c12s-kubespray/roles/etcd/tasks/main.yml

---
- include_tasks: check_certs.yml
  when: cert_management == "script"
  tags:
    - etcd-secrets
    - facts

- include_tasks: "gen_certs_script.yml"
  when:
    - cert_management |d('script') == "script"
  tags:
    - etcd-secrets

- include_tasks: upd_ca_trust.yml
  tags:
    - etcd-secrets

- name: "Gen_certs | Get etcd certificate serials"
  command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"
  register: "etcd_client_cert_serial_result"
  changed_when: false
  when:
    - inventory_hostname in groups['k8s-cluster']|union(groups['calico-rr']|default([]))|unique|sort
  tags:
    - master
    - network

- name: Set etcd_client_cert_serial
  set_fact:
    etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
  when:
    - inventory_hostname in groups['k8s-cluster']|union(groups['calico-rr']|default([]))|unique|sort
  tags:
    - master
    - network

- include_tasks: "install_{{ etcd_deployment_type }}.yml"
  when: is_etcd_master
  tags:
    - upgrade

- include_tasks: configure.yml
  when: is_etcd_master

- include_tasks: refresh_config.yml
  when: is_etcd_master

- name: Restart etcd if certs changed
  service:
    name: etcd
    state: restarted
    enabled: yes
  when: is_etcd_master and etcd_cluster_setup and etcd_secret_changed|default(false)

- name: Restart etcd-events if certs changed
  service:
    name: etcd-events
    state: restarted
    enabled: yes
  when: is_etcd_master and etcd_events_cluster_setup and etcd_secret_changed|default(false)

# After etcd cluster is assembled, make sure that
# initial state of the cluster is in `existing`
# state instead of `new`.
- include_tasks: refresh_config.yml
  when: is_etcd_master

- name: Install etcdctl binary from etcd role
  include_tasks: install_host.yml
  vars:
    etcd_cluster_setup: true
  when:
    - etcd_kubeadm_enabled
Initial commit 2015-10-03 20:19:50 +00:00			`---`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: check_certs.yml`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`when: cert_management == "script"`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 07:43:04 +00:00			`tags:`
			`- etcd-secrets`
			`- facts`
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy 2017-02-17 21:22:34 +00:00
Remove Vault (#3684) * Remove Vault * Remove reference to 'kargo' in the doc * change check order 2018-11-10 16:51:24 +00:00			`- include_tasks: "gen_certs_script.yml"`
			`when:`
			`- cert_management \|d('script') == "script"`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 07:43:04 +00:00			`tags:`
			`- etcd-secrets`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: upd_ca_trust.yml`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 07:43:04 +00:00			`tags:`
			`- etcd-secrets`
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks. 2017-08-30 13:03:22 +00:00
Adding in certificate serial numbers to manifests (#1392) 2017-09-01 06:02:23 +00:00			`- name: "Gen_certs \| Get etcd certificate serials"`
Replace shell with command in order to allow the task to fail when openssl x509 does return zero (#3516) 2018-10-16 06:48:12 +00:00			`command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"`
Fix setting etcd client cert serial (#1775) 2017-10-11 18:47:11 +00:00			`register: "etcd_client_cert_serial_result"`
Idempotency fixes (#1838) 2017-10-25 20:19:40 +00:00			`changed_when: false`
Calculate etcd client cert serial for appropriate groups (#3605) Standalone etcd nodes do not generate node-$hostname certs and do not need this serial calculated. 2018-11-01 12:50:26 +00:00			`when:`
			`- inventory_hostname in groups['k8s-cluster']\|union(groups['calico-rr']\|default([]))\|unique\|sort`
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node 2018-07-06 06:12:13 +00:00			`tags:`
			`- master`
			`- network`
Fix setting etcd client cert serial (#1775) 2017-10-11 18:47:11 +00:00
			`- name: Set etcd_client_cert_serial`
			`set_fact:`
Replace shell with command in order to allow the task to fail when openssl x509 does return zero (#3516) 2018-10-16 06:48:12 +00:00			`etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"`
Calculate etcd client cert serial for appropriate groups (#3605) Standalone etcd nodes do not generate node-$hostname certs and do not need this serial calculated. 2018-11-01 12:50:26 +00:00			`when:`
			`- inventory_hostname in groups['k8s-cluster']\|union(groups['calico-rr']\|default([]))\|unique\|sort`
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node 2018-07-06 06:12:13 +00:00			`tags:`
			`- master`
			`- network`
Adding in certificate serial numbers to manifests (#1392) 2017-09-01 06:02:23 +00:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: "install_{{ etcd_deployment_type }}.yml"`
Remove etcd-proxy from all nodes and use etcd multiaccess 2016-11-09 10:31:12 +00:00			`when: is_etcd_master`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 07:43:04 +00:00			`tags:`
			`- upgrade`
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy 2017-02-17 21:22:34 +00:00
Fix import task. Has to be include task to evalutate etcd_cluster_setup variable at run time 2018-03-30 22:06:32 +00:00			`- include_tasks: configure.yml`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`when: is_etcd_master`
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy 2017-02-17 21:22:34 +00:00
Fix import task. Has to be include task to evalutate etcd_cluster_setup variable at run time 2018-03-30 22:06:32 +00:00			`- include_tasks: refresh_config.yml`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`when: is_etcd_master`
use rsync instead of command 2016-01-23 17:26:07 +00:00
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role. 2017-03-03 20:30:37 +00:00			`- name: Restart etcd if certs changed`
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com> 2017-01-13 11:43:43 +00:00			`service:`
			`name: etcd`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`state: restarted`
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com> 2017-01-13 11:43:43 +00:00			`enabled: yes`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`when: is_etcd_master and etcd_cluster_setup and etcd_secret_changed\|default(false)`
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com> 2017-01-13 11:43:43 +00:00
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`- name: Restart etcd-events if certs changed`
Add etcd-events cluster for kube-apiserver (#2385) Add etcd-events cluster for kube-apiserver 2018-03-01 08:39:14 +00:00			`service:`
			`name: etcd-events`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`state: restarted`
Add etcd-events cluster for kube-apiserver (#2385) Add etcd-events cluster for kube-apiserver 2018-03-01 08:39:14 +00:00			`enabled: yes`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`when: is_etcd_master and etcd_events_cluster_setup and etcd_secret_changed\|default(false)`
Add etcd-events cluster for kube-apiserver (#2385) Add etcd-events cluster for kube-apiserver 2018-03-01 08:39:14 +00:00
Scale-up functionality for etcd cluster * Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`, because parameter `new` makes sense only on cluster assembly stage. * If cluster exists and current node is not a part of the cluster, add it with command `etcdctl add member name url`. Closes kubespray/kargo/#270 2016-05-27 09:55:52 +00:00			`# After etcd cluster is assembled, make sure that`
			# initial state of the cluster is in `existing`
Fix some typos (#3690) Signed-off-by: mooncake <xcoder@tenxcloud.com> 2018-11-10 14:53:58 +00:00			# state instead of `new`.
Fix import task. Has to be include task to evalutate etcd_cluster_setup variable at run time 2018-03-30 22:06:32 +00:00			`- include_tasks: refresh_config.yml`
Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes 2018-04-01 16:58:08 +00:00			`when: is_etcd_master`
Enable kubeadm etcd mode (#4818) * Enable kubeadm etcd mode Uses cert commands from kubeadm experimental control plane to enable non-master nodes to obtain etcd certs. Related story: PROD-29434 Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178 * Add validation checks and exclude calico kdd mode Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c * Move etcd mode test to ubuntu flannel HA job Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732 * rename etcd_mode to etcd_kubeadm_enabled Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172 2019-06-20 18:12:51 +00:00
			`- name: Install etcdctl binary from etcd role`
fix wrong path in include install_host.yml in etcd role (#5256) 2019-10-14 01:16:34 +00:00			`include_tasks: install_host.yml`
Enable kubeadm etcd mode (#4818) * Enable kubeadm etcd mode Uses cert commands from kubeadm experimental control plane to enable non-master nodes to obtain etcd certs. Related story: PROD-29434 Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178 * Add validation checks and exclude calico kdd mode Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c * Move etcd mode test to ubuntu flannel HA job Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732 * rename etcd_mode to etcd_kubeadm_enabled Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172 2019-06-20 18:12:51 +00:00			`vars:`
			`etcd_cluster_setup: true`
			`when:`
			`- etcd_kubeadm_enabled`