C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Release 2.8 robust san handling (#4478)

Browse source 
* robust handling of API server SANs for 2.8 branch

* use apiserver_loadbalancer_domain_name if it is defined, according to PR 3977
This commit is contained in:
rptaylor 2019-04-10 04:30:15 -07:00 committed by Kubernetes Prow Robot
parent 447605ca0e
commit 6f97687d19
4 changed files with 18 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
roles/kubernetes/master/tasks/kubeadm-setup.yml
View file

@ -42,29 +42,21 @@
- name: kubeadm | aggregate all SANs
set_fact:
apiserver_sans: >-
kubernetes
kubernetes.default
kubernetes.default.svc
kubernetes.default.svc.{{ dns_domain }}
{{ kube_apiserver_ip }}
localhost
127.0.0.1
{{ ' '.join(groups['kube-master']) }}
{%- if loadbalancer_apiserver is defined %}
{{ apiserver_loadbalancer_domain_name }}
{%- endif %}
{% for host in groups['kube-master'] -%}
{%- if hostvars[host]['access_ip'] is defined -%}
{{ hostvars[host]['access_ip'] }}
{%- endif %}
{{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
{%- endfor %}
{%- if supplementary_addresses_in_ssl_keys is defined -%}
{% for addr in supplementary_addresses_in_ssl_keys -%}
{{ addr }}
{%- endfor %}
{%- endif %}
apiserver_sans: "{{ (sans_base + groups['kube-master'] + sans_lb + sans_supp + sans_access_ip + sans_ip + sans_address) | unique }}"
vars:
sans_base:
- "kubernetes"
- "kubernetes.default"
- "kubernetes.default.svc"
- "kubernetes.default.svc.{{ dns_domain }}"
- "{{ kube_apiserver_ip }}"
- "localhost"
- "127.0.0.1"
sans_lb: "{{ [apiserver_loadbalancer_domain_name] if apiserver_loadbalancer_domain_name is defined else [] }}"
sans_supp: "{{ supplementary_addresses_in_ssl_keys if supplementary_addresses_in_ssl_keys is defined else [] }}"
sans_access_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'access_ip') | list | select('defined') | list }}"
sans_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'ip') | list | select('defined') | list }}"
sans_address: "{{ groups['kube-master'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | list | select('defined') | list }}"
tags: facts
- name: kubeadm | Copy etcd cert dir under k8s cert dir

2
roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2
View file

@ -177,7 +177,7 @@ apiServerExtraVolumes:
{% endif %}
{% endif %}
apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %}
{% for san in apiserver_sans %}
- {{ san }}
{% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl

2
roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2
View file

@ -206,7 +206,7 @@ schedulerExtraArgs:
{% endfor %}
{% endif %}
apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %}
{% for san in apiserver_sans %}
- {{ san }}
{% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl

2
roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2
View file

@ -43,7 +43,7 @@ controlPlaneEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.po
controlPlaneEndpoint: {{ ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }}
{% endif %}
apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %}
{% for san in apiserver_sans %}
- {{ san }}
{% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl