cookbook 'cookbook-openshift3', '= 2.0.29'
cookbook-openshift3
(157) Versions
2.0.29
-
-
2.1.26
-
2.1.25
-
2.1.24
-
2.1.23
-
2.1.21
-
2.1.19
-
2.1.18
-
2.1.17
-
2.1.14
-
2.1.13
-
2.1.11
-
2.1.9
-
2.1.8
-
2.1.7
-
2.1.6
-
2.1.5
-
2.1.4
-
2.1.3
-
2.1.2
-
2.1.1
-
2.1.0
-
2.0.90
-
2.0.88
-
2.0.86
-
2.0.85
-
2.0.83
-
2.0.82
-
2.0.77
-
2.0.76
-
2.0.75
-
2.0.74
-
2.0.72
-
2.0.71
-
2.0.69
-
2.0.68
-
2.0.66
-
2.0.65
-
2.0.64
-
2.0.63
-
2.0.62
-
2.0.60
-
2.0.58
-
2.0.57
-
2.0.55
-
2.0.54
-
2.0.53
-
2.0.52
-
2.0.51
-
2.0.50
-
2.0.49
-
2.0.48
-
2.0.47
-
2.0.46
-
2.0.45
-
2.0.44
-
2.0.43
-
2.0.42
-
2.0.41
-
2.0.33
-
2.0.32
-
2.0.29
-
2.0.28
-
2.0.27
-
2.0.26
-
2.0.24
-
2.0.23
-
2.0.22
-
2.0.21
-
2.0.20
-
2.0.19
-
2.0.18
-
2.0.15
-
2.0.14
-
2.0.13
-
2.0.12
-
2.0.10
-
2.0.9
-
2.0.7
-
2.0.6
-
2.0.5
-
1.10.67
-
1.10.66
-
1.10.64
-
1.10.63
-
1.10.62
-
1.10.61
-
1.10.60
-
1.10.59
-
1.10.58
-
1.10.57
-
1.10.56
-
1.10.55
-
1.10.54
-
1.10.53
-
1.10.52
-
1.10.51
-
1.10.50
-
1.10.49
-
1.10.48
-
1.10.47
-
1.10.46
-
1.10.45
-
1.10.44
-
1.10.43
-
1.10.42
-
1.10.41
-
1.10.40
-
1.10.39
-
1.10.38
-
1.10.37
-
1.10.36
-
1.10.35
-
1.10.34
-
1.10.33
-
1.10.32
-
1.10.31
-
1.10.30
-
1.10.29
-
1.10.28
-
1.10.27
-
1.10.26
-
1.10.25
-
1.10.24
-
1.10.23
-
1.10.22
-
1.10.21
-
1.10.20
-
1.10.19
-
1.10.18
-
1.10.17
-
1.10.16
-
1.10.15
-
1.10.14
-
1.10.13
-
1.10.12
-
1.10.11
-
1.10.10
-
1.10.9
-
1.10.8
-
1.10.7
-
1.10.6
-
1.10.5
-
1.10.4
-
1.10.3
-
1.10.2
-
1.10.1
-
1.10.0
-
1.0.9
-
1.0.8
-
1.0.7
-
1.0.6
-
1.0.5
-
1.0.4
-
1.0.3
-
1.0.2
-
0.0.2
-
0.0.1
Follow6
- 2.1.26
- 2.1.25
- 2.1.24
- 2.1.23
- 2.1.21
- 2.1.19
- 2.1.18
- 2.1.17
- 2.1.14
- 2.1.13
- 2.1.11
- 2.1.9
- 2.1.8
- 2.1.7
- 2.1.6
- 2.1.5
- 2.1.4
- 2.1.3
- 2.1.2
- 2.1.1
- 2.1.0
- 2.0.90
- 2.0.88
- 2.0.86
- 2.0.85
- 2.0.83
- 2.0.82
- 2.0.77
- 2.0.76
- 2.0.75
- 2.0.74
- 2.0.72
- 2.0.71
- 2.0.69
- 2.0.68
- 2.0.66
- 2.0.65
- 2.0.64
- 2.0.63
- 2.0.62
- 2.0.60
- 2.0.58
- 2.0.57
- 2.0.55
- 2.0.54
- 2.0.53
- 2.0.52
- 2.0.51
- 2.0.50
- 2.0.49
- 2.0.48
- 2.0.47
- 2.0.46
- 2.0.45
- 2.0.44
- 2.0.43
- 2.0.42
- 2.0.41
- 2.0.33
- 2.0.32
- 2.0.29
- 2.0.28
- 2.0.27
- 2.0.26
- 2.0.24
- 2.0.23
- 2.0.22
- 2.0.21
- 2.0.20
- 2.0.19
- 2.0.18
- 2.0.15
- 2.0.14
- 2.0.13
- 2.0.12
- 2.0.10
- 2.0.9
- 2.0.7
- 2.0.6
- 2.0.5
- 1.10.67
- 1.10.66
- 1.10.64
- 1.10.63
- 1.10.62
- 1.10.61
- 1.10.60
- 1.10.59
- 1.10.58
- 1.10.57
- 1.10.56
- 1.10.55
- 1.10.54
- 1.10.53
- 1.10.52
- 1.10.51
- 1.10.50
- 1.10.49
- 1.10.48
- 1.10.47
- 1.10.46
- 1.10.45
- 1.10.44
- 1.10.43
- 1.10.42
- 1.10.41
- 1.10.40
- 1.10.39
- 1.10.38
- 1.10.37
- 1.10.36
- 1.10.35
- 1.10.34
- 1.10.33
- 1.10.32
- 1.10.31
- 1.10.30
- 1.10.29
- 1.10.28
- 1.10.27
- 1.10.26
- 1.10.25
- 1.10.24
- 1.10.23
- 1.10.22
- 1.10.21
- 1.10.20
- 1.10.19
- 1.10.18
- 1.10.17
- 1.10.16
- 1.10.15
- 1.10.14
- 1.10.13
- 1.10.12
- 1.10.11
- 1.10.10
- 1.10.9
- 1.10.8
- 1.10.7
- 1.10.6
- 1.10.5
- 1.10.4
- 1.10.3
- 1.10.2
- 1.10.1
- 1.10.0
- 1.0.9
- 1.0.8
- 1.0.7
- 1.0.6
- 1.0.5
- 1.0.4
- 1.0.3
- 1.0.2
- 0.0.2
- 0.0.1
Installs/Configures Openshift 3.x (>= 3.4)
cookbook 'cookbook-openshift3', '= 2.0.29', :supermarket
knife supermarket install cookbook-openshift3
knife supermarket download cookbook-openshift3
Description
- Installs OSEv3 and related packages.
