废弃ansible hosts中basic_auth相关配置

example/hosts.allinone.example

@@ -53,10 +53,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # 集群 DNS 域名
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# 集群basic auth 使用的用户名和密码 (运行时会生成随机密码)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # ---------附加参数--------------------
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"

example/hosts.allinone.example.en

@@ -54,10 +54,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # Cluster DNS Domain
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# Basic auth for apiserver (a random password will be gennerated on cluster setup)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # -------- Additional Variables --------------------
 # Binaries Directory
 bin_dir="/opt/kube/bin"

example/hosts.cloud.example

@@ -53,10 +53,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # 集群 DNS 域名
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# 集群basic auth 使用的用户名和密码 (运行时会生成随机密码)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # ---------附加参数--------------------
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"

example/hosts.cloud.example.en

@@ -54,10 +54,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # Cluster DNS Domain
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# Basic auth for apiserver (a random password will be gennerated on cluster setup)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # -------- Additional Variables --------------------
 # Binaries Directory
 bin_dir="/opt/kube/bin"

example/hosts.m-masters.example

@@ -63,10 +63,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # 集群 DNS 域名
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# 集群basic auth 使用的用户名和密码 (运行时会生成随机密码)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # ---------附加参数--------------------
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"

example/hosts.m-masters.example.en

@@ -64,10 +64,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # Cluster DNS Domain
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# Basic auth for apiserver (a random password will be gennerated on cluster setup)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # -------- Additional Variables --------------------
 # Binaries Directory
 bin_dir="/opt/kube/bin"

example/hosts.s-master.example

@@ -54,10 +54,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # 集群 DNS 域名
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# 集群basic auth 使用的用户名和密码 (运行时会生成随机密码)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # ---------附加参数--------------------
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"

example/hosts.s-master.example.en

@@ -55,10 +55,6 @@ CLUSTER_DNS_SVC_IP="10.68.0.2"
 # Cluster DNS Domain
 CLUSTER_DNS_DOMAIN="cluster.local."
 
-# Basic auth for apiserver (a random password will be gennerated on cluster setup)
-BASIC_AUTH_USER="admin"
-BASIC_AUTH_PASS="test1234"
-
 # -------- Additional Variables --------------------
 # Binaries Directory
 bin_dir="/opt/kube/bin"

roles/deploy/tasks/main.yml

@@ -32,12 +32,6 @@
   when: p.stat.isreg is not defined
   shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert -initca ca-csr.json | {{ bin_dir }}/cfssljson -bare ca" 
 
-# 随机生成集群 basic auth 使用的密码
-- name: 生成随机 basic auth 密码
-  shell: 'export PWD=`date +%s%N | md5sum | head -c 16`; sed -i "s/^BASIC_AUTH_PASS.*$/BASIC_AUTH_PASS=\"$PWD\"/g" {{ base_dir }}/hosts'
-  connection: local
-  when: p.stat.isreg is not defined
-
 #----------- 创建kubectl kubeconfig文件: /root/.kube/config
 - name: 准备kubectl使用的admin 证书签名请求
   template: src=admin-csr.json.j2 dest={{ ca_dir }}/admin-csr.json

roles/kube-master/defaults/main.yml

@@ -8,3 +8,10 @@ MASTER_CERT_HOSTS:
   - "k8s.test.io"
   #- "61.182.11.41"
   #- "www.test.com"
+
+# apiserver 基础认证（用户名/密码）配置
+# BASIC_AUTH_PASS 初次运行时会被随机密码覆盖
+# 在 master 节点文件‘/etc/kubernetes/ssl/basic-auth.csv’ 可以查看密码
+BASIC_AUTH_ENABLE: "yes"
+BASIC_AUTH_USER: "admin"
+BASIC_AUTH_PASS: "test1234"