c12s-kubespray/roles/kubernetes/secrets/tasks/gen_certs.yml

52 lines
1.2 KiB
YAML
Raw Normal View History

---
- name: certs | write openssl config
sudo: False
local_action: template src="openssl.conf.j2" dest="{{ role_path }}/files/openssl.conf"
run_once: yes
- name: certs | run cert generation script
sudo: False
local_action: shell
{{ role_path }}/scripts/make-ssl.sh
-f {{ role_path }}/files/openssl.conf
-d {{ role_path }}/files/certs/
run_once: yes
- name: certs | Copy certs on nodes
copy:
src: "certs/{{ item }}"
dest: "{{ kube_cert_dir }}"
with_items:
- ca.pem
- node.pem
- node-key.pem
when: inventory_hostname in "{{ groups['k8s-cluster'] }}"
- name: certs | Copy certs on master
copy:
src: "certs/{{ item }}"
dest: "{{ kube_cert_dir }}"
with_items:
- ca-key.pem
- admin.pem
- admin-key.pem
- apiserver-key.pem
- apiserver.pem
when: inventory_hostname in "{{ groups['kube-master'] }}"
- name: certs | check certificate permissions
file:
path={{ kube_cert_dir }}
group={{ kube_cert_group }}
owner=kube
recurse=yes
- shell: ls {{ kube_cert_dir}}/*key.pem
register: keyfiles
- name: certs | set permissions on keys
file:
path: "{{ item }}"
mode: 0600
with_items: keyfiles.stdout_lines