Initial import

99 files changed, 2104 insertions, 0 deletions

diff --git a/roles/ands_facts/README b/roles/ands_facts/README
new file mode 100644
index 0000000..09abd03
--- /dev/null
+++ b/roles/ands_facts/README
@@ -0,0 +1,7 @@
+This is simplified Ands role which tries to detect storage configuration and set facts required for other
+roles. 
+
+Facts:
+ - ands_data_vg
+ - ands_data_path
+ 
\ No newline at end of file
diff --git a/roles/ands_facts/defaults/main.yml b/roles/ands_facts/defaults/main.yml
new file mode 100644
index 0000000..257685d
--- /dev/null
+++ b/roles/ands_facts/defaults/main.yml
@@ -0,0 +1,11 @@
+ands_data_device_default_threshold: 10
+
+ands_empty_lv: { 'vg': '' }
+
+ands_data_lv: "ands_data"
+ands_data_vg: "{{ ( ansible_lvm['lvs'][ands_data_lv] | default(ands_empty_lv) )['vg'] }}"
+ands_heketi_lv: "ands_heketi"
+ands_heketi_vg: "{{ ( ansible_lvm['lvs'][ands_heketi_lv] | default(ands_empty_lv) )['vg'] }}"
+
+ands_storage_servers: "{{ groups.ands_storage_servers | map('extract', hostvars, 'ands_storage_hostname') | list }}"
+#openshift_storage_nodes: "{{ groups.storage_nodes | map('extract', hostvars, 'ands_storage_hostname') | list }}"
diff --git a/roles/ands_facts/tasks/detect_data_path.yml b/roles/ands_facts/tasks/detect_data_path.yml
new file mode 100644
index 0000000..0837e12
--- /dev/null
+++ b/roles/ands_facts/tasks/detect_data_path.yml
@@ -0,0 +1,10 @@
+---
+- name: Try to detect ands_data_path
+  set_fact: ands_data_path="{{ item.mount }}"
+  with_items: "{{ ansible_mounts }}"
+  no_log: true
+  when: 
+    - not ands_data_path is defined
+    - ansible_lvm.lvs[ands_data_lv] is defined
+    - ansible_lvm.lvs[ands_data_lv].size_g > ( ands_data_device_threshold | default(ands_data_device_default_threshold) )
+    - item.device == "/dev/mapper/{{ands_data_vg}}-{{ands_data_lv}}"
diff --git a/roles/ands_facts/tasks/main.yml b/roles/ands_facts/tasks/main.yml
new file mode 100644
index 0000000..52cc5bc
--- /dev/null
+++ b/roles/ands_facts/tasks/main.yml
@@ -0,0 +1,35 @@
+- include_vars: dir="vars"
+
+- include: detect_data_path.yml
+  when: not ands_data_path is defined
+
+- name: Detect Heketi
+  set_fact: ands_storage_domains="{{ ands_storage_domains | union([ands_heketi_domain]) }}"
+  when: ansible_lvm.lvs[ands_heketi_lv] is defined
+
+- name: Set some facts
+  set_fact:
+    ands_storage_servers: "{{ ands_storage_servers }}"
+
+- name: Set some facts
+  set_fact:
+    ands_data_vg: "{{ ands_data_vg }}"
+  when: ands_data_vg != ""
+
+- name: Set some facts
+  set_fact:
+    ands_data_lv: "{{ ands_data_lv }}"
+  when: ands_data_lv != ""
+
+- name: Set some facts
+  set_fact:
+    ands_heketi_vg: "{{ ands_heketi_vg }}"
+  when: ands_heketi_vg != ""
+
+- name: Set some facts
+  set_fact:
+    ands_heketi_lv: "{{ ands_heketi_lv }}"
+  when: ands_heketi_lv != ""
+
+#- command: yum-complete-transaction --cleanup-only
+
diff --git a/roles/ands_facts/vars b/roles/ands_facts/vars
new file mode 120000
index 0000000..c56a6fe
--- /dev/null
+++ b/roles/ands_facts/vars
@@ -0,0 +1 @@
+../../setup/configs/
\ No newline at end of file
diff --git a/roles/ands_kaas/defaults/main.yml b/roles/ands_kaas/defaults/main.yml
new file mode 100644
index 0000000..3835453
--- /dev/null
+++ b/roles/ands_kaas/defaults/main.yml
@@ -0,0 +1,11 @@
+kaas_resync: false
+kaas_projects: "{{ ands_openshift_projects.keys() }}"
+
+kaas_template_root: "{{ ands_paths.provision }}/kaas/"
+
+kaas_glusterfs_endpoints: gfs
+kaas_openshift_volumes: "{{ ands_openshift_volumes }}"
+
+kaas_default_volume_capacity: "1Ti"
+kaas_default_file_owner: root
+kaas_default_file_group: root
diff --git a/roles/ands_kaas/tasks/file.yml b/roles/ands_kaas/tasks/file.yml
new file mode 100644
index 0000000..9a36e74
--- /dev/null
+++ b/roles/ands_kaas/tasks/file.yml
@@ -0,0 +1,9 @@
+---
+- name: "Setting up files in {{ path }}"
+  file: 
+    path: "{{ path }}" 
+    recurse: "{{ file.recurse | default(true) }}" 
+    mode: "{{ file.mode | default( ((file.state | default('directory')) == 'directory') | ternary('0755', '0644') ) }}"
+    owner: "{{ file.owner | default(kaas_project_config.file_owner) | default(kaas_default_file_owner) }}" 
+    group: "{{ file.group | default(kaas_project_config.file_group) | default(kaas_default_file_group) }}"
+    state: "{{ file.state | default('directory') }}"
diff --git a/roles/ands_kaas/tasks/keys.yml b/roles/ands_kaas/tasks/keys.yml
new file mode 100644
index 0000000..2096c75
--- /dev/null
+++ b/roles/ands_kaas/tasks/keys.yml
@@ -0,0 +1,37 @@
+---
+- name: Try to locate pubkey file
+  set_fact: "kaas_{{ pod.key }}_pubkey={{ lookup('file', item) }}"
+  with_first_found:
+    - paths:
+        - "{{ kaas_project_path }}/keys/"
+      files:
+        -  "{{ pod.key }}.crt"
+        -  "{{ pod.key }}.pub"
+        -  "{{ pod.value.service.host | default('default') }}.crt"
+        -  "{{ pod.value.service.host | default('default') }}.pub"
+      skip: true
+
+- name: Try to locate privkey file
+  set_fact: "kaas_{{ pod.key }}_privkey={{ lookup('file', item) }}"
+  with_first_found:
+    - paths:
+        - "{{ kaas_project_path }}/keys/"
+      files:
+        - "{{ pod.key }}.key"
+        - "{{ pod.key }}.pem"
+        - "{{ pod.value.service.host | default('default') }}.key"
+        - "{{ pod.value.service.host | default('default') }}.pem"
+      skip: true
+
+- name: Try to locate CA file
+  set_fact: "kaas_{{ pod.key }}_ca={{ lookup('file', item) }}"
+  with_first_found:
+    - paths:
+        - "{{ kaas_project_path }}/keys/"
+      files:
+        - "{{ pod.key }}.ca"
+        - "{{ pod.value.service.host | default('default') }}.ca"
+        - ca-bundle.pem
+        - ca.pem
+        - ca.crt
+      skip: true
diff --git a/roles/ands_kaas/tasks/main.yml b/roles/ands_kaas/tasks/main.yml
new file mode 100644
index 0000000..c9fb857
--- /dev/null
+++ b/roles/ands_kaas/tasks/main.yml
@@ -0,0 +1,12 @@
+---
+- name: Provision OpenShift resources & configurations
+#  include: only_templates.yml
+  include: project.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  with_items: "{{ kaas_projects }}"
+  loop_control:
+    loop_var: kaas_project
+  vars:
+    kaas_template_path: "{{ kaas_template_root }}/{{ kaas_project }}"
+    kaas_project_path: "{{playbook_dir}}/projects/{{ kaas_project }}"
diff --git a/roles/ands_kaas/tasks/oc.yml b/roles/ands_kaas/tasks/oc.yml
new file mode 100644
index 0000000..d3504f8
--- /dev/null
+++ b/roles/ands_kaas/tasks/oc.yml
@@ -0,0 +1,10 @@
+---
+- name: Configure KaaS resources
+  include_role: 
+    name: openshift_resource
+    tasks_from: command.yml
+  vars: 
+    resource: "{{ ocitem.resource | default('') }}"
+    command: "{{ ocitem.oc }}"
+    project: "{{ kaas_project }}"
+    recreate: "{{ ocitem.recreate | default(false) }}"
diff --git a/roles/ands_kaas/tasks/ocitem.yml b/roles/ands_kaas/tasks/ocitem.yml
new file mode 100644
index 0000000..f21e8cd
--- /dev/null
+++ b/roles/ands_kaas/tasks/ocitem.yml
@@ -0,0 +1,13 @@
+---
+- name: OpenShift templates
+  include: templates.yml
+  run_once: true
+  vars:
+    kaas_template_glob: "{{ ocitem.template }}"
+  when: ocitem.template is defined
+
+- name: OpenShift commands
+  include: oc.yml
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  when: ocitem.oc is defined
diff --git a/roles/ands_kaas/tasks/ocscript.yml b/roles/ands_kaas/tasks/ocscript.yml
new file mode 100644
index 0000000..4927de4
--- /dev/null
+++ b/roles/ands_kaas/tasks/ocscript.yml
@@ -0,0 +1,8 @@
+---
+- include: ocitem.yml
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  with_items: "{{ kaas_project_config.oc }}"
+  loop_control:
+    loop_var: ocitem
+  
\ No newline at end of file
diff --git a/roles/ands_kaas/tasks/project.yml b/roles/ands_kaas/tasks/project.yml
new file mode 100644
index 0000000..002596b
--- /dev/null
+++ b/roles/ands_kaas/tasks/project.yml
@@ -0,0 +1,76 @@
+---
+- name: Load global variables
+  include_vars: "{{kaas_project_path}}/vars/globals.yml" 
+  when: "'{{kaas_project_path}}/vars/globals.yml' | is_file"
+
+- name: Load variables
+  include_vars: dir="{{kaas_project_path}}/vars" name="kaas_project_config"
+  when: "'{{kaas_project_path}}/vars' | is_dir"
+
+- name: Ensure OpenShift template directory exists
+  file: path="{{ kaas_template_path }}" state="directory" mode=0755 owner=root group=root
+
+- name: Configure KaaS volumes
+  include: volume.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  with_dict: "{{ kaas_project_config.volumes | default(kaas_openshift_volumes) }}"
+  loop_control:
+    loop_var: osv
+  vars:
+    query: "[*].volumes.{{osv.value.volume}}.mount"
+    mntpath: "{{ (ands_storage_domains | json_query(query)) }}"
+    path: "{{ mntpath[0] ~ (osv.value.path | default('')) }}"
+    name: "{{osv.key}}"
+    volume: "{{osv.value}}"
+  when: ( mntpath | length ) > 0
+
+- name: Copy static configuration
+  include: sync_all.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  with_items: "{{ lookup('pipe', search).split('\n') }}"
+  loop_control:
+    loop_var: osv_path
+  vars:
+    search: "find {{ kaas_project_path }}/files/ -type d -mindepth 1 -maxdepth 1"
+    osv: "{{ osv_path | basename }}"    
+    pvar: "kaas_{{ osv }}_path"
+    local_path: "{{ osv_path }}"
+    remote_path: "{{ hostvars[inventory_hostname][pvar] }}"
+  when:
+    - osv in kaas_openshift_volumes
+    - hostvars[inventory_hostname][pvar] is defined
+
+- name: Configure KaaS files
+  include: file.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  with_items: "{{ kaas_project_config.files | default(ands_openshift_files) }}"
+  loop_control:
+    loop_var: file
+  vars:
+    pvar: "kaas_{{ file.osv }}_path"
+    path: "{{ hostvars[inventory_hostname][pvar] }}/{{ file.path }}"
+  when: file.osv in ( kaas_project_config.volumes | default(kaas_openshift_volumes) )
+
+- name: Load OpenSSL keys
+  include: keys.yml
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  with_dict: "{{ kaas_project_config.pods }}"
+  loop_control:
+    loop_var: pod
+
+- name: "Run OC script"
+  include: ocscript.yml
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  when: kaas_project_config.oc is defined
+
+- name: "Configure all templates"
+  include: templates.yml
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  when: kaas_project_config.oc is undefined
+
diff --git a/roles/ands_kaas/tasks/sync.yml b/roles/ands_kaas/tasks/sync.yml
new file mode 100644
index 0000000..399cb66
--- /dev/null
+++ b/roles/ands_kaas/tasks/sync.yml
@@ -0,0 +1,8 @@
+---
+- name: Check if already exists
+  stat: path="{{ item_dest }}" 
+  register: result
+
+- name: "Sync '{{ item_name }}'"
+  synchronize: src="{{ item_src }}" dest="{{ remote_path }}/" archive=yes
+  when: (result.stat.exists == False) or (kaas_resync | default(false))
diff --git a/roles/ands_kaas/tasks/sync_all.yml b/roles/ands_kaas/tasks/sync_all.yml
new file mode 100644
index 0000000..58a1710
--- /dev/null
+++ b/roles/ands_kaas/tasks/sync_all.yml
@@ -0,0 +1,13 @@
+#  If delegation is enabled, synchronize will look from files on delegated host not locally
+
+- name: "Analyze '{{ local_path | basename }}'"
+#  debug: msg="{{ local_path }} - {{ item_name }} - {{ item }}"
+  include: sync.yml
+  run_once: true
+  with_items: "{{ lookup('pipe', filesearch).split('\n') }}"
+  vars:
+    filesearch: "find '{{ local_path }}' -mindepth 1 -maxdepth 1"
+    item_name: "{{ item | basename }}"
+    item_src: "{{ local_path }}/{{ item_name }}"
+    item_dest: "{{ remote_path }}/{{ item_name }}"
+  when: item != ""
diff --git a/roles/ands_kaas/tasks/template.yml b/roles/ands_kaas/tasks/template.yml
new file mode 100644
index 0000000..6a81dd7
--- /dev/null
+++ b/roles/ands_kaas/tasks/template.yml
@@ -0,0 +1,17 @@
+- name: Populate template
+  template: src="{{ item }}" dest="{{ kaas_template_path }}/{{ item | basename | regex_replace('\.j2','') }}" owner=root group=root mode="0644"
+  register: result
+  with_first_found:
+    - paths:
+        - "{{ role_path }}/templates/"
+        - "{{ kaas_project_path }}/templates/"
+      files:
+        - "{{ tmpl_name }}"
+
+- name: Configure KaaS resources
+  include_role: name="openshift_resource"
+  vars: 
+    template: "{{ tmpl_name | basename | regex_replace('\\.j2','') }}"
+    template_path: "{{ kaas_template_path }}"
+    project: "{{ kaas_project }}"
+    recreate: "{{ result | changed | ternary (true, false) }}"
diff --git a/roles/ands_kaas/tasks/templates.yml b/roles/ands_kaas/tasks/templates.yml
new file mode 100644
index 0000000..75d43f3
--- /dev/null
+++ b/roles/ands_kaas/tasks/templates.yml
@@ -0,0 +1,20 @@
+---
