okd/playbooks/openshift-master/private/config.yml

---
- name: Master Install Checkpoint Start
  hosts: all
  gather_facts: false
  tasks:
  - name: Set Master install 'In Progress'
    run_once: true
    set_stats:
      data:
        installer_phase_master:
          status: "In Progress"
          start: "{{ lookup('pipe', 'date +%Y%m%d%H%M%SZ') }}"

- import_playbook: certificates.yml

- name: Disable excluders
  hosts: oo_masters_to_config
  gather_facts: no
  roles:
  - role: openshift_excluder
    r_openshift_excluder_action: disable

- name: Gather and set facts for master hosts
  hosts: oo_masters_to_config
  pre_tasks:
  # Per https://bugzilla.redhat.com/show_bug.cgi?id=1469336
  #
  # When scaling up a cluster upgraded from OCP <= 3.5, ensure that
  # OPENSHIFT_DEFAULT_REGISTRY is present as defined on the existing
  # masters, or absent if such is the case.
  - name: Detect if this host is a new master in a scale up
    set_fact:
      g_openshift_master_is_scaleup: "{{ inventory_hostname in ( groups['new_masters'] | default([]) ) }}"

  - name: Scaleup Detection
    debug:
      var: g_openshift_master_is_scaleup

  - name: Check for RPM generated config marker file .config_managed
    stat:
      path: /etc/origin/.config_managed
    register: rpmgenerated_config

  - name: Remove RPM generated config files if present
    file:
      path: "/etc/origin/{{ item }}"
      state: absent
    when:
    - rpmgenerated_config.stat.exists == true
    - openshift_deployment_type == 'openshift-enterprise'
    with_items:
    - master
    - node
    - .config_managed

  roles:
  - openshift_facts
  post_tasks:
  - openshift_facts:
      role: master
      local_facts:
        api_port: "{{ openshift_master_api_port | default(None) }}"
        api_url: "{{ openshift_master_api_url | default(None) }}"
        api_use_ssl: "{{ openshift_master_api_use_ssl | default(None) }}"
        controllers_port: "{{ openshift_master_controllers_port | default(None) }}"
        public_api_url: "{{ openshift_master_public_api_url | default(None) }}"
        cluster_hostname: "{{ openshift_master_cluster_hostname | default(None) }}"
        cluster_public_hostname: "{{ openshift_master_cluster_public_hostname | default(None) }}"
        console_path: "{{ openshift_master_console_path | default(None) }}"
        console_port: "{{ openshift_master_console_port | default(None) }}"
        console_url: "{{ openshift_master_console_url | default(None) }}"
        console_use_ssl: "{{ openshift_master_console_use_ssl | default(None) }}"
        public_console_url: "{{ openshift_master_public_console_url | default(None) }}"
        master_count: "{{ openshift_master_count | default(groups.oo_masters | length) }}"

- name: Inspect state of first master config settings
  hosts: oo_first_master
  roles:
  - role: openshift_facts
  post_tasks:
  - openshift_facts:
      role: master
      local_facts:
        session_auth_secrets: "{{ openshift_master_session_auth_secrets | default(openshift.master.session_auth_secrets | default(None)) }}"
        session_encryption_secrets: "{{ openshift_master_session_encryption_secrets | default(openshift.master.session_encryption_secrets | default(None)) }}"
  - name: Check for existing configuration
    stat:
      path: /etc/origin/master/master-config.yaml
    register: master_config_stat

  - name: Set clean install fact
    set_fact:
      l_clean_install: "{{ not master_config_stat.stat.exists | bool }}"

  - name: Determine if etcd3 storage is in use
    command: grep  -Pzo  "storage-backend:\n.*etcd3" /etc/origin/master/master-config.yaml -q
    register: etcd3_grep
    failed_when: false
    changed_when: false

  - name: Set etcd3 fact
    set_fact:
      l_etcd3_enabled: "{{ etcd3_grep.rc == 0 | bool }}"

  - name: Check if atomic-openshift-master sysconfig exists yet
    stat:
      path: /etc/sysconfig/atomic-openshift-master
    register: l_aom_exists

  - name: Preserve OPENSHIFT_DEFAULT_REGISTRY master parameter if present
    command: awk '/^OPENSHIFT_DEFAULT_REGISTRY/' /etc/sysconfig/atomic-openshift-master
    register: l_default_registry_defined
    when: l_aom_exists.stat.exists | bool

  - name: Check if atomic-openshift-master-api sysconfig exists yet
    stat:
      path: /etc/sysconfig/atomic-openshift-master-api
    register: l_aom_api_exists

