Release 2.8 robust san handling (#4478)

* robust handling of API server SANs for 2.8 branch

* use apiserver_loadbalancer_domain_name if it is defined, according to PR 3977
This commit is contained in:
rptaylor 2019-04-10 04:30:15 -07:00 committed by Kubernetes Prow Robot
parent 447605ca0e
commit 6f97687d19
4 changed files with 18 additions and 26 deletions

View file

@ -42,29 +42,21 @@
- name: kubeadm | aggregate all SANs - name: kubeadm | aggregate all SANs
set_fact: set_fact:
apiserver_sans: >- apiserver_sans: "{{ (sans_base + groups['kube-master'] + sans_lb + sans_supp + sans_access_ip + sans_ip + sans_address) | unique }}"
kubernetes vars:
kubernetes.default sans_base:
kubernetes.default.svc - "kubernetes"
kubernetes.default.svc.{{ dns_domain }} - "kubernetes.default"
{{ kube_apiserver_ip }} - "kubernetes.default.svc"
localhost - "kubernetes.default.svc.{{ dns_domain }}"
127.0.0.1 - "{{ kube_apiserver_ip }}"
{{ ' '.join(groups['kube-master']) }} - "localhost"
{%- if loadbalancer_apiserver is defined %} - "127.0.0.1"
{{ apiserver_loadbalancer_domain_name }} sans_lb: "{{ [apiserver_loadbalancer_domain_name] if apiserver_loadbalancer_domain_name is defined else [] }}"
{%- endif %} sans_supp: "{{ supplementary_addresses_in_ssl_keys if supplementary_addresses_in_ssl_keys is defined else [] }}"
{% for host in groups['kube-master'] -%} sans_access_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'access_ip') | list | select('defined') | list }}"
{%- if hostvars[host]['access_ip'] is defined -%} sans_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'ip') | list | select('defined') | list }}"
{{ hostvars[host]['access_ip'] }} sans_address: "{{ groups['kube-master'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | list | select('defined') | list }}"
{%- endif %}
{{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
{%- endfor %}
{%- if supplementary_addresses_in_ssl_keys is defined -%}
{% for addr in supplementary_addresses_in_ssl_keys -%}
{{ addr }}
{%- endfor %}
{%- endif %}
tags: facts tags: facts
- name: kubeadm | Copy etcd cert dir under k8s cert dir - name: kubeadm | Copy etcd cert dir under k8s cert dir

View file

@ -177,7 +177,7 @@ apiServerExtraVolumes:
{% endif %} {% endif %}
{% endif %} {% endif %}
apiServerCertSANs: apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %} {% for san in apiserver_sans %}
- {{ san }} - {{ san }}
{% endfor %} {% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl certificatesDir: {{ kube_config_dir }}/ssl

View file

@ -206,7 +206,7 @@ schedulerExtraArgs:
{% endfor %} {% endfor %}
{% endif %} {% endif %}
apiServerCertSANs: apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %} {% for san in apiserver_sans %}
- {{ san }} - {{ san }}
{% endfor %} {% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl certificatesDir: {{ kube_config_dir }}/ssl

View file

@ -43,7 +43,7 @@ controlPlaneEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.po
controlPlaneEndpoint: {{ ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }} controlPlaneEndpoint: {{ ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }}
{% endif %} {% endif %}
apiServerCertSANs: apiServerCertSANs:
{% for san in apiserver_sans.split() | unique %} {% for san in apiserver_sans %}
- {{ san }} - {{ san }}
{% endfor %} {% endfor %}
certificatesDir: {{ kube_config_dir }}/ssl certificatesDir: {{ kube_config_dir }}/ssl