C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/vault/defaults/main.yml

102 lines
3.3 KiB
YAML
Raw Normal View History

Adding the Vault role
2017-01-13 20:31:10 +00:00
---
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_adduser_vars:
comment: "Hashicorp Vault User"
createhome: no
name: vault
shell: /sbin/nologin
system: yes
vault_base_dir: /etc/vault
# https://releases.hashicorp.com/vault/0.6.4/vault_0.6.4_SHA256SUMS
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
vault_version: 0.6.4
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_binary_checksum: 04d87dd553aed59f3fe316222217a8d8777f40115a115dac4d88fac1611c51a6
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_bootstrap: false
vault_ca_options:
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
common_name: vault
Adding the Vault role
2017-01-13 20:31:10 +00:00
format: pem
ttl: 87600h
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_cert_dir: "{{ vault_base_dir }}/ssl"
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_client_headers:
Accept: "application/json"
Content-Type: "application/json"
vault_config:
backend:
etcd:
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
address: "{{ vault_etcd_url }}"
Adding the Vault role
2017-01-13 20:31:10 +00:00
ha_enabled: "true"
redirect_addr: "https://{{ ansible_default_ipv4.address }}:{{ vault_port }}"
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
tls_ca_file: "{{ vault_etcd_cert_dir }}/ca.pem"
Adding the Vault role
2017-01-13 20:31:10 +00:00
cluster_name: "kubernetes-vault"
default_lease_ttl: "{{ vault_default_lease_ttl }}"
listener:
tcp:
address: "0.0.0.0:{{ vault_port }}"
tls_cert_file: "{{ vault_cert_dir }}/api.pem"
tls_key_file: "{{ vault_cert_dir }}/api-key.pem"
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
max_lease_ttl: "{{ vault_max_lease_ttl }}"
vault_config_dir: "{{ vault_base_dir }}/config"
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_container_name: kube-hashicorp-vault
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
# This variable is meant to match the GID of vault inside Hashicorp's official Vault Container
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_default_lease_ttl: 720h
vault_default_role_permissions:
allow_any_name: true
vault_deployment_type: docker
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_download_url: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip"
vault_download_vars:
container: "{{ vault_deployment_type != 'host' }}"
dest: "vault/vault_{{ vault_version }}_linux_amd64.zip"
enabled: true
mode: "0755"
owner: "vault"
repo: "{{ vault_image_repo }}"
sha256: "{{ vault_binary_checksum if vault_deployment_type == 'host' else vault_digest_checksum|d(none) }}"
source_url: "{{ vault_download_url }}"
tag: "{{ vault_image_tag }}"
unarchive: true
url: "{{ vault_download_url }}"
version: "{{ vault_version }}"
Fixed deploy cluster with vault cert manager (#1548) * Added custom ips to etcd vault distributed certificates * Added custom ips to kube-master vault distributed certificates * Added comment about issue_cert_copy_ca var in vault/issue_cert role file * Generate kube-proxy, controller-manager and scheduler certificates by vault * Revert "Disable vault from CI (#1546)" This reverts commit 781f31d2b81b98c8aa6cfda0897d5bd4d966107c. * Fixed upgrade cluster with vault cert manager * Remove vault dir in reset playbook
2017-08-20 10:53:58 +00:00
vault_etcd_url: "https://{{ hostvars[groups.etcd[0]]['ip']|d(hostvars[groups.etcd[0]]['ansible_default_ipv4']['address']) }}:2379"
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_image_repo: "vault"
vault_image_tag: "{{ vault_version }}"
vault_log_dir: "/var/log/vault"
vault_max_lease_ttl: 87600h
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_needs_gen: false
vault_port: 8200
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_roles_dir: "{{ vault_base_dir }}/roles"
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_secret_shares: 1
vault_secret_threshold: 1
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_secrets_dir: "{{ vault_base_dir }}/secrets"
Adding the Vault role
2017-01-13 20:31:10 +00:00
vault_temp_config:
backend:
file:
path: /vault/file
Adding ability to override max ttl (#1559) Prior this would fail because we didnt set max ttl for vault temp
2017-08-23 06:54:01 +00:00
default_lease_ttl: "{{ vault_default_lease_ttl }}"
Adding the Vault role
2017-01-13 20:31:10 +00:00
listener:
tcp:
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
address: "0.0.0.0:{{ vault_port }}"
Adding the Vault role
2017-01-13 20:31:10 +00:00
tls_disable: "true"
Adding ability to override max ttl (#1559) Prior this would fail because we didnt set max ttl for vault temp
2017-08-23 06:54:01 +00:00
max_lease_ttl: "{{ vault_max_lease_ttl }}"
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
vault_temp_container_name: vault-temp
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 13:03:22 +00:00
# etcd pki mount options
vault_etcd_cert_dir: /etc/ssl/etcd/ssl
vault_etcd_mount_path: etcd
vault_etcd_default_lease_ttl: 720h
vault_etcd_max_lease_ttl: 87600h
vault_etcd_role:
name: etcd
group: etcd
policy_rules: default
role_options: default
mount_path: "{{ vault_etcd_mount_path }}"
# kubernetes pki mount options
vault_kube_cert_dir: "{{ kube_cert_dir }}"
vault_kube_mount_path: kube
vault_kube_default_lease_ttl: 720h
vault_kube_max_lease_ttl: 87600h
vault_kube_role:
name: kube
group: k8s-cluster
policy_rules: default
role_options: default
mount_path: "{{ vault_kube_mount_path }}"
Reference in a new issue Copy permalink