remove old/unused OSBS roles now that osbs-cluster is in prod
Signed-off-by: Adam Miller <admiller@redhat.com>
This commit is contained in:
Adam Miller
parent
e50b79325f
commit
c438796add
34 changed files with 0 additions and 1658 deletions
|
|
@ -1,58 +0,0 @@
|
|||
install-openshift
|
||||
=================
|
||||
|
||||
Installs OpenShift v3 from various sources. Currently supports installing RPM
|
||||
from COPR and building and installing the RPM from source code.
|
||||
|
||||
This role is part of
|
||||
[ansible-osbs](https://github.com/projectatomic/ansible-osbs/) playbook for
|
||||
deploying OpenShift build service. Please refer to that github repository for
|
||||
[documentation](https://github.com/projectatomic/ansible-osbs/blob/master/README.md)
|
||||
and [issue tracker](https://github.com/projectatomic/ansible-osbs/issues).
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
You need to specify which method of installation you want to use. Valid options
|
||||
are `copr` (default) and `source`.
|
||||
|
||||
install_openshift_method: copr
|
||||
|
||||
You must specify particular version that should be installed from the COPR.
|
||||
Can be in either `version` or `version-release` format.
|
||||
|
||||
install_openshift_copr_version: 1.0.5
|
||||
|
||||
When building from source, you need to specify the version of the built package.
|
||||
|
||||
install_openshift_source_version: 1.0.5
|
||||
|
||||
Git commit to build packages from.
|
||||
|
||||
install_openshift_source_commit: c66613fded194b10ce4e4e1c473fbfc0a511405b
|
||||
|
||||
File name of the tarball to be downloaded from github.
|
||||
|
||||
install_openshift_source_archive: openshift-{{ install_openshift_source_commit }}.tar.gz
|
||||
|
||||
Directory for rpmbuild.
|
||||
|
||||
install_openshift_source_rpmbuild_dir: "{{ ansible_env.HOME }}/rpmbuild"
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
- hosts: builders
|
||||
roles:
|
||||
- role: install-openshift
|
||||
install_openshift_method: copr
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
BSD
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
Martin Milata <mmilata@redhat.com>
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
---
|
||||
# methods: copr, source, fedora
|
||||
install_openshift_method: fedora
|
||||
|
||||
# copr-specific variables
|
||||
|
||||
# specify particular version that should be installed from copr
|
||||
# can be either VERSION or VERSION-RELEASE
|
||||
install_openshift_copr_version: 1.0.8
|
||||
|
||||
# variables for source build
|
||||
|
||||
# version of the built package
|
||||
install_openshift_source_version: 1.0.5
|
||||
|
||||
# git commit to build package from
|
||||
install_openshift_source_commit: c66613fded194b10ce4e4e1c473fbfc0a511405b
|
||||
|
||||
# name of the tarball to download from github
|
||||
install_openshift_source_archive: openshift-{{ install_openshift_source_commit }}.tar.gz
|
||||
|
||||
# rpmbuild directory
|
||||
install_openshift_source_rpmbuild_dir: "{{ ansible_env.HOME }}/rpmbuild"
|
||||
|
||||
# update package from copr to the latest version?
|
||||
osbs_update_packages: false
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
[maxamillion-fedora-openshift]
|
||||
name=Copr repo for fedora-openshift owned by maxamillion
|
||||
baseurl=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/epel-7-$basearch/
|
||||
skip_if_unavailable=True
|
||||
gpgcheck=1
|
||||
gpgkey=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/pubkey.gpg
|
||||
enabled=1
|
||||
enabled_metadata=1
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
[maxamillion-fedora-openshift]
|
||||
name=Copr repo for fedora-openshift owned by maxamillion
|
||||
baseurl=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/fedora-$releasever-$basearch/
|
||||
skip_if_unavailable=True
|
||||
gpgcheck=1
|
||||
gpgkey=https://copr-be.cloud.fedoraproject.org/results/maxamillion/fedora-openshift/pubkey.gpg
|
||||
enabled=1
|
||||
enabled_metadata=1
|
||||
|
|
@ -1 +0,0 @@
|
|||
{install_date: 'Thu Jan 7 17:30:46 2016', version: master}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
---
|
||||
galaxy_info:
|
||||
author: Martin Milata
|
||||
description: Install OpenShift v3 from various sources
|
||||
company: Red Hat
|
||||
issue_tracker_url: https://github.com/projectatomic/ansible-osbs/issues
|
||||
license: BSD
|
||||
min_ansible_version: 1.2
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- 7
|
||||
- name: Fedora
|
||||
versions:
|
||||
- 21
|
||||
- 22
|
||||
categories:
|
||||
- cloud
|
||||
- development
|
||||
- packaging
|
||||
dependencies: []
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
---
|
||||
- include: method_fedora.yml
|
||||
when: install_openshift_method == 'fedora'
|
||||
|
||||
- include: method_copr.yml
|
||||
when: install_openshift_method == 'copr'
|
||||
|
||||
- include: method_source.yml
|
||||
when: install_openshift_method == 'source'
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
---
|
||||
- name: setup repository
|
||||
copy:
|
||||
src: maxamillion-fedora-openshift.repo
|
||||
dest: /etc/yum.repos.d/maxamillion-fedora-openshift.repo
|
||||
when: is_fedora is defined
|
||||
|
||||
- name: setup repository
|
||||
copy:
|
||||
src: maxamillion-epel-openshift.repo
|
||||
dest: /etc/yum.repos.d/maxamillion-epel-openshift.repo
|
||||
when: is_rhel is defined
|
||||
|
||||
- name: install openshift
|
||||
action: "{{ ansible_pkg_mgr }} name={{ item }} state={{ osbs_update_packages | ternary('latest', 'present') }}"
|
||||
with_items:
|
||||
- origin-master
|
||||
- origin-node
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
---
|
||||
- name: install openshift
|
||||
action: "{{ ansible_pkg_mgr }} name={{ item }} state={{ osbs_update_packages | ternary('latest', 'present') }}"
|
||||
with_items:
|
||||
- origin-master
|
||||
- origin-node
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
---
|
||||
- name: install build packages
|
||||
action: "{{ ansible_pkg_mgr }} name={{ item }} state=installed"
|
||||
with_items:
|
||||
- rpm-build
|
||||
- rpmdevtools
|
||||
|
||||
- name: install build packages
|
||||
yum: name=yum-utils state=installed
|
||||
when: ansible_pkg_mgr == "yum"
|
||||
|
||||
- name: delete rpmbuild directories
|
||||
file: path={{ install_openshift_source_rpmbuild_dir }}/{{ item }}/ state=absent
|
||||
with_items:
|
||||
- RPMS
|
||||
- SRPMS
|
||||
- BUILD
|
||||
- BUILDROOT
|
||||
|
||||
- name: create rpmbuild directories
|
||||
file: path={{ install_openshift_source_rpmbuild_dir }}/{{ item }}/ state=directory recurse=yes
|
||||
with_items:
|
||||
- SPECS
|
||||
- SOURCES
|
||||
|
||||
- name: upload SPEC
|
||||
template: src=openshift.spec.j2 dest={{ install_openshift_source_rpmbuild_dir }}/SPECS/openshift.spec
|
||||
|
||||
- name: install build dependencies
|
||||
command: yum-builddep -y {{ install_openshift_source_rpmbuild_dir }}/SPECS/openshift.spec
|
||||
when: ansible_pkg_mgr == "yum"
|
||||
|
||||
- name: install build dependencies
|
||||
command: dnf builddep -y {{ install_openshift_source_rpmbuild_dir }}/SPECS/openshift.spec
|
||||
when: ansible_pkg_mgr == "dnf"
|
||||
|
||||
- name: download openshift tarball
|
||||
get_url:
|
||||
url: https://github.com/openshift/origin/archive/{{ install_openshift_source_commit }}/{{ install_openshift_source_archive }}
|
||||
dest: "{{ install_openshift_source_rpmbuild_dir }}/SOURCES/{{ install_openshift_source_archive }}"
|
||||
|
||||
- name: run build
|
||||
command: rpmbuild -bb --clean {{ install_openshift_source_rpmbuild_dir }}/SPECS/openshift.spec
|
||||
|
||||
- name: find the RPMs
|
||||
command: find {{ install_openshift_source_rpmbuild_dir }}/RPMS/ -type f
|
||||
register: find_rpms
|
||||
|
||||
- name: install the RPMs
|
||||
shell: yum -y localinstall {{ install_openshift_source_rpmbuild_dir }}/RPMS/x86_64/*openshift*.rpm
|
||||
when: ansible_pkg_mgr == "yum"
|
||||
|
||||
- name: install the RPMs
|
||||
shell: dnf -y install {{ install_openshift_source_rpmbuild_dir }}/RPMS/x86_64/*openshift*.rpm
|
||||
when: ansible_pkg_mgr == "dnf"
|
||||
|
||||
- name: link /etc/openshift to /etc/origin
|
||||
file: path=/etc/openshift src=/etc/origin state=link
|
||||
|
|
@ -1,337 +0,0 @@
|
|||
#debuginfo not supported with Go
|
||||
%global debug_package %{nil}
|
||||
%global gopath %{_datadir}/gocode
|
||||
%global import_path github.com/openshift/origin
|
||||
%global kube_plugin_path /usr/libexec/kubernetes/kubelet-plugins/net/exec/redhat~openshift-ovs-subnet
