C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix certificates checking when adding etcd node to existing k8s node (#5807) (#5826)

Browse source 
Co-authored-by: alexkomrakov <alexkomrakov@gmail.com>
(cherry picked from commit 6ad6609872)
This commit is contained in:
Etienne Champetier 2020-03-26 11:50:25 -04:00 committed by GitHub
parent de26988e05
commit fde234fda7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 23 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
roles/etcd/tasks/check_certs.yml
View file

@ -33,10 +33,29 @@
['{{ etcd_cert_dir }}/ca.pem',
{% set all_etcd_hosts = groups['k8s-cluster']|union(groups['etcd'])|union(groups['calico-rr']|default([]))|unique|sort %}
{% for host in all_etcd_hosts %}
'{{ etcd_cert_dir }}/node-{{ host }}-key.pem'
{% if not loop.last %}{{','}}{% endif %}
'{{ etcd_cert_dir }}/node-{{ host }}-key.pem',
'{{ etcd_cert_dir }}/admin-{{ host }}-key.pem',
'{{ etcd_cert_dir }}/member-{{ host }}-key.pem'
{% if not loop.last %}{{','}}{% endif %}
{% endfor %}]
- name: "Check_certs | Set 'gen_master_certs' to true"
set_fact:
gen_master_certs: |-
{
{% set all_etcd_hosts = groups['k8s-cluster']|union(groups['etcd'])|union(groups['calico-rr']|default([]))|unique|sort -%}
{% set existing_certs = etcdcert_master.files|map(attribute='path')|list|sort %}
{% for host in all_etcd_hosts -%}
{% set host_cert = "%s/member-%s-key.pem"|format(etcd_cert_dir, host) %}
{% if host_cert in existing_certs -%}
"{{ host }}": False,
{% else -%}
"{{ host }}": True,
{% endif -%}
{% endfor %}
}
run_once: true
- name: "Check_certs | Set 'gen_node_certs' to true"
set_fact:
gen_node_certs: |-
@ -59,6 +78,7 @@
sync_certs: true
when:
- gen_node_certs[inventory_hostname] or
gen_master_certs[inventory_hostname] or
(not etcdcert_node.results[0].stat.exists|default(false)) or
(not etcdcert_node.results[1].stat.exists|default(false)) or
(etcdcert_node.results[1].stat.checksum|default('') != etcdcert_master.files|selectattr("path", "equalto", etcdcert_node.results[1].stat.path)|map(attribute="checksum")|first|default(''))

2
roles/etcd/tasks/gen_certs_script.yml
View file

@ -55,7 +55,7 @@
command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
environment:
- MASTERS: "{% for m in groups['etcd'] %}
{% if gen_node_certs[m] %}
{% if gen_master_certs[m] %}
{{ m }}
{% endif %}
{% endfor %}"