C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
3139 commits 17 branches 66 tags 141 MiB
Commit graph

70 commits

Author SHA1 Message Date
Matthew Mosesohn
77c910c1c3
Fixup vault etcd check (#2938) 
* Fixup vault etcd

* Update main.yml
 2018-07-02 15:37:37 +03:00
Brad Beam
20dba8b388 Adding uuidfile for rkt based vault to properly cleanup after itself 2018-06-23 15:14:40 -05:00
Brad Beam
a8715f9f0f Adding wait for vault up handler in service restart 2018-06-06 10:40:27 -05:00
Matthew Mosesohn
59be578842
Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Matthew Mosesohn
7433348aae wip pr for improved cert sync 2018-05-30 12:15:11 +03:00
Matthew Mosesohn
07cc981971
refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Chad Swenson
d87b6fd9f3 Use dedicated front-proxy-ca for front-proxy-client 2018-04-12 11:03:22 -05:00
Matthew Mosesohn
3fa7468d54 Copy ca-key.pem to etcd and kube-masters accordingly 2018-04-12 10:17:54 +03:00
Andreas Krüger
c1eb975545
Merge pull request #2557 from chenhonggc/vault_health_check_delay 
Maybe vault health check needs delay
 2018-03-30 21:39:15 +02:00
Matthew Mosesohn
03bcfa7ff5
Stop templating kube-system namespace and creating it (#2545) 
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
 2018-03-30 14:29:13 +03:00
Chen Hong
4a705b3fba May vault health check needs delay 2018-03-30 16:42:08 +08:00
mirwan
ee8f678010 Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly (#2446) 2018-03-21 10:50:32 +03:00
Brad Beam
c874f16c02 Fixing credential lookup for fe proxy and vault (#2361) 2018-02-22 15:09:26 +03:00
Antoine Legrand
57e7a5a34a
Merge pull request #2233 from hswong3i/multiple_inventory_dir 
Support multiple inventory files under individual inventory directory
 2018-02-08 11:57:04 +01:00
Antoine Legrand
7bce70339f
Merge pull request #2251 from woopstar/metrics-server-patch-2 
Adding metrics-server support for K8s version 1.9
 2018-02-08 11:16:44 +01:00
Wong Hoi Sing Edison
1a1d154e14 Support multiple inventory files under individual inventory directory 2018-02-08 08:08:15 +08:00
woopstar
f9df692056 Issue front proxy certs for vault 2018-02-07 11:03:10 +01:00
Matthew Mosesohn
16629d0b8e Vault should use cert auth for etcd 2018-01-31 20:37:14 +03:00
Matthew Mosesohn
dc6a17e092
Use include/import tasks (#2192) 
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
 2018-01-29 14:37:48 +03:00
Matthew Mosesohn
bfb25fa47b
Change vault cert ttl to 8y (#2013) 2017-12-15 13:34:00 +00:00
Brad Beam
d3850a4da5 Fixing alt_names for vault cert generation 2017-12-11 17:28:18 -06:00
Brad Beam
19def41fdf
Merge pull request #2047 from bradbeam/vaulttime 
Adding retries for vault-temp to come online
 2017-12-11 09:04:57 -06:00
Brad Beam
fa5a538fe5
Merge pull request #2050 from jbonachera/fix-vault-tls-validation 
append newline char to vault generated certs
 2017-12-11 08:41:34 -06:00
Brad Beam
93f3614382 Fixes #2039 - changing alt_names to be string instead of list (#2043) 2017-12-11 12:48:07 +00:00
Julien BONACHERA
290bc993a5
append newline char to vault generated certs 2017-12-10 13:06:28 +01:00
Brad Beam
3694657eb6 Adding retries for vault-init to come online 2017-12-09 17:40:44 -06:00
Brad Beam
27ead5d4fa
Merge pull request #2003 from abelgana/master 
Change altnames to alt_names
 2017-12-05 08:48:32 -06:00
Matthew Mosesohn
4d3326b542
Raise default vault lease TTL to 10y (#2008) 2017-11-29 10:38:59 +00:00
abelgana
fe3290601a
The variable altnames is used by this task. 
Since the value will change on the default. It needs to change here also.
 2017-11-27 06:57:16 -05:00
abelgana
e7173e1d62
Change altnames to alt_names 
Hi,