|
||||
%global sdn_import_path github.com/openshift/openshift-sdn
|
||||
|
||||
# docker_version is the version of docker requires by packages
|
||||
%global docker_verison 1.6.2
|
||||
# tuned_version is the version of tuned requires by packages
|
||||
%global tuned_version 2.3
|
||||
# openvswitch_version is the version of openvswitch requires by packages
|
||||
%global openvswitch_version 2.3.1
|
||||
# %commit and %ldflags are intended to be set by tito custom builders provided
|
||||
# in the rel-eng directory. The values in this spec file will not be kept up to date.
|
||||
%{!?commit:
|
||||
%global commit {{ openshift_commit }}
|
||||
}
|
||||
%global shortcommit %(c=%{commit}; echo ${c:0:7})
|
||||
# OpenShift specific ldflags from hack/common.sh os::build:ldflags
|
||||
%{!?ldflags:
|
||||
%global ldflags -X github.com/openshift/origin/pkg/version.majorFromGit 1 -X github.com/openshift/origin/pkg/version.minorFromGit 0+ -X github.com/openshift/origin/pkg/version.versionFromGit v1.0.4-366-gc66613f-dirty -X github.com/openshift/origin/pkg/version.commitFromGit {{ openshift_commit | truncate(7, True, '') }} -X k8s.io/kubernetes/pkg/version.gitCommit 44c91b1 -X k8s.io/kubernetes/pkg/version.gitVersion v1.1.0-alpha.0-1605-g44c91b1
|
||||
}
|
||||
|
||||
Name: openshift
|
||||
# Version is not kept up to date and is intended to be set by tito custom
|
||||
# builders provided in the rel-eng directory of this project
|
||||
Version: {{ openshift_version }}
|
||||
Release: 0%{?dist}
|
||||
Summary: Open Source Platform as a Service by Red Hat
|
||||
License: ASL 2.0
|
||||
URL: https://%{import_path}
|
||||
ExclusiveArch: x86_64
|
||||
Source0: https://%{import_path}/archive/%{commit}/%{name}-%{commit}.tar.gz
|
||||
|
||||
BuildRequires: systemd
|
||||
BuildRequires: golang >= 1.4
|
||||
|
||||
|
||||
%description
|
||||
%{summary}
|
||||
|
||||
%package master
|
||||
Summary: OpenShift Master
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
%description master
|
||||
%{summary}
|
||||
|
||||
%package node
|
||||
Summary: OpenShift Node
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires: docker-io >= %{docker_version}
|
||||
Requires: tuned-profiles-%{name}-node
|
||||
Requires: util-linux
|
||||
Requires: socat
|
||||
Requires: nfs-utils
|
||||
Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
%description node
|
||||
%{summary}
|
||||
|
||||
%package -n tuned-profiles-%{name}-node
|
||||
Summary: Tuned profiles for OpenShift Node hosts
|
||||
Requires: tuned >= %{tuned_version}
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description -n tuned-profiles-%{name}-node
|
||||
%{summary}
|
||||
|
||||
%package clients
|
||||
Summary: Openshift Client binaries for Linux, Mac OSX, and Windows
|
||||
BuildRequires: golang-pkg-darwin-amd64
|
||||
BuildRequires: golang-pkg-windows-386
|
||||
|
||||
%description clients
|
||||
%{summary}
|
||||
|
||||
%package dockerregistry
|
||||
Summary: Docker Registry v2 for OpenShift
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description dockerregistry
|
||||
%{summary}
|
||||
|
||||
%package pod
|
||||
Summary: OpenShift Pod
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description pod
|
||||
%{summary}
|
||||
|
||||
%prep
|
||||
%setup -qn origin-%{commit}
|
||||
|
||||
%build
|
||||
|
||||
# Don't judge me for this ... it's so bad.
|
||||
mkdir _build
|
||||
|
||||
# Horrid hack because golang loves to just bundle everything
|
||||
pushd _build
|
||||
mkdir -p src/github.com/openshift
|
||||
ln -s $(dirs +1 -l) src/%{import_path}
|
||||
popd
|
||||
|
||||
|
||||
# Gaming the GOPATH to include the third party bundled libs at build
|
||||
# time. This is bad and I feel bad.
|
||||
mkdir _thirdpartyhacks
|
||||
pushd _thirdpartyhacks
|
||||
ln -s \
|
||||
$(dirs +1 -l)/Godeps/_workspace/src/ \
|
||||
src
|
||||
popd
|
||||
export GOPATH=$(pwd)/_build:$(pwd)/_thirdpartyhacks:%{buildroot}%{gopath}:%{gopath}
|
||||
# Build all linux components we care about
|
||||
for cmd in openshift dockerregistry
|
||||
do
|
||||
go install -ldflags "%{ldflags}" %{import_path}/cmd/${cmd}
|
||||
done
|
||||
|
||||
# Build only 'openshift' for other platforms
|
||||
GOOS=windows GOARCH=386 go install -ldflags "%{ldflags}" %{import_path}/cmd/openshift
|
||||
GOOS=darwin GOARCH=amd64 go install -ldflags "%{ldflags}" %{import_path}/cmd/openshift
|
||||
|
||||
#Build our pod
|
||||
pushd images/pod/
|
||||
go build -ldflags "%{ldflags}" pod.go
|
||||
popd
|
||||
|
||||
%install
|
||||
|
||||
install -d %{buildroot}%{_bindir}
|
||||
|
||||
# Install linux components
|
||||
for bin in openshift dockerregistry
|
||||
do
|
||||
echo "+++ INSTALLING ${bin}"
|
||||
install -p -m 755 _build/bin/${bin} %{buildroot}%{_bindir}/${bin}
|
||||
done
|
||||
# Install 'openshift' as client executable for windows and mac
|
||||
for pkgname in openshift
|
||||
do
|
||||
install -d %{buildroot}%{_datadir}/${pkgname}/{linux,macosx,windows}
|
||||
install -p -m 755 _build/bin/openshift %{buildroot}%{_datadir}/${pkgname}/linux/oc
|
||||
install -p -m 755 _build/bin/darwin_amd64/openshift %{buildroot}%{_datadir}/${pkgname}/macosx/oc
|
||||
install -p -m 755 _build/bin/windows_386/openshift.exe %{buildroot}%{_datadir}/${pkgname}/windows/oc.exe
|
||||
done
|
||||
|
||||
#Install openshift pod
|
||||
install -p -m 755 images/pod/pod %{buildroot}%{_bindir}/
|
||||
|
||||
install -d -m 0755 %{buildroot}%{_unitdir}
|
||||
|
||||
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
|
||||
|
||||
for cmd in oc oadm; do
|
||||
ln -s %{_bindir}/%{name} %{buildroot}%{_bindir}/$cmd
|
||||
done
|
||||
ln -s %{_bindir}/%{name} %{buildroot}%{_bindir}/kubectl
|
||||
|
||||
install -d -m 0755 %{buildroot}%{_sysconfdir}/origin/{master,node}
|
||||
|
||||
for pkgname in openshift
|
||||
do
|
||||
install -m 0644 rel-eng/${pkgname}-master.service %{buildroot}%{_unitdir}/${pkgname}-master.service
|
||||
install -m 0644 rel-eng/${pkgname}-node.service %{buildroot}%{_unitdir}/${pkgname}-node.service
|
||||
|
||||
install -m 0644 rel-eng/${pkgname}-master.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/${pkgname}-master
|
||||
install -m 0644 rel-eng/${pkgname}-node.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/${pkgname}-node
|
||||
install -d -m 0755 %{buildroot}%{_prefix}/lib/tuned/${pkgname}-node-{guest,host}
|
||||
install -m 0644 tuned/%{name}-node-guest/tuned.conf %{buildroot}%{_prefix}/lib/tuned/${pkgname}-node-guest/tuned.conf
|
||||
install -m 0644 tuned/%{name}-node-host/tuned.conf %{buildroot}%{_prefix}/lib/tuned/${pkgname}-node-host/tuned.conf
|
||||
install -d -m 0755 %{buildroot}%{_mandir}/man7
|
||||
