Revert "First run at stg OSBS for layered build system"
This reverts commit 9cd22bd47e.
This commit is contained in:
Adam Miller
parent
f064f02276
commit
17b1f48e89
25 changed files with 0 additions and 1057 deletions
|
|
@ -43,16 +43,3 @@
|
||||||
|
|
||||||
handlers:
|
handlers:
|
||||||
- include: "{{ handlers }}/restart_services.yml"
|
- include: "{{ handlers }}/restart_services.yml"
|
||||||
|
|
||||||
- name: apply common osbs configuration
|
|
||||||
hosts: osbs-stg
|
|
||||||
roles:
|
|
||||||
- osbs_common
|
|
||||||
|
|
||||||
- name: set up openshift build hosts
|
|
||||||
hosts: osbs-stg
|
|
||||||
roles:
|
|
||||||
- osbs_install_openshift_copr
|
|
||||||
|
|
||||||
# change behind_auth_proxy to true when using kerberos proxy
|
|
||||||
- { role: osbs_builder, behind_auth_proxy: false }
|
|
||||||
|
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
---
|
|
||||||
# OSBS expects the build image to be named buildroot
|
|
||||||
buildroot_tag: buildroot
|
|
||||||
|
|
||||||
# create build image from source or pull it from a registry?
|
|
||||||
# see options below
|
|
||||||
buildroot_from_source: true
|
|
||||||
|
|
||||||
## for build_buildroot_from_source=false
|
|
||||||
buildroot_pull:
|
|
||||||
registry: registry.hub.docker.com
|
|
||||||
registry_insecure: false
|
|
||||||
image: mmilata/buildroot:latest
|
|
||||||
|
|
||||||
## for build_buildroot_from_source=true
|
|
||||||
buildroot_build:
|
|
||||||
# buildroot base image source
|
|
||||||
base_registry: registry.hub.docker.com
|
|
||||||
base_registry_insecure: false
|
|
||||||
base_image: library/fedora:latest
|
|
||||||
# allow retagging the base image to match FROM in Dockerfile
|
|
||||||
base_image_retag: fedora:latest
|
|
||||||
# buildroot dockerfile source
|
|
||||||
git_url: https://github.com/mmilata/osbs-buildroot-osv3.git
|
|
||||||
git_branch: master
|
|
||||||
git_subdir: ""
|
|
||||||
git_local_path: "{{ ansible_env.HOME }}/osbs-buildroot-docker"
|
|
||||||
|
|
||||||
## docker needs to know which registries are insecure
|
|
||||||
insecure_registries: []
|
|
||||||
|
|
||||||
# is authenticating proxy in front of us? if true, do not expose openshift port
|
|
||||||
# and require users to be authenticated
|
|
||||||
# set to false for debugging
|
|
||||||
behind_auth_proxy: true
|
|
||||||
|
|
||||||
# set to false if you don't use firewalld or do not want the playbook to modify it
|
|
||||||
manage_firewall: true
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
OPTIONS="--loglevel=3"
|
|
||||||
CONFIG_FILE=/etc/openshift/master/master-config.yaml
|
|
||||||
|
|
||||||
# Proxy configuration
|
|
||||||
# OpenShift uses standard HTTP_PROXY environment variables. Be sure to set
|
|
||||||
# NO_PROXY for your master
|
|
||||||
#NO_PROXY=master.example.com
|
|
||||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
|
||||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
OPTIONS="--loglevel=3"
|
|
||||||
# /etc/openshift/node/ should contain the entire contents of
|
|
||||||
# /var/lib/openshift.local.certificates/node-${node-fqdn} generated by
|
|
||||||
# running 'openshift admin create-node-config' on your master
|
|
||||||
#
|
|
||||||
# If if your node is running on a separate host you can rsync the contents
|
|
||||||
# rsync -a root@openshift-master:/var/lib/openshift/openshift.local.certificates/node-`hostname`/ /etc/openshift/node
|
|
||||||
CONFIG_FILE=/etc/openshift/node/node-config.yaml
|
|
||||||
|
|
||||||
# The $DOCKER_NETWORK_OPTIONS variable is used by sdn plugins to set
|
|
||||||
# $DOCKER_NETWORK_OPTIONS variable in the /etc/sysconfig/docker-network
|
|
||||||
# Most plugins include their own defaults within the scripts
|
|
||||||
# TODO: More elegant solution like this
|
|
||||||
# https://github.com/coreos/flannel/blob/master/dist/mk-docker-opts.sh
|
|
||||||
# DOCKER_NETWORK_OPTIONS='-b=lbr0 --mtu=1450'
|
|
||||||
|
|
||||||
# Proxy configuration
|
|
||||||
# OpenShift uses standard HTTP_PROXY environment variables. Be sure to set
|
|
||||||
# NO_PROXY for your master
|
|
||||||
#NO_PROXY=master.example.com
|
|
||||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
|
||||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
---
|
|
||||||
- name: pull buildroot base image
|
|
||||||
command: docker pull {{ buildroot_build.base_registry }}/{{ buildroot_build.base_image }}
|
|
||||||
|
|
||||||
- name: tag buildroot base image
|
|
||||||
command: docker tag -f {{ buildroot_build.base_registry }}/{{ buildroot_build.base_image }} {{ buildroot_build.base_image_retag }}
|
|
||||||
when: buildroot_base_image_retag is defined
|
|
||||||
|
|
||||||
- name: pull build image git repository
|
|
||||||
git:
|
|
||||||
repo: "{{ buildroot_build.git_url }}"
|
|
||||||
dest: "{{ buildroot_build.git_local_path }}"
|
|
||||||
version: "{{ buildroot_build.git_branch }}"
|
|
||||||
accept_hostkey: yes
|
|
||||||
register: buildroot_git_repo
|
|
||||||
|
|
||||||
- name: build buildroot
|
|
||||||
command: docker build --no-cache=true --tag={{ buildroot_tag }} {{ buildroot_build.git_local_path }}/{{ buildroot_build.git_subdir }}
|
|
||||||
when: buildroot_git_repo.changed
|
|
||||||
|
|
@ -1,139 +0,0 @@
|
||||||
---
|
|
||||||
- name: install packages required by osbs
|
|
||||||
yum: name={{ item }} state=installed
|
|
||||||
with_items:
