486b223e01
This replaces kube-master with kube_control_plane because of [1]:
The Kubernetes project is moving away from wording that is
considered offensive. A new working group WG Naming was created
to track this work, and the word "master" was declared as offensive.
A proposal was formalized for replacing the word "master" with
"control plane". This means it should be removed from source code,
documentation, and user-facing configuration from Kubernetes and
its sub-projects.
NOTE: The reason why this changes it to kube_control_plane not
kube-control-plane is for valid group names on ansible.
[1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation
201 lines
6.2 KiB
YAML
201 lines
6.2 KiB
YAML
---
|
|
vault_bootstrap: false
|
|
vault_deployment_type: docker
|
|
|
|
vault_adduser_vars:
|
|
comment: "Hashicorp Vault User"
|
|
createhome: no
|
|
name: vault
|
|
shell: /sbin/nologin
|
|
system: yes
|
|
|
|
# This variables redefined in kubespray-defaults for using shared tasks
|
|
# in etcd and kubernetes/secrets roles
|
|
vault_base_dir: /etc/vault
|
|
vault_cert_dir: "{{ vault_base_dir }}/ssl"
|
|
vault_config_dir: "{{ vault_base_dir }}/config"
|
|
vault_roles_dir: "{{ vault_base_dir }}/roles"
|
|
vault_secrets_dir: "{{ vault_base_dir }}/secrets"
|
|
vault_lib_dir: "/var/lib/vault"
|
|
vault_log_dir: "/var/log/vault"
|
|
|
|
vault_version: 0.10.1
|
|
vault_binary_checksum: 66f0f1b0b221d664dd5913f8697409d7401df4bb2a19c7277e8fbad152063fae
|
|
vault_download_url: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_{{ image_arch }}.zip"
|
|
|
|
# hvac==0.7.0 is broken at the moment
|
|
hvac_version: 0.6.4
|
|
|
|
# Arch of Docker images and needed packages
|
|
image_arch: "{{host_architecture}}"
|
|
|
|
vault_download_vars:
|
|
container: "{{ vault_deployment_type != 'host' }}"
|
|
dest: "vault/vault_{{ vault_version }}_linux_{{ image_arch }}.zip"
|
|
enabled: true
|
|
mode: "0755"
|
|
owner: "vault"
|
|
repo: "{{ vault_image_repo }}"
|
|
sha256: "{{ vault_binary_checksum if vault_deployment_type == 'host' else vault_digest_checksum|d(none) }}"
|
|
source_url: "{{ vault_download_url }}"
|
|
tag: "{{ vault_image_tag }}"
|
|
unarchive: true
|
|
url: "{{ vault_download_url }}"
|
|
version: "{{ vault_version }}"
|
|
|
|
vault_container_name: kube-hashicorp-vault
|
|
vault_temp_container_name: vault-temp
|
|
vault_image_repo: "vault"
|
|
vault_image_tag: "{{ vault_version }}"
|
|
|
|
vault_bind_address: 0.0.0.0
|
|
vault_port: 8200
|
|
vault_etcd_url: "{{ etcd_access_addresses }}"
|
|
|
|
# By default lease
|
|
vault_default_lease_ttl: 70080h
|
|
vault_max_lease_ttl: 87600h
|
|
|
|
vault_temp_config:
|
|
backend:
|
|
file:
|
|
path: /vault/file
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
listener:
|
|
tcp:
|
|
address: "{{ vault_bind_address }}:{{ vault_port }}"
|
|
tls_disable: "true"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
|
|
vault_config:
|
|
backend:
|
|
etcd:
|
|
address: "{{ vault_etcd_url }}"
|
|
ha_enabled: "true"
|
|
redirect_addr: "https://{{ inventory_hostname }}:{{ vault_port }}"
|
|
tls_ca_file: "{{ etcd_cert_dir }}/ca.pem"
|
|
tls_cert_file: "{{ etcd_cert_dir}}/node-{{ inventory_hostname }}.pem"
|
|
tls_key_file: "{{ etcd_cert_dir}}/node-{{ inventory_hostname }}-key.pem"
|
|
cluster_name: "kubernetes-vault"
