diff options
| author | Andrew Butcher <abutcher@redhat.com> | 2016-09-26 10:36:02 -0400 |
|---|---|---|
| committer | Samuel Munilla <smunilla@redhat.com> | 2016-09-29 15:35:40 -0400 |
| commit | 6826f27769563d30194818a0f13b9da086ddf7ab (patch) | |
| tree | aadb0d4868d9f98e4d513e3b79b9636730083d2e /roles | |
| parent | 4b102facfb32e4de14147fcbbe97626c4e08e264 (diff) | |
| download | openshift-6826f27769563d30194818a0f13b9da086ddf7ab.tar.gz openshift-6826f27769563d30194818a0f13b9da086ddf7ab.tar.bz2 openshift-6826f27769563d30194818a0f13b9da086ddf7ab.tar.xz openshift-6826f27769563d30194818a0f13b9da086ddf7ab.zip | |
Further secure registry improvements
- Default to hosted_registry_insecure=False
- Add openshift ca to system ca-trust.
- Update ca trust in openshift_node_certificates rather than docker_ca_trust
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/openshift_docker_facts/tasks/main.yml | 2 | ||||
| -rw-r--r-- | roles/openshift_node_certificates/handlers/main.yml | 10 | ||||
| -rw-r--r-- | roles/openshift_node_certificates/tasks/main.yml | 11 |
3 files changed, 22 insertions, 1 deletions
diff --git a/roles/openshift_docker_facts/tasks/main.yml b/roles/openshift_docker_facts/tasks/main.yml index 0ce142983..0c8a36d65 100644 --- a/roles/openshift_docker_facts/tasks/main.yml +++ b/roles/openshift_docker_facts/tasks/main.yml @@ -13,7 +13,7 @@ log_options: "{{ openshift_docker_log_options | default(None) }}" options: "{{ openshift_docker_options | default(None) }}" disable_push_dockerhub: "{{ openshift_disable_push_dockerhub | default(None) }}" - hosted_registry_insecure: "{{ openshift_docker_hosted_registry_insecure | default(openshift.common.deployment_subtype != 'registry') }}" + hosted_registry_insecure: "{{ openshift_docker_hosted_registry_insecure | default(False) }}" hosted_registry_network: "{{ openshift_docker_hosted_registry_network | default(None) }}" - set_fact: diff --git a/roles/openshift_node_certificates/handlers/main.yml b/roles/openshift_node_certificates/handlers/main.yml new file mode 100644 index 000000000..f2299cecf --- /dev/null +++ b/roles/openshift_node_certificates/handlers/main.yml @@ -0,0 +1,10 @@ +--- +- name: update ca trust + command: update-ca-trust + notify: + - restart docker after updating ca trust + +- name: restart docker after updating ca trust + service: + name: docker + state: restarted diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml index a729b4d6c..80ab4bb1d 100644 --- a/roles/openshift_node_certificates/tasks/main.yml +++ b/roles/openshift_node_certificates/tasks/main.yml @@ -124,3 +124,14 @@ when: node_certs_missing | bool delegate_to: localhost become: no + +- name: Copy OpenShift CA to system CA trust + copy: + src: "{{ item.cert }}" + dest: "/etc/pki/ca-trust/source/anchors/{{ item.id }}-{{ item.cert | basename }}" + remote_src: yes + with_items: + - id: openshift + cert: "{{ openshift_node_cert_dir }}/ca.crt" + notify: + - update ca trust |