Requirements
Platform
- Tested on Red Hat RHEL 7.4
- Tested on Centos 7.4
Openshift Version
- Support OSE version from 3.3+
- Support Origin version from 1.3+
- Default the installation to 3.7
Highly recommended:
Explicitly set node['cookbook-openshift3']['ose_version']
, node['cookbook-openshift3']['ose_major_version']
and ideally node['cookbook-openshift3']['docker_version']
to be safe when a major version is released on the
CentOS PaaS repository;
This cookbook does support upgrade between major versions (Read doc)
New Features!
- Control upgrades between versions
- ETCD migration v2 to v3 (Mandatory before upgrading to 3.7)
Supported version
[x] 1.3 to 1.4
[x] 1.4 to 1.5
[x] 1.5 to 3.6
[x] 3.6 to 3.7
Control Upgrade
Control upgrade requires variables to be set before running.
The CHEF run will ignore any upgrade unless all variables are correctly set
Variables:
NAME | PURPOSE | Default value | Mandatory |
---|---|---|---|
control_upgrade | Execute an upgrade | false |
YES |
control_upgrade_version | Target version (13,14,15,36,37) | "" |
YES |
control_upgrade_flag | Location of the control upgrade flag | "/to_be_replaced" |
YES |
upgrade_repos | Target YUM repo | "" |
NO |
"override_attributes": { "cookbook-openshift3": { "control_upgrade": true, "control_upgrade_version": "37", "control_upgrade_flag": "/tmp/ready", "upgrade_repos": [ { "name": "centos-openshift-origin37", "baseurl": "http://mirror.centos.org/centos/7/paas/x86_64/openshift-origin37/", "gpgcheck": false } ] } }
[Read more about the upgrade process here!](upgrade-process.md)
Test Matrix
Platform | OSE 3.7.0 | OSE 3.6.1 | OSE 1.5.1 | OSE 1.4.1 | OSE 1.3.3 | OSE 1.2.2 |
---|---|---|---|---|---|---|
centos 7.4 | PASS | PASS | PASS | PASS | PASS | Not supported |
Override Attributes
[Read more about overriding attributes here!](attribute-cookbook.md)
Structure
node['cookbook-openshift3']['openshift_master_identity_provider']['HTPasswdPasswordIdentityProvider']
{ "name" : "htpasswd_auth", "login" : true, "challenge" : true, "kind" : "HTPasswdPasswordIdentityProvider", "filename" : "/etc/openshift/openshift-passwd" }
node['cookbook-openshift3']['openshift_master_identity_provider']['LDAPPasswordIdentityProvider']
{ "name" : "ldap_identity", "login" : true, "challenge" : true, "kind" : "LDAPPasswordIdentityProvider", "ldap_server" : "ldap.domain.local", "ldap_bind_dn" : "", "ldap_bind_password" : "", "ldap_insecure" : true, "ldap_base_ou" : "OU=people,DC=domain,DC=local", "ldap_preferred_username" : "uid" }
node['cookbook-openshift3']['openshift_master_asset_config']
{ "extensionStylesheets":["/path/to/css"], "extensionScripts":["/path/to/script"], "extensions":"/path/to/my_images", "templates":"/path/to/template" }
node['cookbook-openshift3']['openshift_node_docker-storage']
{ "DEVS": ["/dev/sdb","/dev/sdc"], "VG": "docker-vg", "DATA_SIZE": "80%FREE" }
node['cookbook-openshift3']['docker_log_driver']
Set to 'json-file'
(default), 'journald'
or any other supported docker log driver.
Set to '' to disable it.
node['cookbook-openshift3']['docker_log_options']
Assuming node['cookbook-openshift3']['docker_log_driver']
is 'json-file'
(the default):
{ "max-size": "50M", "max-file": "3" }
Any option can be set, as long as they are supported by the current docker log driver.
node['cookbook-openshift3']['openshift_master_named_certificates']
CN or SAN names are automatically detected from the certificate file.
[ { "certfile": "/etc/where_is/my_certfile", "keyfile": "/etc/where_is/my_keyfile" } ]
node['cookbook-openshift3']['persistent_storage']
They key called 'claim' is optional and will automatically create a PersistentVolumeClaim within a specified namespace.
{ "name": "registry", "capacity": "5Gi", "access_modes": "ReadWriteMany", "server": "core.domain.local", "path": "/var/nfs/registry", "claim": { "namespace": "default" } }
node['cookbook-openshift3']['openshift_hosted_cluster_metrics']
Any option can be set, as long as they are supported by the current Metrics deployer template.
Full list of attributes can be found here.
We only support 1 cassandra POD.
Example of options for deploying metrics:
json
{
"openshift_hosted_cluster_metrics": true,
"openshift_metrics_heapster_requests_memory": "1Gi",
"openshift_metrics_image_version": "v1.5.1",
"openshift_metrics_cassandra_storage_type": "dynamic",
"openshift_metrics_hawkular_user_write_access": false,
"....."
}
Example of removing metrics components:
json
{
"openshift_hosted_cluster_metrics": true,
"openshift_metrics_install_metrics": false,
"....."
}
Example of overriding the default kubelet options:
* node['cookbook-openshift3']['openshift_node_kubelet_args_custom']
Any option can be set, as long as they are supported by current Kubelet Options.
{ "openshift_node_kubelet_args_custom": { "pods-per-core": "5", "image-gc-high-threshold": "85", "resolv-conf": "/etc/resolv.conf" }, "....." }
Example of enabling a specific "feature-gate": enabling the persistent local volumes feature (OSE v3.7 and up):
json
{
"openshift_master_api_server_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
},
"openshift_master_controller_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
},
"openshift_node_kubelet_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
}
}
Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig
Hash
Key Name | Description |
---|---|
enable | A boolean to enable or disable audit logs. Default is false . |
audit-file | File path where the requests should be logged to. If not set, logs are printed to master logs. |
max-retention-day | Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename. |
max-file-number | Specifies the maximum number of old audit log files to retain. |
max-file-size | Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB. |
{ ... "openshift_master_auditconfig": { "enable": true, "audit-file": "/var/log/audit-ocp", "max-file-size": "50", "max-file-number": "10" }, ... }
Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig
Hash
Key Name | Description |
---|---|
enable | A boolean to enable or disable audit logs. Default is false . |
audit-file | File path where the requests should be logged to. If not set, logs are printed to master logs. |
max-retention-day | Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename. |
max-file-number | Specifies the maximum number of old audit log files to retain. |
max-file-size | Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB. |
{ ... "openshift_master_auditconfig": { "enable": true, "audit-file": "/var/log/audit-ocp", "max-file-size": "50", "max-file-number": "10" }, ... }
Example of overriding the setting for global builds:
Any option can be set, as long as they are supported by current Global Build Defaults and Overrides.
When setting CPU/Memory via openshift_builddefaults_resources_*
, openshift_builddefaults_resources
needs to be set to true
{ "....." "openshift_builddefaults_git_http_proxy": "http://USER:PASSWORD@HOST:PORT", "openshift_builddefaults_git_https_proxy": "https://USER:PASSWORD@HOST:PORT", "openshift_builddefaults_git_no_proxy": "mycorp.com", "openshift_builddefaults_env": [ { "http_proxy": "http://proxy.example.com.redhat.com:3128" }, { "NO_PROXY": "ose3-master.example.com" } ], "openshift_builddefaults_image_labels": [ { "name": "imagelabelname1", "value": "imagelabelvalue1" } ], "openshift_builddefaults_nodeselectors": { "nodelabel1": "nodelabelvalue1", "nodelabel2": "nodelabelvalue2" }, "openshift_builddefaults_annotations": { "annotationkey1": "annotationvalue1" }, "openshift_buildoverrides_force_pull": "true", "openshift_buildoverrides_image_labels": [ { "name": "imagelabelname1", "value": "imagelabelvalue1" } ], "openshift_buildoverrides_nodeselectors": { "nodelabel1": "nodelabelvalue1" }, "openshift_buildoverrides_annotations": { "annotationkey1": "annotationvalue1" }, "....." }
If OpenShift Container Platform administrators would like to control the level of overcommit and manage container density on nodes, masters can be configured to override the ratio between request and limit set on developer containers. This requires configuring the ClusterResourceOverride variables.
{ ".....", "openshift_clusterresourceoverrides_memorylimit_percent": "10", "openshift_clusterresourceoverrides_cpulimit_percent": "50", "openshift_clusterresourceoverrides_limitcputomem_percent": "200", "...." }
Cloud Providers Integration
Cloud providers integration requires passing some sensetive credentials to OpenShift. This cookbook uses encrypted data bags as the safest way to achieve this. Thus you should have:
- running Chef Server
- encrypted data bags with cloud providers' credentials
Currently only AWS integration is supported.
AWS
To integrate your OpenShift installation with AWS you should have following attributes for cookbook-openshift3
cookbook:
{ "openshift_cloud_provider": "aws", "openshift_cloud_providers": { "aws": { "data_bag_name": "cloud-provider", "data_bag_item_name": "aws", "secret_file": "/etc/chef/shared_secret" } } }
You should also have data bag named cloud-provider
(data_bag_name
attribute above) and encrypted with some shared secret data bag item named aws
(data_bag_item_name
attribute above) at your Chef Server. If secret_file
attribute from above is not defined a default for Chef Client shared secret file will be used (/etc/chef/encrypted_data_bag_secret
). For more information see official Chef docs.
Data bag item content should be of the form:
{ "id": "aws", "access_key_id": "your_access_key_id", "secret_access_key": "your_secret_access_key" }
Please note: id
value should be exactly the same as data_bag_item_name
attribute value from above.
Alternatively you can attach IAM policies to your AWS instances and do not provide AWS credentials in encrypted data bags. In this case you should have the following attribute for cookbook-openshift3
cookbook:
{ "openshift_cloud_provider": "aws" }
and the following IAM policy attached to your master servers:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" }, { "Effect": "Allow", "Action": "elasticloadbalancing:*", "Resource": "*" } ] }
and the following IAM policy attached to your node servers:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:AttachVolume", "Resource": "*" }, { "Effect": "Allow", "Action": "ec2:DetachVolume", "Resource": "*" } ] }
=====
Include the default recipe in a CHEF role so as to ease the deployment.
Roles (Examples)
- BASE
{ "name": "base", "description": "Common Base Role", "json_class": "Chef::Role", "default_attributes": { }, "override_attributes": { }, "chef_type": "role", "run_list": [ "recipe[cookbook-openshift3]" ], "env_run_lists": { } }
- UNINSTALL (ADHOC)
{ "name": "uninstall", "description": "Common Base Role", "json_class": "Chef::Role", "default_attributes": { }, "override_attributes": { }, "chef_type": "role", "run_list": [ "recipe[cookbook-openshift3::adhoc_uninstall]" ], "env_run_lists": { } }
- REDEPLOY CERTIFICATES (ADHOC)
The redeployment of the certificates requires variables and flags to be set before running.
The CHEF run will ignore any attempts unless all variables are correctly set
Variables:
NAME | PURPOSE | Default value | Mandatory |
---|---|---|---|
adhoc_redeploy_certificates | Execute certificates redeploy | false |
YES |
adhoc_redeploy_etcd_ca | Execute an ETCD CA redeploy | false |
YES |
adhoc_redeploy_cluster_ca | Execute a CLUSTER CA CERTS redeploy | false |
YES |
redeploy_etcd_ca_control_flag | Location of the etcd ca control flag | "/to_be_replaced_ca_etcd" |
YES |
redeploy_etcd_certs_control_flag | Location of the etcd certs control flag | "/to_be_replaced_certs" |
YES |
redeploy_cluster_ca_certserver_control_flag | Location of the cluster ca control flag | "/to_be_replaced_ca_cluster" |
YES |
redeploy_cluster_ca_masters_control_flag | Location of the cluster master ca control flag | "/to_be_replaced_masters" |
YES |
redeploy_cluster_ca_nodes_control_flag | Location of the node ca control flag | "/to_be_replaced_nodes" |
YES |
"override_attributes": { "cookbook-openshift3": { "redeploy_cluster_ca_certserver_control_flag": "/tmp/caready", "adhoc_redeploy_etcd_ca": true } }
[Read more about the certificate redeploy process here!](certificates-process.md)
ENVIRONMENT
Modify the attributes as required in your environments to change how various configurations are applied per the attributes section above.
In general, override attributes in the environment should be used when changing attributes.
Minimal example
- CLUSTER-NATIVE (Only available option)
{ "name": "cluster_native", "description": "", "cookbook_versions": { }, "json_class": "Chef::Environment", "chef_type": "environment", "default_attributes": { }, "override_attributes": { "cookbook-openshift3": { "openshift_HA": true, "openshift_cluster_name": "ose-cluster.domain.local", "persistent_storage": [ { "name": "registry", "capacity": "5Gi", "access_modes": "ReadWriteMany", "server": "core.domain.local", "path": "/var/nfs/registry", "claim": { "namespace": "default" } }, { "name": "metrics", "capacity": "3Gi", "access_modes": "ReadWriteOnce", "server": "core.domain.local", "path": "/var/nfs/metrics", "policy": "Recycle" }, { "name": "logging", "capacity": "2Gi", "access_modes": "ReadWriteOnce", "server": "core.domain.local", "path": "/var/nfs/logging", "policy": "Recycle" } ], "lb_servers": [ { "fqdn": "lb1-server.domain.local", "ipaddress": "1.1.1.4" }, ], "master_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2" }, { "fqdn": "ose3-server.domain.local", "ipaddress": "1.1.1.3" } ], "etcd_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2" }, { "fqdn": "ose3-server.domain.local", "ipaddress": "1.1.1.3" } ], "node_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1", "schedulable": true, "labels": "region=infra" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2", "schedulable": true, "labels": "region=infra" }, { "fqdn": "ose3-server.domain.local", "ipaddress": "1.1.1.3", "schedulable": true, "labels": "region=infra" }, { "fqdn": "ose4-server.domain.local", "ipaddress": "1.1.1.4", "labels": "region=user zone=east" }, { "fqdn": "ose5-server.domain.local", "ipaddress": "1.1.1.5", "labels": "region=user zone=west" }, ], } } }
- SINGLE MASTER (EMBEDDED ETCD)
{ "name": "single", "description": "", "cookbook_versions": { }, "json_class": "Chef::Environment", "chef_type": "environment", "default_attributes": { }, "override_attributes": { "cookbook-openshift3": { "master_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" } ], "node_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2", "labels": "region=user" } ], } } }
- ADD NEW ETCD SERVERS TO CLUSTER ("etcd_add_additional_nodes" must be set to true and a key called "new_node" should be added to the server(s)". If the server was previously part of the cluster, remember to clear its data directory before starting CHEF)
Members must
be added one by one !!!
... "etcd_add_additional_nodes": true, "etcd_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2" }, { "fqdn": "ose3-server.domain.local", "ipaddress": "1.1.1.3" }, { "fqdn": "ose4-server.domain.local", "ipaddress": "1.1.1.4", "new_node": true } ] ...
- REMOVE ETCD SERVERS FROM CLUSTER ("etcd_remove_servers" must be defined and list all servers you want to remove. etcd_servers should be your desire state")
You can remove all members in once!!!
... "etcd_remove_servers": [ { "fqdn": "ose4-server.domain.local", } ] "etcd_servers": [ { "fqdn": "ose1-server.domain.local", "ipaddress": "1.1.1.1" }, { "fqdn": "ose2-server.domain.local", "ipaddress": "1.1.1.2" }, { "fqdn": "ose3-server.domain.local", "ipaddress": "1.1.1.3" } ] ...
- EXCLUDE NODES FROM SCHEDULING AND LABELLING("skip_run" must be defined and the node will be excluded when enforcing labels and schedulability")
Ex (ose2 and ose3 will be skipped when enforcing the schedulable and labels parts.)
```json
...
"node_servers": [
{
"fqdn": "ose1-server.domain.local",
"ipaddress": "1.1.1.1",
"schedulable": true,
"labels": "region=infra"
},
{
"fqdn": "ose2-server.domain.local",
"ipaddress": "1.1.1.2",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
},
{
"fqdn": "ose3-server.domain.local",
"ipaddress": "1.1.1.3",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
}
]
...
```
Once it is done you should assign the node to the relevant environment.
knife node environment set NODE_NAME ENVIRONMENT_NAME
Run list
knife node run_list add NODE_NAME 'role[base]'
Manual Integration Test (ORIGIN)
There is a way to quickly test this cookbook.
You will need a CentOS 7.1+ with "Minimal" installation option and at least 10GB left on the Volume group. (Later used by Docker)
- Deploy ORIGIN ALL IN THE BOX Flavour (MASTER + NODE)
bash <(curl -s https://raw.githubusercontent.com/IshentRas/cookbook-openshift3/master/scripts/origin_deploy.sh)
Automated Integration Tests (KITCHEN)
This cookbook features inspect integration tests,
for both standalone and cluster-native (HA) variants.
Attention: the .kitchen.yml
tests all the versions listed in the Test Matrix,
so use kitchen list
and selective kitchen converge
to only test a subset of the versions.
Assuming the latest chef-dk is installed,
running the tests is as simple as:
kitchen converge # wait a few minutes to give openshift a chance to initialize before running the tests kitchen verify kitchen destroy
Check the .kitchen.yml
file to get started.
Automated Integration Tests (SHUTIT)
For multi-node setups, testing can be done using a ShutIt script.
There is a chef branch, which tests this cookbook.
[sudo] pip install shutit git clone --recursive https://github.com/ianmiell/shutit-openshift-cluster/tree/chef cd shutit-openshift-cluster ./run.sh
Release Checklist
- Run kitchen tests
- Are there any attributes changes? If yes:
- Update attribute-cookbook.md and
- Update example roles in README.md
- Have you updated the CHANGELOG.md?
Development
License and Author
Author: William Burton (william17.burton@gmail.com)
The MIT License (MIT)
Copyright (C) 2014 OpenBet Limited
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Dependent cookbooks
yum >= 5.0 |
iptables >= 4.0.0 |
selinux_policy >= 0.0.0 |
docker >= 4.0 |
Contingent cookbooks
There are no cookbooks that are contingent upon this one.
Openshift 3 Cookbook CHANGELOG
This file is used to list changes made in each version of the Openshift 3 cookbook.
v2.0.29
Improvement
- Stop pushing for etcd / docker package upgrade
- New vars for upgrade (ETCD/Docker) upgrade_docker_version upgrade_etcd_version
v2.0.28
Bug
- Fix issue when upgrading etcd
v2.0.27
Bug
- Fix foodcritic issue with new metric logic
v2.0.26
Bug
- Fix issue with excluder pkgs when server has got dual roles (master && node)
- Refactor the metrics logi to support all versions (3.3+)
- Fix issue when disabling SWAP for node servers
v2.0.25
Bug
- Add option to control docker yum exclude options custom_pkgs_excluder
- Revert last logic not working
v2.0.24
Bug
- Fix issue with master keys != 400 perms ### Improvement
- Add option to control docker yum options (Exclude/Include X pkgs) docker_yum_options
v2.0.23
Bug
- Fix issue with node service when NM is not turned off (Openshift >= 3.6)
v2.0.22
Bug
- Fix issue when restarting ETCD during upgrade
v2.0.21
Bug
- Fix issue during upgrade when having certificate_server which is not first master
- Add ETCD package to servers (Master for certificates, Etcd and certificate server for certificate renewal)
v2.0.20
Bug
- Fix issue during upgrade when upgrading master services
v2.0.19
Improvement
- Split the certificate server function from the other roles
- General code review
- Improve the general experience during certificate renewal
v2.0.18
Bug
- Fix issue during upgrade node components
v2.0.17
Improvement
- Give the possibility for setting ENV to router (openshift_hosted_deploy_env_router)
v2.0.16
Bug
- Fix issue during uninstall when server has not got docker installed
v2.0.15
Improvement
- Improve the general experience during upgrades
- Restarts of services are aligned with activities (upgrade/intall)
- Give the possibility for deploying custom router (openshift_hosted_deploy_custom_router)
v2.0.14
Bug
- Fix issue during upgrade when master are separated from ETCD
v2.0.13
Bug
- Fix race condition for certs
- Fix issue when deploying hosted services outside of the default project
v2.0.12
Bug
- General code improvements/MISC issues
v2.0.11
Bug
- General code improvements/MISC issues
v2.0.10
Bug
- Fix issue for upgrade when being a master only (No need to restart Docker)
v2.0.9
Bug
- Fix issue when creating PV (NFS)
- General code improvements/MISC issues
v2.0.8
Bug
- General code improvements/MISC issues
v2.0.7
Improvement
- Improve creating PV/PVC
Bug
- General code improvements/MISC issues
v2.0.6
Improvement
- Add logic for removing redhat registry (Fixed issue 206)
- Improve IPtables logic
Bug
- General code improvements/MISC issues
v2.0.5
Bug
- General code improvements/MISC issues
Improvement
- Initial Support for 3.7.x
- Capability for automated upgrade between versions
- Certitificate redeploy for ETCD (CA/CERTS)
v1.10.67
Bug
- Fixes error in v1.10.66 - use action ':nothing' on declaration, cf: https://serverfault.com/questions/587188/chef-how-to-run-a-resource-on-notification-only
- admin.kubeconfig made unambiguous - file creation failures avoided
v1.10.66
Improvement
- Add timeout to
du
call - Rewrite ruby blocks into Chef resources
v1.10.65
Improvement
- Initial support for 3.6
- Capability for Overriding master and node servingInfo.minTLSVersion and .cipherSuites [openshift_(master|node)cipher_suites, openshift(master|node)_min_tls_version]
- Capability for defining ExternalIPNetworkCIDRs controls what values are acceptable for the service external IP field [openshift_master_external_ip_network_cidrs]
- Capability for defining IngressIPNetworkCIDR controls the range to assign ingress IPs [openshift_master_ingress_ip_network_cidr]
- Capability for defining mcs_allocator_range, mcs_labels_per_project and uid_allocator_range [openshift_master_NAME]
- Capability for referencing the registry by a stable name (not IP) [openshift_push_via_dns]
- Add etcd_debug and etcd_log_package_levels capabilities
v1.10.64
Improvement
- All tgz files are encrypted with a default passphrase, and decrypted at the other end after downloading.
Bug
- Fixes error in v1.10.62 - file permissions on tar.gz
- Fix bug with LDAP Provider (Enforce LDAPS when selecting secure)
v1.10.63
Bug
- Fixes error in v1.10.62 - file permissions on tar.gz
v1.10.62 - BROKEN
Improvement
- Jenkinsfile parameters added
- New Centos yum repos added
Bug
- Allow users to suppress ruby block call from provider code (breaks in older Chef client versions)
- Make perms and ownership on tar.gz files explicit for more restrictive distributions
- Kitchen tests updated for latest versions
v1.10.61
Improvement
- Allow passing custom arguments when deploying the hosted router
Bug
- Fix issue with cookstyle indentation
v1.10.60
Improvement
- Update Example files (ImageStreams/Templates)
- Update Hosted templates
- Add more logic for dnsmasq (Install NetworkManager and add conf-dir line)
Bug
- Fix issues with certificate_servers
v1.10.59
Improvement
- Add the possibilty for openshift_buildoverrides
- Add the possibilty of retrieving the OCP certs from a custom location/server
Bug
- Fix issue with cookstyle indentation
- Improve the code for ignoring dnsmasq issues
- Add missing dirs and files to be removed when uninstalling
v1.10.58
Improvement
- Remove support for 1.2/3.2 (README)
v1.10.57
Improvement
- Remove support for 1.2/3.2
- Update openshift_example files
- Add extra wait time for 1.3/3.3 installation
Bug
- Change test for 1.3/3.3 to use docker 1.10.x
- Adapt the kubelet args
v1.10.56
Improvement
- Add the possibility of deploying Metrics according to https://docs.openshift.com/container-platform/latest/install_config/cluster_metrics.html
v1.10.55
Bug
- Fix backticks in environment not working (#138)
v1.10.54
Bug
- Fix CHEF-3694 warning that triggered while waiting for node registration
v1.10.53
Improvement
- Remove duplicated code between etcd_cluster and master_cluster recipes.
Bug
- Enable *-master-controllers and *-master-api services on master nodes.
- Fix Jenkinsfile: email address does not support aliases
- Fix CHEF-3694 warning with master certificates
v1.10.52
Bug
- Fix cookstyle issues
v1.10.51
Bug
- Fix bug when not declaring lb_servers role
v1.10.50
Bug
- Fix Foodcritic issues related to CONTRIBUTING.md
v1.10.49
Bug
- Fix Foodcritic issues related to metada.rb
v1.10.48
Improvement
- Initial support for 1.5/3.5 OCP
- Refactor logic for HA cluster deployment
- Add support for deploying only LB role (Haproxy) https://github.com/IshentRas/cookbook-openshift3/issues/100
- MISC bug fix
Bug
- Separated certificates to be copied from first master
v1.10.47
Improvement
- Jenkinsfile gets correct branch
- Kitchen tests at end (less likely to fail)
Bug
- Separated etcd cluster now works (all certs pulled from first master)
v1.10.46
Bug
- Spacing corrected and defaults not included as per discussion in #115
v1.10.45
Improvement
- Jenkinsfile has resilient kitchen tests reinstated
Bug
- Certificate redeployment code fixed to remove node certs
- Certificate redeployment - run etcd code only if etcd on the node (eg standalone)
v1.10.44
Improvement
- Upgrade from x.2 to x.3 supported
- Service signer cert created as part of cert creation
v1.10.43
Improvement
- Added Jenkinsfile
- Rename file: service_openvsitch-containerized.service.erb -> service_openvswitch-containerized.service.erb
Bug
- Fix redeploy certs for separate etcd cluster
- Use more config items rather than hard-coded values in delete node
v1.10.42
Improvement
- Replace most hard link usage with local copy
- Change http server binding to default IP address
- Give the possibility to specify custom certificate for hosted router
Bug
- Fix CHEF-3694 warning due to redundant package resource
- Removed potentially unsafe identity providers defaults
- Fix named certificates when common_name is also listed in alternative names
- Allow distinct hostnames for internal and public API access
v1.10.41
Bug
- Fix AWS issue when using empty data bag
v1.10.40
Bug
- Fix bug for enterprise version (Hosted template files)
- Fix deletion of service files
v1.10.39
Improvement
- Give the possibility of adding custom master CA certificate
- Give the possibility of supporting AWS IAM based integration
Bug
- Fix dnsIP for dedicated nameserver within PODS (Default to IP of the node)
v1.10.38
Improvement
- Give the possibility of adding cAdvisor port and read-only port for kubelet arguments
- Give the possibility of skipping nodes when applying schedulability and labelling
Bug
- Fix issue reported by https://github.com/IshentRas/cookbook-openshift3/issues/77
v1.10.37
Bug
- Emergency update for fixing ose_major_version when running standalone deployment
v1.10.36
Bug
- Fixed cookstyle offenses
- Revert the ETCD change causing issue when adding / removing members
- Make secret call compatible with x.2 version(s)
Improvement
- Expand .kitchen.yml to test OSE v1.4.1, v1.3.3 and v1.2.1
- Improved code readability
- Added support for multiple identity providers
- Added support for AWS cloud provider
v1.10.35
Bug
- Fix ETCD service defined in 2 places
- Fix cookstyle issues
- Fix admin.kubeconfig logic
v1.10.34
Bug
- Adjust predicates and priorities based on ose_major_version
- Fix containerized deployment
Improvement
- Give the possibility to add or remove etcd server members
- Improve ETCD deployment for single etcd server
v1.10.33
Bug
- Revert e168f9b, use stable repository URLs again
Improvement
- Use stable CentOS PaaS repository during tests
- Add integration test for hosted metrics feature
v1.10.32
Bug
- Make apiServerArguments conditional on the version for pre-1.3/3.3 versions
v1.10.31
Improvement
- Handle 1.4/3.4 deployment
- Clean codes over unused attributes
- Integration tests for 1.4/3.4
- Add the possibility to supply dns-search option via Docker
- Add the possibility to specify a deserialization cache size parameter.
Bug
- Fix permissions over /etc/origin/node
- Fix iptables issue due to version used by clients
v1.10.30
Improvement
- Add the possibility to deploy the cluster metrics
- Add the possibility to add more manageName serviceaccount in master config
- Move registry persistent_volume_claim name to explicit LWRP attribute
- Added integration test for openshift_hosted_manage_registry feature
- Added integration test for openshift_hosted_manage_router feature
- Added integration test for persistent_storage feature
- Refactor router-related resources to new openshift_deploy_router LWRP
- Move registry persistent_volume_claim name to explicit LWRP attribute
Bug
- Fix README.md typo
- Fix issue with systemd when uninstalling the Openshift
- Fix issue for systemctl daemon-reload
- Removed redundant guard clause for registry deloyment
v1.10.29
Bug
- Remove property attributes for resources (backward compatibility)
v1.10.28
Improvement
- Add the possibility to deploy the cluster metrics
- Add the possibility to add more manageName serviceaccount in master config
Bug
- Fix README.md typo
- Fix issue with systemd when uninstalling the Openshift
- Fix issue for systemctl daemon-reload
v1.10.27
Bug
- Fix the Origin deployment issue (https://github.com/IshentRas/cookbook-openshift3/issues/20)
- Fix master-api service and master-controllers service (https://github.com/IshentRas/cookbook-openshift3/issues/40)
v1.10.26
Improvement
- Set the default ipaddress used in etcd-related attributes accordingly with the etcd_server variable
Bug
- Remove duplicated variables for ETCD
v1.10.25
Bug
- Fix documentation
- Fix redeploying OSE certificates
v1.10.24
Improvement
- Add the possibility to run adhoc command for redeploying OSE certificates
- Add FW rules in a dedicated jump chain
- Add a validation point for mandatory variables
- Add the possibility to specify logging drivers (https://docs.docker.com/engine/admin/logging/overview/)
Bug
- Fix adhoc uninstall
- Move openssl.conf under CA directory (ETCD)
v1.10.23
Bug
- Typo in README
- Fix schedulability and node-labelling guards
v1.10.22
Bug
- Skip nodes which are not listed when labelling or seetingn schedulability (https://github.com/IshentRas/cookbook-openshift3/issues/32)
v1.10.21
Bug
- Improve delete adhoc
- Remove duplicates for cors origin (Forcing ETCD to fail)
v1.10.20
Improvement
- Remove the need to specify the master server peers.
- Add the possibility to specify scc rather than assuming \'privileged\' one
- Add new scheduler predicates & priorities
- Add the possibility to create PV and PVC (Type NFS only)
- Deploy Hosted environment (Registry & Router)
- Autoscale Hosted environment (Registry & Router) based on labelling
- Only 1 recipe is needed for deploying the environment : recipe[cookbook-openshift3]
Bug
- Remove duplicated resources
- Fix Docker log-driver for json
Removal
- Remove the node['cookbook-openshift3']['use_params_roles'] which used the CHEF search capability
- Remove the node['cookbook-openshift3']['set_nameserver'] and node['cookbook-openshift3']['register_dns']
v1.10.19
Improvement
- Add the possibility to enable the Audit logging
- Add the possibility to label nodes
- Add the possibility to set scheduling against nodes
- Add the possibility to deploy the Stand-alone Registry & Router
Bug
- Remove automatic rebooting when playing adhoc uninstallation
v1.10.18
Improvement
- Add the possibility to run adhoc command for uninstalling Openshift on dedicated server(s)
v1.10.17
Improvement
- Add the possibility to have any number of ETCD servers
Bug
- Fix HTTPD service enabling for ETCD
v1.10.16
Improvement
- Add the possibility to only deploy ETCD role
Bug
- Remove hard-coded values for deployment type (Affecting Origin deploymemts)
v1.10.15
Improvement
- Add the possibility to specifying an exact rpm version to install or configure.
- Update Openshift configuration for 1.3 or 3.3
- Add the possibilty to specifying a major version (3.1, 3.2 or 3.3)
v1.10.14
Bug
- Add logging EFK
v1.10.13
Bug
- Add SNI capability when testing master API
Improvement
- Give the choice to user to select CHEF search or solo capability
- Add the concept of wildcard nodes --> wildcard kubeconfig (AWS cloud deployment)
- Update Openshift templates
v1.10.12
Bug
- Fix nodeSelector issue when using cluster architecture
Improvement
- Add capacity to manage container logs (Docker options)
v1.10.11
Bug
- Remove too restrictive version for RHEL
v1.10.10
Bug
- Fix typo for URL for Public master API
v1.10.9
Bug
- Fix URL for master API
Improvement
- Clarify use of masterPublicURL, publicURL and masterURL
v1.10.8
Improvement
- Simplify the creation of node/master servers
v1.10.7
Bug
- Fix issue for dnsmasq
v1.10.6
Bug
- Fix issue for documentation
v1.10.5
Bug
- Fix issue for documentation
v1.10.4
Bug
- Fix issue for restarting openshift-api or controllers
- Fix issue for restarting node
Improvement
- Update Openshift documentation
- Use chef-solo attribute style as a default for setting attributes
- Remove queries for any type of data that is indexed by the Chef server
v1.10.3
Bug
- Fix issue for Openshift Node (Clashing ClusterNetwork)
- Fix issue for generating certificates (NODES)
Improvement
- Add capability for deploying 3.2.x
- Add capability for deploying containerized version of Openshift
- Add capability of using dnsmasq for interacting with skyDNS
- Update Openshift template examples
v1.10.2
Bug
- Fix issue for nodes certificate SAN
v1.10.1
Bug
- Fix issue for ETCD certificate lifetime
- Fix IP discovery for origin_deploy.sh
Improvement
- Add capability for enabling or not a yum repository
v1.10.0
Bug
- Fix docker restrart when running CHEF
- Fix openshift-master restart when running CHEF
- Fix openshift-node restart when running CHEF
v1.0.9
Bug
- Remove dnsIP from node definiton. Default to use the kubernetes service network 172.x.x.1
v1.0.8
Improvement
- Add kubeletArguments for node servers
Bug
- Enable Docker at startup
- Mask master service when running native HA
v1.0.7
Improvement
- Add possibility to disable yum repositories
- Fix etcd certificate (Simplify the call for peers members)
- Add possibility to specify a version to be installed for docker
Bug
- Fix permissions for directory (Set to Apache in case of a dodgy umask number)
v1.0.6
Improvement
- Add delay/retry before installing servcieaccount
- Change xip.io for nip.io (STABLE)
Bug
- Fix scripts/origin_deploy.sh
- Fix hostname for origin_deploy.sh
v1.0.5
Bug
- Fix bug when enabling HTTPD at startup
v1.0.4
Improvement
- Detect the CN or SAN from certificates file when using named certificates.
- Move origin_deploy.sh in scripts folder
Bug
- Enable HTTPD at startup
- Fix some typos
mprovement
- Add the possibility to only deploy ETCD role
Bug
- Remove hard-coded values for deployment type (Affecting Origin deploymemts) ## v1.0.3 ### Improvement
- Add possibility to customise docker-storage-setup
- Add possibility for configuring Custom Certificates
v1.0.2
Improvement
- Add MIT LICENCE model
- Add script to auto deploy origin instance
- Add the possibility to exclude packages from updates or installs
Bug fix
- Fix attributes labelling when using chef in local mode (or solo)
- Remove specific mentions to OSE
v0.0.1
- Current public release
Collaborator Number Metric
2.0.29 passed this metric
Contributing File Metric
2.0.29 passed this metric
Foodcritic Metric
2.0.29 passed this metric
License Metric
2.0.29 passed this metric
No Binaries Metric
2.0.29 passed this metric
Testing File Metric
2.0.29 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
2.0.29 passed this metric
2.0.29 passed this metric
2.0.29 passed this metric
Foodcritic Metric
2.0.29 passed this metric
License Metric
2.0.29 passed this metric
No Binaries Metric
2.0.29 passed this metric
Testing File Metric
2.0.29 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
2.0.29 passed this metric
2.0.29 passed this metric
2.0.29 passed this metric
No Binaries Metric
2.0.29 passed this metric
Testing File Metric
2.0.29 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
2.0.29 passed this metric
2.0.29 passed this metric
2.0.29 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
2.0.29 passed this metric
2.0.29 passed this metric