1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
---
- name: Retrieving the cert to use when generating secrets for the logging components
slurp: src="{{generated_certs_dir}}/{{item.file}}"
register: key_pairs
with_items:
- { name: "ca_file", file: "ca.crt" }
- { name: "kibana_key", file: "system.logging.kibana.key"}
- { name: "kibana_cert", file: "system.logging.kibana.crt"}
- { name: "curator_key", file: "system.logging.curator.key"}
- { name: "curator_cert", file: "system.logging.curator.crt"}
- { name: "fluentd_key", file: "system.logging.fluentd.key"}
- { name: "fluentd_cert", file: "system.logging.fluentd.crt"}
- { name: "kibana_internal_key", file: "kibana-internal.key"}
- { name: "kibana_internal_cert", file: "kibana-internal.crt"}
- { name: "server_tls", file: "server-tls.json"}
- name: Generating secrets for logging components
template: src=secret.j2 dest={{mktemp.stdout}}/templates/{{secret_name}}-secret.yaml
vars:
secret_name: "logging-{{component}}"
secret_key_file: "{{component}}_key"
secret_cert_file: "{{component}}_cert"
secrets:
- {key: ca, value: "{{key_pairs | entry_from_named_pair('ca_file')| b64decode }}"}
- {key: key, value: "{{key_pairs | entry_from_named_pair(secret_key_file)| b64decode }}"}
- {key: cert, value: "{{key_pairs | entry_from_named_pair(secret_cert_file)| b64decode }}"}
secret_keys: ["ca", "cert", "key"]
with_items:
- kibana
- curator
- fluentd
loop_control:
loop_var: component
check_mode: no
changed_when: no
- name: Retrieving the cert to use when generating secrets for mux
slurp: src="{{generated_certs_dir}}/{{item.file}}"
register: mux_key_pairs
with_items:
- { name: "ca_file", file: "ca.crt" }
- { name: "mux_key", file: "system.logging.mux.key"}
- { name: "mux_cert", file: "system.logging.mux.crt"}
- { name: "mux_shared_key", file: "mux_shared_key"}
when: openshift_logging_use_mux
- name: Generating secrets for mux
template: src=secret.j2 dest={{mktemp.stdout}}/templates/{{secret_name}}-secret.yaml
vars:
secret_name: "logging-{{component}}"
secret_key_file: "{{component}}_key"
secret_cert_file: "{{component}}_cert"
secrets:
- {key: ca, value: "{{mux_key_pairs | entry_from_named_pair('ca_file')| b64decode }}"}
- {key: key, value: "{{mux_key_pairs | entry_from_named_pair(secret_key_file)| b64decode }}"}
- {key: cert, value: "{{mux_key_pairs | entry_from_named_pair(secret_cert_file)| b64decode }}"}
- {key: shared_key, value: "{{mux_key_pairs | entry_from_named_pair('mux_shared_key')| b64decode }}"}
secret_keys: ["ca", "cert", "key", "shared_key"]
with_items:
- mux
loop_control:
loop_var: component
check_mode: no
changed_when: no
when: openshift_logging_use_mux
- name: Generating secrets for kibana proxy
template: src=secret.j2 dest={{mktemp.stdout}}/templates/{{secret_name}}-secret.yaml
vars:
secret_name: logging-kibana-proxy
secrets:
- {key: oauth-secret, value: "{{oauth_secret}}"}
- {key: session-secret, value: "{{session_secret}}"}
- {key: server-key, value: "{{kibana_key_file}}"}
- {key: server-cert, value: "{{kibana_cert_file}}"}
- {key: server-tls.json, value: "{{server_tls_file}}"}
secret_keys: ["server-tls.json", "server-key", "session-secret", "oauth-secret", "server-cert"]
kibana_key_file: "{{key_pairs | entry_from_named_pair('kibana_internal_key')| b64decode }}"
kibana_cert_file: "{{key_pairs | entry_from_named_pair('kibana_internal_cert')| b64decode }}"
server_tls_file: "{{key_pairs | entry_from_named_pair('server_tls')| b64decode }}"
check_mode: no
changed_when: no
- name: Generating secrets for elasticsearch
command: >
{{openshift.common.client_binary}} --config={{ mktemp.stdout }}/admin.kubeconfig secrets new {{secret_name}}
key={{generated_certs_dir}}/logging-es.jks truststore={{generated_certs_dir}}/truststore.jks
searchguard.key={{generated_certs_dir}}/elasticsearch.jks searchguard.truststore={{generated_certs_dir}}/truststore.jks
admin-key={{generated_certs_dir}}/system.admin.key admin-cert={{generated_certs_dir}}/system.admin.crt
admin-ca={{generated_certs_dir}}/ca.crt admin.jks={{generated_certs_dir}}/system.admin.jks -o yaml
vars:
secret_name: logging-elasticsearch
secret_keys: ["admin-cert", "searchguard.key", "admin-ca", "key", "truststore", "admin-key", "searchguard.truststore"]
register: logging_es_secret
check_mode: no
changed_when: no
- copy: content="{{logging_es_secret.stdout}}" dest={{mktemp.stdout}}/templates/logging-elasticsearch-secret.yaml
when: logging_es_secret.stdout is defined
check_mode: no
changed_when: no
- name: Retrieving the cert to use when generating secrets for Elasticsearch external route
slurp: src="{{generated_certs_dir}}/{{item.file}}"
register: es_key_pairs
with_items:
- { name: "ca_file", file: "ca.crt" }
- { name: "es_key", file: "system.logging.es.key"}
- { name: "es_cert", file: "system.logging.es.crt"}
when: openshift_logging_es_allow_external | bool
- name: Generating secrets for Elasticsearch external route
template: src=secret.j2 dest={{mktemp.stdout}}/templates/{{secret_name}}-secret.yaml
vars:
secret_name: "logging-{{component}}"
secret_key_file: "{{component}}_key"
secret_cert_file: "{{component}}_cert"
secrets:
- {key: ca, value: "{{es_key_pairs | entry_from_named_pair('ca_file')| b64decode }}"}
- {key: key, value: "{{es_key_pairs | entry_from_named_pair(secret_key_file)| b64decode }}"}
- {key: cert, value: "{{es_key_pairs | entry_from_named_pair(secret_cert_file)| b64decode }}"}
secret_keys: ["ca", "cert", "key"]
with_items:
- es
loop_control:
loop_var: component
check_mode: no
changed_when: no
when: openshift_logging_es_allow_external | bool
|