openshift_hosted: Update tasks to use oc_ modules

roles/openshift_hosted/tasks/main.yml

@@ -4,7 +4,8 @@
   register: mktemp
   changed_when: False
 
-- set_fact:
+- name: set_fact openshift_hosted_kubeconfig
+  set_fact:
     openshift_hosted_kubeconfig: "{{ mktemp.stdout }}/admin.kubeconfig"
 
 - name: Copy the admin client config(s)

roles/openshift_hosted/tasks/registry/registry.yml

@@ -1,64 +1,68 @@
 ---
 - name: Retrieve list of openshift nodes matching registry selector
-  command: >
-    {{ openshift.common.client_binary }} --api-version='v1' -o json
-    get nodes -n default --config={{ openshift_hosted_kubeconfig }}
-    --selector={{ openshift.hosted.registry.selector | default('') }}
-  register: registry_nodes_json
-  changed_when: false
+  oc_obj:
+    state: list
+    kind: node
+    selector: "{{ openshift.hosted.registry.selector | default('') }}"
+  register: registry_nodes
   when: openshift.hosted.registry.replicas | default(none) is none
 
-- set_fact:
-    l_node_count: "{{ (registry_nodes_json.stdout | default('{\"items\":[]}') | from_json)['items'] | length }}"
+- name: set_fact l_node_count to number of nodes matching registry selector
+  set_fact:
+    l_node_count: "{{ registry_nodes.results.results[0]['items'] | length }}"
 
 # Determine the default number of registry/router replicas to use if no count
 # has been specified.
 # If no registry nodes defined, the default should be 0.
-- set_fact:
+- name: set_fact l_default_replicas when l_node_count == 0
+  set_fact:
     l_default_replicas: 0
   when: l_node_count | int == 0
 
 # If registry nodes are defined and the registry storage kind is
 # defined, default should be the number of registry nodes, otherwise
 # just 1:
-- set_fact:
+- name: set_fact l_default_replicas when l_node_count > 0
+  set_fact:
     l_default_replicas: "{{ l_node_count if openshift.hosted.registry.storage.kind | default(none) is not none else 1 }}"
   when: l_node_count | int > 0
 
-- set_fact:
+- name: set_fact replicas
+  set_fact:
     replicas: "{{ openshift.hosted.registry.replicas | default(l_default_replicas) }}"
 
 - name: Create OpenShift registry
-  command: >
-    {{ openshift.common.client_binary }} adm registry --create
-    --config={{ openshift_hosted_kubeconfig }}
-    {% if replicas > 1 -%}
-    --replicas={{ replicas }}
-    {% endif -%}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    --service-account=registry
-    {% if openshift.hosted.registry.selector | default(none) is not none -%}
-    --selector='{{ openshift.hosted.registry.selector }}'
-    {% endif -%}
-    {% if not openshift.common.version_gte_3_2_or_1_2 | bool -%}
-    --credentials={{ openshift_master_config_dir }}/openshift-registry.kubeconfig
-    {% endif -%}
-    {% if openshift.hosted.registry.registryurl | default(none) is not none -%}
-    --images='{{ openshift.hosted.registry.registryurl }}'
-    {% endif -%}
-  register: openshift_hosted_registry_results
-  changed_when: "'service exists' not in openshift_hosted_registry_results.stdout"
-  failed_when: "openshift_hosted_registry_results.rc != 0 and 'service exists' not in openshift_hosted_registry_results.stdout and 'deployment_config' not in openshift_hosted_registry_results.stderr and 'service' not in openshift_hosted_registry_results.stderr"
+  oc_adm_registry:
+    state: present
+    name: registry
+    namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+    selector: "{{ openshift.hosted.registry.selector }}"
+    replicas: "{{ replicas }}"
+    service_account: registry
+    images: "{{ openshift.hosted.registry.registryurl }}"
   when: replicas | int > 0
 
 - include: secure.yml
   static: no
-  when: replicas | int > 0 and not (openshift.docker.hosted_registry_insecure | default(false) | bool)
+  when:
+  - replicas | int > 0
+  - not (openshift.docker.hosted_registry_insecure | default(false) | bool)
 
 - include: storage/object_storage.yml
   static: no
-  when: replicas | int > 0 and openshift.hosted.registry.storage.kind | default(none) == 'object'
+  when:
+  - replicas | int > 0
+  - openshift.hosted.registry.storage.kind | default(none) == 'object'
 
-- include: storage/persistent_volume.yml
-  static: no
-  when: replicas | int > 0 and openshift.hosted.registry.storage.kind | default(none) in ['nfs', 'openstack']
+- name: Add persistent volume to dc/docker-registry
+  oc_adm_registry:
+    state: present
+    name: docker-registry
+    namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+    volume_mounts:
+    - name: registry-storage
+      type: persistentVolumeClaim
+      claim_name: "{{ openshift.hosted.registry.storage.volume.name }}-claim"
+  when:
+  - replicas | int > 0
+  - openshift.hosted.registry.storage.kind | default(none) in ['nfs', 'openstack']

roles/openshift_hosted/tasks/registry/secure.yml

@@ -1,49 +1,35 @@
 ---
 - name: Create passthrough route for docker-registry
   oc_route:
-    kubeconfig: "{{ openshift_hosted_kubeconfig }}"
     name: docker-registry
     namespace: default
     service_name: docker-registry
     state: present
     tls_termination: passthrough
   run_once: true
 
-- name: Determine if registry certificate must be created
-  stat:
-    path: "{{ openshift_master_config_dir }}/{{ item }}"
-  with_items:
-  - registry.crt
-  - registry.key
-  register: docker_registry_certificates_stat_result
-  changed_when: false
-  failed_when: false
-
 - name: Retrieve registry service IP
   oc_service:
     namespace: default
     name: docker-registry
     state: list
   register: docker_registry_service_ip
-  changed_when: false
 
-- set_fact:
+- name: Set fact docker_registry_route_hostname
+  set_fact:
     docker_registry_route_hostname: "{{ 'docker-registry-default.' ~ (openshift_master_default_subdomain | default('router.default.svc.cluster.local', true)) }}"
 
-- name: Create registry certificates if they do not exist
-  command: >
-    {{ openshift.common.client_binary }} adm ca create-server-cert
-    --signer-cert={{ openshift_master_config_dir }}/ca.crt
-    --signer-key={{ openshift_master_config_dir }}/ca.key
-    --signer-serial={{ openshift_master_config_dir }}/ca.serial.txt
-    --hostnames="{{ docker_registry_service_ip.results.clusterip }},docker-registry.default.svc.cluster.local,{{ docker_registry_route_hostname }}"
-    --cert={{ openshift_master_config_dir }}/registry.crt
-    --key={{ openshift_master_config_dir }}/registry.key
-  when: False in (docker_registry_certificates_stat_result.results | default([]) | oo_collect(attribute='stat.exists') | list)
+- name: Create registry certificates
+  oc_adm_ca_server_cert:
+    signer-cert: "{{ openshift_master_config_dir }}/ca.crt"
+    signer-key: "{{ openshift_master_config_dir }}/ca.key"
+    signer-serial: "{{ openshift_master_config_dir }}/ca.serial.txt"
+    hostnames: "{{ docker_registry_service_ip.results.clusterip }},docker-registry.default.svc.cluster.local,{{ docker_registry_route_hostname }}"
+    cert: "{{ openshift_master_config_dir }}/registry.crt"
+    key: "{{ openshift_master_config_dir }}/registry.key"
 
 - name: Create the secret for the registry certificates
   oc_secret:
-    kubeconfig: "{{ openshift_hosted_kubeconfig }}"
     name: registry-certificates
     namespace: default
     state: present
@@ -60,73 +46,26 @@
     service_account: "{{ item }}"
     secret: registry-certificates
     namespace: default
-    kubeconfig: "{{ openshift_hosted_kubeconfig  }}"
     state: present
   with_items:
   - registry
   - default
 
-- name: Determine if registry-certificates secret volume attached
-  command: >
-    {{ openshift.common.client_binary }} get dc/docker-registry
-    -o jsonpath='{.spec.template.spec.volumes[?(@.secret)].secret.secretName}'
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
-  register: docker_registry_volumes
-  changed_when: false
-  failed_when: "docker_registry_volumes.stdout != '' and 'secretName is not found' not in docker_registry_volumes.stdout and docker_registry_volumes.rc != 0"
-
-- name: Attach registry-certificates secret volume
-  command: >
-   {{ openshift.common.client_binary }} volume dc/docker-registry --add --type=secret
-   --secret-name=registry-certificates
-   -m /etc/secrets
-   --config={{ openshift_hosted_kubeconfig }}
-   -n default
-  when: "'registry-certificates' not in docker_registry_volumes.stdout"
-
-- name: Determine if registry environment variables must be set
-  command: >
-    {{ openshift.common.client_binary }} env dc/docker-registry
-    --list
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
-  register: docker_registry_env
-  changed_when: false
-
-- name: Configure certificates in registry deplomentConfig
-  command: >
-    {{ openshift.common.client_binary }} env dc/docker-registry
-    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt
-    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
-  when: "'REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt' not in docker_registry_env.stdout or 'REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key' not in docker_registry_env.stdout"
-
-- name: Determine if registry liveness probe scheme is HTTPS
-  command: >
-    {{ openshift.common.client_binary }} get dc/docker-registry
-    -o jsonpath='{.spec.template.spec.containers[*].livenessProbe.httpGet.scheme}'
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
-  register: docker_registry_liveness_probe
-  changed_when: false
-
-# This command is on a single line to preserve patch json.
-- name: Update registry liveness probe from HTTP to HTTPS
-  command: "{{ openshift.common.client_binary }} patch dc/docker-registry --api-version=v1 -p '{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"registry\",\"livenessProbe\":{\"httpGet\":{\"scheme\":\"HTTPS\"}}}]}}}}' --config={{ openshift_hosted_kubeconfig }} -n default"
-  when: "'HTTPS' not in docker_registry_liveness_probe.stdout"
-
-- name: Determine if registry readiness probe scheme is HTTPS
-  command: >
-    {{ openshift.common.client_binary }} get dc/docker-registry
-    -o jsonpath='{.spec.template.spec.containers[*].readinessProbe.httpGet.scheme}'
-    --config={{ openshift_hosted_kubeconfig }}
-    -n default
-  register: docker_registry_readiness_probe
-  changed_when: false
-
-# This command is on a single line to preserve patch json.
-- name: Update registry readiness probe from HTTP to HTTPS
-  command: "{{ openshift.common.client_binary }} patch dc/docker-registry --api-version=v1 -p '{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"registry\",\"readinessProbe\":{\"httpGet\":{\"scheme\":\"HTTPS\"}}}]}}}}' --config={{ openshift_hosted_kubeconfig }} -n default"
-  when: "'HTTPS' not in docker_registry_readiness_probe.stdout"
+- name: Update registry configuration
+  oc_adm_registry:
+    name: registry
+    namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+    volume_mounts:
+    - path: /etc/secrets
+      type: secret
+      secret_name: registry-certificates
+    env_vars:
+      REGISTRY_HTTP_TLS_CERTIFICATE: /etc/secrets/registry.crt
+      REGISTRY_HTTP_TLS_KEY: /etc/secrets/registry.key
+    edits:
+    - key: spec.template.spec.containers[0].livenessProbe.httpGet.scheme
+      value: HTTPS
+      action: put
+    - key: spec.template.spec.containers[0].readinessProbe.httpGet.scheme
+      value: HTTPS
+      action: put

