registry.yml 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. ---
  2. - name: Update registry certificates
  3. hosts: oo_first_master
  4. vars:
  5. tasks:
  6. - name: Create temp directory for kubeconfig
  7. command: mktemp -d /tmp/openshift-ansible-XXXXXX
  8. register: mktemp
  9. changed_when: false
  10. - name: Copy admin client config(s)
  11. command: >
  12. cp {{ openshift.common.config_base }}/master//admin.kubeconfig {{ mktemp.stdout }}/admin.kubeconfig
  13. changed_when: false
  14. - name: Determine if docker-registry exists
  15. command: >
  16. {{ openshift.common.client_binary }} get dc/docker-registry -o json
  17. --config={{ mktemp.stdout }}/admin.kubeconfig
  18. -n default
  19. register: l_docker_registry_dc
  20. failed_when: false
  21. changed_when: false
  22. - set_fact:
  23. docker_registry_env_vars: "{{ ((l_docker_registry_dc.stdout | from_json)['spec']['template']['spec']['containers'][0]['env']
  24. | oo_collect('name'))
  25. | default([]) }}"
  26. docker_registry_secrets: "{{ ((l_docker_registry_dc.stdout | from_json)['spec']['template']['spec']['volumes']
  27. | oo_collect('secret')
  28. | oo_collect('secretName'))
  29. | default([]) }}"
  30. changed_when: false
  31. when: l_docker_registry_dc.rc == 0
  32. # Replace dc/docker-registry environment variable certificate data if set.
  33. - name: Update docker-registry environment variables
  34. shell: >
  35. {{ openshift.common.client_binary }} env dc/docker-registry
  36. OPENSHIFT_CA_DATA="$(cat /etc/origin/master/ca.crt)"
  37. OPENSHIFT_CERT_DATA="$(cat /etc/origin/master/openshift-registry.crt)"
  38. OPENSHIFT_KEY_DATA="$(cat /etc/origin/master/openshift-registry.key)"
  39. --config={{ mktemp.stdout }}/admin.kubeconfig
  40. -n default
  41. when: l_docker_registry_dc.rc == 0 and 'OPENSHIFT_CA_DATA' in docker_registry_env_vars and 'OPENSHIFT_CERT_DATA' in docker_registry_env_vars and 'OPENSHIFT_KEY_DATA' in docker_registry_env_vars
  42. # Replace dc/docker-registry certificate secret contents if set.
  43. - block:
  44. - name: Retrieve registry service IP
  45. command: >
  46. {{ openshift.common.client_binary }} get service docker-registry
  47. -o jsonpath='{.spec.clusterIP}'
  48. --config={{ mktemp.stdout }}/admin.kubeconfig
  49. -n default
  50. register: docker_registry_service_ip
  51. changed_when: false
  52. - set_fact:
  53. docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift.master.default_subdomain | default('router.default.svc.cluster.local', true)) }}"
  54. changed_when: false
  55. - name: Generate registry certificate
  56. command: >
  57. {{ openshift.common.client_binary }} adm ca create-server-cert
  58. --signer-cert={{ openshift.common.config_base }}/master/ca.crt
  59. --signer-key={{ openshift.common.config_base }}/master/ca.key
  60. --signer-serial={{ openshift.common.config_base }}/master/ca.serial.txt
  61. --hostnames="{{ docker_registry_service_ip.stdout }},docker-registry.default.svc.cluster.local,{{ docker_registry_route_hostname }}"
  62. --cert={{ openshift.common.config_base }}/master/registry.crt
  63. --key={{ openshift.common.config_base }}/master/registry.key
  64. - name: Update registry certificates secret
  65. shell: >
  66. {{ openshift.common.client_binary }} secret new registry-certificates
  67. {{ openshift.common.config_base }}/master/registry.crt
  68. {{ openshift.common.config_base }}/master/registry.key
  69. --config={{ mktemp.stdout }}/admin.kubeconfig
  70. -n default
  71. -o json | oc replace -f -
  72. when: l_docker_registry_dc.rc == 0 and 'registry-certificates' in docker_registry_secrets and 'REGISTRY_HTTP_TLS_CERTIFICATE' in docker_registry_env_vars and 'REGISTRY_HTTP_TLS_KEY' in docker_registry_env_vars
  73. - name: Redeploy docker registry
  74. command: >
  75. {{ openshift.common.client_binary }} deploy dc/docker-registry
  76. --latest
  77. --config={{ mktemp.stdout }}/admin.kubeconfig
  78. -n default
  79. - name: Delete temp directory
  80. file:
  81. name: "{{ mktemp.stdout }}"
  82. state: absent
  83. changed_when: False