main.yaml 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532
  1. ---
  2. - name: Ensure that ElasticSearch has nodes to run on
  3. fail:
  4. msg: |-
  5. No schedulable nodes found matching node selector for Elasticsearch - '{{ openshift_logging_es_nodeselector }}'
  6. when:
  7. - openshift_schedulable_node_labels | lib_utils_oo_has_no_matching_selector(openshift_logging_es_nodeselector)
  8. - name: Validate Elasticsearch cluster size
  9. fail: msg="The openshift_logging_es_cluster_size may only be scaled down manually. Please see official documentation on how to do this."
  10. when: openshift_logging_facts.elasticsearch.deploymentconfigs | length > openshift_logging_es_cluster_size|int
  11. - name: Validate Elasticsearch Ops cluster size
  12. fail: msg="The openshift_logging_es_ops_cluster_size may only be scaled down manually. Please see official documentation on how to do this."
  13. when: openshift_logging_facts.elasticsearch_ops.deploymentconfigs | length > openshift_logging_es_ops_cluster_size|int
  14. - fail:
  15. msg: Invalid deployment type, one of ['data-master', 'data-client', 'master', 'client'] allowed
  16. when: not openshift_logging_elasticsearch_deployment_type in __allowed_es_types
  17. - set_fact:
  18. elasticsearch_name: "{{ 'logging-elasticsearch' ~ ( (openshift_logging_elasticsearch_ops_deployment | default(false) | bool) | ternary('-ops', '')) }}"
  19. es_component: "{{ 'es' ~ ( (openshift_logging_elasticsearch_ops_deployment | default(false) | bool) | ternary('-ops', '') ) }}"
  20. - name: Set default image variables based on openshift_deployment_type
  21. include_vars: "{{ var_file_name }}"
  22. with_first_found:
  23. - "{{ openshift_deployment_type }}.yml"
  24. - "default_images.yml"
  25. loop_control:
  26. loop_var: var_file_name
  27. - name: Set elasticsearch image facts
  28. set_fact:
  29. openshift_logging_elasticsearch_proxy_image_prefix: "{{ openshift_logging_elasticsearch_proxy_image_prefix | default(__openshift_logging_elasticsearch_proxy_image_prefix) }}"
  30. openshift_logging_elasticsearch_proxy_image_version: "{{ openshift_logging_elasticsearch_proxy_image_version | default(__openshift_logging_elasticsearch_proxy_image_version) }}"
  31. openshift_logging_elasticsearch_image_prefix: "{{ openshift_logging_elasticsearch_image_prefix | default(__openshift_logging_elasticsearch_image_prefix) }}"
  32. openshift_logging_elasticsearch_image_version: "{{ openshift_logging_elasticsearch_image_version | default(__openshift_logging_elasticsearch_image_version) }}"
  33. - include_tasks: determine_version.yaml
  34. - set_fact:
  35. full_restart_cluster: True
  36. when:
  37. - _es_installed_version is defined
  38. - _es_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
  39. - set_fact:
  40. full_restart_cluster: True
  41. when:
  42. - _es_ops_installed_version is defined
  43. - _es_ops_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
  44. # allow passing in a tempdir
  45. - name: Create temp directory for doing work in
  46. command: mktemp -d /tmp/openshift-logging-ansible-XXXXXX
  47. register: mktemp
  48. changed_when: False
  49. - set_fact:
  50. tempdir: "{{ mktemp.stdout }}"
  51. # This may not be necessary in this role
  52. - name: Create templates subdirectory
  53. file:
  54. state: directory
  55. path: "{{ tempdir }}/templates"
  56. mode: 0755
  57. changed_when: False
  58. # we want to make sure we have all the necessary components here
  59. # service account
  60. - name: Create ES service account
  61. oc_serviceaccount:
  62. state: present
  63. name: "aggregated-logging-elasticsearch"
  64. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  65. image_pull_secrets: "{{ openshift_logging_image_pull_secret }}"
  66. when: openshift_logging_image_pull_secret != ''
  67. - name: Create ES service account
  68. oc_serviceaccount:
  69. state: present
  70. name: "aggregated-logging-elasticsearch"
  71. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  72. when:
  73. - openshift_logging_image_pull_secret == ''
  74. # rolebinding reader
  75. - name: Create rolebinding-reader role
  76. oc_clusterrole:
  77. state: present
  78. name: rolebinding-reader
  79. rules:
  80. - apiGroups: [""]
  81. resources: ["clusterrolebindings"]
  82. verbs: ["get"]
  83. # SA roles
