111 lines
3.7 KiB
YAML
111 lines
3.7 KiB
YAML
---
|
|
- include: check-certs.yml
|
|
tags: [k8s-secrets, facts]
|
|
|
|
- include: check-tokens.yml
|
|
tags: [k8s-secrets, facts]
|
|
|
|
- name: Make sure the certificate directory exits
|
|
file:
|
|
path: "{{ kube_cert_dir }}"
|
|
state: directory
|
|
mode: o-rwx
|
|
group: "{{ kube_cert_group }}"
|
|
|
|
- name: Make sure the tokens directory exits
|
|
file:
|
|
path: "{{ kube_token_dir }}"
|
|
state: directory
|
|
mode: o-rwx
|
|
group: "{{ kube_cert_group }}"
|
|
|
|
- name: Make sure the users directory exits
|
|
file:
|
|
path: "{{ kube_users_dir }}"
|
|
state: directory
|
|
mode: o-rwx
|
|
group: "{{ kube_cert_group }}"
|
|
|
|
- name: Populate users for basic auth in API
|
|
template:
|
|
src: known_users.csv.j2
|
|
dest: "{{ kube_users_dir }}/known_users.csv"
|
|
backup: yes
|
|
when: inventory_hostname in groups['kube-master'] and kube_basic_auth|default(true)
|
|
notify: set secret_changed
|
|
|
|
#
|
|
# The following directory creates make sure that the directories
|
|
# exist on the first master for cases where the first master isn't
|
|
# being run.
|
|
#
|
|
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
|
|
file:
|
|
path: "{{ kube_config_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
tags: [kubelet, k8s-secrets, kube-controller-manager, kube-apiserver, bootstrap-os, apps, network, master, node]
|
|
when: gen_certs|default(false) or gen_tokens|default(false)
|
|
|
|
- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
|
|
file:
|
|
path: "{{ kube_script_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
tags: [k8s-secrets, bootstrap-os]
|
|
when: gen_certs|default(false) or gen_tokens|default(false)
|
|
|
|
- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
|
|
file:
|
|
path: "{{ kube_token_dir }}"
|
|
state: directory
|
|
mode: o-rwx
|
|
group: "{{ kube_cert_group }}"
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_tokens|default(false)
|
|
|
|
- include: "gen_certs_{{ cert_management }}.yml"
|
|
tags: k8s-secrets
|
|
|
|
- include: upd_ca_trust.yml
|
|
tags: k8s-secrets
|
|
|
|
- name: "Gen_certs | Get certificate serials on kube masters"
|
|
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
|
|
register: "master_certificate_serials"
|
|
with_items:
|
|
- "admin-{{ inventory_hostname }}.pem"
|
|
- "apiserver.pem"
|
|
- "kube-controller-manager.pem"
|
|
- "kube-scheduler.pem"
|
|
when: inventory_hostname in groups['kube-master']
|
|
|
|
- name: "Gen_certs | set kube master certificate serial facts"
|
|
set_fact:
|
|
etcd_admin_cert_serial: "{{ master_certificate_serials.results[0].stdout|default() }}"
|
|
apiserver_cert_serial: "{{ master_certificate_serials.results[1].stdout|default() }}"
|
|
controller_manager_cert_serial: "{{ master_certificate_serials.results[2].stdout|default() }}"
|
|
scheduler_cert_serial: "{{ master_certificate_serials.results[3].stdout|default() }}"
|
|
when: inventory_hostname in groups['kube-master']
|
|
|
|
- name: "Gen_certs | Get certificate serials on kube nodes"
|
|
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
|
|
register: "node_certificate_serials"
|
|
with_items:
|
|
- "node-{{ inventory_hostname }}.pem"
|
|
- "kube-proxy-{{ inventory_hostname }}.pem"
|
|
when: inventory_hostname in groups['k8s-cluster']
|
|
|
|
- name: "Gen_certs | set kube node certificate serial facts"
|
|
set_fact:
|
|
etcd_node_cert_serial: "{{ node_certificate_serials.results[0].stdout|default() }}"
|
|
kube_proxy_cert_serial: "{{ node_certificate_serials.results[1].stdout|default() }}"
|
|
when: inventory_hostname in groups['k8s-cluster']
|
|
|
|
- include: gen_tokens.yml
|
|
tags: k8s-secrets
|