kubeasz/11.harbor.yml

77 lines
2.6 KiB
YAML
Raw Normal View History

# [optional] to set up a HARBOR, and to integrate the HARBOR with k8s cluster
# read the guide: 'guide/harbor.md'
2017-12-25 15:05:21 +08:00
- hosts: harbor
roles:
- { role: chrony, when: "hostvars[groups.deploy[0]]['NTP_ENABLED'] == 'yes' and NEW_INSTALL == 'yes'" }
- { role: prepare, when: "NEW_INSTALL == 'yes'" }
- { role: docker, when: "NEW_INSTALL == 'yes'" }
- { role: harbor, when: "NEW_INSTALL == 'yes'" }
tasks:
- name: Fetching the HARBOR SERVER's CA cert
fetch:
src: "{{ ca_dir }}/ca.pem"
dest: "{{ base_dir }}/down/"
flat: yes
2017-12-25 15:05:21 +08:00
2018-02-26 20:45:17 +08:00
- hosts:
- kube-master
2018-02-26 20:45:17 +08:00
- kube-node
2017-12-25 15:05:21 +08:00
tasks:
2019-05-19 22:01:40 +08:00
- name: Define 'harbor_host', a domain name
2019-02-05 12:32:52 +08:00
set_fact: harbor_host="{{ hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] }}"
- name: Define 'harbor_host', an IP Addr
set_fact: harbor_host="{{ groups['harbor'][0] }}"
2019-05-19 22:01:40 +08:00
when: hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] == ''
2019-05-19 22:01:40 +08:00
- block:
- name: Creating cert dir for the docker daemon
file: name=/etc/docker/certs.d/{{ harbor_host }} state=directory
- name: Installing the HARBOR SERVER's CA cert for docker
copy: src={{ base_dir }}/down/ca.pem dest=/etc/docker/certs.d/{{ harbor_host }}/ca.crt
when: CONTAINER_RUNTIME == 'docker'
- block:
- name: Installing the HARBOR SERVER's CA cert on k8s nodes
copy: src={{ base_dir }}/down/ca.pem dest=/usr/share/ca-certificates/harbor-ca.crt
- name: Add the HARBOR SERVER's CA cert
lineinfile:
dest: /etc/ca-certificates.conf
state: present
regexp: 'harbor-ca'
line: 'harbor-ca.crt'
- name: Update the trusted ca-certificates
shell: 'update-ca-certificates'
- name: restart containerd
service: name=containerd state=restarted
when:
- 'CONTAINER_RUNTIME == "containerd"'
- 'ansible_distribution == "Ubuntu"'
- block:
- name: Installing the HARBOR SERVER's CA cert on k8s nodes
copy: src={{ base_dir }}/down/ca.pem dest=/etc/pki/ca-trust/source/anchors/harbor-ca.crt
- name: Update the trusted ca-certificates
shell: 'update-ca-trust'
- name: restart containerd
service: name=containerd state=restarted
when:
- 'CONTAINER_RUNTIME == "containerd"'
- 'ansible_distribution in ["CentOS","RedHat","Amazon"]'
2017-12-25 15:05:21 +08:00
# [optional] if you have a DNS server, add an 'A record' instead
- name: Adding an '/etc/hosts' entry for the HARBOR DOMAIN
2018-05-04 22:11:08 +08:00
lineinfile:
dest: /etc/hosts
state: present
2019-02-05 12:32:52 +08:00
regexp: '{{ harbor_host }}'
line: "{{ groups['harbor'][0] }} {{ harbor_host }}"
when: "hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] != ''"