+# Sorting is not enforeced
+- name: "Find KaaS templates"
+  command: "echo {{ item | quote }}"
+  register: results
+  changed_when: false
+  with_fileglob:
+    - "{{ role_path }}/templates/{{ kaas_template_glob | default('*') }}.j2"
+    - "{{ kaas_project_path }}/templates/{{ kaas_template_glob | default('*') }}.j2"
+
+- name: "Sort and execute KaaS templates"
+  include: "template.yml"
+  delegate_to: "{{ groups.masters[0] }}"
+  run_once: true
+  with_items: "{{ sorted_tmpl }}"
+  vars:
+    sorted_tmpl: "{{ results | json_query('results[*].stdout_lines') | sum(start=[]) | map('basename') | sort | unique }}"
+  loop_control:
+    loop_var: tmpl_name
+
diff --git a/roles/ands_kaas/tasks/volume.yml b/roles/ands_kaas/tasks/volume.yml
new file mode 100644
index 0000000..b82e55f
--- /dev/null
+++ b/roles/ands_kaas/tasks/volume.yml
@@ -0,0 +1,11 @@
+---
+- name: "Configure {{ name }} fact"
+  set_fact: "kaas_{{ name }}_path={{ path }}"
+
+- name: "Ensure {{ path }} exists"
+  file: 
+    path: "{{ path }}" 
+    state: "directory" 
+    mode: "{{ volume.mode | default(0755) }}" 
+    owner: "{{ volume.owner | default(kaas_project_config.file_owner) | default(kaas_default_file_owner) }}" 
+    group: "{{ volume.group | default(kaas_project_config.file_group) | default(kaas_default_file_group) }}"
diff --git a/roles/ands_kaas/templates/0-gfs-volumes.yml.j2 b/roles/ands_kaas/templates/0-gfs-volumes.yml.j2
new file mode 100644
index 0000000..a162c8b
--- /dev/null
+++ b/roles/ands_kaas/templates/0-gfs-volumes.yml.j2
@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: Template
+metadata:
+  name: 
+  annotations:
+    descriptions: "KATRIN Volumes"
+objects:
+{% for name, vol in (kaas_project_config.volumes | default(kaas_openshift_volumes)).iteritems() %}
+  - apiVersion: v1
+    kind: PersistentVolume
+    metadata:
+      name: {{ vol.name | default(name) }}
+    spec:
+      persistentVolumeReclaimPolicy: Retain 
+      glusterfs: 
+        endpoints: {{ kaas_glusterfs_endpoints }}
+        path: {{ vol.volume }}
+        readOnly: {{ not (vol.write | default(false)) }}
+      accessModes:
+        - {{ vol.access | default('ReadWriteMany') }}
+      capacity:
+        storage: {{ vol.capacity | default(kaas_default_volume_capacity) }}
+      claimRef:
+        name: {{ vol.name | default(name) }}
+        namespace: {{ kaas_project }}
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: {{ vol.name | default(name) }}
+    spec:
+      volumeName: {{ vol.name | default(name) }}
+      accessModes:
+        - {{ vol.access | default('ReadWriteMany') }}
+      resources:
+        requests:
+          storage: {{ vol.capacity | default(kaas_default_volume_capacity) }}
+{% endfor %}
diff --git a/roles/ands_kaas/templates/6-kaas-pods.yml.j2 b/roles/ands_kaas/templates/6-kaas-pods.yml.j2
new file mode 100644
index 0000000..9849bd3
--- /dev/null
+++ b/roles/ands_kaas/templates/6-kaas-pods.yml.j2
@@ -0,0 +1,173 @@
+#jinja2: trim_blocks: "true", lstrip_blocks: "false"
+---
+apiVersion: v1
+kind: Template
+metadata:
+  name: {{ kaas_project }}-pods
+  annotations:
+    descriptions: {{ kaas_project_config.description | default(kaas_project ~ "auto-generated pod template") }}
+objects:
+{% for name, pod in (kaas_project_config.pods | default(kaas_openshift_volumes)).iteritems() %}
+  {% set pubkey = "kaas_" ~ name ~ "_pubkey" %}
+  {% set privkey = "kaas_" ~ name ~ "_privkey" %}
+  {% set cakey = "kaas_" ~ name ~ "_ca" %}
+  {% if pod.service is defined %}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: {{ pod.name | default(name) }}
+    spec:
+      selector:
+        name: {{ pod.name | default(name) }}
+    {% if pod.service.ports is defined %}
+      ports:
+        {% for port in pod.service.ports %}
+            {% set portmap = (port | string).split('/') %}
+        - name: "{{ portmap[0] }}"
+          port: {{ portmap[0] }}
+          targetPort: {{ (portmap[1] is defined) | ternary(portmap[1], portmap[0]) }}
+        {% endfor %}
+    {% endif %}
+    {% if (pod.service.ports is defined) and (pod.service.host is defined) %}
+      {% set first_port = (pod.service.ports[0] | string).split('/')[0] %}
+  - apiVersion: v1
+    kind: Route
+    metadata:
+      name: kaas
+    spec:
+      host: {{ pod.service.host }}
+      to:
+        kind: Service
+        name: {{ pod.name | default(name) }}
+      port:
+        targetPort: {{ first_port }}
+      {% if (first_port == "80") %}
+      tls:
+        termination: edge
+        insecureEdgeTerminationPolicy: Allow
+        {% if hostvars[inventory_hostname][pubkey] is defined %}
+        certificate: |-
+          {{ hostvars[inventory_hostname][pubkey] | indent(10) }}
+        {% endif %}
+        {% if hostvars[inventory_hostname][privkey] is defined %}
+        key: |-
+          {{ hostvars[inventory_hostname][privkey] | indent(10) }}
+        {% endif %}
+        {% if hostvars[inventory_hostname][cakey] is defined %}
+        caCertificate: |-
+          {{ hostvars[inventory_hostname][cakey] | indent(10) }}
+        {% endif %}
+      {% endif %}
+    {% endif %}
+  {% endif %}
+  - apiVersion: v1
+    kind: DeploymentConfig
+    metadata:
+      name: kaas
+    spec:
+      replicas: {{ pod.sched.replicas | default(1) }}
+      selector:
+        name: {{ pod.name | default(name) }}
+      template:
+        metadata:
+          name: {{ pod.name | default(name) }}
+          labels:
+            name: {{ pod.name | default(name) }}
+        strategy:
+          type: {{ pod.sched.strategy | default('Rolling') }}
+        triggers:
+          - type: ConfigChange
+        spec:
+    {% if pod.selector is defined %}
+          nodeSelector: 
+      {% for skey, sval in pod.selector.iteritems() %}
+            {{ skey }}: "{{ sval }}"
+      {% endfor %}
+    {% endif %}
+    {% set mappings = (pod.images | json_query('[*].mappings') | length)  %}
+    {% if mappings > 0 %}
+          volumes:
+      {% for img in pod.images %}
+        {% set imgidx = loop.index %}
+        {% for vol in img.mappings %}
+            - name: vol-{{imgidx}}-{{loop.index}}
+              persistentVolumeClaim: 
+                claimName: {{ vol.name }}
+        {% endfor %}
+      {% endfor %}
+    {% endif %}
+          containers:
+    {% for img in pod.images %}
+      {% set imgidx = loop.index %}
+            - name: {{ img.name | default(pod.name) | default(name) }}
+              image: {{ img.image }}
+              imagePullPolicy: Always
+              ports:
+      {% if img.ports is defined %}
+        {% for port in img.ports %}
+                - containerPort: {{ port }}
+        {% endfor %}
+      {% else %}
+        {% for port in pod.service.ports %}
+          {% set portmap = (port | string).split('/') %}
+                - containerPort: {{ (portmap[1] is defined) | ternary(portmap[1], portmap[0]) }}
+        {% endfor %}
+      {% endif %}
+      {% if img.env is defined %}
+              env:
+        {% for env_name, env_val in img.env.iteritems() %}
+          {% set env_parts = (env_val | string).split('@') %}
+          {% if env_parts[0] == "secret" %}
+                - name: {{ env_name }}
+             {% set env_sec = (env_parts[1] | string).split('/') %}
+                  valueFrom: 
+                    secretKeyRef:
+                      name: {{ env_sec[0] }}
+                      key: {{ env_sec[1] }}
+          {% elif env_parts[0] == "cm" %}
+             {% set env_cm = (env_parts[1] | string).split('/') %}
+                  valueFrom: 
+                    configMapKeyRef:
+                      name: {{ env_cm[0] }}
+                      key: {{ env_cm[1] }}
+          {% else %}
+                  value: {{ env_val }}
+          {% endif %}
+        {% endfor %}
+      {% endif %}
+      {% if img.mappings is defined %}
+              volumeMounts:
+        {% for vol in img.mappings %}
+                - name: vol-{{imgidx}}-{{loop.index}}
+                  subPath: {{ (((kaas_project_config.volumes | default(kaas_openshift_volumes))[vol.name].path | default("")) ~ "/") | regex_replace('^/','')  }}{{ vol.path | default("") }}
+                  mountPath: {{ vol.mount }}
+        {% endfor %}
+      {% endif %}
+      {% if img.probes is defined %}
+        {% for probe in img.probes %}
+          {% if (probe.type is undefined) %}
+            {% set seq = ['livenessProbe', 'readynessProbe'] %}
+          {% elif (probe.type == "liveness") %}
+            {% set seq = ['livenessProbe'] %}
+          {% else %}
+            {% set seq = ['readynessProbe'] %}
+          {% endif %}
+          {% for type in seq %}
+              {{ type }}:
+                timeoutSeconds: {{ probe.timeout | default(1) }}
+                initialDelaySeconds: {{ probe.delay | default(10) }}
+            {% if (probe.cmd is defined) %}
+                command: "{{ probe.cmd }}"
+            {% elif (probe.path is defined) %}
+                httpGet: 
+                  path: {{ probe.path }}
+                  port: {{ probe.port | default(80) }}
+            {% else %}
+                tcpSocket:
+                  port: {{ probe.port | default(80) }}
+            {% endif %}
+          {% endfor %}
+        {% endfor %}
+      {% endif %}
+    {% endfor %}
+{% endfor %}
diff --git a/roles/ands_openshift/defaults/main.yml b/roles/ands_openshift/defaults/main.yml
new file mode 100644
index 0000000..857c389
--- /dev/null
+++ b/roles/ands_openshift/defaults/main.yml
@@ -0,0 +1,11 @@
+openshift_all_subroles: "{{ [ 'hostnames', 'users', 'ssh', 'storage', 'heketi' ] }}"
+openshift_subroles: "{{ ( subrole is defined ) | ternary( [ subrole ], openshift_all_subroles ) }}"
+
+openshift_namespace: "default"
+ands_disable_dynamic_provisioning: false
+
+ssh_template_path: "{{ ands_paths.provision }}/ssh/"
+storage_template_path: "{{ ands_paths.provision }}/gfs/"
+heketi_template_path: "{{ ands_paths.provision }}/heketi/"
+
+openshift_storage_nodes: "{{ groups.storage_nodes | map('extract', hostvars, 'ands_storage_hostname') | list }}"
diff --git a/roles/ands_openshift/files/gfs-svc.yml b/roles/ands_openshift/files/gfs-svc.yml
new file mode 100644
index 0000000..359f3b1
--- /dev/null
+++ b/roles/ands_openshift/files/gfs-svc.yml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Template
+metadata:
+  name: gfs
+  annotations:
+    descriptions: "GlusterFS endpoints & service"
+    tags: glusterfs
+objects:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: gfs
+    spec:
+      ports:
+        - port: 1
diff --git a/roles/ands_openshift/files/heketi/heketi.json b/roles/ands_openshift/files/heketi/heketi.json
new file mode 100644
index 0000000..9efe610
--- /dev/null
+++ b/roles/ands_openshift/files/heketi/heketi.json
@@ -0,0 +1,23 @@
+{
+        "_port_comment": "Heketi Server Port Number",
+        "port" : "8080",
+
+        "use_auth" : false,
+        "jwt" : {
+                "admin" : {
+                        "key" : "My Secret"
+                },
+                "user" : { 
+                        "key" : "My Secret"
+                }
+        },
+
+        "glusterfs" : {
+                "executor" : "ssh",
+                "sshexec": {
+                    "keyfile": "/etc/heketi_keys/id_rsa",
+                    "user": "root"
+                },
+                "db" : "/var/lib/heketi/heketi.db"
+        }
+}
diff --git a/roles/ands_openshift/handlers/main.yml b/roles/ands_openshift/handlers/main.yml
new file mode 100644
index 0000000..e46b2a9
--- /dev/null
+++ b/roles/ands_openshift/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: heketi_topology
+  debug: msg="heketi-cli -s http://heketi.{{ openshift_master_default_subdomain }} --user=admin --secret={{ ands_secrets.heketi.admin | quote }} topology load --json={{ heketi_template_path }}/topology.json"
+#  command: heketi-cli -s "http://heketi.{{ openshift_master_default_subdomain }}" --user="admin" --secret={{ ands_secrets.heketi.admin | quote }} topology load --json="{{ heketi_template_path }}/topology.json"
diff --git a/roles/ands_openshift/tasks/heketi.yml b/roles/ands_openshift/tasks/heketi.yml
new file mode 100644
index 0000000..149f85d
--- /dev/null
+++ b/roles/ands_openshift/tasks/heketi.yml
@@ -0,0 +1,13 @@
+---
+- block:
+  - name: Ensure all required packages are installed
+    yum: name={{item}} state=present
+    with_items:
+      - heketi-client
+
+  - include: heketi_resources.yml
+    run_once: true
+    delegate_to: "{{ groups.masters[0] }}"
+    when: ansible_lvm.lvs.{{ ands_heketi_lv }} is defined
+
+  when: ansible_lvm.lvs.{{ ands_heketi_lv }} is defined