Could you please check if it was a typo?

https://www.vaultproject.io/api/secret/pki/

Regards,
 2017-11-25 17:29:21 -05:00
Brad Beam
c115e5677e
Merge pull request #1828 from hzamani/patch-1 
Use etcd_access_addresses for vault_etcd_url
 2017-11-10 10:56:37 -05:00
Spencer Smith
6df104b275 don't check for no_proxy, only http/https_proxy. fix linting issues. 2017-10-30 11:42:14 -04:00
Spencer Smith
b27453d8d8 improved proxy support 2017-10-30 11:42:14 -04:00
Peter Lee
0b60201a1e fix etcd health check bug (#1480) 2017-10-24 16:10:56 +01:00
Matthew Mosesohn
fc9a65be2b Refactor downloads to use download role directly (#1824) 
* Refactor downloads to use download role directly

Also disable fact delegation so download delegate works acros OSes.

* clean up bools and ansible_os_family conditionals
 2017-10-19 09:17:11 +01:00
Hassan Zamani
3acc42c5b3 Use etcd_access_addresses for vault_etcd_url 2017-10-17 19:27:36 +03:30
Spencer Smith
f2db15873d Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix 
add hosts to rkt kubelet
 2017-10-10 10:37:36 -04:00
ArchiFleKs
7c663de6c9 add /etc/hosts volume to rkt templates 2017-10-09 16:41:51 +02:00
Aivars Sterns
9c86da1403 Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 08:43:04 +01:00
Brad Beam
f2ae16e71d Merge pull request #1651 from bradbeam/vaultnocontent 
Fixing condition where vault CA already exists
 2017-09-14 17:04:15 -05:00
Brad Beam
ac281476c8 Prune unnecessary certs from vault setup (#1652) 
* Cleaning up cert checks for vault

* Removing all unnecessary etcd certs from each node

* Removing all unnecessary kube certs from each node
 2017-09-14 12:28:11 +01:00
Brad Beam
4b587aaf99 Adding ability to specify altnames for vault cert (#1640) 2017-09-14 07:19:44 +01:00
Brad Beam
0a89f88b89 Fixing condition where CA already exists 2017-09-13 03:40:46 +00:00
Maxim Krasilnikov
e16b57aa05 Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster (#1632) 2017-09-07 23:30:16 +03:00
mkrasilnikov
957b7115fe Remove node name from kube-proxy and admin certificates 2017-09-05 14:40:26 +03:00
mkrasilnikov
b930b0ef5a Place vault role credentials only to vault group hosts 2017-09-05 11:16:18 +03:00
mkrasilnikov
ad313c9d49 typo fix 2017-09-05 09:07:36 +03:00
mkrasilnikov
e1384f6618 Using issue cert result var instead hostvars 2017-09-05 09:07:36 +03:00
mkrasilnikov
3acb86805b Rename vault_address to vault_bind_address 2017-09-05 09:07:35 +03:00
mkrasilnikov
bf0af1cd3d Vault role updates: 
* using separated vault roles for generate certs with different `O` (Organization) subject field;
  * configure vault roles for issuing certificates with different `CN` (Common name) subject field;
  * set `CN` and `O` to `kubernetes` and `etcd` certificates;
  * vault/defaults vars definition was simplified;
  * vault dirs variables defined in kubernetes-defaults foles for using
  shared tasks in etcd and kubernetes/secrets roles;
  * upgrade vault to 0.8.1;
  * generate random vault user password for each role by default;
  * fix `serial` file name for vault certs;
  * move vault auth request to issue_cert tasks;
  * enable `RBAC` in vault CI;
 2017-09-05 09:07:35 +03:00