From f1b599ca660964ae92188be4a6fdf949bc2b5bd4 Mon Sep 17 00:00:00 2001 From: Alex Knol Date: Thu, 23 Feb 2017 16:59:22 +0100 Subject: [PATCH] optionally add an extra ip for the apiservers certificate --- inventory/group_vars/all.yml | 5 +++++ roles/kubernetes/secrets/templates/openssl.conf.j2 | 3 +++ 2 files changed, 8 insertions(+) diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml index 17652ef50..abfae120b 100644 --- a/inventory/group_vars/all.yml +++ b/inventory/group_vars/all.yml @@ -6,6 +6,11 @@ ## but don't know about that address themselves. #access_ip: 1.1.1.1 +# The kube_apiserver_ext_ip is only used when generating the certificate protecting the apiservers +# This is handy in case you want/have to access the apiserver through an external IP +# that is not routable inside the cluster. +# kube_apiserver_ext_ip: 10.10.10.10 + ### LOADBALANCING AND ACCESS MODES ## Enable multiaccess to configure etcd clients to access all of the etcd members directly ## as the "http://hostX:port, http://hostY:port, ..." and ignore the proxy loadbalancers. diff --git a/roles/kubernetes/secrets/templates/openssl.conf.j2 b/roles/kubernetes/secrets/templates/openssl.conf.j2 index d3164286e..b748604c9 100644 --- a/roles/kubernetes/secrets/templates/openssl.conf.j2 +++ b/roles/kubernetes/secrets/templates/openssl.conf.j2 @@ -26,3 +26,6 @@ IP.{{ 2 * loop.index }} = {{ hostvars[host]['ip'] | default(hostvars[host]['ansi {% set idx = groups['kube-master'] | length | int * 2 + 1 %} IP.{{ idx }} = {{ kube_apiserver_ip }} IP.{{ idx + 1 }} = 127.0.0.1 +{% if kube_apiserver_ext_ip is defined %} +IP.{{ idx + 1 | string }} = {{ kube_apiserver_ext_ip }} +{% endif %}