diff --git a/roles/ands_openshift/tasks/heketi_perms.yml b/roles/ands_openshift/tasks/heketi_perms.yml
new file mode 100644
index 0000000..4df6260
--- /dev/null
+++ b/roles/ands_openshift/tasks/heketi_perms.yml
@@ -0,0 +1,9 @@
+---
+- name: Mount heketidb volume
+  mount: name="{{ heketi_template_path }}/heketidbstorage"  src="localhost:heketidbstorage" fstype="glusterfs" opts="defaults,_netdev" state="mounted"
+
+- name: Allow writting to heketidb
+  file: path="{{ heketi_template_path }}/heketidbstorage" owner="root" group="root" mode=0777
+
+- name: Mount heketidb volume
+  mount: name="{{ heketi_template_path }}/heketidbstorage"  state="absent"
diff --git a/roles/ands_openshift/tasks/heketi_resources.yml b/roles/ands_openshift/tasks/heketi_resources.yml
new file mode 100644
index 0000000..06ae6b3
--- /dev/null
+++ b/roles/ands_openshift/tasks/heketi_resources.yml
@@ -0,0 +1,74 @@
+---
+- name: Ensure heketi configuration directory exists
+  file: path="{{ heketi_template_path }}" state="directory" mode=0600 owner=root group=root
+
+- name: Check if secret exists
+  command: oc -n "{{ openshift_namespace }}" get secret/heketi
+  register: result
+  failed_when: false
+  changed_when: (result | failed)
+  
+- name: Create secret for dynamic volume provisioning
+  command: "kubectl create secret generic heketi --type=kubernetes.io/glusterfs --from-literal=key={{ ands_secrets.heketi.admin | quote }} --from-literal=user={{ ands_secrets.heketi.user | quote }} --namespace={{ openshift_namespace }}"
+  when: (result | changed)
+
+- name: Copy Heketi configuration
+  copy: src="heketi/heketi.json" dest="{{ heketi_template_path }}/heketi.json" owner=root group=root mode="0644"
+  register: result1
+
+- name: Check if configMap exists
+  command: oc -n "{{ openshift_namespace }}" get cm/heketi
+  register: result2
+  failed_when: false
+  changed_when: (result2 | failed)
+
+- name: Desotry existing Heketi configuration
+  command: oc -n "{{ openshift_namespace }}" delete cm/heketi
+  when: ( result1 | changed ) and (not (result2 | changed))
+
+- name: Create heketiConfigmap
+  command: oc  -n "{{ openshift_namespace }}" create cm heketi --from-file="{{ heketi_template_path }}/heketi.json"
+  when: (result1 | changed) or (result2 | changed)
+
+- name: Check if Heketi POD is running
+  command: oc -n "{{ openshift_namespace }}" get dc/heketi --template "{{ '{{.status.availableReplicas}}' }}"
+  register: result
+  failed_when: false
+  changed_when: (result | failed) or ((result.stdout | int) < 1)
+
+- name: Fix GlusterFS volume permissions
+  include: heketi_perms.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  when: (result | changed)
+
+- name: Copy Heketi Template
+  template: src="heketi/heketi_template.json.j2" dest="{{ heketi_template_path }}/heketi_template.json" owner=root group=root mode="0644"
+  register: result
+
+- name: Create Heketi Pod
+  include_role: name="openshift_resource"
+  vars:
+    template: heketi_template.json
+    template_path: "{{ heketi_template_path }}"
+    project: "{{ openshift_namespace }}"
+    recreate: "{{ result | changed | ternary (true, false) }}"
+
+- name: Wait until heketi service is running
+  wait_for: host="heketi.{{ openshift_master_default_subdomain }}" port=80 state=present
+  
+- name: Copy Heketi topology
+  template: src="heketi/topology.json.j2" dest="{{ heketi_template_path }}/topology.json" owner=root group=root mode="0644"
+  notify: heketi_topology
+  
+- name: Copy Heketi storage class
+  template: src="heketi/heketi-sc.yml.j2" dest="{{ heketi_template_path }}/heketi-sc.yml" owner=root group=root mode="0644"
+  register: result
+
+- name: Setup Heketi-based dynamic volume provisioning
+  include_role: name="openshift_resource"
+  vars:
+    template: heketi-sc.yml
+    template_path: "{{ heketi_template_path }}"
+    project: "{{ openshift_namespace }}"
+    recreate: "{{ result | changed | ternary (true, false) }}"
diff --git a/roles/ands_openshift/tasks/hostnames.yml b/roles/ands_openshift/tasks/hostnames.yml
new file mode 100644
index 0000000..e489a8c
--- /dev/null
+++ b/roles/ands_openshift/tasks/hostnames.yml
@@ -0,0 +1,15 @@
+---
+#- name: Remove obsolte hostnames from /etc/hosts
+#  lineinfile: dest="/etc/hosts" regexp="{{ hostvars[item]['openshift_hostname'] }}" state="absent"
+#  with_inventory_hostnames:
+#    - nodes
+
+
+- name: Configure all cluster hostnames in /etc/hosts
+  lineinfile: dest="/etc/hosts" line="{{ hostvars[item]['openshift_ip'] }} {{ hostvars[item]['openshift_public_hostname'] }} {{ hostvars[item]['openshift_hostname'] }}" regexp="{{ hostvars[item]['openshift_hostname'] }}" state="present"
+  with_inventory_hostnames:
+    - nodes
+
+- name: Provision /etc/hosts to ensure that all masters servers are accessing Master API on loopback device
+  lineinfile: dest="/etc/hosts" line="127.0.0.1 {{ openshift_master_cluster_hostname }}" regexp=".*{{ openshift_master_cluster_hostname }}$" state="present"
+  when: "'masters' in group_names"
diff --git a/roles/ands_openshift/tasks/main.yml b/roles/ands_openshift/tasks/main.yml
new file mode 100644
index 0000000..f72123f
--- /dev/null
+++ b/roles/ands_openshift/tasks/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Configuring OpenShift"
+  include: "{{ current_subrole }}.yml"
+  with_items: "{{ openshift_subroles }}"
+  loop_control:
+    loop_var: current_subrole
diff --git a/roles/ands_openshift/tasks/ssh.yml b/roles/ands_openshift/tasks/ssh.yml
new file mode 100644
index 0000000..7d8d99d
--- /dev/null
+++ b/roles/ands_openshift/tasks/ssh.yml
@@ -0,0 +1,21 @@
+---
+- name: Check if ssh secret exists
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  command: oc -n "{{ openshift_namespace }}" get secret/ands-ssh
+  register: result
+  changed_when: (result | failed)
+  failed_when: false
+
+- include: ssh_keygen.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
+  when: (result | changed)
+
+- name: Read SSH public key
+  shell: cat "{{ ssh_template_path }}/id_rsa.pub"
+  changed_when: false
+  register: result
+
+- name: Distribute public keys
+  authorized_key: user="root" key="{{result.stdout}}" state=present manage_dir=yes exclusive=no
diff --git a/roles/ands_openshift/tasks/ssh_keygen.yml b/roles/ands_openshift/tasks/ssh_keygen.yml
new file mode 100644
index 0000000..21a7b0a
--- /dev/null
+++ b/roles/ands_openshift/tasks/ssh_keygen.yml
@@ -0,0 +1,12 @@
+---
+- name: Ensure ssh directory exists
+  file: path="{{ ssh_template_path }}" state="directory" mode=0600 owner=root group=root
+
+- name: Generate ssh-key
+  command: ssh-keygen -t rsa -C "ands-ssh@ipe.kit.edu" -N "" -f "{{ ssh_template_path }}"/id_rsa creates="{{ ssh_template_path }}/id_rsa"
+
+- name: Create ssh secret
+  command: oc -n "{{ openshift_namespace }}" secrets new ands-ssh id_rsa="{{ ssh_template_path }}"/id_rsa id_rsa_pub="{{ ssh_template_path }}/id_rsa.pub"
+
+- name: Ensure ssh secret key is removed
+  file: path="{{ ssh_template_path }}/id_rsa" state=absent
diff --git a/roles/ands_openshift/tasks/storage.yml b/roles/ands_openshift/tasks/storage.yml
new file mode 100644
index 0000000..be2583a
--- /dev/null
+++ b/roles/ands_openshift/tasks/storage.yml
@@ -0,0 +1,4 @@
+---
+- include: storage_resources.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
diff --git a/roles/ands_openshift/tasks/storage_resources.yml b/roles/ands_openshift/tasks/storage_resources.yml
new file mode 100644
index 0000000..5adf69e
--- /dev/null
+++ b/roles/ands_openshift/tasks/storage_resources.yml
@@ -0,0 +1,33 @@
+---
+- name: Ensure OpenShift template directory exists
+  file: path="{{ storage_template_path }}" state="directory" mode=0644 owner=root group=root
+
+- name: Copy GlusterFS service template
+  copy: src="gfs-svc.yml" dest="{{ storage_template_path }}/gfs-svc.yml" owner=root group=root mode="0644"
+  register: result
+
+- name: Configure GFS service & endpoints
+  include_role: name="openshift_resource"
+  vars: 
+    template: gfs-svc.yml 
+    template_path: "{{ storage_template_path }}"
+    project: "{{ prj_item }}" 
+    recreate: "{{ result | changed | ternary (true, false) }}"
+  with_items: "{{ ands_openshift_projects.keys() | union(['default']) }}"
+  loop_control: 
+    loop_var: prj_item
+
+- name: Configure GlusterFS end-points
+  template: src="gfs-ep.yml.j2" dest="{{ storage_template_path }}/gfs-ep.yml" owner=root group=root mode="0644"
+  register: result
+
+- name: Configure GFS service & endpoints
+  include_role: name="openshift_resource"
+  vars: 
+    template: gfs-ep.yml 
+    template_path: "{{ storage_template_path }}"
+    project: "{{ prj_item }}"
+    recreate: "{{ result | changed | ternary (true, false) }}"
+  with_items: "{{ ands_openshift_projects.keys() | union(['default']) }}"
+  loop_control: 
+    loop_var: prj_item
diff --git a/roles/ands_openshift/tasks/users.yml b/roles/ands_openshift/tasks/users.yml
new file mode 100644
index 0000000..c816203
--- /dev/null
+++ b/roles/ands_openshift/tasks/users.yml
@@ -0,0 +1,8 @@
+---
+- name: Copy htpasswd to /etc/origin/master
+  copy: src="users/htpasswd" dest="/etc/origin/master/htpasswd" mode=0644 owner=root group=root force=yes backup=no
+  when: "'masters' in group_names"
+
+- include: users_resources.yml
+  run_once: true
+  delegate_to: "{{ groups.masters[0] }}"
diff --git a/roles/ands_openshift/tasks/users_resources.yml b/roles/ands_openshift/tasks/users_resources.yml
new file mode 100644
index 0000000..35323cb
--- /dev/null
+++ b/roles/ands_openshift/tasks/users_resources.yml
@@ -0,0 +1,40 @@
+---
+- name: Configure cluster roles
+  command: "oc adm policy add-cluster-role-to-user {{  item.key.split('/')[0] }} {{ item.value.replace(' ','').split(',') | join(' ') }}"
+  with_dict: "{{ ands_openshift_roles }}"
+  when: "{{ item.key.split('/') | length == 1 }}"
+
+- name: Get project list
+  command: "oc get projects -o json"
+  changed_when: false
+  register: results
+
+- name: Find missing projects
+  set_fact: new_projects="{{ ands_openshift_projects.keys() | difference (results.stdout | from_json | json_query('items[*].metadata.name')) }}"
+  when: (results | succeeded)
+
+- name: Create missing projects
+  command: "oc adm new-project --description '{{ ands_openshift_projects[item] }}' {{ item }}"
+  with_items: "{{ new_projects | default([]) }}"
+
+- name: Configure per project roles
+  command: "oc adm policy add-role-to-user -n {{  item.key.split('/')[0] }} {{ item.key.split('/')[1] }} {{ item.value.replace(' ','').split(',') | join(' ') }}"
+  with_dict: "{{ ands_openshift_roles }}"
+  when: "{{ item.key.split('/') | length == 2 }}"
+
+- name: Get user list
+  command: "oc get users -o json"
+  changed_when: false
+  register: results
+
+- name: Find removed users
+  set_fact: removed_users="{{ results.stdout | from_json | json_query('items[*].metadata.name') | difference(ands_openshift_users.keys()) }}"
+  when: (results | succeeded)
+
+- name: Create missing projects
+  command: "oc delete identity htpasswd_auth:{{ item }}"
+  with_items: "{{ removed_users | default([]) }}"
+
+- name: Create missing projects
+  command: "oc delete user {{ item }}"
+  with_items: "{{ removed_users | default([]) }}"
diff --git a/roles/ands_openshift/templates/gfs-ep.yml.j2 b/roles/ands_openshift/templates/gfs-ep.yml.j2
new file mode 100644
index 0000000..de3acac
--- /dev/null
+++ b/roles/ands_openshift/templates/gfs-ep.yml.j2
@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: Template
+metadata:
+  name: gfs
+  annotations:
+    descriptions: "GlusterFS endpoints & service"
+    tags: glusterfs
+objects:
+  - apiVersion: v1
+    kind: Endpoints
+    metadata:
+      name: gfs
+    subsets:
+{% for node in openshift_storage_nodes %}
+      - addresses:
+          - ip: {{ node }}
+        ports:
+          - port: 1
+{% endfor %}
diff --git a/roles/ands_openshift/templates/heketi/heketi-sc.yml.j2 b/roles/ands_openshift/templates/heketi/heketi-sc.yml.j2
new file mode 100644
index 0000000..23ce6ce
--- /dev/null
+++ b/roles/ands_openshift/templates/heketi/heketi-sc.yml.j2
@@ -0,0 +1,21 @@
+---
+apiVersion: v1
+kind: Template
+metadata:
+  name: heketi-sc
+  annotations:
+    descriptions: "Heketi Dynamic Volume Provisioning"
+    tags: heketi
+objects:
+  - apiVersion: storage.k8s.io/v1beta1
+    kind: StorageClass
+    metadata:
+      name: heketi
+      annotations:
+        storageclass.beta.kubernetes.io/is-default-class: "true" 
+    provisioner: kubernetes.io/glusterfs
+    parameters:
+      resturl: "http://heketi.{{ openshift_master_default_subdomain }}" 
+      restuser: "admin"
