Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly (#2446)
This commit is contained in:
parent
a6b918c1a1
commit
ee8f678010
|
@ -12,3 +12,4 @@ library = ./library
|
||||||
callback_whitelist = profile_tasks
|
callback_whitelist = profile_tasks
|
||||||
roles_path = roles:$VIRTUAL_ENV/usr/local/share/kubespray/roles:$VIRTUAL_ENV/usr/local/share/ansible/roles:/usr/share/kubespray/roles
|
roles_path = roles:$VIRTUAL_ENV/usr/local/share/kubespray/roles:$VIRTUAL_ENV/usr/local/share/ansible/roles:/usr/share/kubespray/roles
|
||||||
deprecation_warnings=False
|
deprecation_warnings=False
|
||||||
|
inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo, .creds
|
||||||
|
|
|
@ -74,7 +74,7 @@ authentication. One could generate a kubeconfig based on one installed
|
||||||
kube-master hosts (needs improvement) or connect with a username and password.
|
kube-master hosts (needs improvement) or connect with a username and password.
|
||||||
By default, a user with admin rights is created, named `kube`.
|
By default, a user with admin rights is created, named `kube`.
|
||||||
The password can be viewed after deployment by looking at the file
|
The password can be viewed after deployment by looking at the file
|
||||||
`PATH_TO_KUBESPRAY/credentials/kube_user`. This contains a randomly generated
|
`PATH_TO_KUBESPRAY/credentials/kube_user.creds`. This contains a randomly generated
|
||||||
password. If you wish to set your own password, just precreate/modify this
|
password. If you wish to set your own password, just precreate/modify this
|
||||||
file yourself.
|
file yourself.
|
||||||
|
|
||||||
|
|
|
@ -137,6 +137,6 @@ The possible vars are:
|
||||||
|
|
||||||
By default, a user with admin rights is created, named `kube`.
|
By default, a user with admin rights is created, named `kube`.
|
||||||
The password can be viewed after deployment by looking at the file
|
The password can be viewed after deployment by looking at the file
|
||||||
`PATH_TO_KUBESPRAY/credentials/kube_user`. This contains a randomly generated
|
`PATH_TO_KUBESPRAY/credentials/kube_user.creds`. This contains a randomly generated
|
||||||
password. If you wish to set your own password, just precreate/modify this
|
password. If you wish to set your own password, just precreate/modify this
|
||||||
file yourself or change `kube_api_pwd` var.
|
file yourself or change `kube_api_pwd` var.
|
||||||
|
|
|
@ -37,7 +37,7 @@ kube_log_level: 2
|
||||||
|
|
||||||
# Users to create for basic auth in Kubernetes API via HTTP
|
# Users to create for basic auth in Kubernetes API via HTTP
|
||||||
# Optionally add groups for user
|
# Optionally add groups for user
|
||||||
kube_api_pwd: "{{ lookup('password', inventory_dir + '/credentials/kube_user length=15 chars=ascii_letters,digits') }}"
|
kube_api_pwd: "{{ lookup('password', inventory_dir + '/credentials/kube_user.creds length=15 chars=ascii_letters,digits') }}"
|
||||||
kube_users:
|
kube_users:
|
||||||
kube:
|
kube:
|
||||||
pass: "{{kube_api_pwd}}"
|
pass: "{{kube_api_pwd}}"
|
||||||
|
|
|
@ -95,5 +95,5 @@ volume_cross_zone_attachment: false
|
||||||
|
|
||||||
## Encrypting Secret Data at Rest
|
## Encrypting Secret Data at Rest
|
||||||
kube_encrypt_secret_data: false
|
kube_encrypt_secret_data: false
|
||||||
kube_encrypt_token: "{{ lookup('password', inventory_dir + '/credentials/kube_encrypt_token length=32 chars=ascii_letters,digits') }}"
|
kube_encrypt_token: "{{ lookup('password', inventory_dir + '/credentials/kube_encrypt_token.creds length=32 chars=ascii_letters,digits') }}"
|
||||||
kube_encryption_algorithm: "aescbc" # Must be either: aescbc, secretbox or aesgcm
|
kube_encryption_algorithm: "aescbc" # Must be either: aescbc, secretbox or aesgcm
|
||||||
|
|
|
@ -115,7 +115,7 @@ vault_pki_mounts:
|
||||||
roles:
|
roles:
|
||||||
- name: vault
|
- name: vault
|
||||||
group: vault
|
group: vault
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/vault length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/vault.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options: default
|
role_options: default
|
||||||
etcd:
|
etcd:
|
||||||
|
@ -127,7 +127,7 @@ vault_pki_mounts:
|
||||||
roles:
|
roles:
|
||||||
- name: etcd
|
- name: etcd
|
||||||
group: etcd
|
group: etcd
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/etcd length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/etcd.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options:
|
role_options:
|
||||||
allow_any_name: true
|
allow_any_name: true
|
||||||
|
@ -142,7 +142,7 @@ vault_pki_mounts:
|
||||||
roles:
|
roles:
|
||||||
- name: kube-master
|
- name: kube-master
|
||||||
group: kube-master
|
group: kube-master
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-master length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-master.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options:
|
role_options:
|
||||||
allow_any_name: true
|
allow_any_name: true
|
||||||
|
@ -150,7 +150,7 @@ vault_pki_mounts:
|
||||||
organization: "system:masters"
|
organization: "system:masters"
|
||||||
- name: kube-node
|
- name: kube-node
|
||||||
group: k8s-cluster
|
group: k8s-cluster
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-node length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-node.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options:
|
role_options:
|
||||||
allow_any_name: true
|
allow_any_name: true
|
||||||
|
@ -158,7 +158,7 @@ vault_pki_mounts:
|
||||||
organization: "system:nodes"
|
organization: "system:nodes"
|
||||||
- name: kube-proxy
|
- name: kube-proxy
|
||||||
group: k8s-cluster
|
group: k8s-cluster
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-proxy length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-proxy.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options:
|
role_options:
|
||||||
allow_any_name: true
|
allow_any_name: true
|
||||||
|
@ -166,7 +166,7 @@ vault_pki_mounts:
|
||||||
organization: "system:node-proxier"
|
organization: "system:node-proxier"
|
||||||
- name: front-proxy-client
|
- name: front-proxy-client
|
||||||
group: k8s-cluster
|
group: k8s-cluster
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-proxy length=15') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/vault/kube-proxy.creds length=15') }}"
|
||||||
policy_rules: default
|
policy_rules: default
|
||||||
role_options:
|
role_options:
|
||||||
allow_any_name: true
|
allow_any_name: true
|
||||||
|
|
|
@ -6,7 +6,7 @@
|
||||||
uri:
|
uri:
|
||||||
url: "https://{{ access_ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }}/api/v1"
|
url: "https://{{ access_ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }}/api/v1"
|
||||||
user: kube
|
user: kube
|
||||||
password: "{{ lookup('password', inventory_dir + '/credentials/kube_user length=15 chars=ascii_letters,digits') }}"
|
password: "{{ lookup('password', inventory_dir + '/credentials/kube_user.creds length=15 chars=ascii_letters,digits') }}"
|
||||||
validate_certs: no
|
validate_certs: no
|
||||||
status_code: 200,401
|
status_code: 200,401
|
||||||
when: not kubeadm_enabled|default(false)
|
when: not kubeadm_enabled|default(false)
|
||||||
|
|
Loading…
Reference in a new issue