c12s-kubespray/contrib/vault/roles/vault/tasks/bootstrap/sync_vault_certs.yml

---
- include_tasks: ../shared/sync_file.yml
  vars:
    sync_file: "ca.pem"
    sync_file_dir: "{{ vault_cert_dir }}"
    sync_file_hosts: "{{ groups.vault }}"
    sync_file_owner: vault
    sync_file_group: root
    sync_file_is_cert: true

- name: bootstrap/sync_vault_certs | Set facts for vault sync_file results
  set_fact:
    vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"

- name: bootstrap/sync_vault_certs | Unset sync_file_results after ca.pem sync
  set_fact:
    sync_file_results: []

# FIXME: Distribute ca.pem alone in a better way
- include_tasks: ../shared/sync_file.yml
  vars:
    sync_file: "ca.pem"
    sync_file_dir: "{{ vault_cert_dir }}"
    sync_file_hosts: "{{ groups['kube_control_plane'] }}"
    sync_file_owner: vault
    sync_file_group: root
    sync_file_is_cert: false

- name: bootstrap/sync_vault_certs | Set facts for vault sync_file results
  set_fact:
    vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"

- name: bootstrap/sync_vault_certs | Unset sync_file_results after ca.pem sync
  set_fact:
    sync_file_results: []


- include_tasks: ../shared/sync_file.yml
  vars:
    sync_file: "api.pem"
    sync_file_dir: "{{ vault_cert_dir }}"
    sync_file_hosts: "{{ groups.vault }}"
    sync_file_owner: vault
    sync_file_group: root
    sync_file_is_cert: true

- name: bootstrap/sync_vault_certs | Set fact if Vault's API cert is needed
  set_fact:
    vault_api_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"

- name: bootstrap/sync_vault_certs | Unset sync_file_results after api.pem sync
  set_fact:
    sync_file_results: []
Adding the Vault role 2017-01-13 20:31:10 +00:00			`---`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: ../shared/sync_file.yml`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`vars:`
			`sync_file: "ca.pem"`
			`sync_file_dir: "{{ vault_cert_dir }}"`
			`sync_file_hosts: "{{ groups.vault }}"`
Fix vault file owner issues and k8s apiserver cert creation (#2985) apiserver cert should be created only once 2018-07-11 11:58:02 +00:00			`sync_file_owner: vault`
			`sync_file_group: root`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`sync_file_is_cert: true`

Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`- name: bootstrap/sync_vault_certs \| Set facts for vault sync_file results`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`set_fact:`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"`
Adding the Vault role 2017-01-13 20:31:10 +00:00
			`- name: bootstrap/sync_vault_certs \| Unset sync_file_results after ca.pem sync`
			`set_fact:`
			`sync_file_results: []`

refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`# FIXME: Distribute ca.pem alone in a better way`
			`- include_tasks: ../shared/sync_file.yml`
			`vars:`
			`sync_file: "ca.pem"`
			`sync_file_dir: "{{ vault_cert_dir }}"`
Replace kube-master with kube_control_plane (#7256) This replaces kube-master with kube_control_plane because of [1]: The Kubernetes project is moving away from wording that is considered offensive. A new working group WG Naming was created to track this work, and the word "master" was declared as offensive. A proposal was formalized for replacing the word "master" with "control plane". This means it should be removed from source code, documentation, and user-facing configuration from Kubernetes and its sub-projects. NOTE: The reason why this changes it to kube_control_plane not kube-control-plane is for valid group names on ansible. [1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation 2021-03-24 00:26:05 +00:00			`sync_file_hosts: "{{ groups['kube_control_plane'] }}"`
Fix vault file owner issues and k8s apiserver cert creation (#2985) apiserver cert should be created only once 2018-07-11 11:58:02 +00:00			`sync_file_owner: vault`
			`sync_file_group: root`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`sync_file_is_cert: false`

			`- name: bootstrap/sync_vault_certs \| Set facts for vault sync_file results`
			`set_fact:`
			`vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"`

			`- name: bootstrap/sync_vault_certs \| Unset sync_file_results after ca.pem sync`
			`set_fact:`
			`sync_file_results: []`


Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: ../shared/sync_file.yml`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`vars:`
			`sync_file: "api.pem"`
			`sync_file_dir: "{{ vault_cert_dir }}"`
			`sync_file_hosts: "{{ groups.vault }}"`
Fix vault file owner issues and k8s apiserver cert creation (#2985) apiserver cert should be created only once 2018-07-11 11:58:02 +00:00			`sync_file_owner: vault`
			`sync_file_group: root`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`sync_file_is_cert: true`

			`- name: bootstrap/sync_vault_certs \| Set fact if Vault's API cert is needed`
			`set_fact:`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`vault_api_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"`
Adding the Vault role 2017-01-13 20:31:10 +00:00
			`- name: bootstrap/sync_vault_certs \| Unset sync_file_results after api.pem sync`
			`set_fact:`
			`sync_file_results: []`