cookbook-openshift3 (157) Versions 2.0.55 Follow6

Installs/Configures Openshift 3.x (>= 3.4)

Policyfile

Berkshelf

Knife

cookbook 'cookbook-openshift3', '= 2.0.55', :supermarket

cookbook 'cookbook-openshift3', '= 2.0.55'

knife supermarket install cookbook-openshift3

knife supermarket download cookbook-openshift3

README

Dependencies

Changelog

Quality 83%

Description

Installs OSEv3 and related packages.

Requirements

Platform

Tested on Red Hat RHEL 7.4
Tested on Centos 7.4

Openshift Version

Support OSE version from 3.3+
Support Origin version from 1.3+
Default the installation to 3.7

Highly recommended:

Explicitly set node['cookbook-openshift3']['ose_version'], node['cookbook-openshift3']['ose_major_version']
and ideally node['cookbook-openshift3']['docker_version'] to be safe when a major version is released on the
CentOS PaaS repository;

This cookbook does support upgrade between major versions (Read doc)

New Features!

Control upgrades between versions
ETCD migration v2 to v3 (Mandatory before upgrading to 3.7)

Supported version

[x] 1.3 to 1.4

[x] 1.4 to 1.5

[x] 1.5 to 3.6

[x] 3.6 to 3.7

Control Upgrade

Control upgrade requires variables to be set before running.

The CHEF run will ignore any upgrade unless all variables are correctly set

Variables:

NAME	PURPOSE	Default value	Mandatory
control_upgrade	Execute an upgrade	`false`	`YES`
control_upgrade_version	Target version (13,14,15,36,37)	`""`	`YES`
control_upgrade_flag	Location of the control upgrade flag	`"/to_be_replaced"`	`YES`
upgrade_repos	Target YUM repo	`""`	`NO`

  "override_attributes": {
    "cookbook-openshift3": {
      "control_upgrade": true,
      "control_upgrade_version": "37",
      "control_upgrade_flag": "/tmp/ready",
      "upgrade_repos": [
        {
          "name": "centos-openshift-origin37",
          "baseurl": "http://mirror.centos.org/centos/7/paas/x86_64/openshift-origin37/",
          "gpgcheck": false
        }
      ]
    }
  }

[Read more about the upgrade process here!](docs/upgrade-process.md)

Test Matrix

Platform	OSE 3.7.0	OSE 3.6.1	OSE 1.5.1	OSE 1.4.1	OSE 1.3.3	OSE 1.2.2
centos 7.4	PASS	PASS	PASS	PASS	PASS	Not supported

Override Attributes

[Read more about overriding attributes here!](docs/attribute-cookbook.md)

Structure

node['cookbook-openshift3']['openshift_master_identity_provider']['HTPasswdPasswordIdentityProvider']

{
"name" : "htpasswd_auth", 
"login" : true, 
"challenge" : true, 
"kind" : "HTPasswdPasswordIdentityProvider", 
"filename" : "/etc/openshift/openshift-passwd"
}

node['cookbook-openshift3']['openshift_master_identity_provider']['LDAPPasswordIdentityProvider']

{
"name" : "ldap_identity", 
"login" : true, 
"challenge" : true, 
"kind" : "LDAPPasswordIdentityProvider", 
"ldap_server" : "ldap.domain.local",
 "ldap_bind_dn" : "", 
 "ldap_bind_password" : "",
 "ldap_insecure" : true, 
 "ldap_base_ou" : "OU=people,DC=domain,DC=local", 
 "ldap_preferred_username" : "uid"
}

node['cookbook-openshift3']['openshift_master_asset_config']

{
 "extensionStylesheets":["/path/to/css"],
 "extensionScripts":["/path/to/script"],
 "extensions":"/path/to/my_images",
 "templates":"/path/to/template"
}

node['cookbook-openshift3']['openshift_node_docker-storage']

{
 "DEVS": ["/dev/sdb","/dev/sdc"],
 "VG": "docker-vg",
 "DATA_SIZE": "80%FREE"
}

node['cookbook-openshift3']['docker_log_driver']

Set to 'json-file' (default), 'journald' or any other supported docker log driver.
Set to '' to disable it.

node['cookbook-openshift3']['docker_log_options']

Assuming node['cookbook-openshift3']['docker_log_driver'] is 'json-file' (the default):

{
 "max-size": "50M",
 "max-file": "3"
}

Any option can be set, as long as they are supported by the current docker log driver.

node['cookbook-openshift3']['openshift_master_named_certificates']
CN or SAN names are automatically detected from the certificate file.

[
  {
   "certfile": "/etc/where_is/my_certfile",
   "keyfile": "/etc/where_is/my_keyfile"
  }
]

node['cookbook-openshift3']['persistent_storage']
They key called 'claim' is optional and will automatically create a PersistentVolumeClaim within a specified namespace.

{
  "name": "registry",
  "capacity": "5Gi",
  "access_modes": "ReadWriteMany",
  "server": "core.domain.local",
  "path": "/var/nfs/registry",
  "claim": {
    "namespace": "default"
  }
}

node['cookbook-openshift3']['openshift_hosted_cluster_metrics']

Any option can be set, as long as they are supported by the current Metrics deployer template.

Full list of attributes can be found here.

We only support 1 cassandra POD.

Example of options for deploying metrics:
json { "openshift_hosted_cluster_metrics": true, "openshift_metrics_heapster_requests_memory": "1Gi", "openshift_metrics_image_version": "v1.5.1", "openshift_metrics_cassandra_storage_type": "dynamic", "openshift_metrics_hawkular_user_write_access": false, "....." }
Example of removing metrics components:
json { "openshift_hosted_cluster_metrics": true, "openshift_metrics_install_metrics": false, "....." }

Example of overriding the default kubelet options:
* node['cookbook-openshift3']['openshift_node_kubelet_args_custom']
Any option can be set, as long as they are supported by current Kubelet Options.

{
  "openshift_node_kubelet_args_custom": {
    "pods-per-core": "5",
    "image-gc-high-threshold": "85",
    "resolv-conf": "/etc/resolv.conf"
  },
  "....."
}

Example of enabling a specific "feature-gate": enabling the persistent local volumes feature (OSE v3.7 and up):
json { "openshift_master_api_server_args_custom": { "feature-gates": ["PersistentLocalVolumes=true"] }, "openshift_master_controller_args_custom": { "feature-gates": ["PersistentLocalVolumes=true"] }, "openshift_node_kubelet_args_custom": { "feature-gates": ["PersistentLocalVolumes=true"] } }

Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig Hash

Key Name	Description
enable	A boolean to enable or disable audit logs. Default is `false`.
audit-file	File path where the requests should be logged to. If not set, logs are printed to master logs.
max-retention-day	Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename.
max-file-number	Specifies the maximum number of old audit log files to retain.
max-file-size	Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB.

{
  ...
  "openshift_master_auditconfig": {
    "enable": true,
    "audit-file": "/var/log/audit-ocp",
    "max-file-size": "50",
    "max-file-number": "10"
  },
  ...
}

Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig Hash

Key Name	Description
enable	A boolean to enable or disable audit logs. Default is `false`.
audit-file	File path where the requests should be logged to. If not set, logs are printed to master logs.
max-retention-day	Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename.
max-file-number	Specifies the maximum number of old audit log files to retain.
max-file-size	Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB.

{
  ...
  "openshift_master_auditconfig": {
    "enable": true,
    "audit-file": "/var/log/audit-ocp",
    "max-file-size": "50",
    "max-file-number": "10"
  },
  ...
}

Example of overriding the setting for global builds:
Any option can be set, as long as they are supported by current Global Build Defaults and Overrides.

When setting CPU/Memory via openshift_builddefaults_resources_*, openshift_builddefaults_resources needs to be set to true

{
  "....."
  "openshift_builddefaults_git_http_proxy": "http://USER:PASSWORD@HOST:PORT",
  "openshift_builddefaults_git_https_proxy": "https://USER:PASSWORD@HOST:PORT",
  "openshift_builddefaults_git_no_proxy": "mycorp.com",
  "openshift_builddefaults_env": [
    {
      "http_proxy": "http://proxy.example.com.redhat.com:3128"
    },
    {
      "NO_PROXY": "ose3-master.example.com"
    }
  ],
  "openshift_builddefaults_image_labels": [
    {
      "name": "imagelabelname1",
      "value": "imagelabelvalue1"
    }
  ],
  "openshift_builddefaults_nodeselectors": {
    "nodelabel1": "nodelabelvalue1",
    "nodelabel2": "nodelabelvalue2"
  },
  "openshift_builddefaults_annotations": {
    "annotationkey1": "annotationvalue1"
  },
  "openshift_buildoverrides_force_pull": "true",
  "openshift_buildoverrides_image_labels": [
    {
      "name": "imagelabelname1",
      "value": "imagelabelvalue1"
    }
  ],
  "openshift_buildoverrides_nodeselectors": {
    "nodelabel1": "nodelabelvalue1"
  },
  "openshift_buildoverrides_annotations": {
    "annotationkey1": "annotationvalue1"
  },
  "....."
}

If OpenShift Container Platform administrators would like to control the level of overcommit and manage container density on nodes, masters can be configured to override the ratio between request and limit set on developer containers. This requires configuring the ClusterResourceOverride variables.

{
  ".....",
  "openshift_clusterresourceoverrides_memorylimit_percent": "10",
  "openshift_clusterresourceoverrides_cpulimit_percent": "50",
  "openshift_clusterresourceoverrides_limitcputomem_percent": "200",
  "...."
}

Cloud Providers Integration

Cloud providers integration requires passing some sensetive credentials to OpenShift. This cookbook uses encrypted data bags as the safest way to achieve this. Thus you should have:

running Chef Server
encrypted data bags with cloud providers' credentials

Currently only AWS integration is supported.

AWS

To integrate your OpenShift installation with AWS you should have following attributes for cookbook-openshift3 cookbook:

{
  "openshift_cloud_provider": "aws",
  "openshift_cloud_providers": {
    "aws": {
      "data_bag_name": "cloud-provider",
      "data_bag_item_name": "aws",
      "secret_file": "/etc/chef/shared_secret"
    }
  }
}

You should also have data bag named cloud-provider (data_bag_name attribute above) and encrypted with some shared secret data bag item named aws (data_bag_item_name attribute above) at your Chef Server. If secret_file attribute from above is not defined a default for Chef Client shared secret file will be used (/etc/chef/encrypted_data_bag_secret). For more information see official Chef docs.

Data bag item content should be of the form:

{
  "id": "aws",
  "access_key_id": "your_access_key_id",
  "secret_access_key": "your_secret_access_key"
}

Please note: id value should be exactly the same as data_bag_item_name attribute value from above.

Alternatively you can attach IAM policies to your AWS instances and do not provide AWS credentials in encrypted data bags. In this case you should have the following attribute for cookbook-openshift3 cookbook:

{
  "openshift_cloud_provider": "aws"
}

and the following IAM policy attached to your master servers:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "elasticloadbalancing:*",
      "Resource": "*"
    }
  ]
}

and the following IAM policy attached to your node servers:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:AttachVolume",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:DetachVolume",
      "Resource": "*"
    }
  ]
}

=====

Include the default recipe in a CHEF role so as to ease the deployment.

Roles (Examples)

BASE

{
  "name": "base",
  "description": "Common Base Role",
  "json_class": "Chef::Role",
  "default_attributes": {

  },
  "override_attributes": {
  },
  "chef_type": "role",
  "run_list": [
    "recipe[cookbook-openshift3]"
  ],
  "env_run_lists": {

  }
}

UNINSTALL (ADHOC)

{
  "name": "uninstall",
  "description": "Common Base Role",
  "json_class": "Chef::Role",
  "default_attributes": {

  },
  "override_attributes": {
  },
  "chef_type": "role",
  "run_list": [
    "recipe[cookbook-openshift3::adhoc_uninstall]"
  ],
  "env_run_lists": {

  }
}

REDEPLOY CERTIFICATES (ADHOC)

The redeployment of the certificates requires variables and flags to be set before running.

The CHEF run will ignore any attempts unless all variables are correctly set

Variables:

NAME	PURPOSE	Default value	Mandatory	Target
adhoc_redeploy_certificates	Execute certificates redeploy	`false`	`YES`	Masters/Nodes/Certificate Server
adhoc_redeploy_etcd_ca	Execute an ETCD CA redeploy	`false`	`YES`	ETCD/Masters
adhoc_redeploy_cluster_ca	Execute a CLUSTER CA CERTS redeploy	`false`	`YES`	Masters/Nodes/Certificate Server
redeploy_etcd_ca_control_flag	Location of the etcd ca control flag	`"/to_be_replaced_ca_etcd"`	`YES`	Certificate Server
redeploy_etcd_certs_control_flag	Location of the etcd certs control flag	`"/to_be_replaced_certs"`	`YES`	ETCD/Masters
redeploy_cluster_ca_certserver_control_flag	Location of the cluster ca control flag	`"/to_be_replaced_ca_cluster"`	`YES`	Certificate Server
redeploy_cluster_ca_masters_control_flag	Location of the cluster master ca control flag	`"/to_be_replaced_masters"`	`YES`	Masters
redeploy_cluster_ca_nodes_control_flag	Location of the node ca control flag	`"/to_be_replaced_nodes"`	`YES`	Nodes
redeploy_cluster_hosted_certserver_control_flag	Location of the hosted control flag	`"/to_be_replaced_hosted_cluster"`	`YES`	1st Master

  "override_attributes": {
    "cookbook-openshift3": {
      "redeploy_cluster_ca_certserver_control_flag": "/tmp/caready",
      "adhoc_redeploy_etcd_ca": true
    }
  }

[Read more about the certificate redeploy process here!](docs/certificates-process.md)

ENVIRONMENT

Modify the attributes as required in your environments to change how various configurations are applied per the attributes section above.
In general, override attributes in the environment should be used when changing attributes.

Minimal example

CLUSTER-NATIVE (Only available option)

{
  "name": "cluster_native",
  "description": "",
  "cookbook_versions": {

  },
  "json_class": "Chef::Environment",
  "chef_type": "environment",
  "default_attributes": {

  },
  "override_attributes": {
    "cookbook-openshift3": {
      "openshift_HA": true,
      "openshift_cluster_name": "ose-cluster.domain.local",
      "persistent_storage": [
        {
          "name": "registry",
          "capacity": "5Gi",
          "access_modes": "ReadWriteMany",
          "server": "core.domain.local",
          "path": "/var/nfs/registry",
          "claim": {
            "namespace": "default"
          }
        },
        {
          "name": "metrics",
          "capacity": "3Gi",
          "access_modes": "ReadWriteOnce",
          "server": "core.domain.local",
          "path": "/var/nfs/metrics",
          "policy": "Recycle"
        },
        {
          "name": "logging",
          "capacity": "2Gi",
          "access_modes": "ReadWriteOnce",
          "server": "core.domain.local",
          "path": "/var/nfs/logging",
          "policy": "Recycle"
        }
      ],
      "lb_servers": [
        {
          "fqdn": "lb1-server.domain.local",
          "ipaddress": "1.1.1.4"
        },
      ],
      "master_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"
        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ],
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ],
      "node_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose4-server.domain.local",
          "ipaddress": "1.1.1.4",
          "labels": "region=user zone=east"
        },
        {
          "fqdn": "ose5-server.domain.local",
          "ipaddress": "1.1.1.5",
          "labels": "region=user zone=west"
        },        
      ],
    }
  }
}

SINGLE MASTER (EMBEDDED ETCD)

{
  "name": "single",
  "description": "",
  "cookbook_versions": {

  },
  "json_class": "Chef::Environment",
  "chef_type": "environment",
  "default_attributes": {

  },
  "override_attributes": {
    "cookbook-openshift3": {
      "master_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        }
      ],
      "node_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2",
          "labels": "region=user"
        }
      ],
    }
  }
}

ADD NEW ETCD SERVERS TO CLUSTER ("etcd_add_additional_nodes" must be set to true and a key called "new_node" should be added to the server(s)". If the server was previously part of the cluster, remember to clear its data directory before starting CHEF)

Members must be added one by one !!!

...
      "etcd_add_additional_nodes": true,
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        },
        {
          "fqdn": "ose4-server.domain.local",
          "ipaddress": "1.1.1.4",
          "new_node": true
        }
      ]
...

REMOVE ETCD SERVERS FROM CLUSTER ("etcd_remove_servers" must be defined and list all servers you want to remove. etcd_servers should be your desire state")

You can remove all members in once!!!

...
      "etcd_remove_servers": [
        {
          "fqdn": "ose4-server.domain.local",
        }
      ]
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ]
...

EXCLUDE NODES FROM SCHEDULING AND LABELLING("skip_run" must be defined and the node will be excluded when enforcing labels and schedulability")

Ex (ose2 and ose3 will be skipped when enforcing the schedulable and labels parts.)
```json
...
"node_servers": [
{
"fqdn": "ose1-server.domain.local",
"ipaddress": "1.1.1.1",
"schedulable": true,
"labels": "region=infra"
},
{
"fqdn": "ose2-server.domain.local",
"ipaddress": "1.1.1.2",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
},
{
"fqdn": "ose3-server.domain.local",
"ipaddress": "1.1.1.3",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
}
]

...
```

Once it is done you should assign the node to the relevant environment.

knife node environment set NODE_NAME ENVIRONMENT_NAME

Run list

knife node run_list add NODE_NAME 'role[base]'

Manual Integration Test (ORIGIN)

There is a way to quickly test this cookbook.
You will need a CentOS 7.1+ with "Minimal" installation option and at least 10GB left on the Volume group. (Later used by Docker)

Deploy ORIGIN ALL IN THE BOX Flavour (MASTER + NODE) bash <(curl -s https://raw.githubusercontent.com/IshentRas/cookbook-openshift3/master/scripts/origin_deploy.sh)

Automated Integration Tests (KITCHEN)

This cookbook features inspect integration tests,
for both standalone and cluster-native (HA) variants.

Attention: the .kitchen.yml tests all the versions listed in the Test Matrix,
so use kitchen list and selective kitchen converge to only test a subset of the versions.

Assuming the latest chef-dk is installed,
running the tests is as simple as:

kitchen converge
# wait a few minutes to give openshift a chance to initialize before running the tests
kitchen verify
kitchen destroy

Check the .kitchen.yml file to get started.

Automated Integration Tests (SHUTIT)

For multi-node setups, testing can be done using a ShutIt script.

There is a chef branch, which tests this cookbook.

[sudo] pip install shutit
git clone --recursive https://github.com/ianmiell/shutit-openshift-cluster/tree/chef
cd shutit-openshift-cluster
./run.sh

Release Checklist

Run kitchen tests
Are there any attributes changes? If yes:
Update docs/attribute-cookbook.md and
Update example roles in README.md
Have you updated the CHANGELOG.md?

Development

License and Author

Author: William Burton (william17.burton@gmail.com)

The MIT License (MIT)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Dependent cookbooks

yum >= 5.0

iptables >= 4.0.0

selinux_policy >= 0.0.0

docker >= 4.0

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

Openshift 3 Cookbook CHANGELOG

This file is used to list changes made in each version of the Openshift 3 cookbook.

v2.0.53-55

Bug

Fix issue with cloud_provider when restarting node service.

v2.0.52

Bug

Fix issue reported 247 (Upgrade 36 -> 37)

v2.0.51

Bug

Fix rubocop issues

v2.0.50

Bug

Fix issue reported 244 (Insecure docker registry)
Fix issue reported 247 (Customised CA)

Improvement

Give the possibility of providing an array for the SCCs

v2.0.49

Bug

Fix several Cloning resource attributes issues
Fix ETCD ca perms on certificate server

v2.0.48

Bug

Prevent Docker to reinstall or update without control

v2.0.47

Improvement

Asynchronous Errata Updates via variable asynchronous_upgrade (Default to false)

v2.0.46

Improvement

Add possibility to specify specific yum options when installing docker docker_yum_options
Add reverse lookup for SkyDNS

v2.0.45

Improvement

Give the possibilty to provide a custom location for '/etc/NetworkManager/dispatcher.d/99-origin-dns.sh'

v2.0.44

Improvement

Change the ETCD CA directory for the certificate server (Moving the certificate server becomes easier: mv /var/www/html)

v2.0.43

Bug

Fix issue 240 when using standalone master

v2.0.42

Bug

Regression bug for controller servers (TTL missing)

v2.0.41

Bug

Remove the openshift-master.kubeconfig file when regenerating certs (Issue < 3.2)

v2.0.40

Bug

Wrong option for generating node certs

v2.0.39

Bug

Bug with certificates renewal for node servers

v2.0.34 - v2.0.38

Bug

Bug with certificates renewal

v2.0.33

Bug

Bug with library for identifying the server roles

v2.0.32

Bug

Bug with library for identifying the server roles

v2.0.31

Bug

Force secret for registry HTTPS

v2.0.30

Improvement

Improve the certs renewal
Improve the custom router template (Name can be customised) openshift_hosted_deploy_custom_name

v2.0.29

Improvement

Stop pushing for etcd / docker package upgrade
New vars for upgrade (ETCD/Docker) upgrade_docker_version upgrade_etcd_version

v2.0.28

Bug

Fix issue when upgrading etcd

v2.0.27

Bug

Fix foodcritic issue with new metric logic

v2.0.26

Bug

Fix issue with excluder pkgs when server has got dual roles (master && node)
Refactor the metrics logi to support all versions (3.3+)
Fix issue when disabling SWAP for node servers

v2.0.25

Bug

Add option to control docker yum exclude options custom_pkgs_excluder
Revert last logic not working

v2.0.24

Bug

Fix issue with master keys != 400 perms ### Improvement
Add option to control docker yum options (Exclude/Include X pkgs) docker_yum_options

v2.0.23

Bug

Fix issue with node service when NM is not turned off (Openshift >= 3.6)

v2.0.22

Bug

Fix issue when restarting ETCD during upgrade

v2.0.21

Bug

Fix issue during upgrade when having certificate_server which is not first master
Add ETCD package to servers (Master for certificates, Etcd and certificate server for certificate renewal)

v2.0.20

Bug

Fix issue during upgrade when upgrading master services

v2.0.19

Improvement

Split the certificate server function from the other roles
General code review
Improve the general experience during certificate renewal

v2.0.18

Bug

Fix issue during upgrade node components

v2.0.17

Improvement

Give the possibility for setting ENV to router (openshift_hosted_deploy_env_router)

v2.0.16

Bug

Fix issue during uninstall when server has not got docker installed

v2.0.15

Improvement

Improve the general experience during upgrades
Restarts of services are aligned with activities (upgrade/intall)
Give the possibility for deploying custom router (openshift_hosted_deploy_custom_router)

v2.0.14

Bug

Fix issue during upgrade when master are separated from ETCD

v2.0.13

Bug

Fix race condition for certs
Fix issue when deploying hosted services outside of the default project

v2.0.12

Bug

General code improvements/MISC issues

v2.0.11

Bug

General code improvements/MISC issues

v2.0.10

Bug

Fix issue for upgrade when being a master only (No need to restart Docker)

v2.0.9

Bug

Fix issue when creating PV (NFS)
General code improvements/MISC issues

v2.0.8

Bug

General code improvements/MISC issues

v2.0.7

Improvement

Improve creating PV/PVC

Bug

General code improvements/MISC issues

v2.0.6

Improvement

Add logic for removing redhat registry (Fixed issue 206)
Improve IPtables logic

Bug

General code improvements/MISC issues

v2.0.5

Bug

General code improvements/MISC issues

Improvement

Initial Support for 3.7.x
Capability for automated upgrade between versions
Certitificate redeploy for ETCD (CA/CERTS)

v1.10.67

Bug

Fixes error in v1.10.66 - use action ':nothing' on declaration, cf: https://serverfault.com/questions/587188/chef-how-to-run-a-resource-on-notification-only
admin.kubeconfig made unambiguous - file creation failures avoided

v1.10.66

Improvement

Add timeout to du call
Rewrite ruby blocks into Chef resources

v1.10.65

Improvement

Initial support for 3.6
Capability for Overriding master and node servingInfo.minTLSVersion and .cipherSuites [openshift_(master|node)cipher_suites, openshift(master|node)_min_tls_version]
Capability for defining ExternalIPNetworkCIDRs controls what values are acceptable for the service external IP field [openshift_master_external_ip_network_cidrs]
Capability for defining IngressIPNetworkCIDR controls the range to assign ingress IPs [openshift_master_ingress_ip_network_cidr]
Capability for defining mcs_allocator_range, mcs_labels_per_project and uid_allocator_range [openshift_master_NAME]
Capability for referencing the registry by a stable name (not IP) [openshift_push_via_dns]
Add etcd_debug and etcd_log_package_levels capabilities

v1.10.64

Improvement

All tgz files are encrypted with a default passphrase, and decrypted at the other end after downloading.

Bug

Fixes error in v1.10.62 - file permissions on tar.gz
Fix bug with LDAP Provider (Enforce LDAPS when selecting secure)

v1.10.63

Bug

Fixes error in v1.10.62 - file permissions on tar.gz

v1.10.62 - BROKEN

Improvement

Jenkinsfile parameters added
New Centos yum repos added

Bug

Allow users to suppress ruby block call from provider code (breaks in older Chef client versions)
Make perms and ownership on tar.gz files explicit for more restrictive distributions
Kitchen tests updated for latest versions

v1.10.61

Improvement

Allow passing custom arguments when deploying the hosted router

Bug

Fix issue with cookstyle indentation

v1.10.60

Improvement

Update Example files (ImageStreams/Templates)
Update Hosted templates
Add more logic for dnsmasq (Install NetworkManager and add conf-dir line)

Bug

Fix issues with certificate_servers

v1.10.59

Improvement

Add the possibilty for openshift_buildoverrides
Add the possibilty of retrieving the OCP certs from a custom location/server

Bug

Fix issue with cookstyle indentation
Improve the code for ignoring dnsmasq issues
Add missing dirs and files to be removed when uninstalling

v1.10.58

Improvement

Remove support for 1.2/3.2 (README)

v1.10.57

Improvement

Remove support for 1.2/3.2
Update openshift_example files
Add extra wait time for 1.3/3.3 installation

Bug

Change test for 1.3/3.3 to use docker 1.10.x
Adapt the kubelet args

v1.10.56

Improvement

Add the possibility of deploying Metrics according to https://docs.openshift.com/container-platform/latest/install_config/cluster_metrics.html

v1.10.55

Bug

Fix backticks in environment not working (#138)

v1.10.54

Bug

Fix CHEF-3694 warning that triggered while waiting for node registration

v1.10.53

Improvement

Remove duplicated code between etcd_cluster and master_cluster recipes.

Bug

Enable *-master-controllers and *-master-api services on master nodes.
Fix Jenkinsfile: email address does not support aliases
Fix CHEF-3694 warning with master certificates

v1.10.52

Bug

Fix cookstyle issues

v1.10.51

Bug

Fix bug when not declaring lb_servers role

v1.10.50

Bug

Fix Foodcritic issues related to CONTRIBUTING.md

v1.10.49

Bug

Fix Foodcritic issues related to metada.rb

v1.10.48

Improvement

Initial support for 1.5/3.5 OCP
Refactor logic for HA cluster deployment
Add support for deploying only LB role (Haproxy) https://github.com/IshentRas/cookbook-openshift3/issues/100
MISC bug fix

Bug

Separated certificates to be copied from first master

v1.10.47

Improvement

Jenkinsfile gets correct branch
Kitchen tests at end (less likely to fail)

Bug

Separated etcd cluster now works (all certs pulled from first master)

v1.10.46

Bug

Spacing corrected and defaults not included as per discussion in #115

v1.10.45

Improvement

Jenkinsfile has resilient kitchen tests reinstated

Bug

Certificate redeployment code fixed to remove node certs
Certificate redeployment - run etcd code only if etcd on the node (eg standalone)

v1.10.44

Improvement

Upgrade from x.2 to x.3 supported
Service signer cert created as part of cert creation

v1.10.43

Improvement

Added Jenkinsfile
Rename file: service_openvsitch-containerized.service.erb -> service_openvswitch-containerized.service.erb

Bug

Fix redeploy certs for separate etcd cluster
Use more config items rather than hard-coded values in delete node

v1.10.42

Improvement

Replace most hard link usage with local copy
Change http server binding to default IP address
Give the possibility to specify custom certificate for hosted router

Bug

Fix CHEF-3694 warning due to redundant package resource
Removed potentially unsafe identity providers defaults
Fix named certificates when common_name is also listed in alternative names
Allow distinct hostnames for internal and public API access

v1.10.41

Bug

Fix AWS issue when using empty data bag

v1.10.40

Bug

Fix bug for enterprise version (Hosted template files)
Fix deletion of service files

v1.10.39

Improvement

Give the possibility of adding custom master CA certificate
Give the possibility of supporting AWS IAM based integration

Bug

Fix dnsIP for dedicated nameserver within PODS (Default to IP of the node)

v1.10.38

Improvement

Give the possibility of adding cAdvisor port and read-only port for kubelet arguments
Give the possibility of skipping nodes when applying schedulability and labelling

Bug

Fix issue reported by https://github.com/IshentRas/cookbook-openshift3/issues/77

v1.10.37

Bug

Emergency update for fixing ose_major_version when running standalone deployment

v1.10.36

Bug

Fixed cookstyle offenses
Revert the ETCD change causing issue when adding / removing members
Make secret call compatible with x.2 version(s)

Improvement

Expand .kitchen.yml to test OSE v1.4.1, v1.3.3 and v1.2.1
Improved code readability
Added support for multiple identity providers
Added support for AWS cloud provider

v1.10.35

Bug

Fix ETCD service defined in 2 places
Fix cookstyle issues
Fix admin.kubeconfig logic

v1.10.34

Bug

Adjust predicates and priorities based on ose_major_version
Fix containerized deployment

Improvement

Give the possibility to add or remove etcd server members
Improve ETCD deployment for single etcd server

v1.10.33

Bug

Revert e168f9b, use stable repository URLs again

Improvement

Use stable CentOS PaaS repository during tests
Add integration test for hosted metrics feature

v1.10.32

Bug

Make apiServerArguments conditional on the version for pre-1.3/3.3 versions

v1.10.31

Improvement

Handle 1.4/3.4 deployment
Clean codes over unused attributes
Integration tests for 1.4/3.4
Add the possibility to supply dns-search option via Docker
Add the possibility to specify a deserialization cache size parameter.

Bug

Fix permissions over /etc/origin/node
Fix iptables issue due to version used by clients

v1.10.30

Improvement

Add the possibility to deploy the cluster metrics
Add the possibility to add more manageName serviceaccount in master config
Move registry persistent_volume_claim name to explicit LWRP attribute
Added integration test for openshift_hosted_manage_registry feature
Added integration test for openshift_hosted_manage_router feature
Added integration test for persistent_storage feature
Refactor router-related resources to new openshift_deploy_router LWRP
Move registry persistent_volume_claim name to explicit LWRP attribute

Bug

Fix README.md typo
Fix issue with systemd when uninstalling the Openshift
Fix issue for systemctl daemon-reload
Removed redundant guard clause for registry deloyment

v1.10.29

Bug

Remove property attributes for resources (backward compatibility)

v1.10.28

Improvement

Add the possibility to deploy the cluster metrics
Add the possibility to add more manageName serviceaccount in master config

Bug

Fix README.md typo
Fix issue with systemd when uninstalling the Openshift
Fix issue for systemctl daemon-reload

v1.10.27

Bug

Fix the Origin deployment issue (https://github.com/IshentRas/cookbook-openshift3/issues/20)
Fix master-api service and master-controllers service (https://github.com/IshentRas/cookbook-openshift3/issues/40)

v1.10.26

Improvement

Set the default ipaddress used in etcd-related attributes accordingly with the etcd_server variable

Bug

Remove duplicated variables for ETCD

v1.10.25

Bug

Fix documentation
Fix redeploying OSE certificates

v1.10.24

Improvement

Add the possibility to run adhoc command for redeploying OSE certificates
Add FW rules in a dedicated jump chain
Add a validation point for mandatory variables
Add the possibility to specify logging drivers (https://docs.docker.com/engine/admin/logging/overview/)

Bug

Fix adhoc uninstall
Move openssl.conf under CA directory (ETCD)

v1.10.23

Bug

Typo in README
Fix schedulability and node-labelling guards

v1.10.22

Bug

Skip nodes which are not listed when labelling or seetingn schedulability (https://github.com/IshentRas/cookbook-openshift3/issues/32)

v1.10.21

Bug

Improve delete adhoc
Remove duplicates for cors origin (Forcing ETCD to fail)

v1.10.20

Improvement

Remove the need to specify the master server peers.
Add the possibility to specify scc rather than assuming \'privileged\' one
Add new scheduler predicates & priorities
Add the possibility to create PV and PVC (Type NFS only)
Deploy Hosted environment (Registry & Router)
Autoscale Hosted environment (Registry & Router) based on labelling
Only 1 recipe is needed for deploying the environment : recipe[cookbook-openshift3]

Bug

Remove duplicated resources
Fix Docker log-driver for json

Removal

Remove the node['cookbook-openshift3']['use_params_roles'] which used the CHEF search capability
Remove the node['cookbook-openshift3']['set_nameserver'] and node['cookbook-openshift3']['register_dns']

v1.10.19

Improvement

Add the possibility to enable the Audit logging
Add the possibility to label nodes
Add the possibility to set scheduling against nodes
Add the possibility to deploy the Stand-alone Registry & Router

Bug

Remove automatic rebooting when playing adhoc uninstallation

v1.10.18

Improvement

Add the possibility to run adhoc command for uninstalling Openshift on dedicated server(s)

v1.10.17

Improvement

Add the possibility to have any number of ETCD servers

Bug

Fix HTTPD service enabling for ETCD

v1.10.16

Improvement

Add the possibility to only deploy ETCD role

Bug

Remove hard-coded values for deployment type (Affecting Origin deploymemts)

v1.10.15

Improvement

Add the possibility to specifying an exact rpm version to install or configure.
Update Openshift configuration for 1.3 or 3.3
Add the possibilty to specifying a major version (3.1, 3.2 or 3.3)

v1.10.14

Bug

Add logging EFK

v1.10.13

Bug

Add SNI capability when testing master API

Improvement

Give the choice to user to select CHEF search or solo capability
Add the concept of wildcard nodes --> wildcard kubeconfig (AWS cloud deployment)
Update Openshift templates

v1.10.12

Bug

Fix nodeSelector issue when using cluster architecture

Improvement

Add capacity to manage container logs (Docker options)

v1.10.11

Bug

Remove too restrictive version for RHEL

v1.10.10

Bug

Fix typo for URL for Public master API

v1.10.9

Bug

Fix URL for master API

Improvement

Clarify use of masterPublicURL, publicURL and masterURL

v1.10.8

Improvement

Simplify the creation of node/master servers

v1.10.7

Bug

Fix issue for dnsmasq

v1.10.6

Bug

Fix issue for documentation

v1.10.5

Bug

Fix issue for documentation

v1.10.4

Bug

Fix issue for restarting openshift-api or controllers
Fix issue for restarting node

Improvement

Update Openshift documentation
Use chef-solo attribute style as a default for setting attributes
Remove queries for any type of data that is indexed by the Chef server

v1.10.3

Bug

Fix issue for Openshift Node (Clashing ClusterNetwork)
Fix issue for generating certificates (NODES)

Improvement

Add capability for deploying 3.2.x
Add capability for deploying containerized version of Openshift
Add capability of using dnsmasq for interacting with skyDNS
Update Openshift template examples

v1.10.2

Bug

Fix issue for nodes certificate SAN

v1.10.1

Bug

Fix issue for ETCD certificate lifetime
Fix IP discovery for origin_deploy.sh

Improvement

Add capability for enabling or not a yum repository

v1.10.0

Bug

Fix docker restrart when running CHEF
Fix openshift-master restart when running CHEF
Fix openshift-node restart when running CHEF

v1.0.9

Bug

Remove dnsIP from node definiton. Default to use the kubernetes service network 172.x.x.1

v1.0.8

Improvement

Add kubeletArguments for node servers

Bug

Enable Docker at startup
Mask master service when running native HA

v1.0.7

Improvement

Add possibility to disable yum repositories
Fix etcd certificate (Simplify the call for peers members)
Add possibility to specify a version to be installed for docker

Bug

Fix permissions for directory (Set to Apache in case of a dodgy umask number)

v1.0.6

Improvement

Add delay/retry before installing servcieaccount
Change xip.io for nip.io (STABLE)

Bug

Fix scripts/origin_deploy.sh
Fix hostname for origin_deploy.sh

v1.0.5

Bug

Fix bug when enabling HTTPD at startup

v1.0.4

Improvement

Detect the CN or SAN from certificates file when using named certificates.
Move origin_deploy.sh in scripts folder

Bug

Enable HTTPD at startup
Fix some typos

mprovement
- Add the possibility to only deploy ETCD role

Bug

Remove hard-coded values for deployment type (Affecting Origin deploymemts) ## v1.0.3 ### Improvement
Add possibility to customise docker-storage-setup
Add possibility for configuring Custom Certificates

v1.0.2

Improvement

Add MIT LICENCE model
Add script to auto deploy origin instance
Add the possibility to exclude packages from updates or installs

Bug fix

Fix attributes labelling when using chef in local mode (or solo)
Remove specific mentions to OSE

v0.0.1

Current public release

Collaborator Number Metric

2.0.55 passed this metric

Contributing File Metric

2.0.55 passed this metric

Foodcritic Metric

2.0.55 passed this metric

No Binaries Metric

2.0.55 passed this metric

Testing File Metric

2.0.55 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric

2.0.55 passed this metric

Adoptable Cookbooks List

Supermarket Belongs to the Community

View our collection of guides, documentation, and articles

Select Badges

Select Supported Platforms

Select Status

Description

Requirements

Platform

Openshift Version

New Features!

Supported version

Control Upgrade

Test Matrix

Override Attributes

Structure

Cloud Providers Integration

AWS

Roles (Examples)

ENVIRONMENT

Minimal example

Once it is done you should assign the node to the relevant environment.

Run list

Manual Integration Test (ORIGIN)

Automated Integration Tests (KITCHEN)

Automated Integration Tests (SHUTIT)

Release Checklist

Development

License and Author

Dependent cookbooks

Contingent cookbooks

Openshift 3 Cookbook CHANGELOG

v2.0.53-55

Bug

v2.0.52

Bug

v2.0.51

Bug

v2.0.50

Bug

Improvement

v2.0.49

Bug

v2.0.48

Bug

v2.0.47

Improvement

v2.0.46

Improvement

v2.0.45

Improvement

v2.0.44

Improvement

v2.0.43

Bug

v2.0.42

Bug

v2.0.41

Bug

v2.0.40

Bug

v2.0.39

Bug

v2.0.34 - v2.0.38

Bug

v2.0.33

Bug

v2.0.32

Bug

v2.0.31

Bug

v2.0.30

Improvement

v2.0.29

Improvement

v2.0.28

Bug

v2.0.27

Bug

v2.0.26