From 74c43c290a9d635c152cfc7e94e01a187e73125e Mon Sep 17 00:00:00 2001 From: Matthew Mosesohn Date: Wed, 12 Apr 2017 13:37:50 +0300 Subject: [PATCH 1/2] Skip vault cert task evaluation completely when using script cert generation --- roles/etcd/tasks/gen_certs_vault.yml | 16 +++++++++++++--- roles/etcd/tasks/main.yml | 15 +-------------- .../kubernetes/secrets/tasks/gen_certs_vault.yml | 13 ++++++++++--- roles/kubernetes/secrets/tasks/main.yml | 8 -------- roles/vault/tasks/bootstrap/start_vault_temp.yml | 3 +++ 5 files changed, 27 insertions(+), 28 deletions(-) diff --git a/roles/etcd/tasks/gen_certs_vault.yml b/roles/etcd/tasks/gen_certs_vault.yml index 144e3b658..e45b2d02d 100644 --- a/roles/etcd/tasks/gen_certs_vault.yml +++ b/roles/etcd/tasks/gen_certs_vault.yml @@ -1,4 +1,12 @@ --- +- include: sync_etcd_master_certs.yml + when: inventory_hostname in groups.etcd + tags: etcd-secrets + +- include: sync_etcd_node_certs.yml + when: inventory_hostname in etcd_node_cert_hosts + tags: etcd-secrets + - name: gen_certs_vault | Read in the local credentials command: cat /etc/vault/roles/etcd/userpass @@ -15,7 +23,7 @@ url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}/v1/auth/userpass/login/{{ etcd_vault_creds.username }}" headers: Accept: application/json - Content-Type: application/json + Content-Type: application/json method: POST body_format: json body: @@ -37,7 +45,7 @@ issue_cert_copy_ca: "{{ item == etcd_master_certs_needed|first }}" issue_cert_file_group: "{{ etcd_cert_group }}" issue_cert_file_owner: kube - issue_cert_headers: "{{ etcd_vault_headers }}" + issue_cert_headers: "{{ etcd_vault_headers }}" issue_cert_hosts: "{{ groups.etcd }}" issue_cert_ip_sans: >- [ @@ -60,7 +68,7 @@ issue_cert_copy_ca: "{{ item == etcd_node_certs_needed|first }}" issue_cert_file_group: "{{ etcd_cert_group }}" issue_cert_file_owner: kube - issue_cert_headers: "{{ etcd_vault_headers }}" + issue_cert_headers: "{{ etcd_vault_headers }}" issue_cert_hosts: "{{ etcd_node_cert_hosts }}" issue_cert_ip_sans: >- [ @@ -75,3 +83,5 @@ with_items: "{{ etcd_node_certs_needed|d([]) }}" when: inventory_hostname in etcd_node_cert_hosts notify: set etcd_secret_changed + + diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml index d917b56ac..afd5fa883 100644 --- a/roles/etcd/tasks/main.yml +++ b/roles/etcd/tasks/main.yml @@ -7,20 +7,7 @@ when: cert_management == "script" tags: [etcd-secrets, facts] -- include: gen_certs_script.yml - when: cert_management == "script" - tags: etcd-secrets - -- include: sync_etcd_master_certs.yml - when: cert_management == "vault" and inventory_hostname in groups.etcd - tags: etcd-secrets - -- include: sync_etcd_node_certs.yml - when: cert_management == "vault" and inventory_hostname in etcd_node_cert_hosts - tags: etcd-secrets - -- include: gen_certs_vault.yml - when: cert_management == "vault" and (etcd_master_certs_needed|d() or etcd_node_certs_needed|d()) +- include: "gen_certs_{{ cert_management }}.yml" tags: etcd-secrets - include: "install_{{ etcd_deployment_type }}.yml" diff --git a/roles/kubernetes/secrets/tasks/gen_certs_vault.yml b/roles/kubernetes/secrets/tasks/gen_certs_vault.yml index 5a7c4827b..ac8e128b4 100644 --- a/roles/kubernetes/secrets/tasks/gen_certs_vault.yml +++ b/roles/kubernetes/secrets/tasks/gen_certs_vault.yml @@ -1,4 +1,11 @@ --- +- include: sync_kube_master_certs.yml + when: inventory_hostname in groups['kube-master'] + tags: k8s-secrets + +- include: sync_kube_node_certs.yml + when: inventory_hostname in groups['k8s-cluster'] + tags: k8s-secrets - name: gen_certs_vault | Read in the local credentials command: cat /etc/vault/roles/kube/userpass @@ -15,7 +22,7 @@ url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}/v1/auth/userpass/login/{{ kube_vault_creds.username }}" headers: Accept: application/json - Content-Type: application/json + Content-Type: application/json method: POST body_format: json body: @@ -54,7 +61,7 @@ }} issue_cert_file_group: "{{ kube_cert_group }}" issue_cert_file_owner: kube - issue_cert_headers: "{{ kube_vault_headers }}" + issue_cert_headers: "{{ kube_vault_headers }}" issue_cert_hosts: "{{ groups['kube-master'] }}" issue_cert_ip_sans: >- [ @@ -75,7 +82,7 @@ issue_cert_copy_ca: "{{ item == kube_node_certs_needed|first }}" issue_cert_file_group: "{{ kube_cert_group }}" issue_cert_file_owner: kube - issue_cert_headers: "{{ kube_vault_headers }}" + issue_cert_headers: "{{ kube_vault_headers }}" issue_cert_hosts: "{{ groups['k8s-cluster'] }}" issue_cert_path: "{{ item }}" issue_cert_role: kube diff --git a/roles/kubernetes/secrets/tasks/main.yml b/roles/kubernetes/secrets/tasks/main.yml index 919ed0df7..fb4c38f38 100644 --- a/roles/kubernetes/secrets/tasks/main.yml +++ b/roles/kubernetes/secrets/tasks/main.yml @@ -74,13 +74,5 @@ - include: "gen_certs_{{ cert_management }}.yml" tags: k8s-secrets -- include: sync_kube_master_certs.yml - when: cert_management == "vault" and inventory_hostname in groups['kube-master'] - tags: k8s-secrets - -- include: sync_kube_node_certs.yml - when: cert_management == "vault" and inventory_hostname in groups['k8s-cluster'] - tags: k8s-secrets - - include: gen_tokens.yml tags: k8s-secrets diff --git a/roles/vault/tasks/bootstrap/start_vault_temp.yml b/roles/vault/tasks/bootstrap/start_vault_temp.yml index eeaaad535..daebf1a6d 100644 --- a/roles/vault/tasks/bootstrap/start_vault_temp.yml +++ b/roles/vault/tasks/bootstrap/start_vault_temp.yml @@ -13,6 +13,9 @@ -v /etc/vault:/etc/vault {{ vault_image_repo }}:{{ vault_version }} server +- name: bootstrap/start_vault_temp | Start again single node Vault with file backend + command: docker start {{ vault_temp_container_name }} + - name: bootstrap/start_vault_temp | Initialize vault-temp uri: url: "http://localhost:{{ vault_port }}/v1/sys/init" From c23385e77ebf6f382d5fd36555d3d1485f93c1de Mon Sep 17 00:00:00 2001 From: Matthew Mosesohn Date: Fri, 14 Apr 2017 13:32:41 +0300 Subject: [PATCH 2/2] Update start_vault_temp.yml --- roles/vault/tasks/bootstrap/start_vault_temp.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/vault/tasks/bootstrap/start_vault_temp.yml b/roles/vault/tasks/bootstrap/start_vault_temp.yml index daebf1a6d..161ef92d6 100644 --- a/roles/vault/tasks/bootstrap/start_vault_temp.yml +++ b/roles/vault/tasks/bootstrap/start_vault_temp.yml @@ -13,6 +13,7 @@ -v /etc/vault:/etc/vault {{ vault_image_repo }}:{{ vault_version }} server +#FIXME(mattymo): Crashes on first start with aufs docker storage. See hashicorp/docker-vault#19 - name: bootstrap/start_vault_temp | Start again single node Vault with file backend command: docker start {{ vault_temp_container_name }}