C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/etcd/tasks/main.yml

63 lines
1.7 KiB
YAML
Raw Normal View History

Initial commit
2015-10-03 20:19:50 +00:00
---
Add etcd TLS support
2016-11-09 10:44:41 +00:00
- include: check_certs.yml
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
when: cert_management == "script"
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 07:43:04 +00:00
tags:
- etcd-secrets
- facts
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
Skip vault cert task evaluation completely when using script cert generation
2017-04-12 10:37:50 +00:00
- include: "gen_certs_{{ cert_management }}.yml"
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 07:43:04 +00:00
tags:
- etcd-secrets
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
- include: upd_ca_trust.yml
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 07:43:04 +00:00
tags:
- etcd-secrets
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 06:02:23 +00:00
- name: "Gen_certs | Get etcd certificate serials"
shell: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial | cut -d= -f2"
Fix setting etcd client cert serial (#1775)
2017-10-11 18:47:11 +00:00
register: "etcd_client_cert_serial_result"
when: inventory_hostname in groups['k8s-cluster']|union(groups['etcd'])|union(groups['calico-rr']|default([]))|unique|sort
- name: Set etcd_client_cert_serial
set_fact:
etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout }}"
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 06:02:23 +00:00
when: inventory_hostname in groups['k8s-cluster']|union(groups['etcd'])|union(groups['calico-rr']|default([]))|unique|sort
Allowing etcd to run via rkt
2016-12-13 17:20:22 +00:00
- include: "install_{{ etcd_deployment_type }}.yml"
Remove etcd-proxy from all nodes and use etcd multiaccess
2016-11-09 10:31:12 +00:00
when: is_etcd_master
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 07:43:04 +00:00
tags:
- upgrade
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
Scale-up functionality for etcd cluster * Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`, because parameter `new` makes sense only on cluster assembly stage. * If cluster exists and current node is not a part of the cluster, add it with command `etcdctl add member name url`. Closes kubespray/kargo/#270
2016-05-27 09:55:52 +00:00
- include: set_cluster_health.yml
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
etcd directly in host fix etcd configuration for nodes fix wrong calico checksums using a var name etcd_bin_dir fix etcd handlers for sysvinit using a var name etcd_bin_dir sysvinit script review etcd configuration
2016-01-19 14:23:19 +00:00
- include: configure.yml
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
Scale-up functionality for etcd cluster * Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`, because parameter `new` makes sense only on cluster assembly stage. * If cluster exists and current node is not a part of the cluster, add it with command `etcdctl add member name url`. Closes kubespray/kargo/#270
2016-05-27 09:55:52 +00:00
- include: refresh_config.yml
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
use rsync instead of command
2016-01-23 17:26:07 +00:00
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
- name: Restart etcd if certs changed
Set default etcd deployment to docker Improved docker reload command to wait for etcd to be up before proceeding. Switched reload to run restart because it can't reload if it is not guaranteed to be in running state.
2016-07-19 13:45:37 +00:00
command: /bin/true
notify: restart etcd
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_secret_changed|default(false)
Set default etcd deployment to docker Improved docker reload command to wait for etcd to be up before proceeding. Switched reload to run restart because it can't reload if it is not guaranteed to be in running state.
2016-07-19 13:45:37 +00:00
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-01-13 11:43:43 +00:00
# reload-systemd
Set default etcd deployment to docker Improved docker reload command to wait for etcd to be up before proceeding. Switched reload to run restart because it can't reload if it is not guaranteed to be in running state.
2016-07-19 13:45:37 +00:00
- meta: flush_handlers
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-01-13 11:43:43 +00:00
- name: Ensure etcd is running
service:
name: etcd
state: started
enabled: yes
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
Flush handlers before etcd restart systemctl daemon-reload should be run before when task modifies/creates union for etcd. Otherwise etcd won't be able to start Closes #892 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-01-13 11:43:43 +00:00
Scale-up functionality for etcd cluster * Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`, because parameter `new` makes sense only on cluster assembly stage. * If cluster exists and current node is not a part of the cluster, add it with command `etcdctl add member name url`. Closes kubespray/kargo/#270
2016-05-27 09:55:52 +00:00
# After etcd cluster is assembled, make sure that
# initial state of the cluster is in `existing`
# state insted of `new`.
- include: set_cluster_health.yml
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
Scale-up functionality for etcd cluster * Set ETCD_INITIAL_CLUSTER_STATE from `new` to `existing`, because parameter `new` makes sense only on cluster assembly stage. * If cluster exists and current node is not a part of the cluster, add it with command `etcdctl add member name url`. Closes kubespray/kargo/#270
2016-05-27 09:55:52 +00:00
- include: refresh_config.yml
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-03 20:30:37 +00:00
when: is_etcd_master and etcd_cluster_setup
Reference in a new issue Copy permalink