4348e78b24
* Enable kubeadm etcd mode Uses cert commands from kubeadm experimental control plane to enable non-master nodes to obtain etcd certs. Related story: PROD-29434 Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178 * Add validation checks and exclude calico kdd mode Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c * Move etcd mode test to ubuntu flannel HA job Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732 * rename etcd_mode to etcd_kubeadm_enabled Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172
88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
---
|
|
- name: set architecture_groups
|
|
set_fact:
|
|
architecture_groups:
|
|
x86_64: amd64
|
|
aarch64: arm64
|
|
|
|
- name: ansible_architecture_rename
|
|
set_fact:
|
|
host_architecture: >-
|
|
{%- if ansible_architecture in architecture_groups -%}
|
|
{{ architecture_groups[ansible_architecture] }}
|
|
{%- else -%}
|
|
{{ ansible_architecture }}
|
|
{% endif %}
|
|
|
|
- include_tasks: check_certs.yml
|
|
when: cert_management == "script"
|
|
tags:
|
|
- etcd-secrets
|
|
- facts
|
|
|
|
- include_tasks: "gen_certs_script.yml"
|
|
when:
|
|
- cert_management |d('script') == "script"
|
|
tags:
|
|
- etcd-secrets
|
|
|
|
- include_tasks: upd_ca_trust.yml
|
|
tags:
|
|
- etcd-secrets
|
|
|
|
- name: "Gen_certs | Get etcd certificate serials"
|
|
command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"
|
|
register: "etcd_client_cert_serial_result"
|
|
changed_when: false
|
|
when:
|
|
- inventory_hostname in groups['k8s-cluster']|union(groups['calico-rr']|default([]))|unique|sort
|
|
tags:
|
|
- master
|
|
- network
|
|
|
|
- name: Set etcd_client_cert_serial
|
|
set_fact:
|
|
etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
|
|
when:
|
|
- inventory_hostname in groups['k8s-cluster']|union(groups['calico-rr']|default([]))|unique|sort
|
|
tags:
|
|
- master
|
|
- network
|
|
|
|
- include_tasks: "install_{{ etcd_deployment_type }}.yml"
|
|
when: is_etcd_master
|
|
tags:
|
|
- upgrade
|
|
|
|
- include_tasks: configure.yml
|
|
when: is_etcd_master
|
|
|
|
- include_tasks: refresh_config.yml
|
|
when: is_etcd_master
|
|
|
|
- name: Restart etcd if certs changed
|
|
service:
|
|
name: etcd
|
|
state: restarted
|
|
enabled: yes
|
|
when: is_etcd_master and etcd_cluster_setup and etcd_secret_changed|default(false)
|
|
|
|
- name: Restart etcd-events if certs changed
|
|
service:
|
|
name: etcd-events
|
|
state: restarted
|
|
enabled: yes
|
|
when: is_etcd_master and etcd_events_cluster_setup and etcd_secret_changed|default(false)
|
|
|
|
# After etcd cluster is assembled, make sure that
|
|
# initial state of the cluster is in `existing`
|
|
# state instead of `new`.
|
|
- include_tasks: refresh_config.yml
|
|
when: is_etcd_master
|
|
|
|
- name: Install etcdctl binary from etcd role
|
|
include_tasks: "{{ role_path }}/../../etcd/tasks/install_host.yml"
|
|
vars:
|
|
etcd_cluster_setup: true
|
|
when:
|
|
- etcd_kubeadm_enabled
|