c12s-kubespray/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml
Matthew Mosesohn a43e0d3f95 Switch to Kubernetes v1.16.0 (#5189)
* Switch to Kubernetes v1.16.0

Change-Id: I5d6a9528b2d443750fc5e031aff15ad3ffead158

* Fix download localhost cached file path

Change-Id: I65e79b70e3d1b37265ebc60f41b460cf4b0a0d47

* fix kubeadm etcd for v1.16

Change-Id: I6888a00fd48b530a38b0b31c4095492476af42d2

* disable tf packet jobs

Change-Id: I075c4666547fdea4c50ec04864f38e2cfaa79154

* Disable contiv packet jobs. Fix kube-router

Change-Id: I3170e8789e60711d4cee8faf65f2094480b79b8d

* bump sonobuoy version

Change-Id: Ib946905629c7c53ed88f08fb2f41c454457a0097
2019-10-02 02:21:07 -07:00

72 lines
2.4 KiB
YAML

---
- name: Refresh certificates so they are fresh and not expired
command: >-
{{ bin_dir }}/kubeadm init phase
--config {{ kube_config_dir }}/kubeadm-config.yaml
upload-certs
--upload-certs
register: kubeadm_upload_cert
delegate_to: "{{ groups['kube-master'][0] }}"
when: kubeadm_etcd_refresh_cert_key
run_once: yes
- name: Parse certificate key if not set
set_fact:
kubeadm_certificate_key: "{{ hostvars[groups['kube-master'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
when: kubeadm_certificate_key is undefined
- name: Pull control plane certs down
shell: >-
{{ bin_dir }}/kubeadm join phase
control-plane-prepare download-certs
--certificate-key {{ kubeadm_certificate_key }}
--control-plane
--token {{ kubeadm_token }}
--discovery-token-unsafe-skip-ca-verification
{{ kubeadm_discovery_address }}
&&
{{ bin_dir }}/kubeadm join phase
control-plane-prepare certs
--control-plane
--token {{ kubeadm_token }}
--discovery-token-unsafe-skip-ca-verification
{{ kubeadm_discovery_address }}
args:
creates: "{{ kube_cert_dir }}/apiserver-etcd-client.key"
- name: Delete unneeded certificates
file:
path: "{{ item }}"
state: absent
with_items:
- "{{ kube_cert_dir }}/apiserver.crt"
- "{{ kube_cert_dir }}/apiserver.key"
- "{{ kube_cert_dir }}/ca.key"
- "{{ kube_cert_dir }}/etcd/ca.key"
- "{{ kube_cert_dir }}/etcd/healthcheck-client.crt"
- "{{ kube_cert_dir }}/etcd/healthcheck-client.key"
- "{{ kube_cert_dir }}/etcd/peer.crt"
- "{{ kube_cert_dir }}/etcd/peer.key"
- "{{ kube_cert_dir }}/etcd/server.crt"
- "{{ kube_cert_dir }}/etcd/server.key"
- "{{ kube_cert_dir }}/front-proxy-ca.crt"
- "{{ kube_cert_dir }}/front-proxy-ca.key"
- "{{ kube_cert_dir }}/front-proxy-client.crt"
- "{{ kube_cert_dir }}/front-proxy-client.key"
- "{{ kube_cert_dir }}/sa.key"
- "{{ kube_cert_dir }}/sa.pub"
- name: Calculate etcd cert serial
command: "openssl x509 -in {{ kube_cert_dir }}/apiserver-etcd-client.crt -noout -serial"
register: "etcd_client_cert_serial_result"
changed_when: false
when:
- inventory_hostname in groups['k8s-cluster']|union(groups['calico-rr']|default([]))|unique|sort
tags:
- network
- name: Set etcd_client_cert_serial
set_fact:
etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
tags:
- network