|
|
||||||
- bind-utils
|
|
||||||
- iptables-services
|
|
||||||
- bridge-utils
|
|
||||||
- dock
|
|
||||||
- docker
|
|
||||||
- docker-registry
|
|
||||||
|
|
||||||
### docker service ###
|
|
||||||
|
|
||||||
- name: ensure docker is running
|
|
||||||
service: name=docker state=started enabled=yes
|
|
||||||
|
|
||||||
- name: configure docker
|
|
||||||
template: src=sysconfig-docker.j2 dest=/etc/sysconfig/docker
|
|
||||||
register: docker_sysconfig
|
|
||||||
|
|
||||||
- name: restart docker after changing configuration
|
|
||||||
service: name=docker state=restarted
|
|
||||||
when: docker_sysconfig.changed
|
|
||||||
|
|
||||||
### openshift service ###
|
|
||||||
|
|
||||||
# Permanent rules aren't applied immediately. Starting with ansible 1.9,
|
|
||||||
# these two rules can be merged into one with permanent=true immediate=true.
|
|
||||||
- name: open openshift port in the firewall
|
|
||||||
firewalld: port={{ openshift_port }}/tcp state=enabled permanent={{ item }}
|
|
||||||
with_items:
|
|
||||||
- true
|
|
||||||
- false
|
|
||||||
when: not behind_auth_proxy and manage_firewall
|
|
||||||
|
|
||||||
- name: close openshift port in the firewall
|
|
||||||
firewalld: port={{ openshift_port }}/tcp state=disabled permanent={{ item }}
|
|
||||||
with_items:
|
|
||||||
- true
|
|
||||||
- false
|
|
||||||
when: behind_auth_proxy and manage_firewall
|
|
||||||
|
|
||||||
- name: modifications in /etc/sysconfig/openshift
|
|
||||||
copy: src=sysconfig-openshift-{{ item }} dest=/etc/sysconfig/openshift-{{ item }}
|
|
||||||
with_items:
|
|
||||||
- master
|
|
||||||
- node
|
|
||||||
|
|
||||||
- name: generate basic openshift configuration and certificates
|
|
||||||
command: openshift start --write-config=/etc/openshift
|
|
||||||
args:
|
|
||||||
chdir: "{{ openshift_home }}"
|
|
||||||
creates: /etc/openshift/node-{{ ansible_fqdn }}/node-config.yaml
|
|
||||||
|
|
||||||
- name: link /etc/openshift/node to actual node directory
|
|
||||||
file: path=/etc/openshift/node src=/etc/openshift/node-{{ ansible_fqdn }} force=yes state=link
|
|
||||||
|
|
||||||
- name: configure openshift master
|
|
||||||
template: src=master.yaml.j2 dest=/etc/openshift/master/master-config.yaml
|
|
||||||
register: openshift_master_config
|
|
||||||
|
|
||||||
- name: configure openshift node
|
|
||||||
template: src=node.yaml.j2 dest=/etc/openshift/node/node-config.yaml
|
|
||||||
register: openshift_node_config
|
|
||||||
|
|
||||||
- name: generate cert for authenticating proxy - self-signed certificate
|
|
||||||
command: >
|
|
||||||
openssl req -new -nodes -x509
|
|
||||||
-subj "/C=CZ/ST=SelfSigned/L=SelfSigned/O=IT/CN={{ ansible_fqdn }}"
|
|
||||||
-days 3650
|
|
||||||
-keyout {{ proxy_auth_key_file }}
|
|
||||||
-out {{ proxy_auth_cert_file }}
|
|
||||||
-extensions v3_ca
|
|
||||||
args:
|
|
||||||
creates: "{{ proxy_auth_cert_file }}"
|
|
||||||
when: behind_auth_proxy and proxy_auth_generate_selfsigned
|
|
||||||
register: auth_proxy_cert
|
|
||||||
|
|
||||||
- name: generate cert for authenticating proxy - convert privkey to rsa
|
|
||||||
command: openssl rsa -in {{ proxy_auth_key_file }} -out {{ proxy_auth_key_file }}
|
|
||||||
when: auth_proxy_cert.changed
|
|
||||||
|
|
||||||
- name: restart openshift master after changing configuration
|
|
||||||
service: name=openshift-master state=restarted
|
|
||||||
when: openshift_master_config.changed
|
|
||||||
|
|
||||||
- name: restart openshift node after changing configuration
|
|
||||||
service: name=openshift-node state=restarted
|
|
||||||
when: openshift_node_config.changed
|
|
||||||
|
|
||||||
- name: ensure openshift is running
|
|
||||||
service: name=openshift-{{ item }} state=started enabled=yes
|
|
||||||
with_items:
|
|
||||||
- master
|
|
||||||
- node
|
|
||||||
|
|
||||||
- name: wait for openshift to start accepting connections
|
|
||||||
wait_for: port={{ openshift_port }} timeout=30
|
|
||||||
|
|
||||||
# Set up authorization policy. If we are behind proxy then assign authenticated
|
|
||||||
# users the "edit" role which can start builds and watch build logs.
|
|
||||||
# If we are not (=debug), add both authenticated and unauthenticated users to
|
|
||||||
# the role.
|
|
||||||
- name: openshift auth - clear
|
|
||||||
command: osadm policy remove-role-from-group edit system:authenticated system:unauthenticated
|
|
||||||
environment: osc_environment
|
|
||||||
register: command_result
|
|
||||||
failed_when: command_result.rc != 0 and "unable to locate RoleBinding" not in command_result.stderr
|
|
||||||
|
|
||||||
- name: openshift auth - make everyone cluster admin
|
|
||||||
command: osadm policy add-role-to-group edit system:unauthenticated system:authenticated
|
|
||||||
environment: osc_environment
|
|
||||||
when: not behind_auth_proxy
|
|
||||||
|
|
||||||
- name: openshift auth - authenticated users are cluster admins
|
|
||||||
command: osadm policy add-role-to-group edit system:authenticated
|
|
||||||
environment: osc_environment
|
|
||||||
when: behind_auth_proxy
|
|
||||||
|
|
||||||
# Useful when using "osc" to inspect openshift state.
|
|
||||||
- name: add OPENSHIFTCONFIG to .bashrc
|
|
||||||
lineinfile:
|
|
||||||
dest: "{{ ansible_env.HOME }}/.bashrc"
|
|
||||||
regexp: "export OPENSHIFTCONFIG="
|
|
||||||
line: "export OPENSHIFTCONFIG={{ kubeconfig_path }}"
|
|
||||||
|
|
||||||
### buildroot image ###
|
|
||||||
|
|
||||||
- name: pull buildroot image
|
|
||||||
command: docker pull {{ buildroot_pull.registry }}/{{ buildroot_pull.image }}
|
|
||||||
register: pull_buildroot
|
|
||||||
when: not buildroot_from_source
|
|
||||||
|
|
||||||
- name: tag buildroot image
|
|
||||||
command: docker tag -f {{ buildroot_pull.registry }}/{{ buildroot_pull.image }} {{ buildroot_tag }}
|
|
||||||
when: pull_buildroot.changed
|
|
||||||
|
|
||||||
- include: buildroot_from_source.yml
|
|
||||||
