-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor openshift_hosted's docker-registry route setup
We have identified an issue where a docker-registry service set up as 'reencrypt' with a provided certificate and a self-signed certificate on the pod does not authorize users to push images. If the docker-registry service is set up as 'passthrough' with the same provided certificate, everything works. In light of this, this commit essentially adds support for configuring provided certificates with a passthrough route while maintaining backwards compatibility with the other use cases. The default remains 'passthrough' with self-generated certificates. Other miscellaneous changes include: - Move fact setup that were only used in secure.yml there - Omit the hostname for the route if there are none to configure, oc_route takes care of handling the default - Replace hardcoded /etc/origin/master by openshift_master_config_dir
- Loading branch information
David Moreau-Simard
committed
May 19, 2017
1 parent
89669ff
commit 6212f4a
Showing
4 changed files
with
138 additions
and
60 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
roles/openshift_hosted/tasks/registry/secure/passthrough.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| --- | ||
| # Generate a self-signed certificate when there is no user-supplied certificate | ||
| - when: | ||
| - "'certfile' not in openshift_hosted_registry_routecertificates" | ||
| - "'keyfile' not in openshift_hosted_registry_routecertificates" | ||
| block: | ||
| - name: Configure self-signed certificate file paths | ||
| set_fact: | ||
| docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt" | ||
| docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key" | ||
|
|
||
| - name: Generate self-signed docker-registry certificates | ||
| oc_adm_ca_server_cert: | ||
| signer_cert: "{{ openshift_master_config_dir }}/ca.crt" | ||
| signer_key: "{{ openshift_master_config_dir }}/ca.key" | ||
| signer_serial: "{{ openshift_master_config_dir }}/ca.serial.txt" | ||
| hostnames: | ||
| - "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}" | ||
| - "{{ docker_registry_service.results.clusterip }}" | ||
| - "{{ openshift_hosted_registry_name }}.default.svc" | ||
| - "{{ openshift_hosted_registry_name }}.default.svc.{{ openshift.common.dns_domain }}" | ||
| - "{{ openshift_hosted_registry_routehost | default(omit) }}" | ||
| cert: "{{ docker_registry_cert_path }}" | ||
| key: "{{ docker_registry_key_path }}" | ||
| expire_days: "{{ openshift_hosted_registry_cert_expire_days if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool else omit }}" | ||
| register: registry_self_cert_passthrough | ||
|
|
||
| # Retrieve user supplied certificate files if they are provided | ||
| - when: | ||
| - "'certfile' in openshift_hosted_registry_routecertificates" | ||
| - "'keyfile' in openshift_hosted_registry_routecertificates" | ||
| block: | ||
| - name: Warn about providing 'cafile' with 'certfile' on a passthrough route | ||
| fail: | ||
| msg: | | ||
| docker-registry setup on passthrough route with a provided | ||
| certificate only requires two files: the certificate and the private key. | ||
| If you need to provide a certificate chain (intermediary or certificate | ||
| authority), bundle it with your certificate file. | ||
| when: "'cafile' in openshift_hosted_registry_routecertificates" | ||
|
|
||
| - name: Configure provided certificate file paths | ||
| set_fact: | ||
| docker_registry_cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}" | ||
| docker_registry_key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}" | ||
|
|
||
| - name: Retrieve provided certificate files | ||
| copy: | ||
| backup: True | ||
| dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}" | ||
| src: "{{ item.value }}" | ||
| when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value | ||
| with_dict: "{{ openshift_hosted_registry_routecertificates }}" | ||
|
|
||
| - name: Configure a passthrough route for docker-registry | ||
| oc_route: | ||
| name: docker-registry | ||
| namespace: "{{ openshift_hosted_registry_namespace }}" | ||
| service_name: docker-registry | ||
| tls_termination: "{{ openshift_hosted_registry_routetermination }}" | ||
| host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}" |
52 changes: 52 additions & 0 deletions
52
roles/openshift_hosted/tasks/registry/secure/reencrypt.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| --- | ||
| - name: Validate route termination configuration | ||
| fail: | ||
| msg: > | ||
| When 'openshift_hosted_registry_routetermination' is 'reencrypt', you must | ||
| provide certificate files with 'openshift_hosted_registry_routecertificates' | ||
| when: ('certfile' not in openshift_hosted_registry_routecertificates) or | ||
| ('keyfile' not in openshift_hosted_registry_routecertificates) or | ||
| ('cafile' not in openshift_hosted_registry_routecertificates) | ||
|
|
||
| - name: Configure self-signed certificate file paths | ||
| set_fact: | ||
| docker_registry_cert_path: "{{ openshift_master_config_dir }}/registry.crt" | ||
| docker_registry_key_path: "{{ openshift_master_config_dir }}/registry.key" | ||
|
|
||
| - name: Generate self-signed docker-registry certificates | ||
| oc_adm_ca_server_cert: | ||
| signer_cert: "{{ openshift_master_config_dir }}/ca.crt" | ||
| signer_key: "{{ openshift_master_config_dir }}/ca.key" | ||
| signer_serial: "{{ openshift_master_config_dir }}/ca.serial.txt" | ||
| hostnames: | ||
| - "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}" | ||
| - "{{ docker_registry_service.results.clusterip }}" | ||
| - "{{ openshift_hosted_registry_name }}.default.svc" | ||
| - "{{ openshift_hosted_registry_name }}.default.svc.{{ openshift.common.dns_domain }}" | ||
| - "{{ openshift_hosted_registry_routehost | default(omit) }}" | ||
| cert: "{{ docker_registry_cert_path }}" | ||
| key: "{{ docker_registry_key_path }}" | ||
| expire_days: "{{ openshift_hosted_registry_cert_expire_days if openshift_version | oo_version_gte_3_5_or_1_5(openshift.common.deployment_type) | bool else omit }}" | ||
| register: registry_self_cert_reencrypt | ||
|
|
||
| - name: Retrieve provided certificate files | ||
| copy: | ||
| backup: True | ||
| dest: "{{ openshift_master_config_dir }}/named_certificates/{{ item.value | basename }}" | ||
| src: "{{ item.value }}" | ||
| when: item.key in ['certfile', 'keyfile', 'cafile'] and item.value | ||
| with_dict: "{{ openshift_hosted_registry_routecertificates }}" | ||
|
|
||
| # Encrypt with the provided certificate and provide the dest_cacert for the | ||
| # self-signed certificate at the endpoint | ||
| - name: Configure a reencrypt route for docker-registry | ||
| oc_route: | ||
| name: docker-registry | ||
| namespace: "{{ openshift_hosted_registry_namespace }}" | ||
| service_name: docker-registry | ||
| tls_termination: "{{ openshift_hosted_registry_routetermination }}" | ||
| host: "{{ openshift_hosted_registry_routehost | default(omit, true) }}" | ||
| cert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}" | ||
| key_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}" | ||
| cacert_path: "{{ openshift_master_config_dir }}/named_certificates/{{ openshift_hosted_registry_routecertificates['cafile'] | basename }}" | ||
| dest_cacert_path: "{{ openshift_master_config_dir }}/ca.crt" |