install -m 0644 tuned/man/tuned-profiles-%{name}-node.7 %{buildroot}%{_mandir}/man7/tuned-profiles-${pkgname}-node.7
|
||||
|
||||
done
|
||||
|
||||
mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
|
||||
mkdir -p %{buildroot}%{_sharedstatedir}/origin
|
||||
|
||||
|
||||
# Install bash completions
|
||||
install -d -m 755 %{buildroot}%{_sysconfdir}/bash_completion.d/
|
||||
install -p -m 644 rel-eng/completions/bash/* %{buildroot}%{_sysconfdir}/bash_completion.d/
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
%doc README.md LICENSE
|
||||
%{_bindir}/openshift
|
||||
%{_bindir}/oc
|
||||
%{_bindir}/oadm
|
||||
%{_bindir}/kubectl
|
||||
%{_sharedstatedir}/%{name}
|
||||
%{_sysconfdir}/bash_completion.d/*
|
||||
%dir %config(noreplace) %{_sysconfdir}/origin
|
||||
|
||||
%pre
|
||||
# If /etc/openshift exists symlink it to /etc/origin
|
||||
if [ -d "%{_sysconfdir}/openshift" ]; then
|
||||
ln -s %{_sysconfdir}/openshift %{_sysconfdir}/origin
|
||||
fi
|
||||
|
||||
%files master
|
||||
%defattr(-,root,root,-)
|
||||
%{_unitdir}/%{name}-master.service
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/%{name}-master
|
||||
%config(noreplace) /etc/origin/master
|
||||
|
||||
%post master
|
||||
%systemd_post %{basename:openshift-master.service}
|
||||
|
||||
%preun master
|
||||
%systemd_preun %{basename:openshift-master.service}
|
||||
|
||||
%postun master
|
||||
%systemd_postun
|
||||
|
||||
%files node
|
||||
%defattr(-,root,root,-)
|
||||
%{_unitdir}/%{name}-node.service
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/%{name}-node
|
||||
%config(noreplace) /etc/origin/node
|
||||
|
||||
%post node
|
||||
%systemd_post %{basename:openshift-node.service}
|
||||
|
||||
%preun node
|
||||
%systemd_preun %{basename:openshift-node.service}
|
||||
|
||||
%postun node
|
||||
%systemd_postun
|
||||
|
||||
%files -n tuned-profiles-openshift-node
|
||||
%defattr(-,root,root,-)
|
||||
%{_prefix}/lib/tuned/openshift-node-host
|
||||
%{_prefix}/lib/tuned/openshift-node-guest
|
||||
%{_mandir}/man7/tuned-profiles-openshift-node.7*
|
||||
|
||||
%post -n tuned-profiles-openshift-node
|
||||
recommended=`/usr/sbin/tuned-adm recommend`
|
||||
if [[ "${recommended}" =~ guest ]] ; then
|
||||
/usr/sbin/tuned-adm profile openshift-node-guest > /dev/null 2>&1
|
||||
else
|
||||
/usr/sbin/tuned-adm profile openshift-node-host > /dev/null 2>&1
|
||||
fi
|
||||
|
||||
%preun -n tuned-profiles-openshift-node
|
||||
# reset the tuned profile to the recommended profile
|
||||
# $1 = 0 when we're being removed > 0 during upgrades
|
||||
if [ "$1" = 0 ]; then
|
||||
recommended=`/usr/sbin/tuned-adm recommend`
|
||||
/usr/sbin/tuned-adm profile $recommended > /dev/null 2>&1
|
||||
fi
|
||||
|
||||
%files clients
|
||||
%{_datadir}/%{name}/linux/oc
|
||||
%{_datadir}/%{name}/macosx/oc
|
||||
%{_datadir}/%{name}/windows/oc.exe
|
||||
|
||||
%files dockerregistry
|
||||
%defattr(-,root,root,-)
|
||||
%{_bindir}/dockerregistry
|
||||
|
||||
%files pod
|
||||
%defattr(-,root,root,-)
|
||||
%{_bindir}/pod
|
||||
|
||||
%changelog
|
||||
* Wed Aug 19 2015 Martin Milata <mmilata@redhat.com> 0.2-9.ansible-osbs
|
||||
- Modified for ansible-osbs
|
||||
|
||||
* Wed Aug 12 2015 Steve Milner <smilner@redhat.com> 0.2-8
|
||||
- Master configs will be generated if none are found.
|
||||
- Node configs will be generated if none are found and master is installed.
|
||||
- All-In-One services removed.
|
||||
|
||||
* Wed Aug 12 2015 Steve Milner <smilner@redhat.com> 0.2-7
|
||||
- Added new ovs script(s) to file lists.
|
||||
|
||||
* Wed Aug 5 2015 Steve Milner <smilner@redhat.com> 0.2-6
|
||||
- Using _unitdir instead of _prefix for unit data
|
||||
|
||||
* Fri Jul 31 2015 Steve Milner <smilner@redhat.com> 0.2-5
|
||||
- Configuration location now /etc/origin
|
||||
- Default configs created upon installation
|
||||
|
||||
* Tue Jul 28 2015 Steve Milner <smilner@redhat.com> 0.2-4
|
||||
- Added AEP packages
|
||||
|
||||
* Mon Jan 26 2015 Scott Dodson <sdodson@redhat.com> 0.2-3
|
||||
- Update to 21fb40637c4e3507cca1fcab6c4d56b06950a149
|
||||
- Split packaging of openshift-master and openshift-node
|
||||
|
||||
* Mon Jan 19 2015 Scott Dodson <sdodson@redhat.com> 0.2-2
|
||||
- new package built with tito
|
||||
|
||||
* Fri Jan 09 2015 Adam Miller <admiller@redhat.com> - 0.2-2
|
||||
- Add symlink for osc command line tooling (merged in from jhonce@redhat.com)
|
||||
|
||||
* Wed Jan 07 2015 Adam Miller <admiller@redhat.com> - 0.2-1
|
||||
- Update to latest upstream release
|
||||
- Restructured some of the golang deps build setup for restructuring done
|
||||
upstream
|
||||
|
||||
* Thu Oct 23 2014 Adam Miller <admiller@redhat.com> - 0-0.0.9.git562842e
|
||||
- Add new patches from jhonce for systemd units
|
||||
|
||||
* Mon Oct 20 2014 Adam Miller <admiller@redhat.com> - 0-0.0.8.git562842e
|
||||
- Update to latest master snapshot
|
||||
|
||||
* Wed Oct 15 2014 Adam Miller <admiller@redhat.com> - 0-0.0.7.git7872f0f
|
||||
- Update to latest master snapshot
|
||||
|
||||
* Fri Oct 03 2014 Adam Miller <admiller@redhat.com> - 0-0.0.6.gite4d4ecf
|
||||
- Update to latest Alpha nightly build tag 20141003
|
||||
|
||||
* Wed Oct 01 2014 Adam Miller <admiller@redhat.com> - 0-0.0.5.git6d9f1a9
|
||||
- Switch to consistent naming, patch by jhonce
|
||||
|
||||
* Tue Sep 30 2014 Adam Miller <admiller@redhat.com> - 0-0.0.4.git6d9f1a9
|
||||
- Add systemd and sysconfig entries from jhonce
|
||||
|
||||
* Tue Sep 23 2014 Adam Miller <admiller@redhat.com> - 0-0.0.3.git6d9f1a9
|
||||
- Update to latest upstream.
|
||||
|
||||
* Mon Sep 15 2014 Adam Miller <admiller@redhat.com> - 0-0.0.2.git2647df5
|
||||
- Update to latest upstream.
|
||||
|
||||
* Thu Aug 14 2014 Adam Miller <admiller@redhat.com> - 0-0.0.1.gitc3839b8
|
||||
- First package
|
||||
|
|
@ -1,155 +0,0 @@
|
|||
osbs-master
|
||||
===========
|
||||
|
||||
Main role for deploying OSBS - [OpenShift build
|
||||
service](https://github.com/projectatomic/osbs-client/), service for building
|
||||
layered Docker images.
|
||||
|
||||
It performs the necessary configuration of Docker and OpenShift and optionally
|
||||
opens/closes OpenShift firewall port. It also generates self-signed certificate
|
||||
that can be used by reverse proxy placed in front of the builder.
|
||||
|
||||
This role is part of
|
||||
[ansible-osbs](https://github.com/projectatomic/ansible-osbs/) playbook for
|
||||
deploying OpenShift build service. Please refer to that github repository for
|
||||
[documentation](https://github.com/projectatomic/ansible-osbs/blob/master/README.md)
|
||||
and [issue tracker](https://github.com/projectatomic/ansible-osbs/issues).
