Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status

RSS

cookbook-openshift3 (157) Versions 2.0.63

Installs/Configures Openshift 3.x (>= 3.4)

Policyfile
Berkshelf
Knife
cookbook 'cookbook-openshift3', '= 2.0.63', :supermarket
cookbook 'cookbook-openshift3', '= 2.0.63'
knife supermarket install cookbook-openshift3
knife supermarket download cookbook-openshift3
README
Dependencies
Changelog
Quality 83%

Description

  • Installs OSEv3 and related packages.

Requirements

Platform

  • Tested on Red Hat RHEL 7.4
  • Tested on Centos 7.4

Openshift Version

  • Support OSE version from 3.3+
  • Support Origin version from 1.3+
  • Default the installation to 3.7

Highly recommended:

Explicitly set node['cookbook-openshift3']['ose_version'], node['cookbook-openshift3']['ose_major_version']
and ideally node['cookbook-openshift3']['docker_version'] to be safe when a major version is released on the
CentOS PaaS repository;

This cookbook does support upgrade between major versions (Read doc)

New Features!

  • Control upgrades between versions
  • ETCD migration v2 to v3 (Mandatory before upgrading to 3.7)

Supported version

[x] 1.3 to 1.4

[x] 1.4 to 1.5

[x] 1.5 to 3.6

[x] 3.6 to 3.7

Control Upgrade

Control upgrade requires variables to be set before running.

The CHEF run will ignore any upgrade unless all variables are correctly set

Variables:

NAME PURPOSE Default value Mandatory
control_upgrade Execute an upgrade false YES
control_upgrade_version Target version (13,14,15,36,37) "" YES
control_upgrade_flag Location of the control upgrade flag "/to_be_replaced" YES
upgrade_repos Target YUM repo "" NO
  "override_attributes": {
    "cookbook-openshift3": {
      "control_upgrade": true,
      "control_upgrade_version": "37",
      "control_upgrade_flag": "/tmp/ready",
      "upgrade_repos": [
        {
          "name": "centos-openshift-origin37",
          "baseurl": "http://mirror.centos.org/centos/7/paas/x86_64/openshift-origin37/",
          "gpgcheck": false
        }
      ]
    }
  }

[Read more about the upgrade process here!](docs/upgrade-process.md)

Test Matrix

Platform OSE 3.7.0 OSE 3.6.1 OSE 1.5.1 OSE 1.4.1 OSE 1.3.3 OSE 1.2.2
centos 7.4 PASS PASS PASS PASS PASS Not supported

Override Attributes

[Read more about overriding attributes here!](docs/attribute-cookbook.md)

Structure


  • node['cookbook-openshift3']['openshift_master_identity_provider']['HTPasswdPasswordIdentityProvider']
{
"name" : "htpasswd_auth", 
"login" : true, 
"challenge" : true, 
"kind" : "HTPasswdPasswordIdentityProvider", 
"filename" : "/etc/openshift/openshift-passwd"
}
  • node['cookbook-openshift3']['openshift_master_identity_provider']['LDAPPasswordIdentityProvider']
{
"name" : "ldap_identity", 
"login" : true, 
"challenge" : true, 
"kind" : "LDAPPasswordIdentityProvider", 
"ldap_server" : "ldap.domain.local",
 "ldap_bind_dn" : "", 
 "ldap_bind_password" : "",
 "ldap_insecure" : true, 
 "ldap_base_ou" : "OU=people,DC=domain,DC=local", 
 "ldap_preferred_username" : "uid"
}
  • node['cookbook-openshift3']['openshift_master_asset_config']
{
 "extensionStylesheets":["/path/to/css"],
 "extensionScripts":["/path/to/script"],
 "extensions":"/path/to/my_images",
 "templates":"/path/to/template"
}
  • node['cookbook-openshift3']['openshift_node_docker-storage']
{
 "DEVS": ["/dev/sdb","/dev/sdc"],
 "VG": "docker-vg",
 "DATA_SIZE": "80%FREE"
}
  • node['cookbook-openshift3']['docker_log_driver']

Set to 'json-file' (default), 'journald' or any other supported docker log driver.
Set to '' to disable it.

  • node['cookbook-openshift3']['docker_log_options']

Assuming node['cookbook-openshift3']['docker_log_driver'] is 'json-file' (the default):

{
 "max-size": "50M",
 "max-file": "3"
}

Any option can be set, as long as they are supported by the current docker log driver.

  • node['cookbook-openshift3']['openshift_master_named_certificates']

  • CN or SAN names are automatically detected from the certificate file.

[
  {
   "certfile": "/etc/where_is/my_certfile",
   "keyfile": "/etc/where_is/my_keyfile"
  }
]
  • node['cookbook-openshift3']['persistent_storage']

  • They key called 'claim' is optional and will automatically create a PersistentVolumeClaim within a specified namespace.

{
  "name": "registry",
  "capacity": "5Gi",
  "access_modes": "ReadWriteMany",
  "server": "core.domain.local",
  "path": "/var/nfs/registry",
  "claim": {
    "namespace": "default"
  }
}
  • node['cookbook-openshift3']['openshift_hosted_cluster_metrics']

Any option can be set, as long as they are supported by the current Metrics deployer template.

Full list of attributes can be found here.

We only support 1 cassandra POD.
Once the metrics is deployed, it creates a flag (openshift_hosted_metrics_flag) on the first master to avoid having CHEF re-creating the resources over and over.

Example of options for deploying metrics:
json
{
"openshift_hosted_cluster_metrics": true,
"openshift_metrics_heapster_requests_memory": "1Gi",
"openshift_metrics_image_version": "v1.5.1",
"openshift_metrics_cassandra_storage_type": "dynamic",
"openshift_metrics_hawkular_user_write_access": false,
"....."
}

Example of removing metrics components:
json
{
"openshift_hosted_cluster_metrics": true,
"openshift_metrics_install_metrics": false,
"....."
}

Example of overriding the default kubelet options:
* node['cookbook-openshift3']['openshift_node_kubelet_args_custom']
Any option can be set, as long as they are supported by current Kubelet Options.

{
  "openshift_node_kubelet_args_custom": {
    "pods-per-core": "5",
    "image-gc-high-threshold": "85",
    "resolv-conf": "/etc/resolv.conf"
  },
  "....."
}

Example of enabling a specific "feature-gate": enabling the persistent local volumes feature (OSE v3.7 and up):
json
{
"openshift_master_api_server_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
},
"openshift_master_controller_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
},
"openshift_node_kubelet_args_custom": {
"feature-gates": ["PersistentLocalVolumes=true"]
}
}

  • node['cookbook-openshift3']['openshift_hosted_router_deploy_shards']

Any ENV options can be set for the sharding router, as long as they are supported by the current documentation Set ENV for router sharding.

** The dedicated service account must have access to the hostnetwork SCC **

Example of options for deploying router sharding:
```json
{
"....."
"openshift_hosted_router_deploy_shards": true,
"openshift_hosted_router_shard":[
{
"namespace": "custom-shard1",
"service_account": "shard1",
"selector": "region=shard1",
"env": [
"ROUTE_LABELS='shard1=yes'"
]
},
{
"namespace": "custom-shard2",
"service_account": "shard2",
"selector": "region=shard2",
"env": [
"NAMESPACE_LABELS='dept != finance'",
]
},
],
"openshift_common_service_accounts_additional": [
{
"name": "shard1",
"namespace": "shard1",
"scc": ["hostnetwork"]
},
{
"name": "shard2",
"namespace": "custom-shard2",
"scc": ["hostnetwork"]
}

],
"....."
}
```

Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig Hash

Key Name Description
enable A boolean to enable or disable audit logs. Default is false.
audit-file File path where the requests should be logged to. If not set, logs are printed to master logs.
max-retention-day Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename.
max-file-number Specifies the maximum number of old audit log files to retain.
max-file-size Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB.
{
  ...
  "openshift_master_auditconfig": {
    "enable": true,
    "audit-file": "/var/log/audit-ocp",
    "max-file-size": "50",
    "max-file-number": "10"
  },
  ...
}

Example of overriding the Audit Configuration Parameters for the openshift_master_auditconfig Hash

Key Name Description
enable A boolean to enable or disable audit logs. Default is false.
audit-file File path where the requests should be logged to. If not set, logs are printed to master logs.
max-retention-day Specifies maximum number of days to retain old audit log files based on the time stamp encoded in their filename.
max-file-number Specifies the maximum number of old audit log files to retain.
max-file-size Specifies maximum size in megabytes of the log file before it gets rotated. Defaults to 100MB.
{
  ...
  "openshift_master_auditconfig": {
    "enable": true,
    "audit-file": "/var/log/audit-ocp",
    "max-file-size": "50",
    "max-file-number": "10"
  },
  ...
}

Example of overriding the setting for global builds:
Any option can be set, as long as they are supported by current Global Build Defaults and Overrides.

When setting CPU/Memory via openshift_builddefaults_resources_*, openshift_builddefaults_resources needs to be set to true

{
  "....."
  "openshift_builddefaults_git_http_proxy": "http://USER:PASSWORD@HOST:PORT",
  "openshift_builddefaults_git_https_proxy": "https://USER:PASSWORD@HOST:PORT",
  "openshift_builddefaults_git_no_proxy": "mycorp.com",
  "openshift_builddefaults_env": [
    {
      "http_proxy": "http://proxy.example.com.redhat.com:3128"
    },
    {
      "NO_PROXY": "ose3-master.example.com"
    }
  ],
  "openshift_builddefaults_image_labels": [
    {
      "name": "imagelabelname1",
      "value": "imagelabelvalue1"
    }
  ],
  "openshift_builddefaults_nodeselectors": {
    "nodelabel1": "nodelabelvalue1",
    "nodelabel2": "nodelabelvalue2"
  },
  "openshift_builddefaults_annotations": {
    "annotationkey1": "annotationvalue1"
  },
  "openshift_buildoverrides_force_pull": "true",
  "openshift_buildoverrides_image_labels": [
    {
      "name": "imagelabelname1",
      "value": "imagelabelvalue1"
    }
  ],
  "openshift_buildoverrides_nodeselectors": {
    "nodelabel1": "nodelabelvalue1"
  },
  "openshift_buildoverrides_annotations": {
    "annotationkey1": "annotationvalue1"
  },
  "....."
}

If OpenShift Container Platform administrators would like to control the level of overcommit and manage container density on nodes, masters can be configured to override the ratio between request and limit set on developer containers. This requires configuring the ClusterResourceOverride variables.

