c12s-kubespray/roles/kubernetes/secrets/tasks/main.yml
JuanJo Ciarlante a5edd0d709 [jjo] add kube-router support (#3339)
* [jjo] add kube-router support

Fixes cloudnativelabs/kube-router#147.

* add kube-router as another network_plugin choice
* support most used kube-router flags via
  `kube_router_foo` vars as other plugins
* implement replacing kube-proxy (--run-service-proxy=true) via
  `kube_proxy_mode: none`, verified in a _non kubeadm_enabled_
  install, should also work for recent kubeadm releases via
  `skipKubeProxyInstall: true` config

* [jjo] address PR#3339 review from @woopstar

* add busybox image used by kube-router to downloads

* fix busybox download groups key

* rework kubeadm_enabled + kube_router_run_service_proxy

- verify it working ok w/the kubeadm_enabled and
  kube_router_run_service_proxy true or false

- introduce `kube_proxy_remove` fact, to decouple logic
  from kube_proxy_mode (which affects kubeadm configmap
  settings, thus no-good to ab-use it to 'none')

* improve kube-router.md re: kubeadm_enabled and kube_router_run_service_proxy

* address @woopstar latest review

* add inventory/sample/group_vars/k8s-cluster/k8s-net-kube-router.yml

* fix kube_router_run_service_proxy conditional for kube-proxy removal

* fix kube_proxy_remove fact (w/ |bool), add some needed kube-proxy tags on my and existing changes

* update kube-router tolerations for 1.12 compatibility

* add PriorityClass to kube-router DaemonSet
2018-10-16 07:15:05 -07:00

135 lines
3.6 KiB
YAML

---
- import_tasks: check-certs.yml
tags:
- k8s-secrets
- k8s-gen-certs
- facts
- import_tasks: check-tokens.yml
tags:
- k8s-secrets
- k8s-gen-tokens
- facts
- name: Make sure the certificate directory exits
file:
path: "{{ kube_cert_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
- name: Make sure the tokens directory exits
file:
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
#
# The following directory creates make sure that the directories
# exist on the first master for cases where the first master isn't
# being run.
#
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
file:
path: "{{ kube_config_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_certs|default(false) or gen_tokens|default(false)
tags:
- kubelet
- k8s-secrets
- kube-controller-manager
- kube-apiserver
- apps
- network
- master
- node
- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
file:
path: "{{ kube_script_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_certs|default(false) or gen_tokens|default(false)
tags:
- k8s-secrets
- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
file:
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_tokens|default(false)
- include_tasks: "gen_certs_{{ cert_management }}.yml"
tags:
- k8s-secrets
- k8s-gen-certs
- import_tasks: upd_ca_trust.yml
tags:
- k8s-secrets
- k8s-gen-certs
- name: "Gen_certs | Get certificate serials on kube masters"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "master_certificate_serials"
changed_when: false
with_items:
- "admin-{{ inventory_hostname }}.pem"
- "apiserver.pem"
- "kube-controller-manager.pem"
- "kube-scheduler.pem"
when: inventory_hostname in groups['kube-master']
tags:
- master
- kubelet
- node
- name: "Gen_certs | set kube master certificate serial facts"
set_fact:
etcd_admin_cert_serial: "{{ master_certificate_serials.results[0].stdout|default() }}"
apiserver_cert_serial: "{{ master_certificate_serials.results[1].stdout|default() }}"
controller_manager_cert_serial: "{{ master_certificate_serials.results[2].stdout|default() }}"
scheduler_cert_serial: "{{ master_certificate_serials.results[3].stdout|default() }}"
when: inventory_hostname in groups['kube-master']
tags:
- master
- kubelet
- node
- name: "Gen_certs | Get certificate serials on kube nodes"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "node_certificate_serials"
changed_when: false
with_items:
- "node-{{ inventory_hostname }}.pem"
- "kube-proxy-{{ inventory_hostname }}.pem"
when:
- inventory_hostname in groups['k8s-cluster']
tags:
- node
- kube-proxy
- name: "Gen_certs | set kube node certificate serial facts"
set_fact:
kubelet_cert_serial: "{{ node_certificate_serials.results[0].stdout|default() }}"
kube_proxy_cert_serial: "{{ node_certificate_serials.results[1].stdout|default() }}"
when: inventory_hostname in groups['k8s-cluster']
tags:
- kubelet
- node
- kube-proxy
- import_tasks: gen_tokens.yml
tags:
- k8s-secrets
- k8s-gen-tokens