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
You may need to configure Docker to connect to registries over plain HTTP, or
|
||||
HTTPS with self-signed certificate (especially when developing OSBS). You can
|
||||
provide list of such registries in `osbs_docker_insecure_registries` (empty by
|
||||
default).
|
||||
|
||||
osbs_docker_insecure_registries: []
|
||||
|
||||
Expose the OpenShift port to the outside world? Set this to `false` when using
|
||||
authenticating proxy on the localhost. Has no effect if `osbs_manage_firewalld`
|
||||
is `false`.
|
||||
|
||||
osbs_master_expose_port: true
|
||||
|
||||
Set to false if you don't use firewalld or do not want the playbook to modify
|
||||
it.
|
||||
|
||||
osbs_manage_firewalld: true
|
||||
|
||||
If you are using authenticating proxy, this role can generate a self-signed certificate that the proxy can use to authenticate itself to OpenShift. The proxy needs the certificate and the key concatenated in one file (`osbs_proxy_cert_file`). OpenShift needs to know the CA of the certificate, which is configured in `osbs_proxy_ca_file` and which is the same as the certificate because it is self-signed.
|
||||
|
||||
osbs_proxy_cert_file: /etc/origin/proxy_selfsigned.crt
|
||||
osbs_proxy_key_file: /etc/origin/proxy_selfsigned.key
|
||||
osbs_proxy_certkey_file: /etc/httpd/openshift_proxy_certkey.crt
|
||||
osbs_proxy_ca_file: /etc/origin/proxy_selfsigned.crt
|
||||
|
||||
OpenShift authorization policy - which users should be assigned the view
|
||||
(read-only), osbs-builder (read-write), and cluster-admin (admin) roles. In
|
||||
default configuration, everyone has read/write access. The authentication is
|
||||
handled by the proxy - if you are not using it the everyone connecting from the
|
||||
outside belongs to the `system:unauthenticated` group.
|
||||
|
||||
Default setup:
|
||||
|
||||
osbs_readonly_users: []
|
||||
osbs_readonly_groups: []
|
||||
osbs_readwrite_users: []
|
||||
osbs_readwrite_groups:
|
||||
- system:authenticated
|
||||
- system:unauthenticated
|
||||
osbs_admin_users: []
|
||||
osbs_admin_groups: []
|
||||
|
||||
Development with authenticating proxy:
|
||||
|
||||
osbs_readonly_users: []
|
||||
osbs_readonly_groups: []
|
||||
osbs_readwrite_users: []
|
||||
osbs_readwrite_groups:
|
||||
- system:authenticated
|
||||
osbs_admin_users: []
|
||||
osbs_admin_groups: []
|
||||
|
||||
Example production configuration with only one user starting the builds:
|
||||
|
||||
osbs_readonly_users: []
|
||||
osbs_readonly_groups:
|
||||
- system:authenticated
|
||||
osbs_readwrite_groups: []
|
||||
osbs_readwrite_users:
|
||||
- kojibuilder
|
||||
osbs_admin_users:
|
||||
- foo@EXAMPLE.COM
|
||||
- bar@EXAMPLE.COM
|
||||
osbs_admin_groups: []
|
||||
|
||||
Limit on the number of running pods.
|
||||
|
||||
osbs_master_max_pods: 3
|
||||
|
||||
[Image garbage
|
||||
collection](https://docs.openshift.org/latest/admin_guide/garbage_collection.html#image-garbage-collection)
|
||||
can be configured with following variables:
|
||||
|
||||
osbs_image_gc_high_threshold: 90
|
||||
osbs_image_gc_low_threshold: 80
|
||||
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
OpenShift is expected to be installed on the remote host. This can by
|
||||
accomplished by the
|
||||
[install-openshift](https://github.com/projectatomic/ansible-role-install-openshift)
|
||||
role.
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
Simple development deployment:
|
||||
|
||||
- hosts: builders
|
||||
roles:
|
||||
- install-openshift
|
||||
- osbs-master
|
||||
- atomic-reactor
|
||||
|
||||
Deployment behind authentication proxy that only allows the *kojibuilder* user
|
||||
to start builds (and everyone to view them). Set docker to trust registry on
|
||||
localhost:5000 even though it uses HTTP.
|
||||
|
||||
- hosts: builders
|
||||
roles:
|
||||
- install-openshift
|
||||
- role: osbs-master
|
||||
osbs_master_expose_port: false
|
||||
osbs_docker_insecure_registries: [172.42.17.1:5000]
|
||||
osbs_readonly_users: []
|
||||
osbs_readonly_groups:
|
||||
- system:authenticated
|
||||
- system:unauthenticated
|
||||
osbs_readwrite_groups: []
|
||||
osbs_readwrite_users:
|
||||
- kojibuilder
|
||||
osbs_admin_users: []
|
||||
osbs_admin_groups: []
|
||||
- atomic-reactor
|
||||
- role: osbs-proxy
|
||||
osbs_proxy_type: kerberos
|
||||
osbs_proxy_kerberos_keytab_file: /etc/HTTP-FQDN.EXAMPLE.COM.keytab
|
||||
osbs_proxy_kerberos_realm: EXAMPLE.COM
|
||||
osbs_proxy_ssl_cert_file: /etc/fqdn.example.com.crt
|
||||
osbs_proxy_ssl_key_file: /etc/fqdn.example.com.key
|
||||
osbs_proxy_ip_whitelist:
|
||||
- subnet: 192.168.66.0/24
|
||||
user: kojibuilder
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
BSD
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
Martin Milata <mmilata@redhat.com>
|
||||
|
|
@ -1,114 +0,0 @@
|
|||
---
|
||||
# set the openshift log level
|
||||
osbs_openshift_loglevel: 0
|
||||
|
||||
# docker needs to know which registries are insecure
|
||||
osbs_docker_insecure_registries: []
|
||||
|
||||
# Expose the OpenShift port to the outside world? Set this to false when using
|
||||
# authenticating proxy on the localhost. Has no effect if osbs_manage_firewalld
|
||||
# is false.
|
||||
osbs_master_expose_port: true
|
||||
|
||||
# set to false if you don't use firewalld or do not want the playbook to modify it
|
||||
osbs_manage_firewalld: true
|
||||
|
||||
# these will be generated for proxy so it can authenticate itself
|
||||
osbs_proxy_cert_file: /etc/origin/proxy_selfsigned.crt
|
||||
osbs_proxy_key_file: /etc/origin/proxy_selfsigned.key
|
||||
osbs_proxy_certkey_file: /etc/origin/proxy_certkey.crt
|
||||
|
||||
# CA cert to validate the proxy certificate against
|
||||
osbs_proxy_ca_file: /etc/origin/proxy_selfsigned.crt
|
||||
|
||||
# openshift authorization - which users should be assigned the view (readonly),
|
||||
# osbs-builder (readwrite), and cluster-admin (admin) roles
|
||||
# in default configuration, everyone has read/write access
|
||||
osbs_readonly_users: []
|
||||
osbs_readonly_groups: []
|
||||
osbs_readwrite_users: []
|
||||
osbs_readwrite_groups:
|
||||
- system:authenticated
|
||||
- system:unauthenticated
|
||||
osbs_admin_users: []
|
||||
osbs_admin_groups: []
|
||||
|
||||
## development w/ auth proxy:
|
||||
#osbs_readonly_users: []
|
||||
#osbs_readonly_groups: []
|
||||
#osbs_readwrite_users: []
|
||||
#osbs_readwrite_groups:
|
||||
# - system:authenticated
|
||||
#osbs_admin_users: []
|
||||
#osbs_admin_groups: []
|
||||
|
||||
## example production configuration:
|
||||
#osbs_readonly_users: []
|
||||
#osbs_readonly_groups:
|
||||
# - system:authenticated
|
||||
#osbs_readwrite_groups: []
|
||||
#osbs_readwrite_users:
|
||||
# - kojibuilder
|
||||
# - "{{ ansible_hostname }}"
|
||||
# - system:serviceaccount:default:default
|
||||
#osbs_admin_users:
|
||||
# - foo@EXAMPLE.COM
|
||||
# - bar@EXAMPLE.COM
|
||||
#osbs_admin_groups: []
