C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Added option to force apiserver and respective client certificate to … (#6403)

Browse source 
* Added option to force apiserver and respective client certificate to be regenerated without necessarily needing to bump the K8S cluster version

* Removed extra blank line
This commit is contained in:
Bogdan Peste 2020-10-12 16:02:48 +03:00 committed by GitHub
parent 270f91e577
commit 5e32655830
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml
View file

@ -312,3 +312,5 @@ persistent_volumes_enabled: false
## Amount of time to retain events. (default 1h0m0s)
event_ttl_duration: "1h0m0s"
## Force regeneration of kubernetes control plane certificates without the need of bumping the cluster version
force_certificate_regeneration: false

2
roles/kubernetes/master/defaults/main/main.yml
View file

@ -193,3 +193,5 @@ secrets_encryption_query: "resources[*].providers[0].{{kube_encryption_algorithm
## Amount of time to retain events. (default 1h0m0s)
event_ttl_duration: "1h0m0s"
## Force regeneration of kubernetes control plane certificates without the need of bumping the cluster version
force_certificate_regeneration: false

4
roles/kubernetes/master/tasks/kubeadm-setup.yml
View file

@ -130,7 +130,7 @@
when:
- inventory_hostname == groups['kube-master']|first
- kubeadm_already_run.stat.exists
- apiserver_sans_check.changed
- apiserver_sans_check.changed or force_certificate_regeneration
- name: kubeadm | regenerate apiserver cert 2/2
command: >-
@ -140,7 +140,7 @@
when:
- inventory_hostname == groups['kube-master']|first
- kubeadm_already_run.stat.exists
- apiserver_sans_check.changed
- apiserver_sans_check.changed or force_certificate_regeneration
- name: kubeadm | Initialize first master
command: >-