+      secretName: "heketi" 
+      secretNamespace: "default" 
diff --git a/roles/ands_openshift/templates/heketi/heketi_template.json.j2 b/roles/ands_openshift/templates/heketi/heketi_template.json.j2
new file mode 100644
index 0000000..221662b
--- /dev/null
+++ b/roles/ands_openshift/templates/heketi/heketi_template.json.j2
@@ -0,0 +1,232 @@
+{
+  "kind": "Template",
+  "apiVersion": "v1",
+  "metadata": {
+    "name": "heketi",
+    "labels": {
+      "glusterfs": "heketi-template"
+    },
+    "annotations": {
+      "description": "Heketi service deployment template",
+      "tags": "glusterfs,heketi"
+    }
+  },
+  "labels": {
+    "template": "heketi"
+  },
+  "objects": [
+    {
+        "kind": "PersistentVolume",
+        "apiVersion": "v1",
+        "metadata": {
+            "name": "heketidb"
+        },
+        "spec": {
+            "persistentVolumeReclaimPolicy": "Retain",
+            "glusterfs": {
+                "endpoints": "gfs",
+                "path": "heketidbstorage"
+            },
+            "accessModes": [ "ReadWriteMany" ],
+            "capacity": {
+                "storage": "1Gi"
+            },
+            "claimRef": {
+                "name": "heketidb",
+                "namespace": "default"
+            }
+        }
+    },
+    {
+        "kind": "PersistentVolumeClaim",
+        "apiVersion": "v1",
+        "metadata": {
+            "name": "heketidb"
+        },
+        "spec": {
+            "volumeName": "heketidb",
+            "accessModes": [ "ReadWriteMany" ],
+            "resources": {
+                "requests": {
+                    "storage": "1Gi"
+                }
+            }
+        }
+    },
+    {
+      "kind": "Service",
+      "apiVersion": "v1",
+      "metadata": {
+        "name": "heketi",
+        "labels": {
+          "glusterfs": "heketi"
+        },
+        "annotations": {
+          "description": "Exposes Heketi service"
+        }
+      },
+      "spec": {
+        "ports": [
+          {
+            "name": "heketi",
+            "port": 8080,
+            "targetPort": 8080
+          }
+        ],
+        "selector": {
+          "name": "heketi"
+        }
+      }
+    },
+    {
+      "kind": "Route",
+      "apiVersion": "v1",
+      "metadata": {
+        "name": "heketi",
+        "labels": {
+          "glusterfs": "heketi"
+        }
+      },
+      "spec": {
+        "host": "heketi.{{ openshift_master_default_subdomain }}",
+        "to": {
+          "kind": "Service",
+          "name": "heketi"
+        }
+      }
+    },
+    {
+      "kind": "DeploymentConfig",
+      "apiVersion": "v1",
+      "metadata": {
+        "name": "heketi",
+        "labels": {
+          "glusterfs": "heketi"
+        },
+        "annotations": {
+          "description": "Defines how to deploy Heketi"
+        }
+      },
+      "spec": {
+        "replicas": 1,
+        "selector": {
+          "name": "heketi"
+        },
+        "template": {
+          "metadata": {
+            "name": "heketi",
+            "labels": {
+              "name": "heketi",
+              "glusterfs": "heketi"
+            }
+          },
+          "triggers": [
+            {
+              "type": "ConfigChange"
+            }
+          ],
+          "strategy": {
+            "type": "Recreate"
+          },
+          "spec": {
+            "nodeSelector": {
+                "master": "1"
+            },
+            "containers": [
+              {
+                "name": "heketi",
+                "image": "heketi/heketi:dev",
+                "imagePullPolicy": "Always",
+                "env": [
+                  {
+                    "name": "HEKETI_USER_KEY",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "heketi",
+                        "key": "user"
+                      }
+                    }
+                  },
+                  {
+                    "name": "HEKETI_ADMIN_KEY",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "heketi",
+                        "key": "key"
+                      }
+                    }
+                  },
+                  {
+                    "name": "HEKETI_FSTAB",
+                    "value": "/var/lib/heketi/fstab"
+                  },
+                  {
+                    "name": "HEKETI_SNAPSHOT_LIMIT",
+                    "value": "14"
+                  }
+                ],
+                "ports": [
+                  {
+                    "containerPort": 8080
+                  }
+                ],
+                "volumeMounts": [
+                  {
+                    "name": "config",
+                    "mountPath": "/etc/heketi",
+                    "readOnly": true
+                  },
+                  {
+                    "name": "ssh",
+                    "mountPath": "/etc/heketi_keys",
+                    "readOnly": true
+                  },
+                  {
+                    "name": "db",
+                    "mountPath": "/var/lib/heketi"
+                  }
+                ],
+                "readinessProbe": {
+                  "timeoutSeconds": 3,
+                  "initialDelaySeconds": 3,
+                  "httpGet": {
+                    "path": "/hello",
+                    "port": 8080
+                  }
+                },
+                "livenessProbe": {
+                  "timeoutSeconds": 3,
+                  "initialDelaySeconds": 30,
+                  "httpGet": {
+                    "path": "/hello",
+                    "port": 8080
+                  }
+                }
+              }
+            ],
+            "volumes": [
+              {
+                "name": "ssh",
+                "secret": {
+                  "secretName": "ands-ssh"
+                }
+              },
+              {
+                "name": "config",
+                "configMap": {
+                  "name" : "heketi"
+                }
+              },
+              {
+                "name": "db",
+                "persistentVolumeClaim": {
+                  "claimName" : "heketidb"
+                }
+              }
+            ]
+          }
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/roles/ands_openshift/templates/heketi/topology.json.j2 b/roles/ands_openshift/templates/heketi/topology.json.j2
new file mode 100644
index 0000000..53d683e
--- /dev/null
+++ b/roles/ands_openshift/templates/heketi/topology.json.j2
@@ -0,0 +1,28 @@
+
+{
+    "clusters": [
+        {
+            "nodes": [
+{% set comma = joiner(",") %}
+{% for node in openshift_storage_nodes %}
+                {{ comma() }} {
+                    "node": {
+                        "hostnames": {
+                            "manage": [
+                                "{{ node }}"
+                            ],
+                            "storage": [
+                                "{{ node }}"
+                            ]
+                        },
+                        "zone": 1
+                    },
+                    "devices": [
+                        "/dev/{{ansible_lvm.lvs[ands_heketi_lv].vg}}/{{ ands_heketi_lv }}"
+                    ]
+                }
+{% endfor %}
+            ]
+        }
+    ]
+}
diff --git a/roles/ands_storage/README b/roles/ands_storage/README
new file mode 100644
index 0000000..d17a6cd
--- /dev/null
+++ b/roles/ands_storage/README
@@ -0,0 +1,25 @@
+Dependencies:
+ - Executed on the fat storage nodes
+ - Ands data VG and mount-point should be configured or they will default to 'ands' and /mnt/ands
+
+Parameters:
+ - ands_data_path: Mount point of Ands Data Volume, defaults to '/mnt/ands'
+ - ands_data_vg / ands_data_lv / ands_data_device / ands_data_volume_size: Configures the LV for Ands Data Volume, VG defaults to 'ands'
+    - The Katrin VG will be created if not existing. The first non-partitioned device with at least 'ands_data_device_threshold' GB of space 
+    will be used unless device is directlys specified with 'ands_data_device'. If ands_data_vg already exists, the 'ands_data_deivce'
+    will be ignored.
+    - Unless 'ands_data_volume_size' is specified, all available space on VG will be used (after creating heketi volume if it
+    resides on the same VG)
+ - ands_heketi_vg / ands_heketi_lv / ands_heketi_device / ands_heketi_volume_size: Configures the LV for Heketi volume manager
+    - The heketi LV is only created if 'ands_heketi_volume_size' is specified in the inventory
+    - By default, the 'ands_data_vg' will be used to create heketi volumes.
+    - If ands_heketi_device is specified, the VG will be created if not existing.
+
+Facts:
+ - ands_data_path:
+ - ands_data_vg:
+
+Actions:
+ - Configures Ands VG & LV on the storage nodes (and detects appropriate devices unless set in inventory)
+ - Mounts Ands data volume
+ 
\ No newline at end of file
diff --git a/roles/ands_storage/defaults/main.yml b/roles/ands_storage/defaults/main.yml
new file mode 100644
index 0000000..3eb68b5
--- /dev/null
+++ b/roles/ands_storage/defaults/main.yml
@@ -0,0 +1,13 @@
+---
+ands_data_vg: "ands"
+#ands_data_vg: "katrin"
+ands_data_path: "/mnt/{{ ands_data_vg }}"
+ands_data_lv: "{{ ands_data_vg }}_data"
+ands_data_volume_size: "100%FREE"
+ands_data_fs: "xfs"
+
+ands_data_device_threshold: 8192
+
+ands_heketi_vg: "{{ ands_data_vg }}"
+ands_heketi_lv: "{{ ands_data_vg }}_heketi"
+#ands_heketi_volume_size: "1024G"
diff --git a/roles/ands_storage/handlers/main.yml b/roles/ands_storage/handlers/main.yml
new file mode 100644
index 0000000..9f55771
--- /dev/null
+++ b/roles/ands_storage/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: ands_heketi_change
+  command: pvresize "/dev/{{ ands_heketi_vg }}/{{ ands_heketi_lv }}"
+  when: heketi_stat_result.stat.exists
+
diff --git a/roles/ands_storage/tasks/detect_device.yml b/roles/ands_storage/tasks/detect_device.yml
new file mode 100644
index 0000000..0fb9764
--- /dev/null
+++ b/roles/ands_storage/tasks/detect_device.yml
@@ -0,0 +1,10 @@
+- name: find large block devices
+  set_fact: ands_data_device="/dev/{{ item.key }}"
+#  debug: msg="{{ item.key }} - {{ (item.value.sectors | int) * (item.value.sectorsize | int) / 1024 / 1024 / 1024 }} GB"
+  with_dict: "{{ ansible_devices }}"
+  when: 
+    - not ands_data_device is defined 
+    - not item.value.partitions
+    - not item.value.holders
+    - item.value.sectors is defined
+    - ( (item.value.sectors | int) * (item.value.sectorsize | int) / 1024 / 1024 / 1024 ) > ands_data_device_threshold
diff --git a/roles/ands_storage/tasks/main.yml b/roles/ands_storage/tasks/main.yml
new file mode 100644
index 0000000..a86babe
--- /dev/null
+++ b/roles/ands_storage/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: Publish some facts
+  set_fact:
+    ands_data_vg: "{{ ands_data_vg }}"
+    ands_data_path: "{{ ands_data_path }}"
+
+- name: Analyze storage devices
+  include: detect_device.yml
+  when: not ands_data_device is defined
+
+- name: Create Ands VG
+  lvg: vg="{{ ands_data_vg }}" pvs="{{ ands_data_device }}"
+  when: ands_data_device is defined
+
+- name: Create Heketi VG
+  lvg: vg="{{ ands_heketi_vg }}" pvs="{{ ands_heketi_device }}"
+  when: ands_heketi_device is defined
+
+- name: Check if Heketi Volume already exists
+  stat: path="/dev/{{ ands_heketi_vg }}/{{ ands_heketi_lv }}"
+  register: heketi_stat_result
+  changed_when: false
+  when: ands_heketi_volume_size is defined
+
+- name: Create Heketi Volume
+  lvol: vg="{{ ands_heketi_vg }}" lv="{{ ands_heketi_lv }}" size="{{ ands_heketi_volume_size }}"
+  notify: ands_heketi_change
+  when: ands_heketi_volume_size is defined
+
+- name: Add Heketi to Storage Domains
+  set_fact: ands_storage_domains="{{ ands_storage_domains | union([ands_heketi_domain]) }}"
+  when: 
+    - (ansible_lvm.lvs[ands_heketi_lv] is defined) or (ands_heketi_volume_size is defined)
+    - heketi_stat_result.stat.exists == False
+
+- name: Create Ands Data Volume
+  lvol: vg="{{ ands_data_vg }}" lv="{{ ands_data_lv }}" size="{{ ands_data_volume_size }}"
+
+- name: Ensure Ands Data Volume is formatted and resize if necessary
+  filesystem: fstype="xfs" resizefs="yes" dev="/dev/{{ ands_data_vg }}/{{ ands_data_lv }}"
+
+- name: Mount Ands Data Volume
+  mount: name="{{ ands_data_path }}"  src="/dev/{{ ands_data_vg }}/{{ ands_data_lv }}" fstype="{{ ands_data_fs }}" opts="defaults" state="mounted"
+
+  
\ No newline at end of file
diff --git a/roles/ands_vagrant_vm/README b/roles/ands_vagrant_vm/README
new file mode 100644
index 0000000..ca4f0d5
--- /dev/null
+++ b/roles/ands_vagrant_vm/README