|
||||
|
||||
# limit on the number of running pods
|
||||
osbs_master_max_pods: 3
|
||||
|
||||
# update packagages to their latest version?
|
||||
osbs_update_packages: false
|
||||
|
||||
# directory for exporting v1 images to koji
|
||||
# if not defined, nothing will happen
|
||||
#osbs_export_dir: /mnt/image-export
|
||||
|
||||
# mount the image export directory
|
||||
#osbs_export_mount_src: /dev/vda1
|
||||
#osbs_export_mount_fs: ext4
|
||||
|
||||
# configure httpd to publish the directory under following path of default vhost
|
||||
#osbs_export_http_path: /image-export
|
||||
|
||||
osbs_image_gc_high_threshold: 90
|
||||
osbs_image_gc_low_threshold: 80
|
||||
|
||||
|
||||
# Specify different identity providers and options needed for the master-config
|
||||
# template
|
||||
#
|
||||
# Currently supported options are:
|
||||
# request_header
|
||||
# htpasswd_provider
|
||||
osbs_identity_provider: "request_header"
|
||||
|
||||
osbs_identity_request:
|
||||
name: request_header
|
||||
challenge: true
|
||||
login: true
|
||||
|
||||
osbs_identity_htpasswd:
|
||||
name: htpasswd_provider
|
||||
challenge: true
|
||||
login: true
|
||||
provider_file: /etc/openshift/htpasswd
|
||||
|
||||
# This correlates to the section of OpenShift master-config.yaml for custom
|
||||
# certificate configuration for the public facing API endpoint
|
||||
#
|
||||
# https://docs.openshift.org/latest/install_config/certificate_customization.html
|
||||
#
|
||||
# Following values:
|
||||
# enabled: boolean - used for checking in the config template
|
||||
# certfile: path to cert (.crt) file
|
||||
# keyfile: path to key (.key) file
|
||||
# names: list of names
|
||||
osbs_named_certificates:
|
||||
enabled: false
|
||||
cert_file:
|
||||
key_file:
|
||||
names:
|
||||
osbs_public_api_url:
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=http://docs.docker.com
|
||||
After=network.target
|
||||
Wants=docker-storage-setup.service
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
NotifyAccess=all
|
||||
EnvironmentFile=-/etc/sysconfig/docker
|
||||
EnvironmentFile=-/etc/sysconfig/docker-storage
|
||||
EnvironmentFile=-/etc/sysconfig/docker-network
|
||||
Environment=GOTRACEBACK=crash
|
||||
ExecStart=/usr/bin/docker daemon \
|
||||
--exec-opt native.cgroupdriver=systemd \
|
||||
$OPTIONS \
|
||||
$DOCKER_STORAGE_OPTIONS \
|
||||
$DOCKER_NETWORK_OPTIONS \
|
||||
$INSECURE_REGISTRY
|
||||
ExecStartPost=/usr/local/bin/fix-docker-iptables
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=1048576
|
||||
LimitCORE=infinity
|
||||
MountFlags=slave
|
||||
StandardOutput=null
|
||||
StandardError=null
|
||||
TimeoutStartSec=0
|
||||
Restart=on-abnormal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
#!/bin/bash -xe
|
||||
# Note: this is done as a script because it needs to be run after
|
||||
# every docker service restart.
|
||||
# And just doing an iptables-restore is going to mess up kubernetes'
|
||||
# NAT table.
|
||||
|
||||
# Delete all old rules
|
||||
iptables --flush FORWARD
|
||||
|
||||
# Re-insert some basic rules
|
||||
iptables -A FORWARD -o docker0 -j DOCKER
|
||||
iptables -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -o docker0 -j ACCEPT
|
||||
|
||||
# Now insert access to allowed boxes
|
||||
# docker-registry
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.56 --dport 443 -j ACCEPT
|
||||
|
||||
#koji.fp.o
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.61 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.61 --dport 443 -j ACCEPT
|
||||
|
||||
# pkgs
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.44 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.44 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.125.44 --dport 9418 -j ACCEPT
|
||||
|
||||
# DNS
|
||||
iptables -A FORWARD -i docker0 -p udp -m udp -d 10.5.126.21 --dport 53 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p udp -m udp -d 10.5.126.22 --dport 53 -j ACCEPT
|
||||
|
||||
# mirrors.fp.o
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.51 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.52 --dport 443 -j ACCEPT
|
||||
|
||||
# dl.phx2
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.93 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.93 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.94 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.94 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.95 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.95 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.96 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.96 --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.97 --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p tcp -m tcp -d 10.5.126.97 --dport 443 -j ACCEPT
|
||||
|
||||
|
||||
# Docker is CRAZY and forces Google DNS upon us.....
|
||||
iptables -A FORWARD -i docker0 -p udp -m udp -d 8.8.8.8 --dport 53 -j ACCEPT
|
||||
iptables -A FORWARD -i docker0 -p udp -m udp -d 8.8.4.4 --dport 53 -j ACCEPT
|
||||
|
||||
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
||||
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
#!/bin/bash -xe
|
||||
# Note: this is done as a script because it needs to be run after
|
||||
# every docker service restart.
|
||||
# And just doing an iptables-restore is going to mess up kubernetes'
|
||||
# NAT table.
|
||||
# And it gets even better with openshift! It thinks I'm stupid and need
|
||||
# to be corrected by automatically adding the "allow all" rules back at
|
||||
# the top as soon as I remove them.
|
||||
# To circumvent that, we're just adding a new chain for this, as it seems
|
||||
# that it doesn't do anything with the firewall if we keep its rules in
|
||||
# place. (it doesn't check the order of its rules, only that they exist)
|
||||
|
||||
if [ "`iptables -nL | grep FILTER_FORWARD`" == "" ];
|
||||
then
|
||||
iptables -N FILTER_FORWARD
|
||||
fi
|
||||
if [ "`iptables -nL | grep 'FILTER_FORWARD all'`" == "" ];
|
||||
then
|
||||
iptables -I FORWARD 1 -j FILTER_FORWARD
|
||||
fi
|
||||
|
||||
# Delete all old rules
|
||||
iptables --flush FILTER_FORWARD
|
||||
|
||||
# Re-insert some basic rules
|
||||
iptables -A FILTER_FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
iptables -A FILTER_FORWARD --src 10.1.0.0/16 --dst 10.1.0.0/16 -j ACCEPT
|
||||
|
||||
# Now insert access to allowed boxes
|
||||
# docker-registry
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.217 --dport 443 -j ACCEPT
|
||||
|
||||
#koji.fp.o
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.87 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.87 --dport 443 -j ACCEPT
|
||||
|
||||
# pkgs.stg
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.83 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.83 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.83 --dport 9418 -j ACCEPT
|
||||
|
||||
# DNS
|
||||
iptables -A FILTER_FORWARD -p udp -m udp -d 10.5.126.21 --dport 53 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p udp -m udp -d 10.5.126.22 --dport 53 -j ACCEPT
|
||||
|
||||
# mirrors.fp.o
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.51 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.52 --dport 443 -j ACCEPT
|
||||
|
||||
# dl.phx2
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.93 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.93 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.94 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.94 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.95 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.95 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.96 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.96 --dport 443 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.97 --dport 80 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.5.126.97 --dport 443 -j ACCEPT
|
||||
|
||||
|
||||
# Docker is CRAZY and forces Google DNS upon us.....
|
||||
iptables -A FILTER_FORWARD -p udp -m udp -d 8.8.8.8 --dport 53 -j ACCEPT
|
||||
iptables -A FILTER_FORWARD -p udp -m udp -d 8.8.4.4 --dport 53 -j ACCEPT
|
||||
|
||||
iptables -A FILTER_FORWARD -j REJECT --reject-with icmp-host-prohibited
|
||||
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: osbs-builder
|
||||
rules:
|
||||
- attributeRestrictions: null
|
||||
resources:
|
||||
- builds/custom
|
||||
- pods/exec
|
||||
- pods/portforward
|
||||
- pods/proxy
|
||||
- resourcegroup:exposedkube
|
||||
- resourcegroup:exposedopenshift
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
- attributeRestrictions: null
|
||||
resources:
|
||||
- resourcegroup:allkube
|
||||
- resourcegroup:allkube-status
|
||||
- resourcegroup:allopenshift-status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- attributeRestrictions: null
|
||||
resources:
|
||||
- imagestreams/layers
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
---
|
||||
- name: restart docker
|
||||
service: name=docker state=restarted
|
||||
|
||||
- name: restart openshift-master
|
||||
service: name=origin-master state=restarted
|
||||
|
||||
- name: restart openshift-node
|
||||
service: name=origin-node state=restarted
|
||||
|
||||
- name: restart httpd
|
||||
service: name=httpd state=restarted
|
||||
|
|
@ -1 +0,0 @@
|
|||
{install_date: 'Thu Jan 7 17:30:46 2016', version: master}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
---
|
||||
galaxy_info:
|
||||
author: Martin Milata
|
||||
description: OpenShift build service - builder of layered Docker images
|
||||
company: Red Hat
|
||||
issue_tracker_url: https://github.com/projectatomic/ansible-osbs/issues
|
||||
license: BSD
|
||||
min_ansible_version: 1.9
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- 7
|
||||
- name: Fedora
|
||||
versions:
|
||||
- 21
|
||||
- 22
|
||||
categories:
|
||||
- cloud
|
||||
- development
|
||||
- packaging
|
||||
dependencies: []
|
||||
|
|
@ -1,56 +0,0 @@
|
|||
---
|
||||
- name: mount the export directory
|
||||
mount:
|
||||
name: "{{ osbs_export_dir }}"
|
||||
src: "{{ osbs_export_mount_src }}"
|
||||
fstype: "{{ osbs_export_mount_fs }}"
|
||||
state: mounted
|
||||
when: osbs_export_mount_src is defined
|
||||
|
||||
- name: set owner of the image export directory
|
||||
file:
|
||||
path: "{{ osbs_export_dir }}"
|
||||
state: directory
|
||||
owner: apache
|
||||
group: apache
|
||||
when: osbs_export_http_path is defined
|
||||
|
||||
- name: configure selinux labels for image export directory
|
||||
command: /usr/sbin/semanage fcontext --add --type httpd_sys_content_t "{{ osbs_export_dir }}(/.*)?"
