okd/roles/openshift_hosted/tasks/secure/passthrough.yml

---
# Generate a self-signed certificate when there is no user-supplied certificate
- name: Configure self-signed certificate file paths
  set_fact:
    docker_registry_cert_path: "/etc/origin/master/registry.crt"
    docker_registry_key_path: "/etc/origin/master/registry.key"
    docker_registry_cacert_path: "/etc/origin/master/ca.crt"
    docker_registry_self_signed: true
  when:
  - "'certfile' not in openshift_hosted_registry_routecertificates"
  - "'keyfile' not in openshift_hosted_registry_routecertificates"

# Retrieve user supplied certificate files if they are provided
- when:
  - "'certfile' in openshift_hosted_registry_routecertificates"
  - "'keyfile' in openshift_hosted_registry_routecertificates"
  block:
  - name: Configure provided certificate file paths
    set_fact:
      docker_registry_cert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
      docker_registry_key_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
      docker_registry_self_signed: false

  # Since we end up bundling the cert, cacert and key in a .pem file, the 'cafile'
  # is optional
  - name: Configure provided ca certificate file path
    set_fact:
      docker_registry_cacert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}"
    when: "'cafile' in openshift_hosted_registry_routecertificates"

  - name: Retrieve provided certificate files
    copy:
      backup: True
      dest: "/etc/origin/master/named_certificates/{{ item.value | basename }}"
      src: "{{ item.value }}"
    when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value
    with_dict: "{{ openshift_hosted_registry_routecertificates }}"

- name: Configure a passthrough route for docker-registry
  oc_route:
    name: docker-registry
    namespace: "{{ openshift_hosted_registry_namespace }}"
    service_name: docker-registry
    tls_termination: "{{ openshift_hosted_registry_routetermination }}"
    host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}"