when: buildroot_from_source
|
|
||||||
|
|
@ -1,127 +0,0 @@
|
||||||
apiLevels:
|
|
||||||
- v1beta3
|
|
||||||
- v1beta1
|
|
||||||
- v1
|
|
||||||
apiVersion: v1
|
|
||||||
assetConfig:
|
|
||||||
logoutURL: ""
|
|
||||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
|
||||||
publicURL: https://{{ ansible_default_ipv4.address }}:8443/console/
|
|
||||||
servingInfo:
|
|
||||||
bindAddress: 0.0.0.0:8443
|
|
||||||
certFile: master.server.crt
|
|
||||||
clientCA: ""
|
|
||||||
keyFile: master.server.key
|
|
||||||
corsAllowedOrigins:
|
|
||||||
- 127.0.0.1
|
|
||||||
- {{ ansible_default_ipv4.address }}:8443
|
|
||||||
- localhost
|
|
||||||
dnsConfig:
|
|
||||||
bindAddress: 0.0.0.0:53
|
|
||||||
etcdClientInfo:
|
|
||||||
ca: ca.crt
|
|
||||||
certFile: master.etcd-client.crt
|
|
||||||
keyFile: master.etcd-client.key
|
|
||||||
urls:
|
|
||||||
- https://{{ ansible_default_ipv4.address }}:4001
|
|
||||||
etcdConfig:
|
|
||||||
address: {{ ansible_default_ipv4.address }}:4001
|
|
||||||
peerAddress: {{ ansible_default_ipv4.address }}:7001
|
|
||||||
peerServingInfo:
|
|
||||||
bindAddress: 0.0.0.0:7001
|
|
||||||
certFile: etcd.server.crt
|
|
||||||
clientCA: ca.crt
|
|
||||||
keyFile: etcd.server.key
|
|
||||||
servingInfo:
|
|
||||||
bindAddress: 0.0.0.0:4001
|
|
||||||
certFile: etcd.server.crt
|
|
||||||
clientCA: ca.crt
|
|
||||||
keyFile: etcd.server.key
|
|
||||||
storageDirectory: /var/lib/openshift/openshift.local.etcd
|
|
||||||
etcdStorageConfig:
|
|
||||||
kubernetesStoragePrefix: kubernetes.io
|
|
||||||
kubernetesStorageVersion: v1beta3
|
|
||||||
openShiftStoragePrefix: openshift.io
|
|
||||||
openShiftStorageVersion: v1beta3
|
|
||||||
imageConfig:
|
|
||||||
format: openshift/origin-${component}:${version}
|
|
||||||
latest: false
|
|
||||||
kind: MasterConfig
|
|
||||||
kubeletClientInfo:
|
|
||||||
ca: ca.crt
|
|
||||||
certFile: master.kubelet-client.crt
|
|
||||||
keyFile: master.kubelet-client.key
|
|
||||||
port: 10250
|
|
||||||
kubernetesMasterConfig:
|
|
||||||
apiLevels:
|
|
||||||
- v1beta1
|
|
||||||
- v1beta2
|
|
||||||
- v1beta3
|
|
||||||
- v1
|
|
||||||
masterCount: 1
|
|
||||||
masterIP: {{ ansible_default_ipv4.address }}
|
|
||||||
podEvictionTimeout: 5m
|
|
||||||
schedulerConfigFile: ""
|
|
||||||
servicesSubnet: 172.30.0.0/16
|
|
||||||
staticNodeNames:
|
|
||||||
- {{ ansible_fqdn }}
|
|
||||||
masterClients:
|
|
||||||
deployerKubeConfig: openshift-deployer.kubeconfig
|
|
||||||
externalKubernetesKubeConfig: ""
|
|
||||||
openshiftLoopbackKubeConfig: openshift-client.kubeconfig
|
|
||||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
|
||||||
networkConfig:
|
|
||||||
clusterNetworkCIDR: 10.1.0.0/16
|
|
||||||
hostSubnetLength: 8
|
|
||||||
networkPluginName: ""
|
|
||||||
oauthConfig:
|
|
||||||
assetPublicURL: https://{{ ansible_default_ipv4.address }}:8443/console/
|
|
||||||
grantConfig:
|
|
||||||
method: auto
|
|
||||||
identityProviders:
|
|
||||||
{% if behind_auth_proxy %}
|
|
||||||
- name: my_request_header_provider
|
|
||||||
challenge: false
|
|
||||||
login: false
|
|
||||||
provider:
|
|
||||||
apiVersion: v1
|
|
||||||
kind: RequestHeaderIdentityProvider
|
|
||||||
clientCA: {{ proxy_auth_ca_file | default('/etc/openshift/master/ca.crt') }}
|
|
||||||
headers:
|
|
||||||
- X-Remote-User
|
|
||||||
{% else %}
|
|
||||||
- challenge: true
|
|
||||||
login: true
|
|
||||||
name: anypassword
|
|
||||||
provider:
|
|
||||||
apiVersion: v1
|
|
||||||
kind: AllowAllPasswordIdentityProvider
|
|
||||||
{% endif %}
|
|
||||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
|
||||||
masterURL: https://{{ ansible_default_ipv4.address }}:8443
|
|
||||||
sessionConfig:
|
|
||||||
sessionMaxAgeSeconds: 300
|
|
||||||
sessionName: ssn
|
|
||||||
sessionSecretsFile: ""
|
|
||||||
tokenConfig:
|
|
||||||
accessTokenMaxAgeSeconds: 86400
|
|
||||||
authorizeTokenMaxAgeSeconds: 300
|
|
||||||
policyConfig:
|
|
||||||
bootstrapPolicyFile: policy.json
|
|
||||||
openshiftSharedResourcesNamespace: openshift
|
|
||||||
projectConfig:
|
|
||||||
defaultNodeSelector: ""
|
|
||||||
projectRequestMessage: ""
|
|
||||||
projectRequestTemplate: ""
|
|
||||||
serviceAccountConfig:
|
|
||||||
managedNames:
|
|
||||||
- default
|
|
||||||
- builder
|
|
||||||
privateKeyFile: serviceaccounts.private.key
|
|
||||||
publicKeyFiles:
|
|
||||||
- serviceaccounts.public.key
|
|
||||||
servingInfo:
|
|
||||||
bindAddress: 0.0.0.0:8443
|
|
||||||
certFile: master.server.crt
|
|
||||||
clientCA: ca.crt
|
|
||||||
keyFile: master.server.key
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
allowDisabledDocker: true
|
|
||||||
apiVersion: v1
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
dnsIP: {{ ansible_default_ipv4.address }}
|
|
||||||
dockerConfig:
|
|
||||||
execHandlerName: native
|
|
||||||
imageConfig:
|
|
||||||
format: openshift/origin-${component}:${version}
|
|
||||||
latest: false
|
|
||||||
kind: NodeConfig
|
|
||||||
masterKubeConfig: node.kubeconfig
|
|
||||||
networkPluginName: ""
|
|
||||||
nodeName: {{ ansible_fqdn }}
|
|
||||||
podManifestConfig: null
|
|
||||||
servingInfo:
|
|
||||||
bindAddress: 0.0.0.0:10250
|
|
||||||
certFile: server.crt
|
|
||||||
clientCA: node-client-ca.crt
|
|
||||||
keyFile: server.key
|
|
||||||
volumeDirectory: /var/lib/openshift/openshift.local.volumes
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
# Modify these options if you want to change the way the docker daemon runs
|
|
||||||
OPTIONS='--selinux-enabled'
|
|
||||||
|
|
||||||
DOCKER_CERT_PATH=/etc/docker
|
|
||||||
|
|
||||||
# If you want to add your own registry to be used for docker search and docker pull use the
|
|
||||||
# ADD_REGISTRY option to list a set of comma separated registries.
|
|
||||||
# Note the last registry added will be the first regisry searched.
|
|
||||||
ADD_REGISTRY='--add-registry registry.access.redhat.com'
