f106bf5bc4
Squashed commits: [f9355ea] Swap order in which we reload docker/socket [2ca6819] Reload docker.socket after installing flannel on coreos Workaround for #569 [9f976e5] Vagrantfile: setup proxy inside virtual machines In corporate networks, it is good to pre-configure proxy variables. [9d7142f] Vagrantfile: use Ubuntu 16.04 LTS Use recent supported version of Ubuntu for local development setup with Vagrant. [50f77cc] Add CI test layouts * Drop Wily from test matrix * Replace the Wily cases dropped with extra cases to test separate roles deployment Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> [03e162b] Update OWNERS [c7b00ca] Use tar+register instead of copy/slurp for distributing tokens and certs Related bug: https://github.com/ansible/ansible/issues/15405 Uses tar and register because synchronize module cannot sudo on the remote side correctly and copy is too slow. This patch dramatically cuts down the number of tasks to process for cert synchronization. [2778ac6] Add new var skip_dnsmasq_k8s If skip_dnsmasq is set, it will still not set up dnsmasq k8s pod. This enables independent setup of resolvconf section before kubelet is up.
93 lines
3.1 KiB
YAML
93 lines
3.1 KiB
YAML
---
|
|
- name: Gen_certs | write openssl config
|
|
template:
|
|
src: "openssl.conf.j2"
|
|
dest: "{{ kube_config_dir }}/openssl.conf"
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
|
|
- name: Gen_certs | copy certs generation script
|
|
copy:
|
|
src: "make-ssl.sh"
|
|
dest: "{{ kube_script_dir }}/make-ssl.sh"
|
|
mode: 0700
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
|
|
- name: Gen_certs | run cert generation script
|
|
command: "{{ kube_script_dir }}/make-ssl.sh -f {{ kube_config_dir }}/openssl.conf -d {{ kube_cert_dir }}"
|
|
run_once: yes
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
when: gen_certs|default(false)
|
|
notify: set secret_changed
|
|
|
|
- set_fact:
|
|
master_certs: ['ca-key.pem', 'admin.pem', 'admin-key.pem', 'apiserver-key.pem', 'apiserver.pem']
|
|
node_certs: ['ca.pem', 'node.pem', 'node-key.pem']
|
|
|
|
- name: Gen_certs | Gather master certs
|
|
shell: "tar cfz - -C {{ kube_cert_dir }} {{ master_certs|join(' ') }} {{ node_certs|join(' ') }} | base64 --wrap=0"
|
|
register: master_cert_data
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
run_once: true
|
|
when: sync_certs|default(false)
|
|
|
|
- name: Gen_certs | Gather node certs
|
|
shell: "tar cfz - -C {{ kube_cert_dir }} {{ node_certs|join(' ') }} | base64 --wrap=0"
|
|
register: node_cert_data
|
|
delegate_to: "{{groups['kube-master'][0]}}"
|
|
run_once: true
|
|
when: sync_certs|default(false)
|
|
|
|
- name: Gen_certs | Copy certs on masters
|
|
shell: "echo '{{master_cert_data.stdout|quote}}' | base64 -d | tar xz -C {{ kube_cert_dir }}"
|
|
changed_when: false
|
|
when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | Copy certs on nodes
|
|
shell: "echo '{{node_cert_data.stdout|quote}}' | base64 -d | tar xz -C {{ kube_cert_dir }}"
|
|
changed_when: false
|
|
when: inventory_hostname in groups['kube-node'] and sync_certs|default(false) and
|
|
inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | check certificate permissions
|
|
file:
|
|
path={{ kube_cert_dir }}
|
|
group={{ kube_cert_group }}
|
|
owner=kube
|
|
recurse=yes
|
|
|
|
- name: Gen_certs | set permissions on keys
|
|
shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
|
|
when: inventory_hostname in groups['kube-master']
|
|
changed_when: false
|
|
|
|
- name: Gen_certs | target ca-certificates directory
|
|
set_fact:
|
|
ca_cert_dir: |-
|
|
{% if ansible_os_family == "Debian" -%}
|
|
/usr/local/share/ca-certificates
|
|
{%- elif ansible_os_family == "RedHat" -%}
|
|
/etc/pki/ca-trust/source/anchors
|
|
{%- elif ansible_os_family == "CoreOS" -%}
|
|
/etc/ssl/certs
|
|
{%- endif %}
|
|
|
|
- name: Gen_certs | add CA to trusted CA dir
|
|
copy:
|
|
src: "{{ kube_cert_dir }}/ca.pem"
|
|
dest: "{{ ca_cert_dir }}/kube-ca.crt"
|
|
remote_src: true
|
|
register: kube_ca_cert
|
|
|
|
- name: Gen_certs | update ca-certificates (Debian/Ubuntu/CoreOS)
|
|
command: update-ca-certificates
|
|
when: kube_ca_cert.changed and ansible_os_family in ["Debian", "CoreOS"]
|
|
|
|
- name: Gen_certs | update ca-certificatesa (RedHat)
|
|
command: update-ca-trust extract
|
|
when: kube_ca_cert.changed and ansible_os_family == "RedHat"
|
|
|