@@ -0,0 +1,19 @@
+Dependencies:
+ - Executed on a single virtualization node
+ - The node should have vagrant configured
+ 
+Parameters:
+ - vagrant_hostname_template                            - The name prefix of generated hosts. I.e. if 'ipekatrin' is specified, the ipekatrin1, ipekatrin2, ... nodes will be produced
+ - vagrant_project                                      - The vagrant project name, just specifies a subdirectory with virtual machines to allow parallel execution of VMs for testing and staging setups
+ - vagrant_projects_dir                                 - Location of all vagrant projects
+ - vagrant_project_dir                                  - Location of this specific vagrant project, normally is vagrant_projects_dir/vagrant_project
+ - vagrant_hosts                                        - Number of VMs to generate, defaults to number of configured ands_hosts (i.e. OpenShift nodes currently)
+ - vagrant_cpu_cores                                    - Number of CPU cores for each VM
+ - vagrant_mem_size                                     - Memory per VM in GB
+ - vagrant_disk_size                                    - Data disk size per VM in GB
+
+Facts:
+
+
+Actions:
+ - Creates and starts VMs
diff --git a/roles/ands_vagrant_vm/defaults/main.yml b/roles/ands_vagrant_vm/defaults/main.yml
new file mode 100644
index 0000000..93d92b6
--- /dev/null
+++ b/roles/ands_vagrant_vm/defaults/main.yml
@@ -0,0 +1,8 @@
+vagrant_hostname_template: ipeands
+vagrant_project: testing
+vagrant_projects_dir: /home/vagrant/projects
+vagrant_project_dir: "/home/vagrant/projects/{{vagrant_project}}"
+vagrant_disk_size: 60200
+vagrant_mem_size: 16384
+vagrant_cpu_cores: 4
+vagrant_hosts: {{ groups.ands_hosts | length }}
diff --git a/roles/ands_vagrant_vm/files/rebuild.sh b/roles/ands_vagrant_vm/files/rebuild.sh
new file mode 100644
index 0000000..73e100d
--- /dev/null
+++ b/roles/ands_vagrant_vm/files/rebuild.sh
@@ -0,0 +1,9 @@
+#! /bin/bash
+
+(
+    cd configs
+
+    vagrant destroy -f
+    vagrant up --parallel
+    vagrant provision
+)
diff --git a/roles/ands_vagrant_vm/files/run.sh b/roles/ands_vagrant_vm/files/run.sh
new file mode 100755
index 0000000..2fceb3d
--- /dev/null
+++ b/roles/ands_vagrant_vm/files/run.sh
@@ -0,0 +1,12 @@
+#! /bin/bash
+
+(
+    cd configs
+
+    VBoxManage hostonlyif ipconfig vboxnet0 --ip 192.168.12.254 --netmask 255.255.255.0
+#    ( ip addr show | grep 12 ) || ip addr add 192.168.12.254/24 dev vboxnet0
+    ( ip addr show | grep 212 ) || ip addr add 192.168.212.254/24 dev vboxnet0
+
+    vagrant up --parallel
+    vagrant provision
+)
diff --git a/roles/ands_vagrant_vm/handlers/main.yml b/roles/ands_vagrant_vm/handlers/main.yml
new file mode 100644
index 0000000..8c4f35d
--- /dev/null
+++ b/roles/ands_vagrant_vm/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: vagrant
+  command: ./run.sh chdir="{{ vagrant_project_dir }}"
diff --git a/roles/ands_vagrant_vm/tasks/main.yml b/roles/ands_vagrant_vm/tasks/main.yml
new file mode 100644
index 0000000..7c3310d
--- /dev/null
+++ b/roles/ands_vagrant_vm/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+- name: Ensure vagrant project dir is existing
+  file: name="{{ vagrant_project_dir }}/{{ item }}" state=directory
+  with_items:
+    - configs
+    - disks
+
+- name: Copy authorized_keys
+  copy: src="~/.ssh/authorized_keys" dest="{{ vagrant_project_dir }}/configs/authorized_keys" owner="root" group="root"
+
+- name: Copy scripts
+  copy: src="{{ item }}" dest="{{ vagrant_project_dir }}/{{ item }}" mode="0755"
+  with_items:
+    - run.sh
+    - rebuild.sh
+
+- name: Install Vagrantfile
+  template: src="Vagrantfile.j2" dest="{{ vagrant_project_dir }}/configs/Vagrantfile"
+  notify:
+    - vagrant
diff --git a/roles/ands_vagrant_vm/templates/Vagrantfile.j2 b/roles/ands_vagrant_vm/templates/Vagrantfile.j2
new file mode 100644
index 0000000..54128d4
--- /dev/null
+++ b/roles/ands_vagrant_vm/templates/Vagrantfile.j2
@@ -0,0 +1,51 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+{% set net = ands_openshift_network | ipaddr('network') | ipaddr(0) | regex_replace('\.\d+$', '')  %}
+{% set storage_net = ands_storage_network | ipaddr('network') | ipaddr(0) | regex_replace('\.\d+$', '') %}
+{% set netid = (  net | regex_replace('^.*\.', '') ) %}
+{% set storage_netid = (  storage_net | regex_replace('^.*\.', '') ) %}
+{% set macid = ( (netid | length) > 2 ) | ternary(netid, "0" ~ netid) %}
+
+Vagrant.configure("2") do |config|
+  (1..{{ vagrant_hosts }}).each do |i|
+    config.vm.define "{{ vagrant_hostname_template }}#{i}" do |node|
+        node.vm.network "public_network", bridge: "br0", mac: "080027{{ macid  }}02#{i}", ip: "{{ net }}.#{i}"
+        node.vm.network "private_network",  mac: "080027{{ macid }}12#{i}", ip: "{{ storage_net }}.#{i}", name: "vboxnet0"
+        node.vm.box = "centos/7"
+        node.vm.hostname = "{{ vagrant_hostname_template }}#{i}.ipe.kit.edu"
+#	node.vm.synced_folder "../data", "/root/data"
+
+# Configuring DHCP in 'vm.network' causes 2 DHCP clients (dhclinet & nm) running in parallel and getting 2 IPs.
+        node.vm.provision "shell", run: "always", inline: "( ip addr show | grep -v 141.52.64.15 | grep -v 141.52.64.17 | grep -v 141.52.64.28 | grep 141.52 ) || dhclient -cf /var/lib/NetworkManager/dhclient-eth0.conf eth1"
+        node.vm.provision "shell", run: "always", inline: "( ip addr show | grep {{ netid }}.#{i} ) || ip addr add 192.168.{{ netid }}.#{i}/24 dev eth1"
+        node.vm.provision "shell", run: "always", inline: "( ip addr show | grep {{ storage_netid }}.#{i} ) || ifcfg eth2 192.168.{{ storage_netid }}.#{i}"
+        node.vm.provision "shell", run: "always", inline: "chmod +r /etc/sysconfig/network-scripts/ifcfg-eth*"
+        node.vm.provision "shell", run: "always", inline: "chcon --reference /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth*"
+        
+        node.vm.provision "shell" do |s|
+            ssh_pub_key = File.readlines("authorized_keys").first.strip
+            s.inline = <<-SHELL
+                mkdir -p /root/.ssh/
+                echo #{ssh_pub_key} >> /root/.ssh/authorized_keys
+            SHELL
+        end
+
+        node.vm.provider "virtualbox" do |vb|
+            vb.memory = "{{ 1024 * (vagrant_mem_size | int) }}"
+            vb.cpus = {{ vagrant_cpu_cores }}
+            #vb.gui = true
+            vb.customize [
+                "modifyvm", :id,
+#               "--ostype", "Linux_64",
+                "--audio", "none",
+            ]
+            vb.customize [
+        	'createhd', '--filename', "../disks/#{i}", '--format', 'VDI', '--size', {{ 1024 * (vagrant_disk_size | int) }}
+            ]
+            vb.customize [
+        	'storageattach', :id, '--storagectl', 'IDE Controller', '--port', 1, '--device', 0,'--type', 'hdd', '--medium', "../disks/#{i}.vdi"
+            ]
+        end
+    end
+  end
+end
diff --git a/roles/common/README b/roles/common/README
new file mode 100644
index 0000000..c8bd679
--- /dev/null
+++ b/roles/common/README
@@ -0,0 +1,11 @@
+Dependencies:
+ - Executed on all nodes
+ - No dependencies & no facts
+
+Parameters:
+ extra_packages: list of extra packages to install
+ 
+Actions:
+ - Enables standard repositories
+ - Install a set of common packages on all nodes (mc, etc.)
+ 
\ No newline at end of file
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
new file mode 100644
index 0000000..3f49a39
--- /dev/null
+++ b/roles/common/tasks/main.yml
@@ -0,0 +1,23 @@
+- name: Ensure all required repositories are configured
+  package: name={{item}} state=present
+  with_items:
+    - epel-release
+    - centos-release-openshift-origin
+
+# Seems we need iptables-services at least temporary...
+- name: Ensure all required packages are installed
+  package: name={{item}} state=present
+  with_items:
+    - mc
+    - bzr
+    - git
+    - yamllint
+    - pyOpenSSL
+    - python-passlib
+    - python2-ruamel-yaml
+    - python2-jmespath
+    - iptables-services
+
+- name: Ensure all extra packages are installed
+  package: name={{item}} state=present
+  with_items: "{{ extra_packages | default([]) }}"
diff --git a/roles/docker/README b/roles/docker/README
new file mode 100644
index 0000000..b9b1537
--- /dev/null
+++ b/roles/docker/README
@@ -0,0 +1,18 @@
+Dependencies:
+ - Executed on all nodes. On the storage nodes, the katrin_storage role should be executed before
+ - Unless docker_storage_vg is defined, it will try to detect the first VG with the space available and which is not equal to katrin_data_vg
+
+Parameters:
+ docker_storage_vg / docker_storage_device: Configures VG to use for docker images
+    - If docker_storage_vg is not set it will try to detect the first VG with space available and which is not listed in the 'docker_exclude_vgs'
+    - If such VG is not found, it will create VG on the specified device
+ docker_exclude_vgs: Lists VGs which should not be used to host Docker volumes
+ docker_min_size: Specifies the minimum size requirement of Docker LV
+ docker_volume_size: Adjust the size of Docker LV
+ 
+Facts:
+ - Nope
+
+Actions;
+ - Detects or creates Docker VG and creates inside the 'docker-pool' LV (autogrowing). The initial size may be given with docker_storage_size
+ - Installs docker, configures LVM storage backend, and enables docker service
diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
new file mode 100644
index 0000000..6542789
--- /dev/null
+++ b/roles/docker/defaults/main.yml
@@ -0,0 +1,3 @@
+docker_min_size: 100
+docker_exclude_vgs: "{{ ands_data_vg is defined | ternary( [ ands_data_vg ], [] ) }}"
+docker_lv: "docker-pool"
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
new file mode 100644
index 0000000..1263cd2
--- /dev/null
+++ b/roles/docker/tasks/main.yml
@@ -0,0 +1,32 @@
+---
+- name: Ensure docker is installed
+  yum: name="docker" state="present"
+
+- name: start docker
+  service: name="docker" state="started"
+
+- name: Configure bridge-nf-call-iptables with sysctl
+  sysctl: name="net.bridge.bridge-nf-call-iptables"  value=1 state=present sysctl_set=yes
+
+- name: Configure bridge-nf-call-ip6tables with sysctl
+  sysctl: name="net.bridge.bridge-nf-call-ip6tables"  value=1 state=present sysctl_set=yes
+
+- name: Determine if loopback
+  shell: docker info | grep 'Data file:.*loop'
+  register: loop_device_check
+  failed_when: false
+  changed_when: loop_device_check.rc == 0
+
+- debug: msg="{{ loop_device_check.stderr }}"
+  when: loop_device_check.stderr
+
+- include: storage.yml
+  when: loop_device_check.rc == 0
+
+- name: extend the vg
+  lvol: vg="{{ ansible_lvm['lvs'][docker_lv]['vg'] }}" lv="docker_lv" size="{{ docker_volume_size }}"
+  when: docker_volume_size is defined
+
+- name: stop docker
+  service: name="docker" enabled=yes state=started
+  
\ No newline at end of file
diff --git a/roles/docker/tasks/storage.yml b/roles/docker/tasks/storage.yml
new file mode 100644
index 0000000..595979c
--- /dev/null
+++ b/roles/docker/tasks/storage.yml
@@ -0,0 +1,41 @@
+---
+- name: list volume groups
+  set_fact: available_vg="{{ item.key }}"
+  with_dict: "{{ ansible_lvm.vgs }}"
+  when:
+    - not available_vg is defined
+    - not item.key in ( docker_exclude_vgs | default([]) )
+    - (item.value.free_g | int) > (docker_volume_size | default(docker_min_size))
+
+- set_fact: docker_storage_vg="{{ available_vg }}"
+  when: (not docker_storage_vg is defined) and (available_vg is defined)
+
+- fail: msg="Can't detect Docker VG"
+  when: not docker_storage_vg is defined
+
+- name: check to see if {{ docker_storage_device }} exists
+  command: "test -e {{ docker_storage_device }}"
+  when: docker_storage_device is defined
+
+- set_fact: docker_storage_config="VG={{ docker_storage_vg }} AUTO_EXTEND_POOL=true"
+
+- set_fact: docker_storage_config="{{ docker_storage_config }} DEVS={{ docker_storage_device }}"
+  when: ( docker_storage_device is defined ) and ( not ansible_lvm.vgs.{{ docker_storage_vg }} is defined )
+  
+- name: stop docker
+  service: name="docker" state="stopped"
+
+- name: delete /var/lib/docker
+  file: path="/var/lib/docker" state=absent
+
+- name: generate docker-storage-setup config file
+  copy:
+      content: "{{ docker_storage_config }}"
+      dest: /etc/sysconfig/docker-storage-setup
+      owner: root
+      group: root
+      mode: 0664
+
+- name: docker storage setup
+  command: docker-storage-setup
+
diff --git a/roles/glusterfs/README b/roles/glusterfs/README
new file mode 100644
index 0000000..9a319d0
--- /dev/null
+++ b/roles/glusterfs/README
@@ -0,0 +1,26 @@
+Dependencies:
+ - Executed on all nodes. 
