c12s-kubespray/roles/kubernetes/secrets/templates/openssl.conf.j2

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.{{ dns_domain }}
DNS.5 = localhost
{% for host in groups['kube-master'] %}
DNS.{{ 5 + loop.index }} = {{ host }}
{% endfor %}
{% if loadbalancer_apiserver is defined  and apiserver_loadbalancer_domain_name is defined %}
{% set idx =  groups['kube-master'] | length | int + 5 + 1 %}
DNS.{{ idx | string }} = {{ apiserver_loadbalancer_domain_name }}
{% endif %}
{% for host in groups['kube-master'] %}
IP.{{ 2 * loop.index - 1 }} = {{ hostvars[host]['access_ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
IP.{{ 2 * loop.index }} = {{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
{% endfor %}
{% set idx =  groups['kube-master'] | length | int * 2 + 1 %}
IP.{{ idx }} = {{ kube_apiserver_ip }}
IP.{{ idx + 1 }} = 127.0.0.1
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`[req]`
			`req_extensions = v3_req`
			`distinguished_name = req_distinguished_name`
			`[req_distinguished_name]`
			`[ v3_req ]`
			`basicConstraints = CA:FALSE`
			`keyUsage = nonRepudiation, digitalSignature, keyEncipherment`
			`subjectAltName = @alt_names`
			`[alt_names]`
			`DNS.1 = kubernetes`
			`DNS.2 = kubernetes.default`
Add kubernetes.default.svc in certs dns 2016-04-01 10:40:01 +00:00			`DNS.3 = kubernetes.default.svc`
			`DNS.4 = kubernetes.default.svc.{{ dns_domain }}`
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00			`DNS.5 = localhost`
add kube-masters to SSL certificate 2016-09-26 17:14:19 +00:00			`{% for host in groups['kube-master'] %}`
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00			`DNS.{{ 5 + loop.index }} = {{ host }}`
add kube-masters to SSL certificate 2016-09-26 17:14:19 +00:00			`{% endfor %}`
manage undefined vars for loadbalancing 2015-12-15 15:51:55 +00:00			`{% if loadbalancer_apiserver is defined and apiserver_loadbalancer_domain_name is defined %}`
fix load balancer DNS name index evaluation in openssl.conf Looks like OpenSSL still properly handles it, even with duplicated "DNS.X" items. 2017-02-15 21:13:52 +00:00			`{% set idx = groups['kube-master'] \| length \| int + 5 + 1 %}`
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00			`DNS.{{ idx \| string }} = {{ apiserver_loadbalancer_domain_name }}`
manage undefined vars for loadbalancing 2015-12-15 15:51:55 +00:00			`{% endif %}`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`{% for host in groups['kube-master'] %}`
Add variables and defaults for multiple types of ip addresses. Each node can have 3 IPs. 1. ansible_default_ip4 - whatever ansible things is the first IPv4 address usually with the default gw. 2. ip - An address to use on the local node to bind listeners and do local communication. For example, Vagrant boxes have a first address that is the NAT bridge and is common for all nodes. The second address/interface should be used. 3. access_ip - An address to use for node-to-node access. This is assumed to be used by other nodes to access the node and may not be actually assigned on the node. For example, AWS public ip that is not assigned to node. This updates the places addresses are used to use either ip or access_ip and walk up the list to find an address. 2016-01-26 20:41:42 +00:00			`IP.{{ 2 * loop.index - 1 }} = {{ hostvars[host]['access_ip'] \| default(hostvars[host]['ansible_default_ipv4']['address']) }}`
			`IP.{{ 2 * loop.index }} = {{ hostvars[host]['ip'] \| default(hostvars[host]['ansible_default_ipv4']['address']) }}`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`{% endfor %}`
Add variables and defaults for multiple types of ip addresses. Each node can have 3 IPs. 1. ansible_default_ip4 - whatever ansible things is the first IPv4 address usually with the default gw. 2. ip - An address to use on the local node to bind listeners and do local communication. For example, Vagrant boxes have a first address that is the NAT bridge and is common for all nodes. The second address/interface should be used. 3. access_ip - An address to use for node-to-node access. This is assumed to be used by other nodes to access the node and may not be actually assigned on the node. For example, AWS public ip that is not assigned to node. This updates the places addresses are used to use either ip or access_ip and walk up the list to find an address. 2016-01-26 20:41:42 +00:00			`{% set idx = groups['kube-master'] \| length \| int * 2 + 1 %}`
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00			`IP.{{ idx }} = {{ kube_apiserver_ip }}`
			`IP.{{ idx + 1 }} = 127.0.0.1`