|
|
||||||
|
|
||||||
# If you want to block registries from being used, use the
|
|
||||||
# BLOCK_REGISTRY option to list a set of comma separated registries, and uncommenting
|
|
||||||
# it. For example adding docker.io will stop users from downloading images from docker.io
|
|
||||||
# BLOCK_REGISTRY='--block-registry public'
|
|
||||||
|
|
||||||
# If you have a registry secured with https but do not have proper certs destributed, you can
|
|
||||||
# tell docker to not look for full authorization by adding the registry to the
|
|
||||||
# INSECURE_REGISTRY line and uncommentin it.
|
|
||||||
INSECURE_REGISTRY='{% if buildroot_build.base_registry_insecure %}--insecure-registry {{ buildroot_build.base_registry }}{% elif buildroot_pull.registry_insecure %}--insecure--registry {{ buildroot_pull.registry }}{% endif %}{% for r in insecure_registries %} --insecure-registry {{ r }}{% endfor %}'
|
|
||||||
|
|
||||||
# On an SELinux system, if you remove the --selinux-enabled option, you
|
|
||||||
# also need to turn on the docker_transition_unconfined boolean.
|
|
||||||
# setsebool -P docker_transition_unconfined 1
|
|
||||||
|
|
||||||
# Location used for temporary files, such as those created by
|
|
||||||
# docker load and build operations. Default is /var/lib/docker/tmp
|
|
||||||
# Can be overriden by setting the following environment variable.
|
|
||||||
# DOCKER_TMPDIR=/var/tmp
|
|
||||||
|
|
||||||
# Controls the /etc/cron.daily/docker-logrotate cron job status.
|
|
||||||
# To disable, uncomment the line below.
|
|
||||||
# LOGROTATE=false
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
---
|
|
||||||
openshift_home: /var/lib/openshift
|
|
||||||
kubeconfig_path: /etc/openshift/master/admin.kubeconfig
|
|
||||||
openshift_port: 8443
|
|
||||||
|
|
||||||
osc_environment:
|
|
||||||
OPENSHIFTCONFIG: "{{ kubeconfig_path }}"
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
---
|
|
||||||
# set hostname of the machine
|
|
||||||
#hostname: example.org
|
|
||||||
|
|
||||||
# set to false if you don't use firewalld or do not want the playbook to modify it
|
|
||||||
manage_firewall: true
|
|
||||||
|
|
@ -1,34 +0,0 @@
|
||||||
---
|
|
||||||
- name: set hostname
|
|
||||||
hostname: name={{ hostname }}
|
|
||||||
when: hostname is defined
|
|
||||||
|
|
||||||
- name: install basic packages
|
|
||||||
yum: name={{ item }} state=installed
|
|
||||||
with_items:
|
|
||||||
- vim
|
|
||||||
- tmux
|
|
||||||
- wget
|
|
||||||
- git
|
|
||||||
- net-tools
|
|
||||||
- yum-utils
|
|
||||||
- tree
|
|
||||||
|
|
||||||
- name: enable rhel7 repos
|
|
||||||
command: yum-config-manager --enable {{ item }}
|
|
||||||
with_items:
|
|
||||||
- rhel-7-server-optional-rpms
|
|
||||||
- rhel-7-server-extras-rpms
|
|
||||||
when: ansible_distribution == 'RedHat' and ansible_distribution_major_version == '7'
|
|
||||||
|
|
||||||
- name: enable epel7
|
|
||||||
yum: name={{ epel7_url }} state=installed
|
|
||||||
when: ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7'
|
|
||||||
|
|
||||||
- name: install firewalld
|
|
||||||
yum: name=firewalld state=installed
|
|
||||||
when: manage_firewall
|
|
||||||
|
|
||||||
- name: enable firewalld
|
|
||||||
service: name=firewalld state=started enabled=yes
|
|
||||||
when: manage_firewall
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
---
|
|
||||||
epel7_url: http://download.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
---
|
|
||||||
openshift_version: 0.5.4
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
---
|
|
||||||
- name: copy repository file
|
|
||||||
template: src=mmilata-openshift.repo.j2 dest=/etc/yum.repos.d/mmilata-openshift.repo
|
|
||||||
|
|
||||||
- name: install openshift
|
|
||||||
yum: name={{ item }} state=installed
|
|
||||||
with_items:
|
|
||||||
- openshift-master
|
|
||||||
- openshift-node
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
[mmilata-openshift]
|
|
||||||
name=Copr repo for openshift owned by mmilata
|
|
||||||
baseurl=https://copr-be.cloud.fedoraproject.org/results/mmilata/openshift/{{ (ansible_distribution == "Fedora") | ternary("fedora", "epel") }}-{{ ansible_distribution_major_version }}-$basearch/
|
|
||||||
skip_if_unavailable=True
|
|
||||||
gpgcheck=1
|
|
||||||
gpgkey=https://copr-be.cloud.fedoraproject.org/results/mmilata/openshift/pubkey.gpg
|
|
||||||
enabled=1
|
|
||||||
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
rpmbuild_dir: "{{ ansible_env.HOME }}/rpmbuild"
|
|
||||||
openshift_commit: 17a2e840914a9e2b0c2161e9f39efc22a043dec9
|
|
||||||
openshift_archive: openshift-{{ openshift_commit }}.tar.gz
|
|
||||||
openshift_version: 0.5.2
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
---
|
|
||||||
- name: install build packages
|
|
||||||
yum: name={{ item }} state=installed
|
|
||||||
with_items:
|
|
||||||
- rpm-build
|
|
||||||
- yum-utils
|
|
||||||
- rpmdevtools
|
|
||||||
|
|
||||||
- name: delete rpmbuild directories
|
|
||||||
file: path={{ rpmbuild_dir }}/{{ item }}/ state=absent
|
|
||||||
with_items:
|
|
||||||
- RPMS
|
|
||||||
- SRPMS
|
|
||||||
- BUILD
|
|
||||||
- BUILDROOT
|
|
||||||
|
|
||||||
- name: create rpmbuild directories
|
|
||||||
file: path={{ rpmbuild_dir }}/{{ item }}/ state=directory recurse=yes
|
|
||||||
with_items:
|
|
||||||
- SPECS
|
|
||||||
- SOURCES
|
|
||||||
|
|
||||||
- name: upload SPEC
|
|
||||||
template: src=openshift.spec.j2 dest={{ rpmbuild_dir }}/SPECS/openshift.spec
|
|
||||||
|
|
||||||
- name: install build dependencies
|
|
||||||
command: yum-builddep -y {{ rpmbuild_dir }}/SPECS/openshift.spec
|
|
||||||
|
|
||||||
- name: download openshift tarball
|
|
||||||
get_url:
|
|
||||||
url: https://github.com/openshift/origin/archive/{{ openshift_commit }}/{{ openshift_archive }}
|
|
||||||
dest: "{{ rpmbuild_dir }}/SOURCES/{{ openshift_archive }}"
|
|
||||||
|
|
||||||
- name: run build
|
|
||||||
command: rpmbuild -bb --clean {{ rpmbuild_dir }}/SPECS/openshift.spec
|
|
||||||
|
|
||||||
- name: find the RPMs
|
|
||||||
command: find {{ rpmbuild_dir }}/RPMS/ -type f
|
|
||||||
register: find_rpms
|
|
||||||
|
|
||||||
- name: install the RPMs
|
|
||||||
shell: yum -y localinstall {{ rpmbuild_dir }}/RPMS/x86_64/*openshift*.rpm
|
|
||||||
|
|
@ -1,295 +0,0 @@
|
||||||
#debuginfo not supported with Go
|
|
||||||
%global debug_package %{nil}
|
|
||||||
%global gopath %{_datadir}/gocode
|
|
||||||
%global import_path github.com/openshift/origin
|
|
||||||
%global kube_plugin_path /usr/libexec/kubernetes/kubelet-plugins/net/exec/redhat~openshift-ovs-subnet
