use logging ca in route to avoid 503 errors
- name: Redeploy kibana
command: oc deploy dc/logging-kibana --latest -n logging
-#- name: Configure certificates for reencrypt route
-# oc_route:
-# name: logging-kibana
-# namespace: logging
-# cert_path: "/etc/origin/master/named_certificates/{{ cert_basename }}"
-# key_path: "/etc/origin/master/named_certificates/{{ key_basename }}"
-# cacert_path: "/etc/origin/master/named_certificates/{{ cacert_basename }}"
-# dest_cacert_path: /etc/origin/master/ca.crt
-# service_name: logging-kibana
-# host: "logs.{{ osalog_clusterid }}.openshift.com"
-# tls_termination: reencrypt
-# register: routeout
-# run_once: true
-#
-#- debug: var=routeout
-# run_once: True
+- name: get ca from kibana secret
+ oc_secret:
+ state: list
+ namespace: logging
+ name: logging-kibana
+ decode: True
+ register: kibana_ca_cert
+ run_once: true
+
+- name: Configure certificates for reencrypt route
+ oc_route:
+ name: logging-kibana
+ namespace: logging
+ cert_path: "/etc/origin/master/named_certificates/{{ cert_basename }}"
+ key_path: "/etc/origin/master/named_certificates/{{ key_basename }}"
+ cacert_path: "/etc/origin/master/named_certificates/{{ cacert_basename }}"
+ dest_cacert_content: "{{ kibana_ca_cert.results.decoded['ca'] }}"
+ service_name: logging-kibana
+ host: "logs.{{ osalog_clusterid }}.openshift.com"
+ tls_termination: reencrypt
+ register: routeout
+ run_once: true
+
+- debug: var=routeout
+ run_once: True
