Generate wildcard router certificate

[enoodle]

Conditioned on openshift_hosted_router_create_certificate=true.
Covers *.{{openshift_master_default_subdomain}},
in particular makes hawkular-metrics route have good cert out of the box.

resubmitting of #3226

[openshift-bot]

Can one of the admins verify this patch?
I understand the following commands:

• bot, add author to whitelist
• bot, test pull request
• bot, test pull request once

[cben]

cc @mtnbikenc @detiber

[enoodle]

@mtnbikenc @detiber can you please take a look?
@kwoodson I had to touch the ansible module to prevent it from crushing on me, can you talk a look please?

[kwoodson]

@enoodle @mtnbikenc
Would prefer to move the cert generation to an include in order to keep the logic in the main router.yml the same and accomplish the same goal by setting fact in the included tasks. Something like this:

https://github.com/kwoodson/openshift-ansible/blob/default_router_cert/roles/openshift_hosted/tasks/router/router.yml

https://github.com/kwoodson/openshift-ansible/blob/default_router_cert/roles/openshift_hosted/tasks/router/wildcard_router_cert.yml

If you'd prefer that I close this PR and open another against my branch we can.

[kwoodson]

These changes need to make it into the src file as the module file (the file under /library/) is autogenerated.

https://github.com/openshift/openshift-ansible/blob/master/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py#L80-L80

Then you can call roles/lib_openshift/src/generate.py to rebuild the lib_openshift/library/ code.

[kwoodson]

I made these changes under my branch.

[enoodle]

@kwoodson I need this change to allow SSO to Kibana from ManageIQ. In ManageIQ we ask the user to give us the main Openshift CA if he wants to authenticate with it. If the router's certificates do not include a wildcard to use with the logging routes, ManageIQ won't be able to authenticate the router through it and we won't be able to securely initiate the SSO.

I would be happy for you to take over with your branch. You seem to know your way around here better than I do :)
Could you please check in your branch if you don't need something similar to [1] to use the certificates default location? (using the new facts that you created? 👍 ).

[1]https://github.com/enoodle/openshift-ansible/blob/e8aeeef35608b06cd92de9b2f88d6e3a84d5f60e/roles/openshift_hosted/tasks/router/router.yml#L72-L74

[kwoodson]

@enoodle, I can take this over.

Could you please check in your branch if you don't need something similar to [1] to use the certificates default location? (using the new facts that you created? 👍 ).

In theory the set_fact in the wildcard router task include sets the openshift_hosted_router_certificates that are used for the openshift_hosted_routers and thus this will wind up taking the ('/etc/origin/master/' ~ (item.certificates.certfile | basename)) which should result in what we want.

#3821