diff options
author | Nick Bartos <flamingo@2thebatcave.com> | 2017-12-05 15:02:52 +1100 |
---|---|---|
committer | Nick Bartos <flamingo@2thebatcave.com> | 2018-01-08 07:44:35 +1100 |
commit | 6daf71565fd69e9ddb2ac20e787d49f74cf7a9d7 (patch) | |
tree | 217ed334a99474d8307a65c75a4c864acbabf7d8 /roles/contiv/tasks/download_bins.yml | |
parent | a5eee09d02120bb16d7f81d1b05982e1a69df4dc (diff) | |
download | openshift-6daf71565fd69e9ddb2ac20e787d49f74cf7a9d7.tar.gz openshift-6daf71565fd69e9ddb2ac20e787d49f74cf7a9d7.tar.bz2 openshift-6daf71565fd69e9ddb2ac20e787d49f74cf7a9d7.tar.xz openshift-6daf71565fd69e9ddb2ac20e787d49f74cf7a9d7.zip |
Contiv multi-master and other fixes
Contiv's etcd was not being deployed correctly when using more than
one master. To make it easier to manage, it has been moved into a
k8s container.
The api proxy was hardcoded to an old version (1.1.1), and in some
environments would run into a docker error. This has been moved into
a k8s container for easier management.
The firewall was too permissive on several ports. Many were open to
the world when they should have only been accessible inside the
cluster.
Many of the contiv role variables were not prefixed with 'contiv',
which may end up clobbering variables from another role. Now all the
contiv specific role variables start with 'contiv_'.
The api proxy's default self-signed certificate was bundled with the
role. This means someone with read-only MITM access and this key
could decrypt traffic. Granted a user defined certificate from a
trusted CA should be used in a production environment, it is still
better to generate one in each environment when one is not provided.
Diffstat (limited to 'roles/contiv/tasks/download_bins.yml')
-rw-r--r-- | roles/contiv/tasks/download_bins.yml | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/roles/contiv/tasks/download_bins.yml b/roles/contiv/tasks/download_bins.yml index 831fd360a..47d74da9c 100644 --- a/roles/contiv/tasks/download_bins.yml +++ b/roles/contiv/tasks/download_bins.yml @@ -4,7 +4,7 @@ path: "{{ contiv_current_release_directory }}" state: directory -- name: Install bzip2 +- name: Download Bins | Install bzip2 yum: name: bzip2 state: installed @@ -18,9 +18,9 @@ mode: 0755 validate_certs: False environment: - http_proxy: "{{ http_proxy|default('') }}" - https_proxy: "{{ https_proxy|default('') }}" - no_proxy: "{{ no_proxy|default('') }}" + http_proxy: "{{ contiv_http_proxy|default('') }}" + https_proxy: "{{ contiv_https_proxy|default('') }}" + no_proxy: "{{ contiv_no_proxy|default('') }}" - name: Download Bins | Extract Contiv tar file unarchive: @@ -30,19 +30,19 @@ - name: Download Bins | Download cni tar file get_url: - url: "{{ cni_bin_url }}" - dest: "{{ cni_download_dir }}" + url: "{{ contiv_cni_bin_url }}" + dest: "{{ contiv_cni_download_dir }}" mode: 0755 validate_certs: False environment: - http_proxy: "{{ http_proxy|default('') }}" - https_proxy: "{{ https_proxy|default('') }}" - no_proxy: "{{ no_proxy|default('') }}" + http_proxy: "{{ contiv_http_proxy|default('') }}" + https_proxy: "{{ contiv_https_proxy|default('') }}" + no_proxy: "{{ contiv_no_proxy|default('') }}" register: download_file - name: Download Bins | Extract cni tar file unarchive: src: "{{ download_file.dest }}" - dest: "{{ cni_download_dir }}" + dest: "{{ contiv_cni_download_dir }}" copy: no when: download_file.changed |