|
|
||||||
%global sdn_import_path github.com/openshift/openshift-sdn
|
|
||||||
|
|
||||||
# %commit and %ldflags are intended to be set by tito custom builders provided
|
|
||||||
# in the rel-eng directory. The values in this spec file will not be kept up to date.
|
|
||||||
%{!?commit:
|
|
||||||
%global commit {{ openshift_commit }}
|
|
||||||
}
|
|
||||||
%global shortcommit %(c=%{commit}; echo ${c:0:7})
|
|
||||||
# OpenShift specific ldflags from hack/common.sh os::build:ldflags
|
|
||||||
%{!?ldflags:
|
|
||||||
%global ldflags -X github.com/openshift/origin/pkg/version.majorFromGit 0 -X github.com/openshift/origin/pkg/version.minorFromGit 0+ -X github.com/openshift/origin/pkg/version.versionFromGit v{{ openshift_version }} -X github.com/openshift/origin/pkg/version.commitFromGit {{ openshift_commit | truncate(7, True, '') }} -X github.com/GoogleCloudPlatform/kubernetes/pkg/version.gitCommit 6241a21 -X github.com/GoogleCloudPlatform/kubernetes/pkg/version.gitVersion v0.11.0-330-g6241a21
|
|
||||||
}
|
|
||||||
|
|
||||||
Name: openshift
|
|
||||||
# Version is not kept up to date and is intended to be set by tito custom
|
|
||||||
# builders provided in the rel-eng directory of this project
|
|
||||||
Version: {{ openshift_version }}
|
|
||||||
Release: 0%{?dist}
|
|
||||||
Summary: Open Source Platform as a Service by Red Hat
|
|
||||||
License: ASL 2.0
|
|
||||||
URL: https://%{import_path}
|
|
||||||
ExclusiveArch: x86_64
|
|
||||||
Source0: https://%{import_path}/archive/%{commit}/%{name}-%{commit}.tar.gz
|
|
||||||
|
|
||||||
BuildRequires: systemd
|
|
||||||
BuildRequires: golang >= 1.2-7
|
|
||||||
#XXX upstream has golang >= 1.4 but it's not in rhel7 (yet)
|
|
||||||
|
|
||||||
|
|
||||||
%description
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package master
|
|
||||||
Summary: OpenShift Master
|
|
||||||
Requires: %{name} = %{version}-%{release}
|
|
||||||
Requires(post): systemd
|
|
||||||
Requires(preun): systemd
|
|
||||||
Requires(postun): systemd
|
|
||||||
|
|
||||||
%description master
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package node
|
|
||||||
Summary: OpenShift Node
|
|
||||||
Requires: %{name} = %{version}-%{release}
|
|
||||||
Requires: docker-io >= 1.6.0
|
|
||||||
Requires: tuned-profiles-openshift-node
|
|
||||||
Requires: util-linux
|
|
||||||
Requires: socat
|
|
||||||
Requires(post): systemd
|
|
||||||
Requires(preun): systemd
|
|
||||||
Requires(postun): systemd
|
|
||||||
|
|
||||||
%description node
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package -n tuned-profiles-openshift-node
|
|
||||||
Summary: Tuned profiles for OpenShift Node hosts
|
|
||||||
Requires: tuned >= 2.3
|
|
||||||
Requires: %{name} = %{version}-%{release}
|
|
||||||
|
|
||||||
%description -n tuned-profiles-openshift-node
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package clients
|
|
||||||
Summary: Openshift Client binaries for Linux, Mac OSX, and Windows
|
|
||||||
BuildRequires: golang-pkg-darwin-amd64
|
|
||||||
BuildRequires: golang-pkg-windows-386
|
|
||||||
|
|
||||||
%description clients
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package dockerregistry
|
|
||||||
Summary: Docker Registry v2 for OpenShift
|
|
||||||
Requires: %{name} = %{version}-%{release}
|
|
||||||
|
|
||||||
%description dockerregistry
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%package pod
|
|
||||||
Summary: OpenShift Pod
|
|
||||||
Requires: openshift = %{version}-%{release}
|
|
||||||
|
|
||||||
%description pod
|
|
||||||
%{summary}
|
|
||||||
|
|
||||||
%prep
|
|
||||||
%setup -qn origin-%{commit}
|
|
||||||
|
|
||||||
%build
|
|
||||||
|
|
||||||
# Don't judge me for this ... it's so bad.
|
|
||||||
mkdir _build
|
|
||||||
|
|
||||||
# Horrid hack because golang loves to just bundle everything
|
|
||||||
pushd _build
|
|
||||||
mkdir -p src/github.com/openshift
|
|
||||||
ln -s $(dirs +1 -l) src/%{import_path}
|
|
||||||
popd
|
|
||||||
|
|
||||||
|
|
||||||
# Gaming the GOPATH to include the third party bundled libs at build
|
|
||||||
# time. This is bad and I feel bad.
|
|
||||||
mkdir _thirdpartyhacks
|
|
||||||
pushd _thirdpartyhacks
|
|
||||||
ln -s \
|
|
||||||
$(dirs +1 -l)/Godeps/_workspace/src/ \
|
|
||||||
src
|
|
||||||
popd
|
|
||||||
export GOPATH=$(pwd)/_build:$(pwd)/_thirdpartyhacks:%{buildroot}%{gopath}:%{gopath}
|
|
||||||
# Build all linux components we care about
|
|
||||||
for cmd in openshift dockerregistry
|
|
||||||
do
|
|
||||||
go install -ldflags "%{ldflags}" %{import_path}/cmd/${cmd}
|
|
||||||
done
|
|
||||||
|
|
||||||
# Build only 'openshift' for other platforms
|
|
||||||
GOOS=windows GOARCH=386 go install -ldflags "%{ldflags}" %{import_path}/cmd/openshift
|
|
||||||
GOOS=darwin GOARCH=amd64 go install -ldflags "%{ldflags}" %{import_path}/cmd/openshift
|
|
||||||
|
|
||||||
#Build our pod
|
|
||||||
pushd images/pod/
|
|
||||||
go build -ldflags "%{ldflags}" pod.go
|
|
||||||
popd
|
|
||||||
|
|
||||||
%install
|
|
||||||
|
|
||||||
install -d %{buildroot}%{_bindir}
|
|
||||||
install -d %{buildroot}%{_datadir}/%{name}/{linux,macosx,windows}
|
|
||||||
|
|
||||||
# Install linux components
|
|
||||||
for bin in openshift dockerregistry
|
|
||||||
do
|
|
||||||
echo "+++ INSTALLING ${bin}"
|
|
||||||
install -p -m 755 _build/bin/${bin} %{buildroot}%{_bindir}/${bin}
|
|
||||||
done
|
|
||||||
# Install 'openshift' as client executable for windows and mac
|
|
||||||
install -p -m 755 _build/bin/openshift %{buildroot}%{_datadir}/%{name}/linux/osc
|
|
||||||
install -p -m 755 _build/bin/darwin_amd64/openshift %{buildroot}%{_datadir}/%{name}/macosx/osc
|
|
||||||
install -p -m 755 _build/bin/windows_386/openshift.exe %{buildroot}%{_datadir}/%{name}/windows/osc.exe
|
|
||||||
#Install openshift pod
|
|
||||||
install -p -m 755 images/pod/pod %{buildroot}%{_bindir}/
|
|
||||||
|
|
||||||
install -d -m 0755 %{buildroot}/etc/%{name}/{master,node}
|
|
||||||
install -d -m 0755 %{buildroot}%{_unitdir}
|
|
||||||
install -m 0644 -t %{buildroot}%{_unitdir} rel-eng/openshift-master.service
|
|
||||||
install -m 0644 -t %{buildroot}%{_unitdir} rel-eng/openshift-node.service
