6f36faa4f9
If you configure your external loadbalancer to do a simple tcp pass-through to the api servers, and you do not use a DNS FQDN but just the ip, then you need to add the ip adress to the certificates too. Example config: ``` ## External LB example config apiserver_loadbalancer_domain_name: "10.50.63.10" loadbalancer_apiserver: address: 10.50.63.10 port: 8383 ```
38 lines
1.4 KiB
Django/Jinja
38 lines
1.4 KiB
Django/Jinja
[req]
|
|
req_extensions = v3_req
|
|
distinguished_name = req_distinguished_name
|
|
[req_distinguished_name]
|
|
[ v3_req ]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
[alt_names]
|
|
DNS.1 = kubernetes
|
|
DNS.2 = kubernetes.default
|
|
DNS.3 = kubernetes.default.svc
|
|
DNS.4 = kubernetes.default.svc.{{ dns_domain }}
|
|
DNS.5 = localhost
|
|
{% for host in groups['kube-master'] %}
|
|
DNS.{{ 5 + loop.index }} = {{ host }}
|
|
{% endfor %}
|
|
{% if loadbalancer_apiserver is defined %}
|
|
{% set idx = groups['kube-master'] | length | int + 5 + 1 %}
|
|
DNS.{{ idx | string }} = {{ apiserver_loadbalancer_domain_name }}
|
|
{% endif %}
|
|
{% for host in groups['kube-master'] %}
|
|
IP.{{ 2 * loop.index - 1 }} = {{ hostvars[host]['access_ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
|
|
IP.{{ 2 * loop.index }} = {{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
|
|
{% endfor %}
|
|
{% set idx = groups['kube-master'] | length | int * 2 + 1 %}
|
|
IP.{{ idx }} = {{ kube_apiserver_ip }}
|
|
{% if loadbalancer_apiserver is defined %}
|
|
IP.{{ idx + 1 }} = {{ loadbalancer_apiserver.address }}
|
|
{% endif %}
|
|
IP.{{ idx + 1 }} = 127.0.0.1
|
|
{% if supplementary_addresses_in_ssl_keys is defined %}
|
|
{% set is = idx + 1 %}
|
|
{% for addr in supplementary_addresses_in_ssl_keys %}
|
|
IP.{{ is + loop.index }} = {{ addr }}
|
|
{% endfor %}
|
|
{% endif %}
|