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
ui: "true"
|
|
listener:
|
|
tcp:
|
|
address: "{{ vault_bind_address }}:{{ vault_port }}"
|
|
tls_cert_file: "{{ vault_cert_dir }}/api.pem"
|
|
tls_key_file: "{{ vault_cert_dir }}/api-key.pem"
|
|
|
|
vault_secret_shares: 1
|
|
vault_secret_threshold: 1
|
|
|
|
vault_successful_http_codes: ["200", "429", "500", "501", "503"]
|
|
|
|
vault_ca_options:
|
|
vault:
|
|
common_name: vault
|
|
format: pem
|
|
ttl: "{{ vault_max_lease_ttl }}"
|
|
exclude_cn_from_sans: true
|
|
alt_names: "vault.kube-system.svc.{{ dns_domain }},vault.kube-system.svc,vault.kube-system,vault"
|
|
etcd:
|
|
common_name: etcd
|
|
format: pem
|
|
ttl: "{{ vault_max_lease_ttl }}"
|
|
exclude_cn_from_sans: true
|
|
kube:
|
|
common_name: kube
|
|
format: pem
|
|
ttl: "{{ vault_max_lease_ttl }}"
|
|
exclude_cn_from_sans: true
|
|
|
|
vault_client_headers:
|
|
Accept: "application/json"
|
|
Content-Type: "application/json"
|
|
|
|
etcd_cert_dir: /etc/ssl/etcd/ssl
|
|
kube_cert_dir: /etc/kubernetes/ssl
|
|
|
|
vault_pki_mounts:
|
|
userpass:
|
|
name: userpass
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
description: "Userpass"
|
|
cert_dir: "{{ vault_cert_dir }}"
|
|
roles:
|
|
- name: userpass
|
|
group: userpass
|
|
password: "{{ lookup('password', credentials_dir + '/vault/userpass.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
|
|
vault:
|
|
name: vault
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
description: "Vault Root CA"
|
|
cert_dir: "{{ vault_cert_dir }}"
|
|
roles:
|
|
- name: vault
|
|
group: vault
|
|
password: "{{ lookup('password', credentials_dir + '/vault/vault.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
etcd:
|
|
name: etcd
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
description: "Etcd Root CA"
|
|
cert_dir: "{{ etcd_cert_dir }}"
|
|
roles:
|
|
- name: etcd
|
|
group: etcd
|
|
password: "{{ lookup('password', credentials_dir + '/vault/etcd.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
enforce_hostnames: false
|
|
organization: "kube:etcd"
|
|
kube:
|
|
name: kube
|
|
default_lease_ttl: "{{ vault_default_lease_ttl }}"
|
|
max_lease_ttl: "{{ vault_max_lease_ttl }}"
|
|
description: "Kubernetes Root CA"
|
|
cert_dir: "{{ kube_cert_dir }}"
|
|
roles:
|
|
- name: kube_control_plane
|
|
group: kube_control_plane
|
|
password: "{{ lookup('password', credentials_dir + '/vault/kube_control_plane.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
enforce_hostnames: false
|
|
organization: "system:masters"
|
|
- name: front-proxy-client
|
|
group: kube_control_plane
|
|
password: "{{ lookup('password', credentials_dir + '/vault/kube-proxy.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
enforce_hostnames: false
|
|
organization: "system:front-proxy-client"
|
|
- name: kube-node
|
|
group: k8s-cluster
|
|
password: "{{ lookup('password', credentials_dir + '/vault/kube-node.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
enforce_hostnames: false
|
|
organization: "system:nodes"
|
|
- name: kube-proxy
|
|
group: k8s-cluster
|
|
password: "{{ lookup('password', credentials_dir + '/vault/kube-proxy.creds length=15') }}"
|
|
policy_rules: default
|
|
role_options:
|
|
allow_any_name: true
|
|
enforce_hostnames: false
|
|
organization: "system:node-proxier"
|