|
||||
when: osbs_export_http_path is defined
|
||||
|
||||
- name: restore selinux labels for image export directory
|
||||
file:
|
||||
path: "{{ osbs_export_dir }}"
|
||||
state: directory
|
||||
setype: httpd_sys_content_t
|
||||
recurse: yes
|
||||
when: osbs_export_http_path is defined
|
||||
|
||||
- name: export the mount directory via http
|
||||
template: src=httpd-osbs_image_export.conf.j2 dest={{ osbs_export_http_conf }}
|
||||
notify:
|
||||
- restart httpd
|
||||
when: osbs_export_http_path is defined
|
||||
|
||||
- name: open http ports
|
||||
firewalld:
|
||||
service: "{{ item }}"
|
||||
state: enabled
|
||||
permanent: true
|
||||
immediate: true
|
||||
with_items:
|
||||
- http
|
||||
- https
|
||||
when: osbs_export_http_path is defined and osbs_manage_firewalld
|
||||
|
||||
- name: install dependencies for garbage collection script
|
||||
action: "{{ ansible_pkg_mgr }} name=koji state=installed"
|
||||
when: osbs_export_koji_hub is defined
|
||||
|
||||
- name: install garbage collection script
|
||||
template:
|
||||
src: osbs-remove-finished-docker-tarball.py.j2
|
||||
dest: /etc/cron.hourly/osbs-remove-finished-docker-tarball.cron
|
||||
mode: "0744"
|
||||
when: osbs_export_koji_hub is defined
|
||||
|
|
@ -1,132 +0,0 @@
|
|||
---
|
||||
### docker service ###
|
||||
|
||||
- name: install packages required by osbs
|
||||
action: "{{ ansible_pkg_mgr }} name=docker state={{ osbs_update_packages | ternary('latest', 'present') }}"
|
||||
|
||||
- name: install openssl for auth proxy cert generation
|
||||
action: "{{ ansible_pkg_mgr }} name=openssl state=latest"
|
||||
|
||||
- name: configure docker
|
||||
template: src=sysconfig-docker.j2 dest=/etc/sysconfig/docker backup=yes
|
||||
notify: restart docker
|
||||
|
||||
- name: ensure docker is running
|
||||
service: name=docker state=started enabled=yes
|
||||
|
||||
### openshift service ###
|
||||
|
||||
- name: open/close openshift port in the firewall
|
||||
firewalld:
|
||||
port: "{{ osbs_openshift_port }}/tcp"
|
||||
state: "{{ osbs_master_expose_port | ternary('enabled', 'disabled') }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
when: osbs_manage_firewalld
|
||||
|
||||
- name: apply modifications to /etc/sysconfig/origin
|
||||
template: src=sysconfig-origin-{{ item }}.j2 dest=/etc/sysconfig/origin-{{ item }}
|
||||
with_items:
|
||||
- master
|
||||
- node
|
||||
|
||||
- name: configure openshift master
|
||||
template: src=master-config.yaml.j2 dest=/etc/origin/master/master-config.yaml
|
||||
notify: restart openshift-master
|
||||
|
||||
- name: configure openshift node
|
||||
template: src=node-config.yaml.j2 dest=/etc/origin/node/node-config.yaml
|
||||
notify: restart openshift-node
|
||||
|
||||
- name: generate cert for authenticating proxy - self-signed certificate
|
||||
command: >
|
||||
openssl req -new -nodes -x509
|
||||
-subj "/C=CZ/ST=SelfSigned/L=SelfSigned/O=IT/CN={{ inventory_hostname }}"
|
||||
-days 3650
|
||||
-keyout {{ osbs_proxy_key_file }}
|
||||
-out {{ osbs_proxy_cert_file }}
|
||||
-extensions v3_ca
|
||||
args:
|
||||
creates: "{{ osbs_proxy_cert_file }}"
|
||||
register: auth_proxy_cert
|
||||
|
||||
- name: generate cert for authenticating proxy - convert privkey to rsa
|
||||
command: openssl rsa -in {{ osbs_proxy_key_file }} -out {{ osbs_proxy_key_file }}
|
||||
when: auth_proxy_cert.changed
|
||||
|
||||
- name: generate cert for authenticating proxy - concatenate cert and key
|
||||
shell: cat {{ osbs_proxy_cert_file }} {{ osbs_proxy_key_file }} > {{ osbs_proxy_certkey_file }}
|
||||
args:
|
||||
creates: "{{ osbs_proxy_certkey_file }}"
|
||||
|
||||
# We need to have openshift restarted in order to configure authentication.
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: ensure openshift is running
|
||||
service: name=origin-{{ item }} state=started enabled=yes
|
||||
with_items:
|
||||
- master
|
||||
- node
|
||||
|
||||
- name: wait for openshift to start accepting connections
|
||||
wait_for: port={{ osbs_openshift_port }} timeout=30
|
||||
|
||||
- name: copy osbs-builder role definition
|
||||
copy: src=openshift-role-osbs-builder.yml dest={{ osbs_openshift_home }}/role-osbs-builder.yml
|
||||
|
||||
- name: import the osbs-builder role
|
||||
shell: "oc replace --force=true --filename={{ osbs_openshift_home }}/role-osbs-builder.yml && touch /etc/origin/osbs-builder-role-imported"
|
||||
args:
|
||||
creates: "/etc/origin/osbs-builder-role-imported"
|
||||
environment: "{{ osbs_environment }}"
|
||||
|
||||
- name: copy role bindings
|
||||
template: src=openshift-rolebinding.yml.j2 dest={{ osbs_openshift_home }}/rolebinding-{{ item.name }}.yml
|
||||
with_items:
|
||||
- name: osbs-readonly
|
||||
role: view
|
||||
users: "{{ osbs_readonly_users }}"
|
||||
groups: "{{ osbs_readonly_groups }}"
|
||||
- name: osbs-readwrite
|
||||
role: osbs-builder
|
||||
users: "{{ osbs_readwrite_users }}"
|
||||
groups: "{{ osbs_readwrite_groups }}"
|
||||
- name: osbs-admin
|
||||
role: cluster-admin
|
||||
users: "{{ osbs_admin_users }}"
|
||||
groups: "{{ osbs_admin_groups }}"
|
||||
|
||||
- name: import the role bindings
|
||||
shell: "oc replace --force=true --filename={{ osbs_openshift_home }}/rolebinding-{{ item }}.yml && touch /etc/origin/role-bindings-imported"
|
||||
args:
|
||||
creates: "/etc/origin/role-bindings-imported"
|
||||
environment: "{{ osbs_environment }}"
|
||||
with_items:
|
||||
- osbs-readonly
|
||||
- osbs-readwrite
|
||||
- osbs-admin
|
||||
|
||||
- name: copy resource quotas
|
||||
template: src=openshift-resourcequota.yml.j2 dest={{ osbs_openshift_home }}/resourcequota.yml
|
||||
|
||||
- name: import resource quotas
|
||||
shell: "oc replace --force=true --filename={{ osbs_openshift_home }}/resourcequota.yml && touch /etc/origin/resource-quotas-imported"
|
||||
args:
|
||||
creates: "/etc/origin/resource-quotas-imported"
|
||||
environment: "{{ osbs_environment }}"
|
||||
|
||||
# Useful when using "oc" to inspect openshift state.
|
||||
- name: add KUBECONFIG to .bashrc
|
||||
lineinfile:
|
||||
dest: "{{ ansible_env.HOME }}/.bashrc"
|
||||
regexp: "export KUBECONFIG="
|
||||
line: "export KUBECONFIG={{ osbs_environment.KUBECONFIG }}"
|
||||
|
||||
- include: export.yml
|
||||
when: osbs_export_dir is defined
|
||||
|
||||
- name: copy docker iptables script
|
||||
copy: src="fix-docker-iptables.{{ env }}" dest=/usr/local/bin/fix-docker-iptables mode=0755