{
  ".....",
  "openshift_clusterresourceoverrides_memorylimit_percent": "10",
  "openshift_clusterresourceoverrides_cpulimit_percent": "50",
  "openshift_clusterresourceoverrides_limitcputomem_percent": "200",
  "...."
}

Cloud Providers Integration

Cloud providers integration requires passing some sensetive credentials to OpenShift. This cookbook uses encrypted data bags as the safest way to achieve this. Thus you should have:

  • running Chef Server
  • encrypted data bags with cloud providers' credentials

Currently only AWS integration is supported.

AWS

To integrate your OpenShift installation with AWS you should have following attributes for cookbook-openshift3 cookbook:

{
  "openshift_cloud_provider": "aws",
  "openshift_cloud_providers": {
    "aws": {
      "data_bag_name": "cloud-provider",
      "data_bag_item_name": "aws",
      "secret_file": "/etc/chef/shared_secret"
    }
  }
}

You should also have data bag named cloud-provider (data_bag_name attribute above) and encrypted with some shared secret data bag item named aws (data_bag_item_name attribute above) at your Chef Server. If secret_file attribute from above is not defined a default for Chef Client shared secret file will be used (/etc/chef/encrypted_data_bag_secret). For more information see official Chef docs.

Data bag item content should be of the form:

{
  "id": "aws",
  "access_key_id": "your_access_key_id",
  "secret_access_key": "your_secret_access_key"
}

Please note: id value should be exactly the same as data_bag_item_name attribute value from above.

Alternatively you can attach IAM policies to your AWS instances and do not provide AWS credentials in encrypted data bags. In this case you should have the following attribute for cookbook-openshift3 cookbook:

{
  "openshift_cloud_provider": "aws"
}

and the following IAM policy attached to your master servers:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "elasticloadbalancing:*",
      "Resource": "*"
    }
  ]
}

and the following IAM policy attached to your node servers:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:AttachVolume",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:DetachVolume",
      "Resource": "*"
    }
  ]
}

=====

Include the default recipe in a CHEF role so as to ease the deployment.

Roles (Examples)

  • BASE
{
  "name": "base",
  "description": "Common Base Role",
  "json_class": "Chef::Role",
  "default_attributes": {

  },
  "override_attributes": {
  },
  "chef_type": "role",
  "run_list": [
    "recipe[cookbook-openshift3]"
  ],
  "env_run_lists": {

  }
}
  • UNINSTALL (ADHOC)
{
  "name": "uninstall",
  "description": "Common Base Role",
  "json_class": "Chef::Role",
  "default_attributes": {

  },
  "override_attributes": {
  },
  "chef_type": "role",
  "run_list": [
    "recipe[cookbook-openshift3::adhoc_uninstall]"
  ],
  "env_run_lists": {

  }
}
  • REDEPLOY CERTIFICATES (ADHOC)

The redeployment of the certificates requires variables and flags to be set before running.

The CHEF run will ignore any attempts unless all variables are correctly set

Variables:

NAME PURPOSE Default value Mandatory Target
adhoc_redeploy_certificates Execute certificates redeploy false YES Masters/Nodes/Certificate Server
adhoc_redeploy_etcd_ca Execute an ETCD CA redeploy false YES ETCD/Masters
adhoc_redeploy_cluster_ca Execute a CLUSTER CA CERTS redeploy false YES Masters/Nodes/Certificate Server
redeploy_etcd_ca_control_flag Location of the etcd ca control flag "/to_be_replaced_ca_etcd" YES Certificate Server
redeploy_etcd_certs_control_flag Location of the etcd certs control flag "/to_be_replaced_certs" YES ETCD/Masters
redeploy_cluster_ca_certserver_control_flag Location of the cluster ca control flag "/to_be_replaced_ca_cluster" YES Certificate Server
redeploy_cluster_ca_masters_control_flag Location of the cluster master ca control flag "/to_be_replaced_masters" YES Masters
redeploy_cluster_ca_nodes_control_flag Location of the node ca control flag "/to_be_replaced_nodes" YES Nodes
redeploy_cluster_hosted_certserver_control_flag Location of the hosted control flag "/to_be_replaced_hosted_cluster" YES 1st Master
  "override_attributes": {
    "cookbook-openshift3": {
      "redeploy_cluster_ca_certserver_control_flag": "/tmp/caready",
      "adhoc_redeploy_etcd_ca": true
    }
  }

[Read more about the certificate redeploy process here!](docs/certificates-process.md)

ENVIRONMENT

Modify the attributes as required in your environments to change how various configurations are applied per the attributes section above.
In general, override attributes in the environment should be used when changing attributes.

Minimal example

  • CLUSTER-NATIVE (Only available option)
{
  "name": "cluster_native",
  "description": "",
  "cookbook_versions": {

  },
  "json_class": "Chef::Environment",
  "chef_type": "environment",
  "default_attributes": {

  },
  "override_attributes": {
    "cookbook-openshift3": {
      "openshift_HA": true,
      "openshift_cluster_name": "ose-cluster.domain.local",
      "persistent_storage": [
        {
          "name": "registry",
          "capacity": "5Gi",
          "access_modes": "ReadWriteMany",
          "server": "core.domain.local",
          "path": "/var/nfs/registry",
          "claim": {
            "namespace": "default"
          }
        },
        {
          "name": "metrics",
          "capacity": "3Gi",
          "access_modes": "ReadWriteOnce",
          "server": "core.domain.local",
          "path": "/var/nfs/metrics",
          "policy": "Recycle"
        },
        {
          "name": "logging",
          "capacity": "2Gi",
          "access_modes": "ReadWriteOnce",
          "server": "core.domain.local",
          "path": "/var/nfs/logging",
          "policy": "Recycle"
        }
      ],
      "lb_servers": [
        {
          "fqdn": "lb1-server.domain.local",
          "ipaddress": "1.1.1.4"
        },
      ],
      "master_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"
        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ],
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ],
      "node_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3",
          "schedulable": true,
          "labels": "region=infra"
        },
        {
          "fqdn": "ose4-server.domain.local",
          "ipaddress": "1.1.1.4",
          "labels": "region=user zone=east"
        },
        {
          "fqdn": "ose5-server.domain.local",
          "ipaddress": "1.1.1.5",
          "labels": "region=user zone=west"
        },        
      ],
    }
  }
}
  • SINGLE MASTER (EMBEDDED ETCD)
{
  "name": "single",
  "description": "",
  "cookbook_versions": {

  },
  "json_class": "Chef::Environment",
  "chef_type": "environment",
  "default_attributes": {

  },
  "override_attributes": {
    "cookbook-openshift3": {
      "master_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        }
      ],
      "node_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2",
          "labels": "region=user"
        }
      ],
    }
  }
}
  • ADD NEW ETCD SERVERS TO CLUSTER ("etcd_add_additional_nodes" must be set to true and a key called "new_node" should be added to the server(s)". If the server was previously part of the cluster, remember to clear its data directory before starting CHEF)

Members must be added one by one !!!

...
      "etcd_add_additional_nodes": true,
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        },
        {
          "fqdn": "ose4-server.domain.local",
          "ipaddress": "1.1.1.4",
          "new_node": true
        }
      ]
...
  • REMOVE ETCD SERVERS FROM CLUSTER ("etcd_remove_servers" must be defined and list all servers you want to remove. etcd_servers should be your desire state")

You can remove all members in once!!!

...
      "etcd_remove_servers": [
        {
          "fqdn": "ose4-server.domain.local",
        }
      ]
      "etcd_servers": [
        {
          "fqdn": "ose1-server.domain.local",
          "ipaddress": "1.1.1.1"
        },
        {
          "fqdn": "ose2-server.domain.local",
          "ipaddress": "1.1.1.2"

        },
        {
          "fqdn": "ose3-server.domain.local",
          "ipaddress": "1.1.1.3"
        }
      ]
...
  • EXCLUDE NODES FROM SCHEDULING AND LABELLING("skip_run" must be defined and the node will be excluded when enforcing labels and schedulability")

Ex (ose2 and ose3 will be skipped when enforcing the schedulable and labels parts.)
```json
...
"node_servers": [
{
"fqdn": "ose1-server.domain.local",
"ipaddress": "1.1.1.1",
"schedulable": true,
"labels": "region=infra"
},
{
"fqdn": "ose2-server.domain.local",
"ipaddress": "1.1.1.2",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
},
{
"fqdn": "ose3-server.domain.local",
"ipaddress": "1.1.1.3",
"schedulable": true,
"labels": "region=infra",
"skip_run": true
}
]

...
```

Once it is done you should assign the node to the relevant environment.

knife node environment set NODE_NAME ENVIRONMENT_NAME

Run list

knife node run_list add NODE_NAME 'role[base]'

Manual Integration Test (ORIGIN)

There is a way to quickly test this cookbook.
You will need a CentOS 7.1+ with "Minimal" installation option and at least 10GB left on the Volume group. (Later used by Docker)

  • Deploy ORIGIN ALL IN THE BOX Flavour (MASTER + NODE) bash <(curl -s https://raw.githubusercontent.com/IshentRas/cookbook-openshift3/master/scripts/origin_deploy.sh)

Automated Integration Tests (KITCHEN)

This cookbook features inspect integration tests,
for both standalone and cluster-native (HA) variants.

Attention: the .kitchen.yml tests all the versions listed in the Test Matrix,
so use kitchen list and selective kitchen converge to only test a subset of the versions.

Assuming the latest chef-dk is installed,
running the tests is as simple as:

kitchen converge
# wait a few minutes to give openshift a chance to initialize before running the tests
kitchen verify
kitchen destroy

Check the .kitchen.yml file to get started.

Automated Integration Tests (SHUTIT)

For multi-node setups, testing can be done using a ShutIt script.

There is a chef branch, which tests this cookbook.

