mirror of https://github.com/easzlab/kubeasz.git
41 lines
1.8 KiB
YAML
41 lines
1.8 KiB
YAML
|
- block:
|
||
|
|
- name: 下载 group:read rbac 文件
|
||
|
|
copy: src=read-group-rbac.yaml dest=/tmp/read-group-rbac.yaml
|
||
|
|
|
||
|
|
- name: 创建group:read rbac 绑定
|
||
|
|
shell: "{{ base_dir }}/bin/kubectl apply -f /tmp/read-group-rbac.yaml"
|
||
|
|
|
||
|
|
- name: 准备kubectl使用的read证书签名请求
|
||
|
|
template: src=read-csr.json.j2 dest={{ base_dir }}/.cluster/ssl/read-csr.json
|
||
|
|
|
||
|
|
- name: 创建read证书与私钥
|
||
|
|
shell: "cd {{ base_dir }}/.cluster/ssl && {{ base_dir }}/bin/cfssl gencert \
|
||
|
|
-ca=ca.pem \
|
||
|
|
-ca-key=ca-key.pem \
|
||
|
|
-config=ca-config.json \
|
||
|
|
-profile=kubernetes read-csr.json | {{ base_dir }}/bin/cfssljson -bare read"
|
||
|
|
|
||
|
|
- name: 设置只读kubeconfig集群参数
|
||
|
|
shell: "{{ base_dir }}/bin/kubectl config set-cluster {{ CLUSTER_NAME }} \
|
||
|
|
--certificate-authority={{ base_dir }}/.cluster/ssl/ca.pem \
|
||
|
|
--embed-certs=true \
|
||
|
|
--server={{ KUBE_APISERVER }} \
|
||
|
|
--kubeconfig=/root/.kube/read.config"
|
||
|
|
|
||
|
|
- name: 设置只读kubeconfig客户端认证参数
|
||
|
|
shell: "{{ base_dir }}/bin/kubectl config set-credentials read \
|
||
|
|
--client-certificate={{ base_dir }}/.cluster/ssl/read.pem \
|
||
|
|
--embed-certs=true \
|
||
|
|
--client-key={{ base_dir }}/.cluster/ssl/read-key.pem \
|
||
|
|
--kubeconfig=/root/.kube/read.config"
|
||
|
|
|
||
|
|
- name: 设置只读kubeconfig上下文参数
|
||
|
|
shell: "{{ base_dir }}/bin/kubectl config set-context {{ CLUSTER_NAME }} \
|
||
|
|
--cluster={{ CLUSTER_NAME }} --user=read \
|
||
|
|
--kubeconfig=/root/.kube/read.config"
|
||
|
|
|
||
|
|
- name: 选择只读kubeconfig默认上下文
|
||
|
|
shell: "{{ base_dir }}/bin/kubectl config use-context {{ CLUSTER_NAME }} \
|
||
|
|
--kubeconfig=/root/.kube/read.config"
|
||
|
|
tags: create_ro_kctl_cfg
|