|
||||
|
||||
- name: copy docker service config
|
||||
copy: src=docker.service dest=/etc/systemd/system/docker.service
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
# atomic-reactor copies tarballs to this directory (via NFS share) and koji
|
||||
# downloads it from this place. Garbage collection needs to be done on this
|
||||
# directory.
|
||||
|
||||
Alias "{{ osbs_export_http_path }}" "{{ osbs_export_dir }}"
|
||||
|
||||
<Directory "{{ osbs_export_dir }}">
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
Options +Indexes
|
||||
</Directory>
|
||||
|
|
@ -1,188 +0,0 @@
|
|||
admissionConfig:
|
||||
pluginConfig: null
|
||||
apiLevels:
|
||||
- v1
|
||||
apiVersion: v1
|
||||
assetConfig:
|
||||
extensionDevelopment: false
|
||||
extensionScripts: null
|
||||
extensionStylesheets: null
|
||||
extensions: null
|
||||
loggingPublicURL: ""
|
||||
logoutURL: ""
|
||||
{% if osbs_public_api_url %}
|
||||
masterPublicURL: https://{{ osbs_public_api_url }}:8443
|
||||
{% else %}
|
||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
||||
{% endif %}
|
||||
metricsPublicURL: ""
|
||||
publicURL: https://{{ ansible_default_ipv4.address }}:8443/console/
|
||||
servingInfo:
|
||||
bindAddress: 0.0.0.0:8443
|
||||
bindNetwork: tcp4
|
||||
certFile: master.server.crt
|
||||
clientCA: ""
|
||||
keyFile: master.server.key
|
||||
maxRequestsInFlight: 0
|
||||
namedCertificates: null
|
||||
requestTimeoutSeconds: 0
|
||||
controllerLeaseTTL: 0
|
||||
controllers: '*'
|
||||
corsAllowedOrigins:
|
||||
- 127.0.0.1
|
||||
- {{ ansible_default_ipv4.address }}:8443
|
||||
- localhost
|
||||
disabledFeatures: null
|
||||
dnsConfig:
|
||||
bindAddress: 0.0.0.0:53
|
||||
bindNetwork: tcp4
|
||||
etcdClientInfo:
|
||||
ca: ca.crt
|
||||
certFile: master.etcd-client.crt
|
||||
keyFile: master.etcd-client.key
|
||||
urls:
|
||||
- https://{{ ansible_default_ipv4.address }}:4001
|
||||
etcdConfig:
|
||||
address: {{ ansible_default_ipv4.address }}:4001
|
||||
peerAddress: {{ ansible_default_ipv4.address }}:7001
|
||||
peerServingInfo:
|
||||
bindAddress: 0.0.0.0:7001
|
||||
bindNetwork: tcp4
|
||||
certFile: etcd.server.crt
|
||||
clientCA: ca.crt
|
||||
keyFile: etcd.server.key
|
||||
namedCertificates: null
|
||||
servingInfo:
|
||||
bindAddress: 0.0.0.0:4001
|
||||
bindNetwork: tcp4
|
||||
certFile: etcd.server.crt
|
||||
clientCA: ca.crt
|
||||
keyFile: etcd.server.key
|
||||
namedCertificates: null
|
||||
storageDirectory: /var/lib/origin/openshift.local.etcd
|
||||
etcdStorageConfig:
|
||||
kubernetesStoragePrefix: kubernetes.io
|
||||
kubernetesStorageVersion: v1
|
||||
openShiftStoragePrefix: openshift.io
|
||||
openShiftStorageVersion: v1
|
||||
imageConfig:
|
||||
format: openshift/origin-${component}:${version}
|
||||
latest: false
|
||||
imagePolicyConfig:
|
||||
disableScheduledImport: false
|
||||
maxImagesBulkImportedPerRepository: 5
|
||||
maxScheduledImageImportsPerMinute: 60
|
||||
scheduledImageImportMinimumIntervalSeconds: 900
|
||||
kind: MasterConfig
|
||||
kubeletClientInfo:
|
||||
ca: ca.crt
|
||||
certFile: master.kubelet-client.crt
|
||||
keyFile: master.kubelet-client.key
|
||||
port: 10250
|
||||
kubernetesMasterConfig:
|
||||
admissionConfig:
|
||||
pluginConfig: null
|
||||
apiLevels: null
|
||||
apiServerArguments: null
|
||||
controllerArguments: null
|
||||
disabledAPIGroupVersions: {}
|
||||
masterCount: 1
|
||||
masterIP: {{ ansible_default_ipv4.address }}
|
||||
podEvictionTimeout: 5m
|
||||
proxyClientInfo:
|
||||
certFile: master.proxy-client.crt
|
||||
keyFile: master.proxy-client.key
|
||||
schedulerConfigFile: ""
|
||||
servicesNodePortRange: 30000-32767
|
||||
servicesSubnet: 172.30.0.0/16
|
||||
staticNodeNames:
|
||||
- {{ inventory_hostname }}
|
||||
masterClients:
|
||||
externalKubernetesKubeConfig: ""
|
||||
openshiftLoopbackKubeConfig: openshift-master.kubeconfig
|
||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
||||
networkConfig:
|
||||
clusterNetworkCIDR: 10.1.0.0/16
|
||||
hostSubnetLength: 8
|
||||
networkPluginName: ""
|
||||
serviceNetworkCIDR: 172.30.0.0/16
|
||||
oauthConfig:
|
||||
assetPublicURL: https://{{ ansible_default_ipv4.address }}:8443/console/
|
||||
grantConfig:
|
||||
method: auto
|
||||
identityProviders:
|
||||
{% if osbs_identity_provider == "request_header" %}
|
||||
- name: {{ osbs_identity_request.name }}
|
||||
challenge: {{ osbs_identity_request.challenge }}
|
||||
login: {{ osbs_identity_request.login }}
|
||||
provider:
|
||||
apiVersion: v1
|
||||
kind: RequestHeaderIdentityProvider
|
||||
clientCA: {{ osbs_proxy_ca_file | default('/etc/origin/master/ca.crt') }}
|
||||
headers:
|
||||
- X-Remote-User
|
||||
{% endif %}
|
||||
{% if osbs_identity_provider == "htpasswd_provider" %}
|
||||
- name: {{ osbs_identity_htpasswd.name }}
|
||||
challenge: {{ osbs_identity_htpasswd.challenge }}
|
||||
login: {{ osbs_identity_htpasswd.login }}
|
||||
provider:
|
||||
apiVersion: v1
|
||||
kind: HTPasswdPasswordIdentityProvider
|
||||
file: {{ osbs_identity_htpasswd.provider_file }}
|
||||
{% endif %}
|
||||
masterCA: ca.crt
|
||||
masterPublicURL: https://{{ ansible_default_ipv4.address }}:8443
|
||||
masterURL: https://{{ ansible_default_ipv4.address }}:8443
|
||||
sessionConfig:
|
||||
sessionMaxAgeSeconds: 300
|
||||
sessionName: ssn
|
||||
sessionSecretsFile: ""
|
||||
templates: null
|
||||
tokenConfig:
|
||||
accessTokenMaxAgeSeconds: 86400
|
||||
authorizeTokenMaxAgeSeconds: 300
|
||||
pauseControllers: false
|
||||
policyConfig:
|
||||
bootstrapPolicyFile: policy.json
|
||||
openshiftInfrastructureNamespace: openshift-infra
|
||||
openshiftSharedResourcesNamespace: openshift
|
||||
projectConfig:
|
||||
defaultNodeSelector: ""
|
||||
projectRequestMessage: ""
|
||||
projectRequestTemplate: ""
|
||||
securityAllocator:
|
||||
mcsAllocatorRange: s0:/2
|
||||
mcsLabelsPerProject: 5
|
||||
uidAllocatorRange: 1000000000-1999999999/10000
|
||||
routingConfig:
|
||||
subdomain: router.default.svc.cluster.local
|
||||
serviceAccountConfig:
|
||||
limitSecretReferences: false
|
||||
managedNames:
|
||||
- default
|
||||
- builder
|
||||
- deployer
|
||||
masterCA: ca.crt
|
||||
privateKeyFile: serviceaccounts.private.key
|
||||
publicKeyFiles:
|
||||
- serviceaccounts.public.key
|
||||
servingInfo:
|
||||
bindAddress: 0.0.0.0:8443
|
||||
bindNetwork: tcp4
|
||||
certFile: master.server.crt
|
||||
clientCA: ca.crt
|
||||
keyFile: master.server.key
|
||||
maxRequestsInFlight: 500
|
||||
requestTimeoutSeconds: 3600
|
||||
{%if osbs_named_certificates.enabled %}
|
||||
namedCertificates:
|
||||
- certFile: {{ osbs_named_certificates.cert_file }}
|
||||
keyFile: {{ osbs_named_certificates.key_file }}
|
||||
names:
|
||||
{% for name in osbs_named_certificates.names %}
|
||||
- {{ name }}
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
namedCertificates: null
|
||||
{% endif %}
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
allowDisabledDocker: false
|
||||
apiVersion: v1
|
||||
authConfig:
|
||||
authenticationCacheSize: 1000
|
||||
authenticationCacheTTL: 5m
|
||||
authorizationCacheSize: 1000
|
||||
authorizationCacheTTL: 5m
|
||||
dnsDomain: cluster.local
|
||||
dnsIP: ""
|
||||
dockerConfig:
|
||||
execHandlerName: native
|
||||
imageConfig:
|
||||
format: openshift/origin-${component}:${version}
|
||||
latest: false
|
||||
iptablesSyncPeriod: 5s
|
||||
kind: NodeConfig
|
||||
masterKubeConfig: node.kubeconfig
|
||||
networkConfig:
|
||||
mtu: 1450
|
||||
networkPluginName: ""
|
||||
nodeIP: ""
|
||||
nodeName: localhost
|
||||
podManifestConfig: null
|
||||
servingInfo:
|
||||
bindAddress: 0.0.0.0:10250
|
||||
bindNetwork: tcp4
|
||||
certFile: server.crt
|
||||
clientCA: node-client-ca.crt
|
||||
keyFile: server.key
|
||||
namedCertificates: null
|
||||
volumeDirectory: /var/lib/origin/openshift.local.volumes
|
||||
kubeletArguments:
|
||||
image-gc-high-threshold:
|
||||
- "{{ osbs_image_gc_high_threshold }}"
|
||||
image-gc-low-threshold:
|
||||
- "{{ osbs_image_gc_low_threshold }}"
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ResourceQuota
|
||||
metadata:
|
||||
name: concurrentbuilds
|
||||
spec:
|
||||
hard:
|
||||
pods: {{ osbs_master_max_pods }}
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ item.name }}
|
||||
roleRef:
|
||||
name: {{ item.role }}
|
||||
|
||||
{% if item.users == [] %}
|
||||
userNames: []
|
||||
{% else %}
|
||||
userNames:
|
||||
{% for u in item.users %}
|
||||
- {{u}}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if item.groups == [] %}
|
||||
groupNames: []
|
||||
{% else %}
|
||||
groupNames:
|
||||
{% for g in item.groups %}
|
||||
- {{g}}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# This file was installed by ansible from role osbs-master.