+    * The GlusteFS servers are configured on all storage servers. 
+    * The GlusterFS clients on all the servers
+    * The volumes are created in the configured domains
+ - Expects that partition for bricks is already prepared
+
+Parameters:
+  glusterfs_version: should be defined (without dot, like 39)
+  glusterfs_transport: Transport to use, defaults to rdma
+
+  glusterfs_network: CIDR for gluster internal Infiniband network
+    - if 192.168.12.0/24 is specified, the 'ipekatrin1' storage node will be mapped '192.168.12.1' IP, etc.
+  glusterfs_servers: List of storage servers in glusterfs_network
+  glusterfs_bricks_path: The location to store volume bricks, defaults to 'ands_data_path'/glusterfs
+  glusterfs_domains: Volume configuration
+
+Facts:
+
+Actions:
+ - Installs appropriate GlusterFS repositories (to match specified version)
+ - Installs required packages, only native clients on the servers without storage
+ - Enables firewalld if necessary and allows GlusterFS service
+ - Configures SELinux, etc. 
+ - Probes all storage nodes using internal Infiniband IPs
+ - Creates requested volumes and mounts them
diff --git a/roles/glusterfs/defaults/main.yml b/roles/glusterfs/defaults/main.yml
new file mode 100644
index 0000000..9587a9b
--- /dev/null
+++ b/roles/glusterfs/defaults/main.yml
@@ -0,0 +1,11 @@
+---
+glusterfs_version: 39
+glusterfs_transport: rdma
+
+glusterfs_network: "{{ ands_storage_network }}"
+glusterfs_servers: "{{ ands_storage_servers }}"
+glusterfs_bricks_path: "{{ ands_data_path }}/glusterfs"
+glusterfs_domains: "{{ ands_storage_domains }}"
+
+glusterfs_all_subroles: "{{ [ 'software', 'volumes' ] }}"
+glusterfs_subroles: "{{ ( subrole is defined ) | ternary( [ subrole ], glusterfs_all_subroles ) }}"
diff --git a/roles/glusterfs/tasks/cfg/vols2.yml b/roles/glusterfs/tasks/cfg/vols2.yml
new file mode 120000
index 0000000..b6a3e8f
--- /dev/null
+++ b/roles/glusterfs/tasks/cfg/vols2.yml
@@ -0,0 +1 @@
+vols3.yml
\ No newline at end of file
diff --git a/roles/glusterfs/tasks/cfg/vols3.yml b/roles/glusterfs/tasks/cfg/vols3.yml
new file mode 100644
index 0000000..d094797
--- /dev/null
+++ b/roles/glusterfs/tasks/cfg/vols3.yml
@@ -0,0 +1,13 @@
+---
+- name: "Create {{ name }} volume"
+  gluster_volume: 
+    state: present
+    name: "{{ name }}"
+    cluster: "{{ domain_servers | join(',') }}"
+    replicas: "{{ domain_servers | length }}"
+    bricks: "{{ glusterfs_bricks_path }}/brick-{{ name }}"
+    transport: "{{ glusterfs_transport }}"
+
+
+- name: "Start {{ name }} volume"
+  gluster_volume: state="started" name="{{ name }}"
diff --git a/roles/glusterfs/tasks/common.yml b/roles/glusterfs/tasks/common.yml
new file mode 100644
index 0000000..7675cb9
--- /dev/null
+++ b/roles/glusterfs/tasks/common.yml
@@ -0,0 +1,16 @@
+---
+- name: Ensure GlusterFS repositories are present
+  yum: name="centos-release-gluster{{ glusterfs_version }}" state=present
+   
+- name: Ensure GlusterFS is installed
+  yum: name={{item}} state=present
+  with_items:
+    - glusterfs-cli
+    - glusterfs-fuse
+    - glusterfs-libs
+    - glusterfs-rdma
+    - glusterfs
+    - libsemanage-python
+            
+- name: Allow fuse in SELinux configuration
+  seboolean: name="virt_sandbox_use_fusefs" state="yes" persistent="yes"
diff --git a/roles/glusterfs/tasks/create_domain.yml b/roles/glusterfs/tasks/create_domain.yml
new file mode 100644
index 0000000..b3fc89e
--- /dev/null
+++ b/roles/glusterfs/tasks/create_domain.yml
@@ -0,0 +1,8 @@
+---
+- name: Configure volumes
+  include: create_volume.yml
+  with_dict: "{{ domain.volumes }}"
+  vars:
+    domain_servers: "{{ groups[domain.servers] | map('extract', hostvars, 'ands_storage_hostname') | list }}"
+  loop_control:
+    loop_var: volume
diff --git a/roles/glusterfs/tasks/create_volume.yml b/roles/glusterfs/tasks/create_volume.yml
new file mode 100644
index 0000000..9b955b0
--- /dev/null
+++ b/roles/glusterfs/tasks/create_volume.yml
@@ -0,0 +1,4 @@
+---
+- include: "{{ volume.value.type }}/vols{{((domain_servers | length) < 4) | ternary((domain_servers | length), 3) }}.yml"
+  vars:
+    name: "{{ volume.key }}"
diff --git a/roles/glusterfs/tasks/main.yml b/roles/glusterfs/tasks/main.yml
new file mode 100644
index 0000000..dbd1aad
--- /dev/null
+++ b/roles/glusterfs/tasks/main.yml
@@ -0,0 +1,13 @@
+---
+- include: common.yml
+  when:
+    - "'software' in glusterfs_subroles"
+
+- include: server.yml
+  when: 
+    - "'software' in glusterfs_subroles"
+    - "'ands_storage_servers' in group_names"
+
+- include: volumes.yml
+  when:
+    - "'volumes' in glusterfs_subroles"
diff --git a/roles/glusterfs/tasks/mount_domain.yml b/roles/glusterfs/tasks/mount_domain.yml
new file mode 100644
index 0000000..94b6677
--- /dev/null
+++ b/roles/glusterfs/tasks/mount_domain.yml
@@ -0,0 +1,12 @@
+---
+- name: Mount volumes
+  include: mount_volume.yml
+  with_dict: "{{ domain.volumes }}"
+  vars:
+    name: "{{ volume.key }}"
+    path: "{{ volume.value.mount }}"
+    server_group: "{{ domain.servers }}"
+    domain_servers: "{{ groups[domain.servers] | map('extract', hostvars, 'ands_storage_hostname') | list }}"
+  when: volume.value.mount is defined
+  loop_control:
+    loop_var: volume
diff --git a/roles/glusterfs/tasks/mount_volume.yml b/roles/glusterfs/tasks/mount_volume.yml
new file mode 100644
index 0000000..2aea7f6
--- /dev/null
+++ b/roles/glusterfs/tasks/mount_volume.yml
@@ -0,0 +1,8 @@
+---
+- name: Mount {{ name }} volume
+  mount: name="{{ path }}"  src="localhost:{{ name }}" fstype="glusterfs" opts="defaults,_netdev" state="mounted"
+  when: server_group in group_names
+  
+- name: Mount {{ name }} volume
+  mount: name="{{ path }}"  src="{{ domain_servers | join(",") }}:{{ name }}" fstype="glusterfs" opts="defaults,_netdev" state="mounted"
+  when: not server_group in group_names
diff --git a/roles/glusterfs/tasks/server.yml b/roles/glusterfs/tasks/server.yml
new file mode 100644
index 0000000..328a8c5
--- /dev/null
+++ b/roles/glusterfs/tasks/server.yml
@@ -0,0 +1,31 @@
+---
+- name: Ensure GlusterFS is installed
+  yum: name={{item}} state=present
+  with_items:
+    - glusterfs-server
+    - glusterfs-rdma
+
+- name: Ensure GlusterFS service is running
+  service: name=glusterd state=started enabled=yes
+
+- name: Ensure firewalld is running
+  service: name=firewalld state=started enabled=yes
+
+- name: Configure firewalld
+  firewalld: rich_rule="rule family=ipv4 source address={{glusterfs_network}} service name=glusterfs accept" state="enabled" permanent="true" immediate="true"
+  when: glusterfs_network is defined
+  
+- name: Configure firewalld
+  firewalld: service="glusterfs" state="enabled" permanent="true" immediate="true"
+  when: not glusterfs_network is defined
+
+- name: Reload firewalld rules
+  shell: firewall-cmd --reload
+
+- name: Create folder for GlusterFS bricks
+  file: dest="{{glusterfs_bricks_path}}" owner="root" group="root" mode="0755" state="directory"
+
+- name: Configure gluster peers (on first host)
+  shell: gluster peer probe {{item}}
+  run_once: true
+  with_items: "{{ glusterfs_servers }}"
diff --git a/roles/glusterfs/tasks/tmp/vols2.yml b/roles/glusterfs/tasks/tmp/vols2.yml
new file mode 120000
index 0000000..b6a3e8f
--- /dev/null
+++ b/roles/glusterfs/tasks/tmp/vols2.yml
@@ -0,0 +1 @@
+vols3.yml
\ No newline at end of file
diff --git a/roles/glusterfs/tasks/tmp/vols3.yml b/roles/glusterfs/tasks/tmp/vols3.yml
new file mode 100644
index 0000000..9565bb3
--- /dev/null
+++ b/roles/glusterfs/tasks/tmp/vols3.yml
@@ -0,0 +1,11 @@
+---
+- name: "Create {{ name }} volume"
+  gluster_volume: 
+    state: present
+    name: "{{ name }}"
+    cluster: "{{ domain_servers | join(',') }}"
+    bricks: "{{ glusterfs_bricks_path }}/brick-{{ name }}"
+    transport: "{{ glusterfs_transport }}"
+
+- name: "Start {{ name }} volume"
+  gluster_volume: state="started" name="{{ name }}"
diff --git a/roles/glusterfs/tasks/volumes.yml b/roles/glusterfs/tasks/volumes.yml
new file mode 100644
index 0000000..e393c08
--- /dev/null
+++ b/roles/glusterfs/tasks/volumes.yml
@@ -0,0 +1,15 @@
+- name: Configure volume domains
+  include: create_domain.yml
+  run_once: true
+  delegate_to: "{{ groups[domain.servers][0] }}"
+  with_items: "{{ glusterfs_domains }}"
+  loop_control:
+    loop_var: domain  
+
+- name: Mount volume domains
+  include: mount_domain.yml
+  when: ( domain.clients | default("---") ) in group_names
+  with_items: "{{ glusterfs_domains }}"
+  loop_control:
+    loop_var: domain  
+
diff --git a/roles/keepalived/.gitignore b/roles/keepalived/.gitignore
new file mode 100644
index 0000000..aa16e10
--- /dev/null
+++ b/roles/keepalived/.gitignore
@@ -0,0 +1,2 @@
+.DS_Store/*
+.vagrant/*
diff --git a/roles/keepalived/README b/roles/keepalived/README
new file mode 100644
index 0000000..956dbcb
--- /dev/null
+++ b/roles/keepalived/README
@@ -0,0 +1,13 @@
+Dependencies:
+ - Run on OpenShift master nodes
+
+Parameters:
+ - keepalived_vips: List of Virtual IPs
+ - keepalived_iface: Network interface
+ 
+Facts:
+
+Actions:
+ - Sets up and configures keepalived daemon
+ - Configures sysctl and firewall
+
diff --git a/roles/keepalived/defaults/main.yml b/roles/keepalived/defaults/main.yml
new file mode 100644
index 0000000..a7087b0
--- /dev/null
+++ b/roles/keepalived/defaults/main.yml
@@ -0,0 +1,12 @@
+---
+keepalived_vips: "{{ ands_ipfailover_vips | default([]) }}"
+keepalived_iface: "{{ ands_ipfailover_interface | default('eth0') }}"
+
+keepalived_master_prio: 80
+keepalived_backup_prio: 20
+keepalived_check_interval: 5
+
+keepalived_password: "{{ ands_secrets.keepalived }}"
+
+keepalived_node_id: "{{ play_hosts.index(inventory_hostname) }}"
+keepalived_num_nodes: "{{ play_hosts | length }}"
diff --git a/roles/keepalived/handlers/main.yml b/roles/keepalived/handlers/main.yml
new file mode 100644
index 0000000..2ac9fe3
--- /dev/null
+++ b/roles/keepalived/handlers/main.yml
@@ -0,0 +1,3 @@
+---
+- name: restart keepalived
+  service: name=keepalived state=restarted
diff --git a/roles/keepalived/tasks/main.yml b/roles/keepalived/tasks/main.yml
new file mode 100644
index 0000000..771faa7
--- /dev/null
+++ b/roles/keepalived/tasks/main.yml
@@ -0,0 +1,22 @@
+---
+- name: Install keepalived 
+  yum: name=keepalived state=present
+  notify: restart keepalived
+
+- name: Configure net.ipv4.ip_nonlocal_bind with sysctl
+  sysctl: name="net.ipv4.ip_nonlocal_bind"  value=1 state=present sysctl_set=yes
+
+- name: Ensure firewalld is running
+  service: name=firewalld state=started enabled=yes
+
+- name: Configure firewalld
+  firewalld: rich_rule="rule protocol value=vrrp accept" state="enabled" permanent="true" immediate="true"
+
+- name: Install configuration
+  template: src=keepalived.conf.j2 dest=/etc/keepalived/keepalived.conf owner=root group=root mode=0600
+  tags: keepalived
+  notify: restart keepalived
+
+- name: Start keepalived
+  service: name=keepalived state=running
+  tags: keepalived
diff --git a/roles/keepalived/templates/keepalived.conf.j2 b/roles/keepalived/templates/keepalived.conf.j2
new file mode 100644
index 0000000..8d9a580
--- /dev/null
+++ b/roles/keepalived/templates/keepalived.conf.j2
