a422ad0d50
Fixed sync_tokens fact Fixed sync_certs for k8s tokens fact Disabled register docker images changability Fixed CNI dir permission Fix idempotency for etcd pre upgrade checks
183 lines
6.4 KiB
YAML
183 lines
6.4 KiB
YAML
---
|
|
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
|
|
file:
|
|
path: "{{ kube_config_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
tags: [kubelet, k8s-secrets, kube-controller-manager, kube-apiserver, bootstrap-os, apps, network, master, node]
|
|
when: gen_certs|default(false)
|
|
|
|
- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
|
|
file:
|
|
path: "{{ kube_script_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
tags: [k8s-secrets, bootstrap-os]
|
|
when: gen_certs|default(false)
|
|
|
|
- name: Gen_certs | write openssl config
|
|
template:
|
|
src: "openssl.conf.j2"
|
|
dest: "{{ kube_config_dir }}/openssl.conf"
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
|
|
- name: Gen_certs | copy certs generation script
|
|
copy:
|
|
src: "make-ssl.sh"
|
|
dest: "{{ kube_script_dir }}/make-ssl.sh"
|
|
mode: 0700
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
|
|
- name: Gen_certs | run cert generation script
|
|
command: "{{ kube_script_dir }}/make-ssl.sh -f {{ kube_config_dir }}/openssl.conf -d {{ kube_cert_dir }}"
|
|
environment:
|
|
- MASTERS: "{% for m in groups['kube-master'] %}
|
|
{% if gen_node_certs[m]|default(false) %}
|
|
{{ m }}
|
|
{% endif %}
|
|
{% endfor %}"
|
|
- HOSTS: "{% for h in groups['k8s-cluster'] %}
|
|
{% if gen_node_certs[h]|default(true) %}
|
|
{{ h }}
|
|
{% endif %}
|
|
{% endfor %}"
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
notify: set secret_changed
|
|
|
|
- set_fact:
|
|
all_master_certs: "['ca-key.pem',
|
|
{% for node in groups['kube-master'] %}
|
|
'admin-{{ node }}.pem',
|
|
'admin-{{ node }}-key.pem',
|
|
'apiserver.pem',
|
|
'apiserver-key.pem',
|
|
{% endfor %}]"
|
|
my_master_certs: ['ca-key.pem',
|
|
'admin-{{ inventory_hostname }}.pem',
|
|
'admin-{{ inventory_hostname }}-key.pem',
|
|
'apiserver.pem',
|
|
'apiserver-key.pem'
|
|
]
|
|
all_node_certs: "['ca.pem',
|
|
{% for node in groups['k8s-cluster'] %}
|
|
'node-{{ node }}.pem',
|
|
'node-{{ node }}-key.pem',
|
|
{% endfor %}]"
|
|
my_node_certs: ['ca.pem', 'node-{{ inventory_hostname }}.pem', 'node-{{ inventory_hostname }}-key.pem']
|
|
tags: facts
|
|
|
|
- name: Gen_certs | Gather master certs
|
|
shell: "tar cfz - -C {{ kube_cert_dir }} -T /dev/stdin <<< {{ my_master_certs|join(' ') }} {{ all_node_certs|join(' ') }} | base64 --wrap=0"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
register: master_cert_data
|
|
check_mode: no
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | Gather node certs
|
|
shell: "tar cfz - -C {{ kube_cert_dir }} -T /dev/stdin <<< {{ my_node_certs|join(' ') }} | base64 --wrap=0"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
register: node_cert_data
|
|
check_mode: no
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: inventory_hostname in groups['kube-node'] and
|
|
sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
#NOTE(mattymo): Use temporary file to copy master certs because we have a ~200k
|
|
#char limit when using shell command
|
|
|
|
#FIXME(mattymo): Use tempfile module in ansible 2.3
|
|
- name: Gen_certs | Prepare tempfile for unpacking certs
|
|
shell: mktemp /tmp/certsXXXXX.tar.gz
|
|
register: cert_tempfile
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | Write master certs to tempfile
|
|
copy:
|
|
content: "{{master_cert_data.stdout}}"
|
|
dest: "{{cert_tempfile.stdout}}"
|
|
owner: root
|
|
mode: "0600"
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | Unpack certs on masters
|
|
shell: "base64 -d < {{ cert_tempfile.stdout }} | tar xz -C {{ kube_cert_dir }}"
|
|
no_log: true
|
|
changed_when: false
|
|
check_mode: no
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
notify: set secret_changed
|
|
|
|
- name: Gen_certs | Cleanup tempfile
|
|
file:
|
|
path: "{{cert_tempfile.stdout}}"
|
|
state: absent
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | Copy certs on nodes
|
|
shell: "base64 -d <<< '{{node_cert_data.stdout|quote}}' | tar xz -C {{ kube_cert_dir }}"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
changed_when: false
|
|
check_mode: no
|
|
when: inventory_hostname in groups['kube-node'] and
|
|
sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
notify: set secret_changed
|
|
|
|
- name: Gen_certs | check certificate permissions
|
|
file:
|
|
path: "{{ kube_cert_dir }}"
|
|
group: "{{ kube_cert_group }}"
|
|
owner: kube
|
|
mode: "u=rwX,g-rwx,o-rwx"
|
|
recurse: yes
|
|
|
|
- name: Gen_certs | target ca-certificates path
|
|
set_fact:
|
|
ca_cert_path: |-
|
|
{% if ansible_os_family == "Debian" -%}
|
|
/usr/local/share/ca-certificates/kube-ca.crt
|
|
{%- elif ansible_os_family == "RedHat" -%}
|
|
/etc/pki/ca-trust/source/anchors/kube-ca.crt
|
|
{%- elif ansible_os_family in ["CoreOS", "Container Linux by CoreOS"] -%}
|
|
/etc/ssl/certs/kube-ca.pem
|
|
{%- endif %}
|
|
tags: facts
|
|
|
|
- name: Gen_certs | add CA to trusted CA dir
|
|
copy:
|
|
src: "{{ kube_cert_dir }}/ca.pem"
|
|
dest: "{{ ca_cert_path }}"
|
|
remote_src: true
|
|
register: kube_ca_cert
|
|
|
|
- name: Gen_certs | update ca-certificates (Debian/Ubuntu/Container Linux by CoreOS)
|
|
command: update-ca-certificates
|
|
when: kube_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS", "Container Linux by CoreOS"]
|
|
|
|
- name: Gen_certs | update ca-certificates (RedHat)
|
|
command: update-ca-trust extract
|
|
when: kube_ca_cert.changed and ansible_os_family == "RedHat"
|
|
|