commit 65edc22a51abb300b4bd0bf372a055b6a8ce665a
author Zack Williams <zdw@opennetworking.org> Tue Jan 30 18:52:30 2018 -0700
committer Zack Williams <zdw@opennetworking.org> Wed Feb 07 10:45:02 2018 -0700
tree 4ee04395140bc50e8121f1be826fad110394fcc0
parent 553f140109fa1a19716162c6eb02a50c0949e1c9

[CORD-717]
Install a SSL-secured docker registry on head node

Change-Id: I871073238669566b1789039d38b80180e21e6dec

roles/pki-cert/defaults/main.yml

diff --git a/roles/pki-cert/defaults/main.yml b/roles/pki-cert/defaults/main.yml
index e6af770..3ccdd6d 100644
--- a/roles/pki-cert/defaults/main.yml
+++ b/roles/pki-cert/defaults/main.yml
@@ -1,4 +1,4 @@
-
+---
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,8 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
----
 # pki-cert/defaults/main.yml
 
 pki_dir: "{{ playbook_dir }}/pki"
@@ -45,5 +43,23 @@
       - "DNS:xos-core.{{ site_suffix }}"
       - "DNS:xos-core"
 
-client_certs: []
+# secure docker registry on head node
+  - cn: "docker-registry.{{ site_suffix }}"
+    subj: "{{ ssl_cert_subj_prefix }}/CN=docker-registry.{{ site_suffix }}"
+    altnames:
+      - "DNS:docker-registry.{{ site_suffix }}"
+      - "DNS:docker-registry"
+      - "DNS:registry.{{ site_suffix }}"
+      - "DNS:registry"
+
+client_certs:
+  - cn: "dockerclient"
+    subj: "{{ ssl_cert_subj_prefix }}/CN=dockerclient"
+    altnames:
+      - "email:dockerclient@{{ site_suffix }}"
+  - cn: "dockerbuildhost"
+    subj: "{{ ssl_cert_subj_prefix }}/CN=dockerbuildhost"
+    altnames:
+      - "email:dockerbuildhost@{{ site_suffix }}"
+