|
||||
|
||||
import os
|
||||
import re
|
||||
import shutil
|
||||
import syslog
|
||||
|
||||
import koji
|
||||
|
||||
SERVER = '{{ osbs_export_koji_hub }}'
|
||||
PARENT = '{{ osbs_export_dir }}'
|
||||
|
||||
session = koji.ClientSession(SERVER)
|
||||
|
||||
|
||||
syslog.openlog('remove-finished-docker-tarball')
|
||||
|
||||
for task_dir in os.listdir(PARENT):
|
||||
if not task_dir.startswith('task-'):
|
||||
continue
|
||||
|
||||
match = re.match('^task-(\d+)$', task_dir)
|
||||
if not match:
|
||||
continue
|
||||
task_id = int(match.group(1))
|
||||
|
||||
if not task_id:
|
||||
continue
|
||||
|
||||
children_tasks = session.getTaskInfo(task_id)
|
||||
if 'parent' not in children_tasks or children_tasks['parent'] is None:
|
||||
continue
|
||||
parent_task_id = children_tasks['parent']
|
||||
builds = session.listBuilds(taskID=parent_task_id)
|
||||
|
||||
for build in builds:
|
||||
build['state'] = koji.BUILD_STATES.get(build['state'], 'BADSTATE')
|
||||
|
||||
if build['state'] in ('BUILDING', 'BADSTATE'):
|
||||
continue
|
||||
|
||||
|
||||
image_msg = '%s %s %s' % (task_id, build['build_id'], build['state'])
|
||||
|
||||
full_path = os.path.join(PARENT, task_dir)
|
||||
try:
|
||||
syslog.syslog('Removing %s (%s)' % (full_path, image_msg))
|
||||
shutil.rmtree(full_path)
|
||||
except OSError, exception:
|
||||
syslog.syslog('Failed to remove %s (%s): %s' % (full_path,
|
||||
image_msg,
|
||||
exception))
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# Modify these options if you want to change the way the docker daemon runs
|
||||
OPTIONS='--selinux-enabled'
|
||||
|
||||
DOCKER_CERT_PATH=/etc/docker
|
||||
|
||||
# If you want to add your own registry to be used for docker search and docker pull use the
|
||||
# ADD_REGISTRY option to list a set of comma separated registries.
|
||||
# Note the last registry added will be the first regisry searched.
|
||||
ADD_REGISTRY=''
|
||||
|
||||
# If you want to block registries from being used, use the
|
||||
# BLOCK_REGISTRY option to list a set of comma separated registries, and uncommenting
|
||||
# it. For example adding docker.io will stop users from downloading images from docker.io
|
||||
# BLOCK_REGISTRY='--block-registry public'
|
||||
|
||||
# If you have a registry secured with https but do not have proper certs destributed, you can
|
||||
# tell docker to not look for full authorization by adding the registry to the
|
||||
# INSECURE_REGISTRY line and uncommentin it.
|
||||
INSECURE_REGISTRY='
|
||||
{%- for r in osbs_docker_insecure_registries %} --insecure-registry {{ r }}
|
||||
{%- endfor %}'
|
||||
|
||||
# On an SELinux system, if you remove the --selinux-enabled option, you
|
||||
# also need to turn on the docker_transition_unconfined boolean.
|
||||
# setsebool -P docker_transition_unconfined 1
|
||||
|
||||
# Location used for temporary files, such as those created by
|
||||
# docker load and build operations. Default is /var/lib/docker/tmp
|
||||
# Can be overriden by setting the following environment variable.
|
||||
# DOCKER_TMPDIR=/var/tmp
|
||||
|
||||
# Controls the /etc/cron.daily/docker-logrotate cron job status.
|
||||
# To disable, uncomment the line below.
|
||||
# LOGROTATE=false
|
||||
|
||||
GOTRACEBACK='crash'
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
OPTIONS="--loglevel=3"
|
||||
CONFIG_FILE=/etc/origin/master/master-config.yaml
|
||||
|
||||
# Proxy configuration
|
||||
# Origin uses standard HTTP_PROXY environment variables. Be sure to set
|
||||
# NO_PROXY for your master
|
||||
#NO_PROXY=master.example.com
|
||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
OPTIONS="--loglevel={{osbs_openshift_loglevel}}"
|
||||
CONFIG_FILE=/etc/origin/master/master-config.yaml
|
||||
|
||||
# Proxy configuration
|
||||
# Origin uses standard HTTP_PROXY environment variables. Be sure to set
|
||||
# NO_PROXY for your master
|
||||
#NO_PROXY=master.example.com
|
||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
OPTIONS="--loglevel=3"
|
||||
# /etc/origin/node/ should contain the entire contents of
|
||||
# /var/lib/origin.local.certificates/node-${node-fqdn} generated by
|
||||
# running 'atomic-enterprise admin create-node-config' on your master
|
||||
#
|
||||
# If if your node is running on a separate host you can rsync the contents
|
||||
# rsync -a root@atomic-enterprise-master:/var/lib/origin/origin.local.certificates/node-`hostname`/ /etc/origin/node
|
||||
CONFIG_FILE=/etc/origin/node/node-config.yaml
|
||||
|
||||
# The $DOCKER_NETWORK_OPTIONS variable is used by sdn plugins to set
|
||||
# $DOCKER_NETWORK_OPTIONS variable in the /etc/sysconfig/docker-network
|
||||
# Most plugins include their own defaults within the scripts
|
||||
# TODO: More elegant solution like this
|
||||
# https://github.com/coreos/flannel/blob/master/dist/mk-docker-opts.sh
|
||||
# DOCKER_NETWORK_OPTIONS='-b=lbr0 --mtu=1450'
|
||||
|
||||
# Proxy configuration
|
||||
# Origin uses standard HTTP_PROXY environment variables. Be sure to set
|
||||
# NO_PROXY for your master
|
||||
#NO_PROXY=master.example.com
|
||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
OPTIONS="--loglevel={{osbs_openshift_loglevel}}"
|
||||
# /etc/origin/node/ should contain the entire contents of
|
||||
# /var/lib/origin.local.certificates/node-${node-fqdn} generated by
|
||||
# running 'atomic-enterprise admin create-node-config' on your master
|
||||
#
|
||||
# If if your node is running on a separate host you can rsync the contents
|
||||
# rsync -a root@atomic-enterprise-master:/var/lib/origin/origin.local.certificates/node-`hostname`/ /etc/origin/node
|
||||
CONFIG_FILE=/etc/origin/node/node-config.yaml
|
||||
|
||||
# The $DOCKER_NETWORK_OPTIONS variable is used by sdn plugins to set
|
||||
# $DOCKER_NETWORK_OPTIONS variable in the /etc/sysconfig/docker-network
|
||||
# Most plugins include their own defaults within the scripts
|
||||
# TODO: More elegant solution like this
|
||||
# https://github.com/coreos/flannel/blob/master/dist/mk-docker-opts.sh
|
||||
# DOCKER_NETWORK_OPTIONS='-b=lbr0 --mtu=1450'
|
||||
|
||||
# Proxy configuration
|
||||
# Origin uses standard HTTP_PROXY environment variables. Be sure to set
|
||||
# NO_PROXY for your master
|
||||
#NO_PROXY=master.example.com
|
||||
#HTTP_PROXY=http://USER:PASSWORD@IPADDR:PORT
|
||||
#HTTPS_PROXY=https://USER:PASSWORD@IPADDR:PORT
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
---
|
||||
osbs_openshift_home: /var/lib/origin
|
||||
osbs_openshift_port: 8443
|
||||
osbs_kubeconfig_path: /etc/origin/master/admin.kubeconfig
|
||||
|
||||
osbs_environment:
|
||||
KUBECONFIG: "{{ osbs_kubeconfig_path }}"
|
||||
|
||||
osbs_export_http_conf: /etc/httpd/conf.d/osbs_image_export.conf
|
||||
Loading…
Add table
Add a link
Reference in a new issue