@@ -0,0 +1,36 @@
+global_defs {
+}
+
+vrrp_script track {
+    script "[ -f /etc/keepalived/track.sh ] || exit 0 && /etc/keepalived/track.sh"
+    interval {{ keepalived_check_interval }}
+}
+
+{% for vips in keepalived_vips  %}
+{% set id = (  vips | ipaddr('address') | regex_replace('^.*\.', '') ) %}
+
+vrrp_instance VI_{{ loop.index }} {
+
+    virtual_router_id {{ id }}
+
+    state {{ (( ( loop.index - 1) % (keepalived_num_nodes | int) ) == (keepalived_node_id | int) ) | ternary('MASTER', 'BACKUP') }}
+    state {{ (( ( loop.index - 1) % (keepalived_num_nodes | int) ) == (keepalived_node_id | int) ) | ternary(keepalived_master_prio, keepalived_backup_prio) }}
+
+    interface {{ keepalived_iface }}
+
+    virtual_ipaddress {
+        {{ vips }} dev {{ keepalived_iface }} 
+    }
+    
+    advert_int 1
+
+    authentication {
+        auth_type PASS
+        auth_pass {{ keepalived_password }}
+    }
+
+    track_script {
+        track
+    }
+}
+{% endfor %}
diff --git a/roles/openshift_certificate_expiry b/roles/openshift_certificate_expiry
new file mode 120000
index 0000000..789348e
--- /dev/null
+++ b/roles/openshift_certificate_expiry
@@ -0,0 +1 @@
+../../openshift-ansible/roles/openshift_certificate_expiry
\ No newline at end of file
diff --git a/roles/openshift_resource/defaults/main.yml b/roles/openshift_resource/defaults/main.yml
new file mode 100644
index 0000000..ec44c4f
--- /dev/null
+++ b/roles/openshift_resource/defaults/main.yml
@@ -0,0 +1 @@
+template_path: "/mnt/provision/templates"
diff --git a/roles/openshift_resource/tasks/command.yml b/roles/openshift_resource/tasks/command.yml
new file mode 100644
index 0000000..c8e8d04
--- /dev/null
+++ b/roles/openshift_resource/tasks/command.yml
@@ -0,0 +1,17 @@
+- block:
+
+  - name: Lookup the specified resource
+    command: "oc get -n {{project}} {{resource}}"
+    register: result
+    failed_when: false
+    changed_when: (result | failed)
+
+  - name: Detroy existing resources
+    command: "oc delete -n {{project}} {{resource}}"
+    failed_when: false
+    when: (recreate|default(false)) 
+
+  - name: Executing command
+    command: "oc -n {{ project }} {{ command }}"
+    when: (recreate|default(false)) or (result | changed)
+  run_once: true
diff --git a/roles/openshift_resource/tasks/lookup.yml b/roles/openshift_resource/tasks/lookup.yml
new file mode 100644
index 0000000..07beb81
--- /dev/null
+++ b/roles/openshift_resource/tasks/lookup.yml
@@ -0,0 +1,6 @@
+---
+- name: Lookup the specified resource
+  command: "oc get -n {{project}} {{rkind}}/{{rname}}"
+  register: result
+  failed_when: false
+  changed_when: (result | failed)
diff --git a/roles/openshift_resource/tasks/main.yml b/roles/openshift_resource/tasks/main.yml
new file mode 100644
index 0000000..698efea
--- /dev/null
+++ b/roles/openshift_resource/tasks/main.yml
@@ -0,0 +1,22 @@
+---
+- block:
+  - name: "Read template {{ template }}"
+    command: cat '{{template_path}}/{{template}}'
+    changed_when: false
+    register: results
+
+  - name: Parse JSON templates
+    set_fact: tmpl="{{ results.stdout | from_json }}"
+    when: template.find(".json") != -1
+
+  - name: Parse YaML templates
+    set_fact: tmpl="{{ results.stdout | from_yaml }}"
+    when: template.find(".json") == -1
+
+  - include: template.yml
+    when: tmpl.kind == "Template"
+
+  - include: resource.yml
+    when: tmpl.kind != "Template"
+ 
+  run_once: true
diff --git a/roles/openshift_resource/tasks/resource.yml b/roles/openshift_resource/tasks/resource.yml
new file mode 100644
index 0000000..326abbb
--- /dev/null
+++ b/roles/openshift_resource/tasks/resource.yml
@@ -0,0 +1,20 @@
+---
+- block:
+  - name: Find out which resources we are going to configure
+    set_fact: rkind="{{ tmpl.kind }}" rname="{{ tmpl.metadata.name }}"
+
+  - name: Lookup the specified resource
+    command: "oc get -n {{project}} {{rkind}}/{{rname}}"
+    register: result
+    failed_when: false
+    changed_when: (result | failed)
+
+  - name: Detroy existing resources
+    command: "oc delete -n {{project}} {{rkind}}/{{rname}}"
+    failed_when: false
+    when: (recreate|default(false)) 
+
+  - name: Create resources defined in template
+    command: "oc create -n {{project}} -f '{{ template_path }}/{{ template }}' {{ create_args | default('') }}"
+    when: (recreate|default(false)) or (result | changed)
+  run_once: true
diff --git a/roles/openshift_resource/tasks/template.yml b/roles/openshift_resource/tasks/template.yml
new file mode 100644
index 0000000..c93dec5
--- /dev/null
+++ b/roles/openshift_resource/tasks/template.yml
@@ -0,0 +1,25 @@
+---
+- block:
+  - name: Find out which resources we are going to configure
+    set_fact: resources="{{ tmpl | json_query(query) }}"
+    vars:
+      query: "objects[*].{kind: kind, name: metadata.name}"
+      
+  - name: Lookup the specified resource
+    command: "oc get -n {{project}} {{item.kind}}/{{item.name}}"
+    register: results
+    failed_when: false
+    changed_when: (results | failed)
+    with_items: "{{ resources | default([]) }}"
+#    when: not (recreate|default(false)) 
+
+  - name: Detroy existing resources
+    command: "oc delete -n {{project}} {{resources[item|int].kind}}/{{resources[item|int].name}}"
+    failed_when: false
+    with_sequence: start=0 count="{{resources | default([]) | length}}"
+    when: ((recreate|default(false)) or (results | changed)) and (results.results[item|int].rc == 0)
+
+  - name: Create resources defined in template
+    shell: "oc process -f '{{ template_path }}/{{template}}' {{ template_args | default('') }} | oc create -n {{project}} -f - {{ create_args | default('') }}"
+    when: (recreate|default(false)) or (results | changed)
+  run_once: true
diff --git a/roles/openvpn/README b/roles/openvpn/README
new file mode 100644
index 0000000..9c64b0d
--- /dev/null
+++ b/roles/openvpn/README
@@ -0,0 +1,12 @@
+Dependencies:
+ - Runs on all OpenShift nodes
+
+Parameters:
+ - ands_openshift_lb: The load balancer which OpenVPN clients (non-master nodes) will be using to get into the network
+ 
+Facts:
+
+Actions:
+ - Sets up and configures OpenVPN servers & clients
+ - Opens firewall port
+
diff --git a/roles/openvpn/defaults/main.yml b/roles/openvpn/defaults/main.yml
new file mode 100644
index 0000000..513936a
--- /dev/null
+++ b/roles/openvpn/defaults/main.yml
@@ -0,0 +1,15 @@
+openvpn_port: 1194
+openvpn_dir: "/etc/openvpn"
+openvpn_config: "katrin"
+openvpn_config_file: "{{openvpn_dir}}/{{openvpn_config}}.conf"
+openvpn_keydir: "{{openvpn_dir}}/keys_{{openvpn_config}}"
+openvpn_ccdir: "{{openvpn_dir}}/ccd_{{openvpn_config}}"
+openvpn_service: "openvpn@{{openvpn_config}}.service"
+
+openvpn_lb: "{{ ands_openshift_lb }}"
+openvpn_servers: "masters"
+
+
+openvpn_server_id: "{{ (openvpn_servers in group_names) | ternary(groups[openvpn_servers].index((openvpn_servers in group_names) | ternary(inventory_hostname, groups[openvpn_servers][0])), -1) }}"
+openvpn_subnet_id: "{{ (katrin_openvpn_subnet_offset | int) + (openvpn_server_id | int) }}"
+openvpn_net: "{{ katrin_openvpn_network | ipsubnet(katrin_openvpn_subnet_bits, openvpn_subnet_id) }}"
diff --git a/roles/openvpn/files/ca/ca.crt b/roles/openvpn/files/ca/ca.crt
new file mode 100644
index 0000000..a37743b
--- /dev/null
+++ b/roles/openvpn/files/ca/ca.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDojCCAwugAwIBAgIJAMIDvuFyaww1MA0GCSqGSIb3DQEBBQUAMIGTMQswCQYD
+VQQGEwJOTzERMA8GA1UECBMIbWlkZ2FhcmQxETAPBgNVBAcTCG1pZGdhYXJkMREw
+DwYDVQQKEwhEYXJrU29mdDELMAkGA1UECxMCQ0ExFDASBgNVBAMTC0RhcmtTb2Z0
+IENBMSgwJgYJKoZIhvcNAQkBFhlkYXJrc29mdEBkc2lkZS5keW5kbnMub3JnMB4X
+DTA5MTAyMjAyMTgzOVoXDTE5MTAyMDAyMTgzOVowgZMxCzAJBgNVBAYTAk5PMREw
+DwYDVQQIEwhtaWRnYWFyZDERMA8GA1UEBxMIbWlkZ2FhcmQxETAPBgNVBAoTCERh
+cmtTb2Z0MQswCQYDVQQLEwJDQTEUMBIGA1UEAxMLRGFya1NvZnQgQ0ExKDAmBgkq
+hkiG9w0BCQEWGWRhcmtzb2Z0QGRzaWRlLmR5bmRucy5vcmcwgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAKDdlL90dk2ixdjG6Fm5hPjvqex2ZqIWk7l+hh9AJjhT
+oFYO5DKTb4JioKYA76KZ7uCgQzxhiDfma3agw7WGR8H+n28AzkxgqTEKWU4ysrxQ
+CtykKO3qs79iYHdcX1NRUAx22cpBnQjq7HJkXJWg5i+3RPSyk8Vl2QC8BzfiLH/D
+AgMBAAGjgfswgfgwHQYDVR0OBBYEFF+geRyB0QoAUHIRgtlq3sLwiZIIMIHIBgNV
+HSMEgcAwgb2AFF+geRyB0QoAUHIRgtlq3sLwiZIIoYGZpIGWMIGTMQswCQYDVQQG
+EwJOTzERMA8GA1UECBMIbWlkZ2FhcmQxETAPBgNVBAcTCG1pZGdhYXJkMREwDwYD
+VQQKEwhEYXJrU29mdDELMAkGA1UECxMCQ0ExFDASBgNVBAMTC0RhcmtTb2Z0IENB
+MSgwJgYJKoZIhvcNAQkBFhlkYXJrc29mdEBkc2lkZS5keW5kbnMub3JnggkAwgO+
+4XJrDDUwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQBey4alwOjkx6LG
+csNMOeofpSVr79muQALum9rdsZVBb93x9ygSJJ8ygCgolXDGF4uAGX31kbYtiANY
+rXef9gNWZLlMt2NPcJzV53hbXnFDYOSpFwUCFwvBAFkhIv4r1TjqxHSDiRdTda31
+0J1sESMtMZook/QKNx+46CQrjUGWzA==
+-----END CERTIFICATE-----
diff --git a/roles/openvpn/files/ca/ca.key b/roles/openvpn/files/ca/ca.key
new file mode 100644
index 0000000..f1df0c4
--- /dev/null
+++ b/roles/openvpn/files/ca/ca.key
@@ -0,0 +1,50 @@
+$ANSIBLE_VAULT;1.1;AES256
+66303364323939633166383539303539333162653336313339616434663839353333613063623262
+6564343033366235336230326161636661393638353336320a646631393037333838633831616532
+33653431326435636135643835613738333634636566373131323634633730343836353562633464
+3561313137613166660a613534623665646637386161633031393461343762663930633634616634
+33366532313537643035623239616137616561633366303132633430636234333534383563663236
+37346239353437333362663862626334383866623338653061326632646363383563356264336665
+65383962646131393165613838623661613865343165396135633761646137306436303266336634
+63356239373032303261353937393664663265396161366163356463633539393635643762366165
+66626230386662353361646663343464643534313332323565386230613463666238356261353730
+35663337626164333233323437393432336535383437653036643338363662313138363037323666
+61343061626262316461613838653834303764623733393131303035346336393333656233383666
+32666235356231663838386530306333383463616362303563363164343230383066303732666533
+38666435313437636132393836313630323839333237623130646366363633393939646261653763
+31313634313134623639303134653264646638666563366334366235653339303031313262346465
+39613934623461393438613363376566646432313931333731333939373966316464373137363431
+62626134303730613736316263616133323863616565326463656562656462316636613933393934
+65303761343762626232633634373233386334643334613337306562613938656136303837616637
+36643363386166373432306236333438663536303065363961613236366465356232303331376233
+32656637373235643839623539633761653164323230363763383737303566326239623530633962
+30616230363434363439383838633765633632663963323337393430643966616663383662643838
+32636465363130366232643933323066383965643032643537616531306239616662633932653866
+64363939343935323137356433373538613930653332303834386436386331313334333031376533
+39346130646439326531356239376531343730656232393331313633363765316439336565353331
+61316266356161366534636138363161643363666266616662306130353334323636363062393539
+65633565333037393264346265303461333734623233306563643732613432623330623232393637
+37323635323432343738376462646639313239313465383661353763306437373939353737356437
+30323037656231653534316665633431343137666665303831346139626539316561303739633339
+61666564643766343061623031666563663962626533313264323435343734343533656430636230
+34386634613739393433306361643634646266626462626333323936306234393430343331313366
+36363537373735613235383164343764643532316561616530306636636431386336323531306639
+66376435636339613963346463653162373137393531373031316635323561393239633661383035
+62343464336639643463633766396263623966613031633666336666333233316530363961336263
+62346334303363323437356535356665393065313665663566336661356334633637646561646135
+66656664303239336263313765623836393937303937343431666234343064636533363463396434
+35366333393738373063633834323038353065616364383234326531303666643139663431613437
+38623332333733356434636462643162396137623138663132336131306137623866346339623261
+32373139376636303636643766343864666263383239316437643533303463383866643830646563
+39353138623435633162663932313130303161656462316237353766313465646332326139653066
+33333138626665363766616630333166636530663163366163373432646463303838316134306463
+39383066396237313132636339656166353336386636373336366238623965643139646138376532
+39666235353662663439353263343834653734616337623938643137396134303835363662316263
+32636337303134383737343238643736373565366462313963353434623935616537613064613931
+33656337653866376630316134326431343139306661383162373163353966633565653336643738
+65653630373638616232663966613330303133366166383135366432353865636534633733343561
+64336631653833356639316135343437343631373831666265643763363262633966656337613535
+33613432323431646334633866626633343062656532666234316565396363346332306632303861
+37393739323835363462363362333966393732643565396532613734313938643737666365376236
+63343062303563393061613436623737303634393365306563363563616665336263326337636464
+3739
diff --git a/roles/openvpn/files/keys/dh1024.pem b/roles/openvpn/files/keys/dh1024.pem
new file mode 100644
index 0000000..39e2099
--- /dev/null
+++ b/roles/openvpn/files/keys/dh1024.pem
@@ -0,0 +1,18 @@
+$ANSIBLE_VAULT;1.1;AES256
+38326437373461343039653963383935386135613432376662636163636131656139393365616237
+6239376630626666303034353733383534666438636439640a663935663538366439363165613436
+35616530653061633137343034616633383833626438353131663264333565343635373239643864
+6233623239383637640a363637316237346561376264336534633563613462633464376238623165
+64653165666663663434316638633238313963383931326138396335613931306233343062346337
+65323438656461366132663266336637306435663064306636333631613135356635636136316665
+63343265616261653635303063346161613639636262363835623161626264636139326139366234
+61656336326434303038633532353334356165623438353637653162323462383962666536353938
+33633163343165353634393965663636306630623536343431633866633932666539656666626339
+38386131346365373237346230653962363639373337313130383263636130626133623838383936
+38326433666237393261616162306365336530383232343430613535356261323761626337386633
+64623637333763653462383635333035623164396130383066313238623633356665663937366563
+61333138393537653766346637656261373762636330386263333337633563356263326561313835
+30333931333966333235333732613931346538346237626664616439643737653032376363343662
+35643462646562393934316534386134663566633037613131326434323933373839653963663730
+61356166616566643665666330343039313630646438363239303039653537646566646461313530
+3566
diff --git a/roles/openvpn/files/openvpn_logrotate.conf b/roles/openvpn/files/openvpn_logrotate.conf
new file mode 100644
index 0000000..7dac758
--- /dev/null
+++ b/roles/openvpn/files/openvpn_logrotate.conf
@@ -0,0 +1,9 @@
+/var/log/openvpn.log {
+    rotate 4
+    weekly
+    missingok
+    notifempty
+    sharedscripts
+    copytruncate
+    delaycompress
+}
diff --git a/roles/openvpn/handlers/main.yml b/roles/openvpn/handlers/main.yml
new file mode 100644
index 0000000..befbcf5
--- /dev/null
+++ b/roles/openvpn/handlers/main.yml
@@ -0,0 +1,12 @@
+---
+- name: daemon-reload
+  command: systemctl daemon-reload
+
+- name: openvpn
+  service: name="{{openvpn_service}}" state=restarted
+
+- name: firewalld
+  shell: firewall-cmd --reload
+
+
+  
\ No newline at end of file
diff --git a/roles/openvpn/tasks/config.yml b/roles/openvpn/tasks/config.yml
new file mode 100644
index 0000000..67fdfa1
--- /dev/null
+++ b/roles/openvpn/tasks/config.yml
@@ -0,0 +1,28 @@
+- name: create openvpn configuration directory
+  file: path="{{openvpn_dir}}" state=directory
+
+- name: create openvpn key directory
+  file: path="{{openvpn_keydir}}" state=directory
+
+- name: create openvpn client config directory
+  file: path="{{openvpn_ccdir}}" state=directory
+  when: openvpn_servers in group_names
+
+- name: copy templates
+  template: src="{{item}}" dest="{{openvpn_ccdir}}/{{ item | basename | regex_replace('\.j2','') }}" owner=root group=root mode="0644"
+  with_fileglob: 
+    - ../templates/{{ openvpn_config }}/ccd/*
+  when: openvpn_servers in group_names
+
+- name: generate cluster templates
+  template: src="{{ openvpn_config }}/ccd.j2" dest="{{openvpn_ccdir}}/{{ hostvars[item]['ansible_hostname'] }}" owner=root group=root mode="0644"
+  vars:
+    id: "{{ hostvars[item]['ands_host_id'] }}"
+  with_inventory_hostnames:
+    - nodes:!{{openvpn_servers}}
+  when: openvpn_servers in group_names
+
+- name: create openvpn config file
+  template: src="{{ openvpn_config }}/{{ (openvpn_servers in group_names) | ternary('openvpn_server.j2', 'openvpn_client.j2') }}" dest="{{ openvpn_config_file }}" owner=root group=root
+  notify:
+    - openvpn
diff --git a/roles/openvpn/tasks/keys.yml b/roles/openvpn/tasks/keys.yml
new file mode 100644
index 0000000..dd9f4ec
--- /dev/null
+++ b/roles/openvpn/tasks/keys.yml
@@ -0,0 +1,13 @@
+- name: Copy CA private key
+  copy: src="ca/ca.key" dest="{{openvpn_keydir}}/" owner="root" group="root" mode="0400"
+
+- name: OpenSSL generate request
+  command: openssl req -subj '/CN={{ ansible_hostname }}' -new -keyout "node.key" -out "node.csr" -batch -nodes chdir="{{openvpn_keydir}}" creates="{{openvpn_keydir}}/node.csr"
+
+- name: Generate CA serial file
+  copy: content="01" dest="{{openvpn_keydir}}/ca.srl"
+
+- name: OpenSSL sign the request
+  command: openssl x509 -req -days 3650 -in "node.csr" -CA "ca.crt" -CAkey "ca.key" -out "node.crt" chdir="{{openvpn_keydir}}" creates="{{openvpn_keydir}}/node.crt"
+  notify:
+    - openvpn
diff --git a/roles/openvpn/tasks/main.yml b/roles/openvpn/tasks/main.yml
new file mode 100644
index 0000000..df49976
--- /dev/null
+++ b/roles/openvpn/tasks/main.yml
@@ -0,0 +1,62 @@
+---
+- name: Ensure OpenVPN and OpenSSL are installed
+  yum: name={{item}} state=present
+  with_items:
+    - openvpn
+    - openssl
+
+- name: copy openvpn logrotate config file
+  copy: src="openvpn_logrotate.conf" dest="/etc/logrotate.d/openvpn.conf" owner="root" group="root" mode="0400"
+
+- name: Copy CA certificate and the keys
+  copy: src="{{ item }}" dest="{{openvpn_keydir}}/" owner="root" group="root" mode="0400"
+  with_fileglob: 
+    - ca/ca.crt
+    - keys/*
+
+- name: Check if OpenSSL certificate is already generated
+  stat: path="{{ openvpn_keydir }}/node.crt" 
+  register: result
+
+- name: setup openvpn keys
+  include: keys.yml
+  when: result.stat.exists == False 
+
+- name: Ensure CA key is removed
+  file: path="{{openvpn_keydir}}/ca.key" state=absent
+
+- name: setup openvpn configuration 
+  include: config.yml
+
+- name: Ensure OpenVPN service is enabled
+  service: name="{{openvpn_service}}" enabled=yes
+
+- name: Check if we already reconfigured SystemD Unit
+  stat: path={{ item }}
+  register: result
+  vars:
+     item: "/etc/systemd/system/{{openvpn_service}}"
+
+- name: Copy SystemD Unit
+  copy: src="/usr/lib/systemd/system/openvpn@.service" dest="{{ item }}" remote_src=true
+  vars:
+    item: "/etc/systemd/system/{{openvpn_service}}"
+  when: result.stat.exists == False 
+
+- name: Re-configure systemd to start OpenVPN after origin-node
+  lineinfile: dest="/etc/systemd/system/{{openvpn_service}}" regexp="^After=" line="After=network.target origin-node.service" state=present
+  notify: daemon-reload
+
+- name: Ensure OpenVPN service is running
+  service: name="{{openvpn_service}}" state=started
+
+- name: Ensure firewalld is running
+  service: name=firewalld state=started enabled=yes
+  when: openvpn_servers in group_names
+
+- name: Configure firewalld
+  firewalld: port="{{openvpn_port}}/tcp"  state="enabled" permanent="true" immediate="true"
+  notify:
+    - firewalld
+  when: openvpn_servers in group_names
+
diff --git a/roles/openvpn/templates/katrin/ccd.j2 b/roles/openvpn/templates/katrin/ccd.j2
new file mode 100644
index 0000000..d278648
--- /dev/null
+++ b/roles/openvpn/templates/katrin/ccd.j2
@@ -0,0 +1,2 @@
+ifconfig-push {{ openvpn_net | ipaddr(id | int) | ipaddr('address') }} {{ openvpn_net | ipaddr('netmask') }}
+push "route 192.168.110.0 255.255.255.0 {{ openvpn_net | ipaddr(181) | ipaddr('address') }}"
diff --git a/roles/openvpn/templates/katrin/ccd/ikkatrinadei.ka.fzk.de.j2 b/roles/openvpn/templates/katrin/ccd/ikkatrinadei.ka.fzk.de.j2
new file mode 100644
index 0000000..e1a786d
--- /dev/null
+++ b/roles/openvpn/templates/katrin/ccd/ikkatrinadei.ka.fzk.de.j2
@@ -0,0 +1,3 @@
+#ifconfig-push clientIP serverIP
+ifconfig-push {{ openvpn_net | ipaddr(181) | ipaddr('address') }} {{ openvpn_net | ipaddr('netmask') }}
+iroute 192.168.110.0 255.255.255.0
diff --git a/roles/openvpn/templates/katrin/ccd/ipechilinga4.ka.fzk.de.j2 b/roles/openvpn/templates/katrin/ccd/ipechilinga4.ka.fzk.de.j2
new file mode 100644
index 0000000..3673a0b
--- /dev/null
+++ b/roles/openvpn/templates/katrin/ccd/ipechilinga4.ka.fzk.de.j2
@@ -0,0 +1 @@
+ifconfig-push {{ openvpn_net | ipaddr(90) | ipaddr('address') }} {{ openvpn_net | ipaddr('netmask') }}
diff --git a/roles/openvpn/templates/katrin/openvpn_client.j2 b/roles/openvpn/templates/katrin/openvpn_client.j2
new file mode 100644
index 0000000..a09322e
--- /dev/null
+++ b/roles/openvpn/templates/katrin/openvpn_client.j2
@@ -0,0 +1,24 @@
+client
+remote {{openvpn_lb}} {{openvpn_port}}
+proto tcp
+dev tun
+
+topology subnet
+
+ca {{openvpn_keydir}}/ca.crt
+cert {{openvpn_keydir}}/node.crt
+key {{openvpn_keydir}}/node.key
+dh {{openvpn_keydir}}/dh1024.pem
+
+resolv-retry infinite
+keepalive 5 15
+comp-lzo
+#user nobody
+#group nobody
+persist-key
+persist-tun
+
+log /var/log/openvpn_{{openvpn_config}}.log
+status /var/log/openvpn_{{openvpn_config}}_status.log
+verb 3
+
diff --git a/roles/openvpn/templates/katrin/openvpn_server.j2 b/roles/openvpn/templates/katrin/openvpn_server.j2
new file mode 100644
index 0000000..22c200d
--- /dev/null
+++ b/roles/openvpn/templates/katrin/openvpn_server.j2
@@ -0,0 +1,26 @@
+port {{openvpn_port}}
+dev tun
+
+topology subnet
+client-to-client
+server {{ openvpn_net | ipaddr('network') }} {{ openvpn_net | ipaddr('netmask') }}
+proto tcp
+
+ca {{openvpn_keydir}}/ca.crt
+cert {{openvpn_keydir}}/node.crt
+key {{openvpn_keydir}}/node.key
+dh {{openvpn_keydir}}/dh1024.pem
+
+keepalive 10 120
+comp-lzo
+#user nobody
+#group nobody
+persist-key
+persist-tun
+client-config-dir {{openvpn_ccdir}}
+log /var/log/openvpn_{{openvpn_config}}.log
+status /var/log/openvpn_{{openvpn_config}}_status.log
+verb 3
+
+route 192.168.110.0 255.255.255.0 {{ openvpn_net | ipaddr(181) | ipaddr('address') }}
+