C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/kubernetes/secrets/tasks/main.yml

87 lines
2.5 KiB
YAML
Raw Normal View History

generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
---
fix add nodes to the cluster
2016-04-07 15:08:39 +00:00
- include: check-certs.yml
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-08 13:36:00 +00:00
tags: [k8s-secrets, facts]
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
generate secrets on first master
2016-05-06 17:17:59 +00:00
- include: check-tokens.yml
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-08 13:36:00 +00:00
tags: [k8s-secrets, facts]
fix add nodes to the cluster
2016-04-07 15:08:39 +00:00
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
- name: Make sure the certificate directory exits
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
path: "{{ kube_cert_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
- name: Make sure the tokens directory exits
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
- name: Make sure the users directory exits
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
path: "{{ kube_users_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
- name: Populate users for basic auth in API
lineinfile:
dest: "{{ kube_users_dir }}/known_users.csv"
create: yes
line: '{{ item.value.pass }},{{ item.key }},{{ item.value.role }}'
backup: yes
with_dict: "{{ kube_users }}"
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 13:15:50 +00:00
when: inventory_hostname in "{{ groups['kube-master'] }}" and kube_basic_auth|default(true)
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
notify: set secret_changed
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 05:24:34 +00:00
#
# The following directory creates make sure that the directories
# exist on the first master for cases where the first master isn't
# being run.
#
Add explicit name printing in task names for deletgated task during cert creation
2017-01-18 20:06:50 +00:00
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 05:24:34 +00:00
file:
path: "{{ kube_config_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
tags: [kubelet, k8s-secrets, kube-controller-manager, kube-apiserver, bootstrap-os, apps, network, master, node]
when: gen_certs|default(false) or gen_tokens|default(false)
Add explicit name printing in task names for deletgated task during cert creation
2017-01-18 20:06:50 +00:00
- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 05:24:34 +00:00
file:
path: "{{ kube_script_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
tags: [k8s-secrets, bootstrap-os]
when: gen_certs|default(false) or gen_tokens|default(false)
Add explicit name printing in task names for deletgated task during cert creation
2017-01-18 20:06:50 +00:00
- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 05:24:34 +00:00
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 05:24:34 +00:00
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_tokens|default(false)
Disable vault role properly on ansible 2.2.0 when condition does not seem to work correctly at playbook level for ansible 2.2.0.
2017-03-03 13:33:00 +00:00
- include: "gen_certs_{{ cert_management }}.yml"
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-08 13:36:00 +00:00
tags: k8s-secrets
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
- include: sync_kube_master_certs.yml
when: cert_management == "vault" and inventory_hostname in groups['kube-master']
tags: k8s-secrets
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
Vault security hardening and role isolation
2017-02-08 21:41:36 +00:00
- include: sync_kube_node_certs.yml
when: cert_management == "vault" and inventory_hostname in groups['k8s-cluster']
tags: k8s-secrets
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-11 22:08:16 +00:00
- include: gen_tokens.yml
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-08 13:36:00 +00:00
tags: k8s-secrets
Reference in a new issue Copy permalink