  - name: Preserve OPENSHIFT_DEFAULT_REGISTRY master-api parameter if present
    command: awk '/^OPENSHIFT_DEFAULT_REGISTRY/' /etc/sysconfig/atomic-openshift-master-api
    register: l_default_registry_defined_api
    when: l_aom_api_exists.stat.exists | bool

  - name: Check if atomic-openshift-master-controllers sysconfig exists yet
    stat:
      path: /etc/sysconfig/atomic-openshift-master-controllers
    register: l_aom_controllers_exists

  - name: Preserve OPENSHIFT_DEFAULT_REGISTRY master-controllers parameter if present
    command: awk '/^OPENSHIFT_DEFAULT_REGISTRY/' /etc/sysconfig/atomic-openshift-master-controllers
    register: l_default_registry_defined_controllers
    when: l_aom_controllers_exists.stat.exists | bool

  - name: Update facts with OPENSHIFT_DEFAULT_REGISTRY value
    set_fact:
      l_default_registry_value: "{{ l_default_registry_defined.stdout | default('') }}"
      l_default_registry_value_api: "{{ l_default_registry_defined_api.stdout | default('') }}"
      l_default_registry_value_controllers: "{{ l_default_registry_defined_controllers.stdout | default('') }}"

- name: Generate master session secrets
  hosts: oo_first_master
  vars:
    g_session_secrets_present: "{{ (openshift.master.session_auth_secrets | default([])) | length > 0 and (openshift.master.session_encryption_secrets | default([])) | length > 0 }}"
    g_session_auth_secrets: "{{ [ 24 | lib_utils_oo_generate_secret ] }}"
    g_session_encryption_secrets: "{{ [ 24 | lib_utils_oo_generate_secret ] }}"
  roles:
  - role: openshift_facts
  tasks:
  - openshift_facts:
      role: master
      local_facts:
        session_auth_secrets: "{{ g_session_auth_secrets }}"
        session_encryption_secrets: "{{ g_session_encryption_secrets }}"
    when: not g_session_secrets_present | bool

- name: Configure masters
  hosts: oo_masters_to_config
  any_errors_fatal: true
  vars:
    openshift_master_count: "{{ openshift.master.master_count }}"
    openshift_master_session_auth_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_auth_secrets }}"
    openshift_master_session_encryption_secrets: "{{ hostvars[groups.oo_first_master.0].openshift.master.session_encryption_secrets }}"
    openshift_ca_host: "{{ groups.oo_first_master.0 }}"
  pre_tasks:
  - name: Prepare the bootstrap node config on masters for self-hosting
    import_role:
      name: openshift_node_group
      tasks_from: bootstrap
  # TODO: move me into a more appropriate location
  - name: Update the sysconfig for the masters to give them bootstrap config
    lineinfile:
      dest: "/etc/sysconfig/{{ openshift_service_type }}-node"
      line: "{{ item.line | default(omit) }}"
      regexp: "{{ item.regexp }}"
      state: "{{ item.state | default('present') }}"
    with_items:
    - line: "BOOTSTRAP_CONFIG_NAME={{ openshift_node_group_master | default('node-config-master') }}"
      regexp: "^BOOTSTRAP_CONFIG_NAME=.*"

  roles:
  - role: openshift_master_facts
  - role: openshift_clock
  - role: openshift_cloud_provider
    when: openshift_cloudprovider_kind is defined
  - role: openshift_builddefaults
  - role: openshift_buildoverrides
  - role: nickhammond.logrotate

  - role: openshift_control_plane
  - role: tuned
  - role: nuage_ca
    when: openshift_use_nuage | default(false) | bool
  - role: nuage_common
    when: openshift_use_nuage | default(false) | bool
  - role: nuage_master
    when: openshift_use_nuage | default(false) | bool
  - role: calico_master
    when: openshift_use_calico | default(false) | bool
  tasks:
  - name: Set up automatic node config reconcilation
    import_role:
      name: openshift_node_group
      tasks_from: sync
  - import_role:
      name: kuryr
      tasks_from: master
    when: openshift_use_kuryr | default(false) | bool

  - name: setup bootstrap settings
    include_tasks: tasks/enable_bootstrap.yml

  post_tasks:
  - name: Create group for deployment type
    group_by: key=oo_masters_deployment_type_{{ openshift_deployment_type }}
    changed_when: False

- name: Re-enable excluder if it was previously enabled
  hosts: oo_masters_to_config
  gather_facts: no
  roles:
  - role: openshift_excluder
    r_openshift_excluder_action: enable

- name: Master Install Checkpoint End
  hosts: all
  gather_facts: false
  tasks:
  - name: Set Master install 'Complete'
    run_once: true
    set_stats:
      data:
        installer_phase_master:
          status: "Complete"
          end: "{{ lookup('pipe', 'date +%Y%m%d%H%M%SZ') }}"