|
|
||||||
|
|
||||||
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
|
|
||||||
install -m 0644 rel-eng/openshift-master.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/openshift-master
|
|
||||||
install -m 0644 rel-eng/openshift-node.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/openshift-node
|
|
||||||
|
|
||||||
mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
|
|
||||||
|
|
||||||
ln -s %{_bindir}/openshift %{buildroot}%{_bindir}/osc
|
|
||||||
ln -s %{_bindir}/openshift %{buildroot}%{_bindir}/osadm
|
|
||||||
|
|
||||||
install -d -m 0755 %{buildroot}%{_prefix}/lib/tuned/openshift-node-{guest,host}
|
|
||||||
install -m 0644 tuned/openshift-node-guest/tuned.conf %{buildroot}%{_prefix}/lib/tuned/openshift-node-guest/
|
|
||||||
install -m 0644 tuned/openshift-node-host/tuned.conf %{buildroot}%{_prefix}/lib/tuned/openshift-node-host/
|
|
||||||
install -d -m 0755 %{buildroot}%{_mandir}/man7
|
|
||||||
install -m 0644 tuned/man/tuned-profiles-openshift-node.7 %{buildroot}%{_mandir}/man7/tuned-profiles-openshift-node.7
|
|
||||||
|
|
||||||
# Install sdn scripts for node subpackage
|
|
||||||
install -d -m 0755 %{buildroot}%{kube_plugin_path}
|
|
||||||
pushd _thirdpartyhacks/src/%{sdn_import_path}/ovssubnet/bin
|
|
||||||
install -p -m 755 openshift-ovs-subnet %{buildroot}%{kube_plugin_path}/openshift-ovs-subnet
|
|
||||||
install -p -m 755 openshift-sdn-kube-subnet-setup.sh %{buildroot}%{_bindir}/
|
|
||||||
install -p -m 755 openshift-sdn-simple-setup-node.sh %{buildroot}%{_bindir}/
|
|
||||||
popd
|
|
||||||
|
|
||||||
%files
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%doc README.md LICENSE
|
|
||||||
%{_bindir}/openshift
|
|
||||||
%{_bindir}/osc
|
|
||||||
%{_bindir}/osadm
|
|
||||||
%{_sharedstatedir}/%{name}
|
|
||||||
|
|
||||||
%files master
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_unitdir}/openshift-master.service
|
|
||||||
%config(noreplace) %{_sysconfdir}/sysconfig/openshift-master
|
|
||||||
%config(noreplace) /etc/%{name}/master
|
|
||||||
|
|
||||||
%post master
|
|
||||||
%systemd_post %{basename:openshift-master.service}
|
|
||||||
|
|
||||||
%preun master
|
|
||||||
%systemd_preun %{basename:openshift-master.service}
|
|
||||||
|
|
||||||
%postun master
|
|
||||||
%systemd_postun
|
|
||||||
|
|
||||||
|
|
||||||
%files node
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_unitdir}/openshift-node.service
|
|
||||||
%config(noreplace) %{_sysconfdir}/sysconfig/openshift-node
|
|
||||||
%config(noreplace) /etc/%{name}/node
|
|
||||||
%{_bindir}/openshift-sdn-simple-setup-node.sh
|
|
||||||
%{_bindir}/openshift-sdn-kube-subnet-setup.sh
|
|
||||||
%{kube_plugin_path}/openshift-ovs-subnet
|
|
||||||
|
|
||||||
%post node
|
|
||||||
%systemd_post %{basename:openshift-node.service}
|
|
||||||
|
|
||||||
%preun node
|
|
||||||
%systemd_preun %{basename:openshift-node.service}
|
|
||||||
|
|
||||||
%postun node
|
|
||||||
%systemd_postun
|
|
||||||
|
|
||||||
%files -n tuned-profiles-openshift-node
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_prefix}/lib/tuned/openshift-node-host
|
|
||||||
%{_prefix}/lib/tuned/openshift-node-guest
|
|
||||||
%{_mandir}/man7/tuned-profiles-openshift-node.7*
|
|
||||||
|
|
||||||
%post -n tuned-profiles-openshift-node
|
|
||||||
recommended=`/usr/sbin/tuned-adm recommend`
|
|
||||||
if [[ "${recommended}" =~ guest ]] ; then
|
|
||||||
/usr/sbin/tuned-adm profile openshift-node-guest > /dev/null 2>&1
|
|
||||||
else
|
|
||||||
/usr/sbin/tuned-adm profile openshift-node-host > /dev/null 2>&1
|
|
||||||
fi
|
|
||||||
|
|
||||||
%preun -n tuned-profiles-openshift-node
|
|
||||||
# reset the tuned profile to the recommended profile
|
|
||||||
# $1 = 0 when we're being removed > 0 during upgrades
|
|
||||||
if [ "$1" = 0 ]; then
|
|
||||||
recommended=`/usr/sbin/tuned-adm recommend`
|
|
||||||
/usr/sbin/tuned-adm profile $recommended > /dev/null 2>&1
|
|
||||||
fi
|
|
||||||
|
|
||||||
%files clients
|
|
||||||
%{_datadir}/%{name}/linux/osc
|
|
||||||
%{_datadir}/%{name}/macosx/osc
|
|
||||||
%{_datadir}/%{name}/windows/osc.exe
|
|
||||||
|
|
||||||
%files dockerregistry
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_bindir}/dockerregistry
|
|
||||||
|
|
||||||
%files pod
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_bindir}/pod
|
|
||||||
|
|
||||||
%changelog
|
|
||||||
* Mon Jan 26 2015 Scott Dodson <sdodson@redhat.com> 0.2-3
|
|
||||||
- Update to 21fb40637c4e3507cca1fcab6c4d56b06950a149
|
|
||||||
- Split packaging of openshift-master and openshift-node
|
|
||||||
|
|
||||||
* Mon Jan 19 2015 Scott Dodson <sdodson@redhat.com> 0.2-2
|
|
||||||
- new package built with tito
|
|
||||||
|
|
||||||
* Fri Jan 09 2015 Adam Miller <admiller@redhat.com> - 0.2-2
|
|
||||||
- Add symlink for osc command line tooling (merged in from jhonce@redhat.com)
|
|
||||||
|
|
||||||
* Wed Jan 07 2015 Adam Miller <admiller@redhat.com> - 0.2-1
|
|
||||||
- Update to latest upstream release
|
|
||||||
- Restructured some of the golang deps build setup for restructuring done
|
|
||||||
upstream
|
|
||||||
|
|
||||||
* Thu Oct 23 2014 Adam Miller <admiller@redhat.com> - 0-0.0.9.git562842e
|
|
||||||
- Add new patches from jhonce for systemd units
|
|
||||||
|
|
||||||
* Mon Oct 20 2014 Adam Miller <admiller@redhat.com> - 0-0.0.8.git562842e
|
|
||||||
- Update to latest master snapshot
|
|
||||||
|
|
||||||
* Wed Oct 15 2014 Adam Miller <admiller@redhat.com> - 0-0.0.7.git7872f0f
|
|
||||||
- Update to latest master snapshot
|
|
||||||
|
|
||||||
* Fri Oct 03 2014 Adam Miller <admiller@redhat.com> - 0-0.0.6.gite4d4ecf
|
|
||||||
- Update to latest Alpha nightly build tag 20141003
|
|
||||||
|
|
||||||
* Wed Oct 01 2014 Adam Miller <admiller@redhat.com> - 0-0.0.5.git6d9f1a9
|
|
||||||
- Switch to consistent naming, patch by jhonce
|
|
||||||
|
|
||||||
* Tue Sep 30 2014 Adam Miller <admiller@redhat.com> - 0-0.0.4.git6d9f1a9
|
|
||||||
- Add systemd and sysconfig entries from jhonce
|
|
||||||
|
|
||||||
* Tue Sep 23 2014 Adam Miller <admiller@redhat.com> - 0-0.0.3.git6d9f1a9
|
|
||||||
- Update to latest upstream.