roles/openshift_hosted/tasks/registry/storage/object_storage.yml

@@ -34,6 +34,7 @@
     same_storage_provider: "{{ (secrets.stdout|from_json)['metadata']['annotations']['provider'] | default(none) == openshift.hosted.registry.storage.provider }}"
   when: secrets.rc == 0
 
+# TODO (rteague): Not sure how to handle this one
 - name: Update registry config secret
   command: >
     {{ openshift.common.client_binary }}
@@ -44,6 +45,7 @@
   register: update_config_secret
   when: secrets.rc == 0 and (secrets.stdout|from_json)['data']['config.yml'] != registry_config and same_storage_provider | bool
 
+# TODO (rteague): Not sure how to handle this one
 - name: Create registry config secret
   shell: >
     echo '{{ registry_config_secret |to_json }}' |
@@ -58,48 +60,17 @@
     service_account: registry
     secret: "{{ registry_config_secret_name }}"
     namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
-    kubeconfig: "{{ openshift_hosted_kubeconfig }}"
     state: present
 
-- name: Determine if deployment config contains secrets
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    set volumes dc/docker-registry --list
-  register: volume
-  changed_when: false
-
 - name: Add secrets to registry deployment config
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    set volumes dc/docker-registry --add --name=docker-config -m /etc/registry
-    --type=secret --secret-name={{ registry_config_secret_name }}
-  when: registry_config_secret_name not in volume.stdout
-
-- name: Determine if registry environment variable needs to be created
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    set env --list dc/docker-registry
-  register: oc_env
-  changed_when: false
-
-- name: Add registry environment variable
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    set env dc/docker-registry REGISTRY_CONFIGURATION_PATH=/etc/registry/config.yml
-  when: "'REGISTRY_CONFIGURATION_PATH' not in oc_env.stdout"
-
-- name: Redeploy registry
-  command: >
-    {{ openshift.common.client_binary }}
-    --config={{ openshift_hosted_kubeconfig }}
-    --namespace={{ openshift.hosted.registry.namespace | default('default') }}
-    deploy dc/docker-registry --latest
-  when: secrets.rc == 0 and not update_config_secret | skipped and update_config_secret.rc == 0 and same_storage_provider | bool
+  oc_adm_registry:
+    state: present
+    name: docker-registry
+    namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+    volume_mounts:
+    - name: docker-config
+      path: /etc/secrets
+      type: secret
+      secret_name: "{{ registry_config_secret_name }}"
+    env_vars:
+      REGISTRY_CONFIGURATION_PATH: /etc/registry/config.yml

roles/openshift_hosted/tasks/registry/storage/s3.yml

@@ -35,13 +35,14 @@
           data: "{{ lookup('file', openshift_hosted_registry_storage_s3_cloudfront_privatekeyfile) }}"
 
     - name: Add cloudfront secret to the registry deployment config
-      command: >
-        oc volume dc/docker-registry --add --name=cloudfront-vol
-        --namespace="{{ openshift.hosted.registry.namespace | default('default') }}"
-        -m /etc/origin --type=secret --secret-name=docker-registry-s3-cloudfront
-      register: cloudfront_vol_attach
-      failed_when:
-        - "'already exists' not in cloudfront_vol_attach.stderr"
-        - "cloudfront_vol_attach.rc != 0"
+      oc_adm_registry:
+        state: present
+        name: docker-registry
+        namespace: "{{ openshift.hosted.registry.namespace | default('default') }}"
+        volume_mounts:
+          - name: cloudfront-vol
+            path: /etc/origin
+            type: secret
+            secret_name: docker-registry-s3-cloudfront
 
   when: openshift_hosted_registry_storage_s3_cloudfront_baseurl | default(none) is not none