486b223e01
This replaces kube-master with kube_control_plane because of [1]:
The Kubernetes project is moving away from wording that is
considered offensive. A new working group WG Naming was created
to track this work, and the word "master" was declared as offensive.
A proposal was formalized for replacing the word "master" with
"control plane". This means it should be removed from source code,
documentation, and user-facing configuration from Kubernetes and
its sub-projects.
NOTE: The reason why this changes it to kube_control_plane not
kube-control-plane is for valid group names on ansible.
[1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation
54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
---
|
|
- include_tasks: ../shared/sync_file.yml
|
|
vars:
|
|
sync_file: "ca.pem"
|
|
sync_file_dir: "{{ vault_cert_dir }}"
|
|
sync_file_hosts: "{{ groups.vault }}"
|
|
sync_file_owner: vault
|
|
sync_file_group: root
|
|
sync_file_is_cert: true
|
|
|
|
- name: bootstrap/sync_vault_certs | Set facts for vault sync_file results
|
|
set_fact:
|
|
vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"
|
|
|
|
- name: bootstrap/sync_vault_certs | Unset sync_file_results after ca.pem sync
|
|
set_fact:
|
|
sync_file_results: []
|
|
|
|
# FIXME: Distribute ca.pem alone in a better way
|
|
- include_tasks: ../shared/sync_file.yml
|
|
vars:
|
|
sync_file: "ca.pem"
|
|
sync_file_dir: "{{ vault_cert_dir }}"
|
|
sync_file_hosts: "{{ groups['kube_control_plane'] }}"
|
|
sync_file_owner: vault
|
|
sync_file_group: root
|
|
sync_file_is_cert: false
|
|
|
|
- name: bootstrap/sync_vault_certs | Set facts for vault sync_file results
|
|
set_fact:
|
|
vault_ca_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"
|
|
|
|
- name: bootstrap/sync_vault_certs | Unset sync_file_results after ca.pem sync
|
|
set_fact:
|
|
sync_file_results: []
|
|
|
|
|
|
- include_tasks: ../shared/sync_file.yml
|
|
vars:
|
|
sync_file: "api.pem"
|
|
sync_file_dir: "{{ vault_cert_dir }}"
|
|
sync_file_hosts: "{{ groups.vault }}"
|
|
sync_file_owner: vault
|
|
sync_file_group: root
|
|
sync_file_is_cert: true
|
|
|
|
- name: bootstrap/sync_vault_certs | Set fact if Vault's API cert is needed
|
|
set_fact:
|
|
vault_api_cert_needed: "{{ sync_file_results[0]['no_srcs'] }}"
|
|
|
|
- name: bootstrap/sync_vault_certs | Unset sync_file_results after api.pem sync
|
|
set_fact:
|
|
sync_file_results: []
|