[sudo] pip install shutit
git clone --recursive https://github.com/ianmiell/shutit-openshift-cluster/tree/chef
cd shutit-openshift-cluster
./run.sh

Release Checklist

  • Run kitchen tests
  • Are there any attributes changes? If yes:
  • Update docs/attribute-cookbook.md and
  • Update example roles in README.md
  • Have you updated the CHANGELOG.md?

Development

License and Author

Author: William Burton (william17.burton@gmail.com)

The MIT License (MIT)

Copyright (C) 2014 OpenBet Limited

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Dependent cookbooks

yum >= 5.0
iptables >= 4.0.0
selinux_policy >= 0.0.0
docker >= 4.0

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

Openshift 3 Cookbook CHANGELOG

This file is used to list changes made in each version of the Openshift 3 cookbook.

v2.0.63

Bug

  • Fix issue when resetting a master node
  • Fix several Cloning resource attributes issues

v2.0.62

Improvement

  • Give the possibility to reset a node including the docker-storage thin-pool (If it is in used) adhoc_reset_control_flag

v2.0.60-61

Improvement

  • Give the possibility to deploy router sharding (Read README)

v2.0.58-59

Improvement

  • Improve metrics deployment logic

v2.0.57

Bug

  • Fix issue when deleting servers

v2.0.56

Improvement

  • Automatically upgrade the custom router template during upgrades

v2.0.53-55

Bug

  • Fix issue with cloud_provider when restarting node service.

v2.0.52

Bug

  • Fix issue reported 247 (Upgrade 36 -> 37)

v2.0.51

Bug

  • Fix rubocop issues

v2.0.50

Bug

  • Fix issue reported 244 (Insecure docker registry)
  • Fix issue reported 247 (Customised CA)

Improvement

  • Give the possibility of providing an array for the SCCs

v2.0.49

Bug

  • Fix several Cloning resource attributes issues
  • Fix ETCD ca perms on certificate server

v2.0.48

Bug

  • Prevent Docker to reinstall or update without control

v2.0.47

Improvement

  • Asynchronous Errata Updates via variable asynchronous_upgrade (Default to false)

v2.0.46

Improvement

  • Add possibility to specify specific yum options when installing docker docker_yum_options
  • Add reverse lookup for SkyDNS

v2.0.45

Improvement

  • Give the possibilty to provide a custom location for '/etc/NetworkManager/dispatcher.d/99-origin-dns.sh'

v2.0.44

Improvement

  • Change the ETCD CA directory for the certificate server (Moving the certificate server becomes easier: mv /var/www/html)

v2.0.43

Bug

  • Fix issue 240 when using standalone master

v2.0.42

Bug

  • Regression bug for controller servers (TTL missing)

v2.0.41

Bug

  • Remove the openshift-master.kubeconfig file when regenerating certs (Issue < 3.2)

v2.0.40

Bug

  • Wrong option for generating node certs

v2.0.39

Bug

  • Bug with certificates renewal for node servers

v2.0.34 - v2.0.38

Bug

  • Bug with certificates renewal

v2.0.33

Bug

  • Bug with library for identifying the server roles

v2.0.32

Bug

  • Bug with library for identifying the server roles

v2.0.31

Bug

  • Force secret for registry HTTPS

v2.0.30

Improvement

  • Improve the certs renewal
  • Improve the custom router template (Name can be customised) openshift_hosted_deploy_custom_name

v2.0.29

Improvement

  • Stop pushing for etcd / docker package upgrade
  • New vars for upgrade (ETCD/Docker) upgrade_docker_version upgrade_etcd_version

v2.0.28

Bug

  • Fix issue when upgrading etcd

v2.0.27

Bug

  • Fix foodcritic issue with new metric logic

v2.0.26

Bug

  • Fix issue with excluder pkgs when server has got dual roles (master && node)
  • Refactor the metrics logi to support all versions (3.3+)
  • Fix issue when disabling SWAP for node servers

v2.0.25

Bug

  • Add option to control docker yum exclude options custom_pkgs_excluder
  • Revert last logic not working

v2.0.24

Bug

  • Fix issue with master keys != 400 perms ### Improvement
  • Add option to control docker yum options (Exclude/Include X pkgs) docker_yum_options

v2.0.23

Bug

  • Fix issue with node service when NM is not turned off (Openshift >= 3.6)

v2.0.22

Bug

  • Fix issue when restarting ETCD during upgrade

v2.0.21

Bug

  • Fix issue during upgrade when having certificate_server which is not first master
  • Add ETCD package to servers (Master for certificates, Etcd and certificate server for certificate renewal)

v2.0.20

Bug

  • Fix issue during upgrade when upgrading master services

v2.0.19

Improvement

  • Split the certificate server function from the other roles
  • General code review
  • Improve the general experience during certificate renewal

v2.0.18

Bug

  • Fix issue during upgrade node components

v2.0.17

Improvement

  • Give the possibility for setting ENV to router (openshift_hosted_deploy_env_router)

v2.0.16

Bug

  • Fix issue during uninstall when server has not got docker installed

v2.0.15

Improvement

  • Improve the general experience during upgrades
  • Restarts of services are aligned with activities (upgrade/intall)
  • Give the possibility for deploying custom router (openshift_hosted_deploy_custom_router)

v2.0.14

Bug

  • Fix issue during upgrade when master are separated from ETCD

v2.0.13

Bug

  • Fix race condition for certs
  • Fix issue when deploying hosted services outside of the default project

v2.0.12

Bug

  • General code improvements/MISC issues

v2.0.11

Bug

  • General code improvements/MISC issues

v2.0.10

Bug

  • Fix issue for upgrade when being a master only (No need to restart Docker)

v2.0.9

Bug

  • Fix issue when creating PV (NFS)
  • General code improvements/MISC issues

v2.0.8

Bug

  • General code improvements/MISC issues

v2.0.7

Improvement

  • Improve creating PV/PVC

Bug

  • General code improvements/MISC issues

v2.0.6

Improvement

  • Add logic for removing redhat registry (Fixed issue 206)
  • Improve IPtables logic

Bug

  • General code improvements/MISC issues

v2.0.5

Bug

  • General code improvements/MISC issues

Improvement

  • Initial Support for 3.7.x
  • Capability for automated upgrade between versions
  • Certitificate redeploy for ETCD (CA/CERTS)

v1.10.67

Bug

v1.10.66

Improvement

  • Add timeout to du call
  • Rewrite ruby blocks into Chef resources

v1.10.65

Improvement

  • Initial support for 3.6
  • Capability for Overriding master and node servingInfo.minTLSVersion and .cipherSuites [openshift_(master|node)cipher_suites, openshift(master|node)_min_tls_version]
  • Capability for defining ExternalIPNetworkCIDRs controls what values are acceptable for the service external IP field [openshift_master_external_ip_network_cidrs]
  • Capability for defining IngressIPNetworkCIDR controls the range to assign ingress IPs [openshift_master_ingress_ip_network_cidr]
  • Capability for defining mcs_allocator_range, mcs_labels_per_project and uid_allocator_range [openshift_master_NAME]
  • Capability for referencing the registry by a stable name (not IP) [openshift_push_via_dns]
  • Add etcd_debug and etcd_log_package_levels capabilities

v1.10.64

Improvement

  • All tgz files are encrypted with a default passphrase, and decrypted at the other end after downloading.

Bug

  • Fixes error in v1.10.62 - file permissions on tar.gz
  • Fix bug with LDAP Provider (Enforce LDAPS when selecting secure)

 v1.10.63

Bug

  • Fixes error in v1.10.62 - file permissions on tar.gz

v1.10.62 - BROKEN

Improvement

  • Jenkinsfile parameters added
  • New Centos yum repos added

Bug

  • Allow users to suppress ruby block call from provider code (breaks in older Chef client versions)
  • Make perms and ownership on tar.gz files explicit for more restrictive distributions
  • Kitchen tests updated for latest versions

v1.10.61

Improvement

  • Allow passing custom arguments when deploying the hosted router

Bug

  • Fix issue with cookstyle indentation

v1.10.60

Improvement

  • Update Example files (ImageStreams/Templates)
  • Update Hosted templates
  • Add more logic for dnsmasq (Install NetworkManager and add conf-dir line)

Bug

  • Fix issues with certificate_servers

v1.10.59

Improvement

  • Add the possibilty for openshift_buildoverrides
  • Add the possibilty of retrieving the OCP certs from a custom location/server

Bug

  • Fix issue with cookstyle indentation
  • Improve the code for ignoring dnsmasq issues
  • Add missing dirs and files to be removed when uninstalling

v1.10.58

Improvement

  • Remove support for 1.2/3.2 (README)

v1.10.57

Improvement

  • Remove support for 1.2/3.2
  • Update openshift_example files
  • Add extra wait time for 1.3/3.3 installation

Bug

  • Change test for 1.3/3.3 to use docker 1.10.x
  • Adapt the kubelet args

v1.10.56

Improvement

v1.10.55

Bug

  • Fix backticks in environment not working (#138)

v1.10.54

Bug

  • Fix CHEF-3694 warning that triggered while waiting for node registration

v1.10.53

Improvement

  • Remove duplicated code between etcd_cluster and master_cluster recipes.

Bug

  • Enable *-master-controllers and *-master-api services on master nodes.
  • Fix Jenkinsfile: email address does not support aliases
  • Fix CHEF-3694 warning with master certificates

v1.10.52

Bug

  • Fix cookstyle issues

v1.10.51

Bug

  • Fix bug when not declaring lb_servers role

v1.10.50

Bug

  • Fix Foodcritic issues related to CONTRIBUTING.md

v1.10.49

Bug

  • Fix Foodcritic issues related to metada.rb

v1.10.48

Improvement

Bug

  • Separated certificates to be copied from first master

v1.10.47

Improvement

  • Jenkinsfile gets correct branch
  • Kitchen tests at end (less likely to fail)

Bug

  • Separated etcd cluster now works (all certs pulled from first master)

v1.10.46

Bug

  • Spacing corrected and defaults not included as per discussion in #115

v1.10.45

Improvement

  • Jenkinsfile has resilient kitchen tests reinstated

Bug

  • Certificate redeployment code fixed to remove node certs
  • Certificate redeployment - run etcd code only if etcd on the node (eg standalone)

v1.10.44

Improvement

  • Upgrade from x.2 to x.3 supported
  • Service signer cert created as part of cert creation

v1.10.43

Improvement

  • Added Jenkinsfile
  • Rename file: service_openvsitch-containerized.service.erb -> service_openvswitch-containerized.service.erb

Bug

  • Fix redeploy certs for separate etcd cluster
  • Use more config items rather than hard-coded values in delete node

v1.10.42

Improvement

  • Replace most hard link usage with local copy
  • Change http server binding to default IP address
  • Give the possibility to specify custom certificate for hosted router

Bug

  • Fix CHEF-3694 warning due to redundant package resource
  • Removed potentially unsafe identity providers defaults
  • Fix named certificates when common_name is also listed in alternative names
  • Allow distinct hostnames for internal and public API access

v1.10.41

Bug

  • Fix AWS issue when using empty data bag

v1.10.40

Bug

  • Fix bug for enterprise version (Hosted template files)
  • Fix deletion of service files

v1.10.39

Improvement

  • Give the possibility of adding custom master CA certificate
  • Give the possibility of supporting AWS IAM based integration

Bug

  • Fix dnsIP for dedicated nameserver within PODS (Default to IP of the node)

v1.10.38

Improvement

  • Give the possibility of adding cAdvisor port and read-only port for kubelet arguments
  • Give the possibility of skipping nodes when applying schedulability and labelling

Bug

v1.10.37

Bug

  • Emergency update for fixing ose_major_version when running standalone deployment

v1.10.36

Bug

  • Fixed cookstyle offenses
  • Revert the ETCD change causing issue when adding / removing members
  • Make secret call compatible with x.2 version(s)

Improvement

  • Expand .kitchen.yml to test OSE v1.4.1, v1.3.3 and v1.2.1
  • Improved code readability
  • Added support for multiple identity providers
  • Added support for AWS cloud provider

v1.10.35

Bug

  • Fix ETCD service defined in 2 places
  • Fix cookstyle issues
  • Fix admin.kubeconfig logic

v1.10.34

Bug

  • Adjust predicates and priorities based on ose_major_version
  • Fix containerized deployment

Improvement

  • Give the possibility to add or remove etcd server members
  • Improve ETCD deployment for single etcd server

v1.10.33

Bug

  • Revert e168f9b, use stable repository URLs again

Improvement

  • Use stable CentOS PaaS repository during tests
  • Add integration test for hosted metrics feature

v1.10.32

Bug

  • Make apiServerArguments conditional on the version for pre-1.3/3.3 versions

v1.10.31

Improvement

  • Handle 1.4/3.4 deployment
  • Clean codes over unused attributes
  • Integration tests for 1.4/3.4
  • Add the possibility to supply dns-search option via Docker
  • Add the possibility to specify a deserialization cache size parameter.

Bug

  • Fix permissions over /etc/origin/node
  • Fix iptables issue due to version used by clients

v1.10.30

Improvement

  • Add the possibility to deploy the cluster metrics
  • Add the possibility to add more manageName serviceaccount in master config
  • Move registry persistent_volume_claim name to explicit LWRP attribute
  • Added integration test for openshift_hosted_manage_registry feature
  • Added integration test for openshift_hosted_manage_router feature
  • Added integration test for persistent_storage feature
  • Refactor router-related resources to new openshift_deploy_router LWRP
  • Move registry persistent_volume_claim name to explicit LWRP attribute

Bug

  • Fix README.md typo
  • Fix issue with systemd when uninstalling the Openshift
  • Fix issue for systemctl daemon-reload
  • Removed redundant guard clause for registry deloyment

v1.10.29

Bug

  • Remove property attributes for resources (backward compatibility)

v1.10.28

Improvement

  • Add the possibility to deploy the cluster metrics
  • Add the possibility to add more manageName serviceaccount in master config

Bug

  • Fix README.md typo
  • Fix issue with systemd when uninstalling the Openshift
  • Fix issue for systemctl daemon-reload

v1.10.27

Bug

v1.10.26

Improvement

  • Set the default ipaddress used in etcd-related attributes accordingly with the etcd_server variable

Bug

  • Remove duplicated variables for ETCD

v1.10.25

Bug

  • Fix documentation
  • Fix redeploying OSE certificates

v1.10.24

Improvement

Bug

  • Fix adhoc uninstall
  • Move openssl.conf under CA directory (ETCD)

v1.10.23

Bug

  • Typo in README
  • Fix schedulability and node-labelling guards

v1.10.22

Bug

v1.10.21

Bug

  • Improve delete adhoc
  • Remove duplicates for cors origin (Forcing ETCD to fail)

v1.10.20

Improvement

  • Remove the need to specify the master server peers.
  • Add the possibility to specify scc rather than assuming \'privileged\' one
  • Add new scheduler predicates & priorities
  • Add the possibility to create PV and PVC (Type NFS only)
  • Deploy Hosted environment (Registry & Router)
  • Autoscale Hosted environment (Registry & Router) based on labelling
  • Only 1 recipe is needed for deploying the environment : recipe[cookbook-openshift3]

Bug

  • Remove duplicated resources
  • Fix Docker log-driver for json

Removal

  • Remove the node['cookbook-openshift3']['use_params_roles'] which used the CHEF search capability
  • Remove the node['cookbook-openshift3']['set_nameserver'] and node['cookbook-openshift3']['register_dns']

v1.10.19

Improvement

  • Add the possibility to enable the Audit logging
  • Add the possibility to label nodes
  • Add the possibility to set scheduling against nodes
  • Add the possibility to deploy the Stand-alone Registry & Router

Bug

  • Remove automatic rebooting when playing adhoc uninstallation

v1.10.18

Improvement

  • Add the possibility to run adhoc command for uninstalling Openshift on dedicated server(s)

v1.10.17

Improvement

  • Add the possibility to have any number of ETCD servers

Bug

  • Fix HTTPD service enabling for ETCD

v1.10.16

Improvement

  • Add the possibility to only deploy ETCD role

Bug

  • Remove hard-coded values for deployment type (Affecting Origin deploymemts)

v1.10.15

Improvement

  • Add the possibility to specifying an exact rpm version to install or configure.
  • Update Openshift configuration for 1.3 or 3.3
  • Add the possibilty to specifying a major version (3.1, 3.2 or 3.3)

v1.10.14

Bug

  • Add logging EFK

v1.10.13

Bug

  • Add SNI capability when testing master API

Improvement

  • Give the choice to user to select CHEF search or solo capability
  • Add the concept of wildcard nodes --> wildcard kubeconfig (AWS cloud deployment)
  • Update Openshift templates

v1.10.12

Bug

  • Fix nodeSelector issue when using cluster architecture

Improvement

  • Add capacity to manage container logs (Docker options)

v1.10.11

Bug

  • Remove too restrictive version for RHEL

v1.10.10

Bug

  • Fix typo for URL for Public master API

v1.10.9

Bug

  • Fix URL for master API

Improvement

  • Clarify use of masterPublicURL, publicURL and masterURL

v1.10.8

Improvement

  • Simplify the creation of node/master servers

v1.10.7

Bug

  • Fix issue for dnsmasq

v1.10.6

Bug

  • Fix issue for documentation

v1.10.5

Bug

  • Fix issue for documentation

v1.10.4

Bug

  • Fix issue for restarting openshift-api or controllers
  • Fix issue for restarting node

Improvement

  • Update Openshift documentation
  • Use chef-solo attribute style as a default for setting attributes
  • Remove queries for any type of data that is indexed by the Chef server

v1.10.3

Bug

  • Fix issue for Openshift Node (Clashing ClusterNetwork)
  • Fix issue for generating certificates (NODES)

Improvement

  • Add capability for deploying 3.2.x
  • Add capability for deploying containerized version of Openshift
  • Add capability of using dnsmasq for interacting with skyDNS
  • Update Openshift template examples

v1.10.2

Bug

  • Fix issue for nodes certificate SAN

v1.10.1

Bug

  • Fix issue for ETCD certificate lifetime
  • Fix IP discovery for origin_deploy.sh

Improvement

  • Add capability for enabling or not a yum repository

v1.10.0

Bug

  • Fix docker restrart when running CHEF
  • Fix openshift-master restart when running CHEF
  • Fix openshift-node restart when running CHEF

v1.0.9

Bug

  • Remove dnsIP from node definiton. Default to use the kubernetes service network 172.x.x.1

v1.0.8

Improvement

  • Add kubeletArguments for node servers

Bug

  • Enable Docker at startup
  • Mask master service when running native HA

v1.0.7

Improvement

  • Add possibility to disable yum repositories
  • Fix etcd certificate (Simplify the call for peers members)
  • Add possibility to specify a version to be installed for docker

Bug

  • Fix permissions for directory (Set to Apache in case of a dodgy umask number)

v1.0.6

Improvement

  • Add delay/retry before installing servcieaccount
  • Change xip.io for nip.io (STABLE)

Bug

  • Fix scripts/origin_deploy.sh
  • Fix hostname for origin_deploy.sh

v1.0.5

Bug

  • Fix bug when enabling HTTPD at startup

v1.0.4

Improvement

  • Detect the CN or SAN from certificates file when using named certificates.
  • Move origin_deploy.sh in scripts folder

Bug

  • Enable HTTPD at startup
  • Fix some typos

mprovement
- Add the possibility to only deploy ETCD role

Bug

  • Remove hard-coded values for deployment type (Affecting Origin deploymemts) ## v1.0.3 ### Improvement
  • Add possibility to customise docker-storage-setup
  • Add possibility for configuring Custom Certificates

v1.0.2

Improvement

  • Add MIT LICENCE model
  • Add script to auto deploy origin instance
  • Add the possibility to exclude packages from updates or installs

Bug fix

  • Fix attributes labelling when using chef in local mode (or solo)
  • Remove specific mentions to OSE

v0.0.1

  • Current public release

Collaborator Number Metric
            

2.0.63 passed this metric

Contributing File Metric
            

2.0.63 passed this metric

Foodcritic Metric
            

2.0.63 passed this metric

No Binaries Metric
            

2.0.63 passed this metric

Testing File Metric
            

2.0.63 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric
            

2.0.63 passed this metric