C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
3731 commits 17 branches 66 tags 141 MiB
Commit graph

78 commits

Author SHA1 Message Date
Tupin Laurent cd4a606cb1 UI is required for vault #3376 (#3377) 2018-09-26 00:27:38 -07:00
Erwan Miran a644b7c267 Introducing credentials_dir in order to be able to override it 2018-09-03 18:04:50 +02:00
Antoine Legrand 2f1fe44762 update images to use arch 2018-08-31 13:45:08 +02:00
Antoine Legrand 26bf719a02
Merge branch 'master' into multi-arch-support 2018-08-17 16:35:50 +02:00
Aleksey Shirokih e8447e3d71
Service file binary place mismatch 
According to cluster/binary.yml vault binary will be placed to `{{ bin_dir }}` and according to `inventory/sample/group_vars/all.yml` that is 
`inventory/sample/group_vars/all.yml`
 2018-08-06 14:44:13 +03:00
Matthew Mosesohn 97e0de7e29
Fix vault file owner issues and k8s apiserver cert creation (#2985) 
apiserver cert should be created only once
 2018-07-11 14:58:02 +03:00
Matthew Mosesohn 0b939a495b
Improve vault etcd initialization check (#2959) 2018-07-05 12:27:45 +03:00
Matthew Mosesohn 77c910c1c3
Fixup vault etcd check (#2938) 
* Fixup vault etcd

* Update main.yml
 2018-07-02 15:37:37 +03:00
Brad Beam 20dba8b388 Adding uuidfile for rkt based vault to properly cleanup after itself 2018-06-23 15:14:40 -05:00
Brad Beam a8715f9f0f Adding wait for vault up handler in service restart 2018-06-06 10:40:27 -05:00
Matthew Mosesohn 59be578842
Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Di Xu 1081f620d2 add support for non-amd64 arch gcr.io images 
Currently all the gcr.io images used in kubespray can only run on x86.
Also gcr.io has not fully support multi-arch docker images.

Add extra var "image_arch" (default is amd64) to support running other
platforms, like arm64.

Change-Id: I8e1c9af533c021cb96ade291a1ce58773b40e271
 2018-06-05 17:29:02 +08:00
Matthew Mosesohn 7433348aae wip pr for improved cert sync 2018-05-30 12:15:11 +03:00
Matthew Mosesohn 07cc981971
refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Chad Swenson d87b6fd9f3 Use dedicated front-proxy-ca for front-proxy-client 2018-04-12 11:03:22 -05:00
Matthew Mosesohn 3fa7468d54 Copy ca-key.pem to etcd and kube-masters accordingly 2018-04-12 10:17:54 +03:00
Andreas Krüger c1eb975545
Merge pull request #2557 from chenhonggc/vault_health_check_delay 
Maybe vault health check needs delay
 2018-03-30 21:39:15 +02:00
Matthew Mosesohn 03bcfa7ff5
Stop templating kube-system namespace and creating it (#2545) 
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
 2018-03-30 14:29:13 +03:00
Chen Hong 4a705b3fba May vault health check needs delay 2018-03-30 16:42:08 +08:00
mirwan ee8f678010 Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly (#2446) 2018-03-21 10:50:32 +03:00
Brad Beam c874f16c02 Fixing credential lookup for fe proxy and vault (#2361) 2018-02-22 15:09:26 +03:00
Antoine Legrand 57e7a5a34a
Merge pull request #2233 from hswong3i/multiple_inventory_dir 
Support multiple inventory files under individual inventory directory
 2018-02-08 11:57:04 +01:00
Antoine Legrand 7bce70339f
Merge pull request #2251 from woopstar/metrics-server-patch-2 
Adding metrics-server support for K8s version 1.9
 2018-02-08 11:16:44 +01:00
Wong Hoi Sing Edison 1a1d154e14 Support multiple inventory files under individual inventory directory 2018-02-08 08:08:15 +08:00
woopstar f9df692056 Issue front proxy certs for vault 2018-02-07 11:03:10 +01:00
Matthew Mosesohn 16629d0b8e Vault should use cert auth for etcd 2018-01-31 20:37:14 +03:00
Matthew Mosesohn dc6a17e092
Use include/import tasks (#2192) 
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
 2018-01-29 14:37:48 +03:00
Matthew Mosesohn bfb25fa47b
Change vault cert ttl to 8y (#2013) 2017-12-15 13:34:00 +00:00
Brad Beam d3850a4da5 Fixing alt_names for vault cert generation 2017-12-11 17:28:18 -06:00
Brad Beam 19def41fdf
Merge pull request #2047 from bradbeam/vaulttime 
Adding retries for vault-temp to come online
 2017-12-11 09:04:57 -06:00
Brad Beam fa5a538fe5
Merge pull request #2050 from jbonachera/fix-vault-tls-validation 
append newline char to vault generated certs
 2017-12-11 08:41:34 -06:00
Brad Beam 93f3614382 Fixes #2039 - changing alt_names to be string instead of list (#2043) 2017-12-11 12:48:07 +00:00
Julien BONACHERA 290bc993a5
append newline char to vault generated certs 2017-12-10 13:06:28 +01:00
Brad Beam 3694657eb6 Adding retries for vault-init to come online 2017-12-09 17:40:44 -06:00
Brad Beam 27ead5d4fa
Merge pull request #2003 from abelgana/master 
Change altnames to alt_names
 2017-12-05 08:48:32 -06:00
Matthew Mosesohn 4d3326b542
Raise default vault lease TTL to 10y (#2008) 2017-11-29 10:38:59 +00:00
abelgana fe3290601a
The variable altnames is used by this task. 
Since the value will change on the default. It needs to change here also.
 2017-11-27 06:57:16 -05:00
abelgana e7173e1d62
Change altnames to alt_names 
Hi,

