
    when: named_certificates | length > 0

- name: Deploy named certificates
  hosts: oo_masters_to_config
  vars:
    named_certs_dir: "{{ master_cert_config_dir }}/named_certificates/"
    named_certs_specified: "{{ openshift_master_named_certificates is defined }}"
    overwrite_named_certs: "{{ openshift_master_overwrite_named_certificates | default(false) }}"
  roles:
  - role: openshift_facts
  post_tasks:
  - openshift_facts:
      role: master
      local_facts:
        named_certificates: "{{ hostvars.localhost.parsed_named_certificates | default([]) }}"
      additive_facts_to_overwrite:
      - "{{ 'master.named_certificates' if overwrite_named_certs | bool else omit }}"
  - name: Clear named certificates
    file:
      path: "{{ named_certs_dir }}"
      state: absent
    when: overwrite_named_certs | bool
  - name: Ensure named certificate directory exists
    file:
      path: "{{ named_certs_dir }}"
      state: directory
      mode: 0700
    when: named_certs_specified | bool
  - name: Land named certificates
    copy: src="{{ item.certfile }}" dest="{{ named_certs_dir }}"
    with_items: openshift_master_named_certificates
    when: named_certs_specified | bool
  - name: Land named certificate keys
    copy: src="{{ item.keyfile }}" dest="{{ named_certs_dir }}" mode=0600
    with_items: openshift_master_named_certificates
    when: named_certs_specified | bool

- name: Configure first master instance
  hosts: oo_first_master
  any_errors_fatal: true
  serial: 1
  vars:
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
    openshift_master_ha: "{{ openshift.master.ha }}"
    openshift_master_count: "{{ openshift.master.master_count }}"
    openshift_master_session_auth_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_auth_secrets }}"
    openshift_master_session_encryption_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_encryption_secrets }}"
    openshift_docker_hosted_registry_network: "{{ hostvars[groups.oo_first_master.0].openshift.common.portal_net }}"
    openshift_no_proxy_internal_hostnames: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_config']
                                                    | union(groups['oo_masters_to_config'])
                                                    | union(groups['oo_etcd_to_config'] | default([])))
                                                | oo_collect('openshift.common.hostname') | default([]) | join (',')
                                                }}"
    when: "{{ (openshift_http_proxy is defined or openshift_https_proxy is defined) and
            openshift_generate_no_proxy_hosts | default(True) | bool }}"
  pre_tasks:
  - name: Ensure certificate directory exists
    file:
      path: "{{ openshift.common.config_base }}/master"
      state: directory
    when: master_certs_missing | bool and 'oo_first_master' not in group_names
  - name: Unarchive the tarball on the master
    unarchive:
      src: "{{ sync_tmpdir }}/{{ master_cert_subdir }}.tgz"
      dest: "{{ master_cert_config_dir }}"
    when: master_certs_missing | bool and 'oo_first_master' not in group_names
  - debug: var=openshift_version
  roles:
  - openshift_master
  - role: nickhammond.logrotate
  - role: nuage_master
    when: openshift.common.use_nuage | bool
  post_tasks:
  - name: Create group for deployment type
    group_by: key=oo_masters_deployment_type_{{ openshift.common.deployment_type }}
    changed_when: False

# TODO: This is a copy paste of the oo_first_master, how do we reconcile the code but change openshift_version?
- name: Configure remaining master instances
  hosts: oo_masters_to_config[1:]
  any_errors_fatal: true
  serial: 1
  vars:
    sync_tmpdir: "{{ hostvars.localhost.g_master_mktemp.stdout }}"
    openshift_version: "{{ oo_first_master.openshift.common.version.split('-')[0] }}"
    openshift_master_ha: "{{ openshift.master.ha }}"
    openshift_master_count: "{{ openshift.master.master_count }}"
    openshift_master_session_auth_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_auth_secrets }}"
    openshift_master_session_encryption_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_encryption_secrets }}"
    openshift_docker_hosted_registry_network: "{{ hostvars[groups.oo_first_master.0].openshift.common.portal_net }}"
    openshift_no_proxy_internal_hostnames: "{{ hostvars | oo_select_keys(groups['oo_nodes_to_config']
                                                    | union(groups['oo_masters_to_config'])
                                                    | union(groups['oo_etcd_to_config'] | default([])))
                                                | oo_collect('openshift.common.hostname') | default([]) | join (',')
                                                }}"
    when: "{{ (openshift_http_proxy is defined or openshift_https_proxy is defined) and
            openshift_generate_no_proxy_hosts | default(True) | bool }}"
  pre_tasks:
  - name: Ensure certificate directory exists
    file:
      path: "{{ openshift.common.config_base }}/master"
      state: directory
    when: master_certs_missing | bool and 'oo_first_master' not in group_names
  - name: Unarchive the tarball on the master
    unarchive:
      src: "{{ sync_tmpdir }}/{{ master_cert_subdir }}.tgz"
      dest: "{{ master_cert_config_dir }}"
    when: master_certs_missing | bool and 'oo_first_master' not in group_names
  roles:
  - openshift_master
  - role: nickhammond.logrotate
  - role: nuage_master
    when: openshift.common.use_nuage | bool
  post_tasks:
  - name: Create group for deployment type
    group_by: key=oo_masters_deployment_type_{{ openshift.common.deployment_type }}
    changed_when: False

- name: Delete temporary directory on localhost
  hosts: localhost
  connection: local
  become: no
  gather_facts: no
  tasks:
  - file: name={{ g_master_mktemp.stdout }} state=absent
    changed_when: False