  84. - name: Set rolebinding-reader permissions for ES
  85. oc_adm_policy_user:
  86. state: present
  87. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  88. resource_kind: cluster-role
  89. resource_name: rolebinding-reader
  90. user: "system:serviceaccount:{{ openshift_logging_elasticsearch_namespace }}:aggregated-logging-elasticsearch"
  91. - oc_adm_policy_user:
  92. state: present
  93. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  94. resource_kind: cluster-role
  95. resource_name: system:auth-delegator
  96. user: "system:serviceaccount:{{ openshift_logging_elasticsearch_namespace}}:aggregated-logging-elasticsearch"
  97. # logging-metrics-reader role
  98. - template:
  99. src: "{{ __base_file_dir }}/logging-metrics-role.j2"
  100. dest: "{{mktemp.stdout}}/templates/logging-metrics-role.yml"
  101. vars:
  102. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  103. role_namespace: "{{ openshift_logging_elasticsearch_prometheus_sa | serviceaccount_namespace(openshift_logging_elasticsearch_namespace) }}"
  104. role_user: "{{ openshift_logging_elasticsearch_prometheus_sa | serviceaccount_name }}"
  105. - name: Create logging-metrics-reader-role
  106. command: >
  107. {{ openshift_client_binary }}
  108. --config={{ openshift.common.config_base }}/master/admin.kubeconfig
  109. -n "{{ openshift_logging_elasticsearch_namespace }}"
  110. create -f "{{mktemp.stdout}}/templates/logging-metrics-role.yml"
  111. register: prometheus_out
  112. check_mode: no
  113. ignore_errors: yes
  114. - fail:
  115. msg: "There was an error creating the logging-metrics-role and binding: {{prometheus_out}}"
  116. when:
  117. - "prometheus_out.stderr | length > 0"
  118. - "'already exists' not in prometheus_out.stderr"
  119. - set_fact:
  120. _logging_metrics_proxy_passwd: "{{ 16 | lib_utils_oo_random_word | b64encode }}"
  121. - template:
  122. src: passwd.j2
  123. dest: "{{mktemp.stdout}}/passwd.yml"
  124. vars:
  125. logging_user_name: "{{ openshift_logging_elasticsearch_prometheus_sa }}"
  126. logging_user_passwd: "{{ _logging_metrics_proxy_passwd }}"
  127. # View role and binding
  128. - name: Generate logging-elasticsearch-view-role
  129. template:
  130. src: "{{ __base_file_dir }}/rolebinding.j2"
  131. dest: "{{mktemp.stdout}}/logging-elasticsearch-view-role.yaml"
  132. vars:
  133. obj_name: logging-elasticsearch-view-role
  134. roleRef:
  135. name: view
  136. subjects:
  137. - kind: ServiceAccount
  138. name: aggregated-logging-elasticsearch
  139. changed_when: no
  140. - name: Set logging-elasticsearch-view-role role
  141. oc_obj:
  142. state: present
  143. name: "logging-elasticsearch-view-role"
  144. kind: rolebinding
  145. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  146. files:
  147. - "{{ tempdir }}/logging-elasticsearch-view-role.yaml"
  148. delete_after: true
  149. # configmap
  150. - assert:
  151. that:
  152. - openshift_logging_elasticsearch_kibana_index_mode in __kibana_index_modes
  153. msg: "The openshift_logging_elasticsearch_kibana_index_mode '{{ openshift_logging_elasticsearch_kibana_index_mode }}' only supports one of: {{ __kibana_index_modes | join(', ') }}"
  154. - assert:
  155. that:
  156. - "{{ openshift_logging_es_log_appenders | length > 0 }}"
  157. msg: "The openshift_logging_es_log_appenders '{{ openshift_logging_es_log_appenders }}' has an unrecognized option and only supports the following as a list: {{ __es_log_appenders | join(', ') }}"
  158. - template:
  159. src: "{{ __base_file_dir }}/elasticsearch.yml.j2"
  160. dest: "{{ tempdir }}/elasticsearch.yml"
  161. vars:
  162. allow_cluster_reader: "{{ openshift_logging_elasticsearch_ops_allow_cluster_reader | lower | default('false') }}"
  163. es_number_of_shards: "{{ openshift_logging_es_number_of_shards | default(1) }}"
  164. es_number_of_replicas: "{{ openshift_logging_es_number_of_replicas| default(0) }}"
  165. es_kibana_index_mode: "{{ openshift_logging_elasticsearch_kibana_index_mode | default('unique') }}"
  166. changed_when: no
  167. # create diff between current configmap files and our current files
  168. - when: not openshift_logging_es5_techpreview
  169. block:
  170. - template:
  171. src: "{{ __base_file_dir }}/elasticsearch-logging.yml.j2"
  172. dest: "{{ tempdir }}/elasticsearch-logging.yml"
  173. vars:
  174. root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
  175. changed_when: no
  176. - include_role:
  177. name: openshift_logging
  178. tasks_from: patch_configmap_files.yaml
  179. vars:
  180. configmap_name: "{{ elasticsearch_name }}"
  181. configmap_namespace: "logging"
  182. configmap_file_names:
  183. - current_file: "elasticsearch.yml"
  184. new_file: "{{ tempdir }}/elasticsearch.yml"
  185. protected_lines: ["number_of_shards", "number_of_replicas"]
  186. - current_file: "logging.yml"
  187. new_file: "{{ tempdir }}/elasticsearch-logging.yml"
  188. - name: Set ES configmap
  189. oc_configmap:
  190. state: present
  191. name: "{{ elasticsearch_name }}"
  192. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  193. from_file:
  194. elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
  195. logging.yml: "{{ tempdir }}/elasticsearch-logging.yml"
  196. register: es_config_creation
  197. notify: "restart elasticsearch"
  198. - when: openshift_logging_es5_techpreview | bool
  199. block:
  200. - template:
  201. src: "{{ __base_file_dir }}/log4j2.properties.j2"
  202. dest: "{{ tempdir }}/log4j2.properties"
  203. vars:
  204. root_logger: "{{ openshift_logging_es_log_appenders | list }}"
  205. changed_when: no
  206. - include_role:
  207. name: openshift_logging
  208. tasks_from: patch_configmap_files.yaml
  209. vars:
  210. configmap_name: "{{ elasticsearch_name }}"
  211. configmap_namespace: "logging"
  212. configmap_file_names:
  213. - current_file: "elasticsearch.yml"
  214. new_file: "{{ tempdir }}/elasticsearch.yml"
  215. - current_file: "log4j2.properties"
  216. new_file: "{{ tempdir }}/log4j2.properties"
  217. - name: Set ES configmap
  218. oc_configmap:
  219. state: present
  220. name: "{{ elasticsearch_name }}"
  221. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  222. from_file:
  223. elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
  224. log4j2.properties: "{{ tempdir }}/log4j2.properties"
  225. register: es_config_creation
  226. notify: "restart elasticsearch"
  227. - when: es_config_creation.changed | bool
  228. block:
  229. - set_fact:
  230. _restart_logging_components: "{{ _restart_logging_components | default([]) + [es_component] | unique }}"
  231. - shell: >
  232. {{ openshift_client_binary }} get dc -l component="{{ es_component }}" -n "{{ openshift_logging_elasticsearch_namespace }}" -o name | cut -d'/' -f2
  233. register: _es_dcs
  234. - set_fact:
  235. _restart_logging_nodes: "{{ _restart_logging_nodes | default([]) + [_es_dcs.stdout] | unique }}"
  236. when: _es_dcs.stdout != ""
  237. # secret
  238. - name: Set ES secret
  239. oc_secret:
  240. state: present
  241. name: "logging-elasticsearch"
  242. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  243. files:
  244. - name: key
  245. path: "{{ generated_certs_dir }}/logging-es.jks"
  246. - name: truststore
  247. path: "{{ generated_certs_dir }}/truststore.jks"
  248. - name: searchguard.key
  249. path: "{{ generated_certs_dir }}/elasticsearch.jks"
  250. - name: searchguard.truststore
  251. path: "{{ generated_certs_dir }}/truststore.jks"
  252. - name: admin-key
  253. path: "{{ generated_certs_dir }}/system.admin.key"
  254. - name: admin-cert
  255. path: "{{ generated_certs_dir }}/system.admin.crt"
  256. - name: admin-ca
  257. path: "{{ generated_certs_dir }}/ca.crt"
  258. - name: admin.jks
  259. path: "{{ generated_certs_dir }}/system.admin.jks"
  260. - name: passwd.yml
  261. path: "{{mktemp.stdout}}/passwd.yml"
  262. # services
  263. - name: Set logging-{{ es_component }}-cluster service
  264. oc_service:
  265. state: present
  266. name: "logging-{{ es_component }}-cluster"
  267. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  268. selector:
  269. component: "{{ es_component }}"
  270. provider: openshift
  271. labels:
  272. logging-infra: 'support'
  273. ports:
  274. - port: 9300
  275. - name: Set logging-{{ es_component }} service
  276. oc_service:
  277. state: present
  278. name: "logging-{{ es_component }}"
  279. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  280. selector:
  281. component: "{{ es_component }}"
  282. provider: openshift
  283. labels:
  284. logging-infra: 'support'
  285. ports:
  286. - port: 9200
  287. targetPort: "restapi"
  288. - name: Set logging-{{ es_component}}-prometheus service
  289. oc_service:
  290. state: present
  291. name: "logging-{{es_component}}-prometheus"
  292. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  293. labels:
  294. logging-infra: 'support'
  295. ports:
  296. - name: proxy
  297. port: 443
  298. targetPort: 4443
  299. selector:
  300. component: "{{ es_component }}"
  301. provider: openshift
  302. - oc_edit:
  303. kind: service
  304. name: "logging-{{es_component}}-prometheus"
  305. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  306. separator: '#'
  307. content:
  308. metadata#annotations#service.alpha.openshift.io/serving-cert-secret-name: "prometheus-tls"
  309. metadata#annotations#prometheus.io/scrape: "true"
  310. metadata#annotations#prometheus.io/scheme: "https"
  311. metadata#annotations#prometheus.io/path: "_prometheus/metrics"
  312. - name: Check to see if PVC already exists
  313. oc_obj:
  314. state: list
  315. kind: pvc
  316. name: "{{ openshift_logging_elasticsearch_pvc_name }}"
  317. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  318. register: logging_elasticsearch_pvc
  319. # logging_elasticsearch_pvc.results.results | length > 0 returns a false positive
  320. # so we check for the presence of 'stderr' to determine if the obj exists or not
  321. # the RC for existing and not existing is both 0
  322. - when:
  323. - logging_elasticsearch_pvc.results.stderr is defined
  324. - openshift_logging_elasticsearch_storage_type == "pvc"
  325. block:
  326. # storageclasses are used by default but if static then disable
  327. # storageclasses with the storageClassName set to "" in pvc.j2
  328. - name: Creating ES storage template - static
  329. template:
  330. src: "{{ __base_file_dir }}/pvc.j2"
  331. dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
  332. vars:
  333. obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
  334. size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
  335. access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
  336. pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
  337. storage_class_name: "{{ openshift_logging_elasticsearch_pvc_storage_class_name | default('', true) }}"
  338. when:
  339. - not openshift_logging_elasticsearch_pvc_dynamic | bool
  340. # Storageclasses are used by default if configured
  341. - name: Creating ES storage template - dynamic
  342. template:
  343. src: "{{ __base_file_dir }}/pvc.j2"
  344. dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
  345. vars:
  346. obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
  347. size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
  348. access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
  349. pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
  350. when:
  351. - openshift_logging_elasticsearch_pvc_dynamic | bool
  352. - name: Set ES storage
  353. oc_obj:
  354. state: present
  355. kind: pvc
  356. name: "{{ openshift_logging_elasticsearch_pvc_name }}"
  357. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  358. files:
  359. - "{{ tempdir }}/templates/logging-es-pvc.yml"
  360. delete_after: true
  361. - set_fact:
  362. es_deploy_name: "logging-{{ es_component }}-{{ openshift_logging_elasticsearch_deployment_type }}-{{ 8 | lib_utils_oo_random_word('abcdefghijklmnopqrstuvwxyz0123456789') }}"
  363. when: openshift_logging_elasticsearch_deployment_name == ""
  364. - set_fact:
  365. es_deploy_name: "{{ openshift_logging_elasticsearch_deployment_name }}"
  366. when: openshift_logging_elasticsearch_deployment_name != ""
  367. # DC
  368. - name: Set ES dc templates
  369. template:
  370. src: "{{ __base_file_dir }}/es.j2"
  371. dest: "{{ tempdir }}/templates/logging-es-dc.yml"
  372. vars:
  373. es_cluster_name: "{{ es_component }}"
  374. component: "{{ es_component }}"
  375. logging_component: elasticsearch
  376. deploy_name: "{{ es_deploy_name }}"
  377. image: "{{ openshift_logging_elasticsearch_image_prefix }}logging-elasticsearch:{{ openshift_logging_elasticsearch_image_version }}"
  378. proxy_image: "{{ openshift_logging_elasticsearch_proxy_image_prefix }}oauth-proxy:{{ openshift_logging_elasticsearch_proxy_image_version }}"
  379. es_cpu_limit: "{{ openshift_logging_elasticsearch_cpu_limit | default('') }}"
  380. es_cpu_request: "{{ openshift_logging_elasticsearch_cpu_request | min_cpu(openshift_logging_elasticsearch_cpu_limit | default(none)) }}"
  381. es_memory_limit: "{{ openshift_logging_elasticsearch_memory_limit }}"
  382. es_node_selector: "{{ openshift_logging_elasticsearch_nodeselector | default({}) }}"
  383. es_storage_groups: "{{ openshift_logging_elasticsearch_storage_group | default([]) }}"
  384. es_container_security_context: "{{ _es_containers.elasticsearch.securityContext if _es_containers is defined and 'elasticsearch' in _es_containers and 'securityContext' in _es_containers.elasticsearch else None }}"
  385. deploy_type: "{{ openshift_logging_elasticsearch_deployment_type }}"
  386. es_replicas: 1
  387. basic_auth_passwd: "{{ _logging_metrics_proxy_passwd | b64decode }}"
  388. es_number_of_shards: "{{ openshift_logging_es_number_of_shards | default(1) }}"
  389. es_number_of_replicas: "{{ openshift_logging_es_number_of_replicas| default(0) }}"
  390. - name: Set ES dc
  391. oc_obj:
  392. state: present
  393. name: "{{ es_deploy_name }}"
  394. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  395. kind: dc
  396. files:
  397. - "{{ tempdir }}/templates/logging-es-dc.yml"
  398. delete_after: true
  399. register: es_dc_creation
  400. notify: "restart elasticsearch"
  401. - set_fact:
  402. _restart_logging_components: "{{ _restart_logging_components | default([]) + [es_component] | unique }}"
  403. _restart_logging_nodes: "{{ _restart_logging_nodes | default([]) + [es_deploy_name] | unique }}"
  404. when: es_dc_creation.changed | bool
  405. - name: Retrieving the cert to use when generating secrets for the {{ es_component }} component
  406. slurp:
  407. src: "{{ generated_certs_dir }}/{{ item.file }}"
  408. register: key_pairs
  409. with_items:
  410. - { name: "ca_file", file: "ca.crt" }
  411. - { name: "es_key", file: "system.logging.es.key" }
  412. - { name: "es_cert", file: "system.logging.es.crt" }
  413. when: openshift_logging_es_allow_external | bool
  414. - set_fact:
  415. es_key: "{{ lookup('file', openshift_logging_es_key) | b64encode }}"
  416. when:
  417. - openshift_logging_es_key | trim | length > 0
  418. - openshift_logging_es_allow_external | bool
  419. changed_when: false
  420. - set_fact:
  421. es_cert: "{{ lookup('file', openshift_logging_es_cert) | b64encode }}"
  422. when:
  423. - openshift_logging_es_cert | trim | length > 0
  424. - openshift_logging_es_allow_external | bool
  425. changed_when: false
  426. - set_fact:
  427. es_ca: "{{ lookup('file', openshift_logging_es_ca_ext) | b64encode }}"
  428. when:
  429. - openshift_logging_es_ca_ext | trim | length > 0
  430. - openshift_logging_es_allow_external | bool
  431. changed_when: false
  432. - set_fact:
  433. es_ca: "{{ key_pairs | entry_from_named_pair('ca_file') }}"
  434. when:
  435. - es_ca is not defined
  436. - openshift_logging_es_allow_external | bool
  437. changed_when: false
  438. - name: Generating Elasticsearch {{ es_component }} route template
  439. template:
  440. src: "{{ __base_file_dir }}/route_reencrypt.j2"
  441. dest: "{{mktemp.stdout}}/templates/logging-{{ es_component }}-route.yaml"
  442. vars:
  443. obj_name: "logging-{{ es_component }}"
  444. route_host: "{{ openshift_logging_es_hostname }}"
  445. service_name: "logging-{{ es_component }}"
  446. tls_key: "{{ es_key | default('') | b64decode }}"
  447. tls_cert: "{{ es_cert | default('') | b64decode }}"
  448. tls_ca_cert: "{{ es_ca | b64decode }}"
  449. tls_dest_ca_cert: "{{ key_pairs | entry_from_named_pair('ca_file') | b64decode }}"
  450. edge_term_policy: "{{ openshift_logging_es_edge_term_policy | default('') }}"
  451. labels:
  452. component: support
  453. logging-infra: support
  454. provider: openshift
  455. changed_when: no
  456. when: openshift_logging_es_allow_external | bool
  457. # This currently has an issue if the host name changes
  458. - name: Setting Elasticsearch {{ es_component }} route
  459. oc_obj:
  460. state: present
  461. name: "logging-{{ es_component }}"
  462. namespace: "{{ openshift_logging_elasticsearch_namespace }}"
  463. kind: route
  464. files:
  465. - "{{ tempdir }}/templates/logging-{{ es_component }}-route.yaml"
  466. when: openshift_logging_es_allow_external | bool
  467. ## Placeholder for migration when necessary ##
  468. - name: Delete temp directory
  469. file:
  470. name: "{{ tempdir }}"
  471. state: absent
  472. changed_when: False