Could you please check if it was a typo?

https://www.vaultproject.io/api/secret/pki/

Regards,
 2017-11-25 17:29:21 -05:00
Brad Beam c115e5677e
Merge pull request #1828 from hzamani/patch-1 
Use etcd_access_addresses for vault_etcd_url
 2017-11-10 10:56:37 -05:00
Spencer Smith 6df104b275 don't check for no_proxy, only http/https_proxy. fix linting issues. 2017-10-30 11:42:14 -04:00
Spencer Smith b27453d8d8 improved proxy support 2017-10-30 11:42:14 -04:00
Peter Lee 0b60201a1e fix etcd health check bug (#1480) 2017-10-24 16:10:56 +01:00
Matthew Mosesohn fc9a65be2b Refactor downloads to use download role directly (#1824) 
* Refactor downloads to use download role directly

Also disable fact delegation so download delegate works acros OSes.

* clean up bools and ansible_os_family conditionals
 2017-10-19 09:17:11 +01:00
Hassan Zamani 3acc42c5b3 Use etcd_access_addresses for vault_etcd_url 2017-10-17 19:27:36 +03:30
Spencer Smith f2db15873d Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix 
add hosts to rkt kubelet
 2017-10-10 10:37:36 -04:00
ArchiFleKs 7c663de6c9 add /etc/hosts volume to rkt templates 2017-10-09 16:41:51 +02:00
Aivars Sterns 9c86da1403 Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 08:43:04 +01:00
Brad Beam f2ae16e71d Merge pull request #1651 from bradbeam/vaultnocontent 
Fixing condition where vault CA already exists
 2017-09-14 17:04:15 -05:00
Brad Beam ac281476c8 Prune unnecessary certs from vault setup (#1652) 
* Cleaning up cert checks for vault

* Removing all unnecessary etcd certs from each node

* Removing all unnecessary kube certs from each node
 2017-09-14 12:28:11 +01:00
Brad Beam 4b587aaf99 Adding ability to specify altnames for vault cert (#1640) 2017-09-14 07:19:44 +01:00