|
|
||||||
|
|
||||||
* Mon Sep 15 2014 Adam Miller <admiller@redhat.com> - 0-0.0.2.git2647df5
|
|
||||||
- Update to latest upstream.
|
|
||||||
|
|
||||||
* Thu Aug 14 2014 Adam Miller <admiller@redhat.com> - 0-0.0.1.gitc3839b8
|
|
||||||
- First package
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
---
|
|
||||||
# generate self-signed certificates? useful for debugging
|
|
||||||
ssl_generate_selfsigned: false
|
|
||||||
|
|
||||||
ssl_cert_file: /etc/pki/tls/certs/{{ ansible_fqdn }}.crt
|
|
||||||
ssl_key_file: /etc/pki/tls/private/{{ ansible_fqdn }}.key
|
|
||||||
ssl_client_certkey_file: /etc/httpd/krbproxy_certkey.crt
|
|
||||||
ssl_client_ca_file: /etc/httpd/krbproxy_ca.crt
|
|
||||||
|
|
||||||
proxy_port: 9443
|
|
||||||
proxy_dest_url: https://127.0.0.1:8443/
|
|
||||||
proxy_authname: Kerberos Authentication
|
|
||||||
|
|
||||||
# used for mutually authenticating the proxy and the proxied machine
|
|
||||||
# no authentication happens when unset
|
|
||||||
#proxy_machine_ca_file: /var/lib/openshift/openshift.local.certificates/ca/cert.crt
|
|
||||||
#proxy_machine_cert_file: /var/lib/openshift/openshift.local.certificates/openshift-client/cert.crt
|
|
||||||
#proxy_machine_key_file: /var/lib/openshift/openshift.local.certificates/openshift-client/key.key
|
|
||||||
|
|
||||||
# if no ticket is supplied, fall back to basic authentication by login+password
|
|
||||||
# (through kerberos)
|
|
||||||
proxy_enable_password_login: false
|
|
||||||
|
|
||||||
proxy_secrets_owner: apache
|
|
||||||
proxy_secrets_group: root
|
|
||||||
proxy_secrets_perms: "0600"
|
|
||||||
|
|
||||||
krb_keytab_file: /etc/httpd/HTTP-{{ ansible_fqdn }}.keytab
|
|
||||||
|
|
||||||
kerberos_client_realm_name: EXAMPLE.COM
|
|
||||||
kerberos_client_kdc_hostname: kerberos
|
|
||||||
kerberos_client_admin_hostname: kerberos
|
|
||||||
kerberos_client_dns_lookup_realm: false
|
|
||||||
kerberos_client_dns_lookup_kdc: false
|
|
||||||
kerberos_client_ticket_lifetime: 24h
|
|
||||||
kerberos_client_renew_lifetime: 7d
|
|
||||||
kerberos_client_forwardable: true
|
|
||||||
|
|
||||||
# extra verbose httpd logs?
|
|
||||||
proxy_debug: false
|
|
||||||
|
|
||||||
# set to false if you don't use firewalld or do not want the playbook to modify it
|
|
||||||
manage_firewall: true
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
---
|
|
||||||
- name: restart httpd
|
|
||||||
service: name=httpd state=restarted
|
|
||||||
|
|
@ -1,89 +0,0 @@
|
||||||
---
|
|
||||||
- name: ensure required packages are installed
|
|
||||||
yum: name={{ item }} state=present
|
|
||||||
with_items:
|
|
||||||
# kerberos
|
|
||||||
- krb5-workstation
|
|
||||||
# httpd
|
|
||||||
- httpd
|
|
||||||
- mod_ssl
|
|
||||||
- mod_auth_kerb
|
|
||||||
# selinux
|
|
||||||
- policycoreutils-python
|
|
||||||
|
|
||||||
# Based on https://github.com/bennojoy/kerberos_client
|
|
||||||
# BSD licensed
|
|
||||||
- name: configure kerberos client
|
|
||||||
template: src=krb5.conf.j2 dest=/etc/krb5.conf
|
|
||||||
|
|
||||||
- name: generate self-signed certificate
|
|
||||||
command: >
|
|
||||||
openssl req -new -nodes -x509
|
|
||||||
-subj "/C=CZ/ST=SelfSigned/L=SelfSigned/O=IT/CN={{ ansible_fqdn }}"
|
|
||||||
-days 3650
|
|
||||||
-keyout {{ ssl_key_file }}
|
|
||||||
-out {{ ssl_cert_file }}
|
|
||||||
-extensions v3_ca
|
|
||||||
args:
|
|
||||||
creates: "{{ ssl_cert_file }}"
|
|
||||||
when: ssl_generate_selfsigned
|
|
||||||
notify:
|
|
||||||
- restart httpd
|
|
||||||
|
|
||||||
# TODO: The private key is world readable after it is generated but before this task finishes.
|
|
||||||
# We should use umask/private directory to protect it.
|
|
||||||
- name: set permissions on private key
|
|
||||||
file:
|
|
||||||
path: "{{ ssl_key_file }}"
|
|
||||||
state: file
|
|
||||||
owner: "{{ proxy_secrets_owner }}"
|
|
||||||
group: "{{ proxy_secrets_group }}"
|
|
||||||
mode: "{{ proxy_secrets_perms }}"
|
|
||||||
|
|
||||||
- name: create proxy client cert+key file
|
|
||||||
shell: cat {{ proxy_machine_cert_file }} {{ proxy_machine_key_file}} > {{ ssl_client_certkey_file }}
|
|
||||||
when: proxy_machine_cert_file is defined
|
|
||||||
register: certkey_file
|
|
||||||
notify:
|
|
||||||
- restart httpd
|
|
||||||
|
|
||||||
- name: set permissions on client cert+key
|
|
||||||
file:
|
|
||||||
path: "{{ ssl_client_certkey_file }}"
|
|
||||||
state: file
|
|
||||||
owner: "{{ proxy_secrets_owner }}"
|
|
||||||
group: "{{ proxy_secrets_group }}"
|
|
||||||
mode: "{{ proxy_secrets_perms }}"
|
|
||||||
when: certkey_file.changed
|
|
||||||
|
|
||||||
- name: copy client CA file
|
|
||||||
command: cp {{ proxy_machine_ca_file }} {{ ssl_client_ca_file }}
|
|
||||||
when: proxy_machine_ca_file is defined
|
|
||||||
|
|
||||||
- name: set permissions on kerberos keytab
|
|
||||||
file:
|
|
||||||
path: "{{ krb_keytab_file }}"
|
|
||||||
state: file
|
|
||||||
owner: "{{ proxy_secrets_owner }}"
|
|
||||||
group: "{{ proxy_secrets_group }}"
|
|
||||||
mode: "{{ proxy_secrets_perms }}"
|
|
||||||
|
|
||||||
- name: configure httpd
|
|
||||||
template: src=httpd-krbproxy.conf.j2 dest=/etc/httpd/conf.d/krbproxy.conf
|
|
||||||
notify:
|
|
||||||
- restart httpd
|
|
||||||
|
|
||||||
- name: allow proxy port in selinux
|
|
||||||
shell: semanage port -a -t http_port_t -p tcp {{ proxy_port }} || true
|
|
||||||
|
|
||||||
# Permanent rules aren't applied immediately. Starting with ansible 1.9,
|
|
||||||
# this ugliness can be replaced with permanent=true immediate=true.
|
|
||||||
- name: open required ports in the firewall
|
|
||||||
firewalld: port={{ proxy_port }}/tcp state=enabled permanent={{ item }}
|
|
||||||
with_items:
|
|
||||||
- true
|
|
||||||
- false
|
|
||||||
when: manage_firewall
|
|
||||||
|
|
||||||
- name: ensure httpd is running
|
|
||||||
service: name=httpd state=started enabled=yes
|
|
||||||
|
|
@ -1,68 +0,0 @@
|
||||||
ServerName {{ ansible_fqdn }}
|
|
||||||
ProxyRequests Off
|
|
||||||
Listen {{ proxy_port }}
|
|
||||||
|
|
||||||
{% if proxy_debug %}
|
|
||||||
## debugging
|
|
||||||
## in prod we should decrease verbosity
|
|
||||||
# DumpIOInput On
|
|
||||||
# DumpIOOutput On
|
|
||||||
LogLevel Debug
|
|
||||||
# LogLevel dumpio:trace7
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
<VirtualHost *:{{ proxy_port }}>
|
|
||||||
DocumentRoot /var/www/html
|
|
||||||
|
|
||||||
SSLEngine on
|
|
||||||
SSLCertificateFile {{ ssl_cert_file }}
|
|
||||||
SSLCertificateKeyFile {{ ssl_key_file }}
|
|
||||||
|
|
||||||
SSLProxyEngine On
|
|
||||||
{% if proxy_machine_ca_file is defined %}
|
|
||||||
SSLProxyCACertificateFile {{ ssl_client_ca_file }}
|
|
||||||
{% endif %}
|
|
||||||
{% if proxy_machine_cert_file is defined %}
|
|
||||||
SSLProxyMachineCertificateFile {{ ssl_client_certkey_file }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
SetEnv proxy-sendchunked 1
|
|
||||||
ProxyRequests Off
|
|
||||||
<Location "/">
|
|
||||||
ProxyPass {{ proxy_dest_url }} connectiontimeout=30 timeout=300
|
|
||||||
ProxyPassReverse {{ proxy_dest_url }}
|
|
||||||
</Location>
|
|
||||||
|
|
||||||
# don't auth /oauth/token/request and /oauth/token/display
|
|
||||||
<ProxyMatch /oauth/token/.*>
|
|
||||||
Require all granted
|
|
||||||
</ProxyMatch>
|
|
||||||
|
|
||||||
# /oauth/authorize and /oauth/approve should be protected by Apache.
|
|
||||||
<ProxyMatch /oauth/a.*>
|
|
||||||
<If "-R '{{ ansible_default_ipv4.address }}' || -R '{{ docker_network }}'">
|
|
||||||
Require all granted
|
|
||||||
RequestHeader set X-Remote-User {{ ansible_hostname }}
|
|
||||||
</If>
|
|
||||||
<Else>
|
|
||||||
AuthType Kerberos
|
|
||||||
AuthName "{{ proxy_authname }}"
|
|
||||||
KrbMethodNegotiate on
|
|
||||||
KrbMethodK5Passwd {{ 'on' if proxy_enable_password_login else 'off' }}
|
|
||||||
KrbServiceName Any
|
|
||||||
KrbAuthRealms {{ kerberos_client_realm_name }}
|
|
||||||
Krb5Keytab {{ krb_keytab_file }}
|
|
||||||
Require valid-user
|
|
||||||
RequestHeader set X-Remote-User %{REMOTE_USER}s
|
|
||||||
</Else>
|
|
||||||
RequestHeader unset Authorization
|
|
||||||
RequestHeader unset WWW-Authenticate
|
|
||||||
</ProxyMatch>
|
|
||||||
|
|
||||||
# All other requests should use Bearer tokens. These can only be verified by
|
|
||||||
# OpenShift so we need to let these requests pass through.
|
|
||||||
<ProxyMatch ^/oauth/>
|
|
||||||
SetEnvIfNoCase Authorization Bearer passthrough
|
|
||||||
Require env passthrough
|
|
||||||
</ProxyMatch>
|
|
||||||
</VirtualHost>
|
|
||||||
|
|
@ -1,23 +0,0 @@
|
||||||
[logging]
|
|
||||||
default = FILE:/var/log/krb5libs.log
|
|
||||||
kdc = FILE:/var/log/krb5kdc.log
|
|
||||||
admin_server = FILE:/var/log/kadmind.log
|
|
||||||
|
|
||||||
[libdefaults]
|
|
||||||
default_realm = {{ kerberos_client_realm_name|upper() }}
|
|
||||||
dns_lookup_realm = {{ kerberos_client_dns_lookup_realm }}
|
|
||||||
dns_lookup_kdc = {{ kerberos_client_dns_lookup_kdc }}
|
|
||||||
ticket_lifetime = {{ kerberos_client_ticket_lifetime }}
|
|
||||||
renew_lifetime = {{ kerberos_client_renew_lifetime }}
|
|
||||||
forwardable = {{ kerberos_client_forwardable }}
|
|
||||||
|
|
||||||
[realms]
|
|
||||||
{{ kerberos_client_realm_name|upper() }} = {
|
|
||||||
kdc = {{ kerberos_client_kdc_hostname }}.{{ kerberos_client_realm_name|lower() }}
|
|
||||||
admin_server = {{ kerberos_client_admin_hostname }}.{{ kerberos_client_realm_name|lower() }}
|
|
||||||
}
|
|
||||||
|
|
||||||
[domain_realm]
|
|
||||||
.{{ kerberos_client_realm_name|lower() }} = {{ kerberos_client_realm_name|upper() }}
|
|
||||||
{{ kerberos_client_realm_name|lower() }} = {{ kerberos_client_realm_name|upper() }}
|
|
||||||
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
---
|
|
||||||
docker_network: 172.17.42.1/16
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue