安装流程重构之优化prepare阶段

01.prepare.yml

@@ -1,10 +1,10 @@
-# [optional] to synchronize time of nodes with 'chrony' 
+# [optional] to synchronize system time of nodes with 'chrony' 
 - hosts: all
   roles:
-  - { role: chrony, when: "hostvars[groups.deploy[0]]['NTP_ENABLED'] == 'yes'" }
+  - { role: chrony, when: "groups['chrony']|length > 0" }
 
-# to create CA, kubeconfig, kube-proxy.kubeconfig etc. on 'deploy' node
-- hosts: deploy
+# to create CA, kubeconfig, kube-proxy.kubeconfig etc.
+- hosts: localhost
   roles:
   - deploy
 
@@ -12,13 +12,6 @@
 - hosts:
   - kube-master
   - kube-node
-  - deploy
   - etcd
-  - lb
   roles:
   - prepare
-
-#  [optional] to install loadbalance service, only needed by multi-master cluster 
-- hosts: lb
-  roles:
-  - lb

docs/op/readonly_kubectl.md

@@ -5,7 +5,7 @@
 ## 创建
 
 - 备份下原先 admin 权限的 kubeconfig 文件：`mv ~/.kube ~/.kubeadmin`
-- 执行 `ansible-playbook /etc/ansible/01.prepare.yml -t create_kctl_cfg -e KUBECTL_USER=read`，成功后查看~/.kube/config 即为只读权限
+- 执行 `ansible-playbook /etc/ansible/01.prepare.yml -t create_kctl_cfg -e USER_NAME=read`，成功后查看~/.kube/config 即为只读权限
 
 ## 讲解
 

roles/chrony/chrony.yml

@@ -1,3 +1,3 @@
 - hosts: all
   roles:
-  - { role: chrony, when: "hostvars[groups.deploy[0]]['NTP_ENABLED'] == 'yes'" }
+  - { role: chrony, when: "groups['chrony']|length > 0" }

roles/chrony/tasks/main.yml

@@ -1,6 +1,7 @@
 - name: apt更新缓存刷新
   apt: update_cache=yes cache_valid_time=72000
   when: ansible_distribution == "Ubuntu" and ansible_distribution_major_version|int >= 16
+  ignore_errors: true
 
 - name: 确保已卸载ntp
   package: name=ntp state=absent
@@ -11,7 +12,7 @@
 - block:
   - name: 配置 chrony server 
     template: src=server-centos.conf.j2 dest=/etc/chrony.conf
-    when: (ansible_distribution == "CentOS" or ansible_distribution == "RedHat") and ansible_distribution_major_version == "7"
+    when: 'ansible_distribution in ["CentOS","RedHat","Amazon"]' 
 
   - name: 配置 chrony server
     template: src=server-ubuntu.conf.j2 dest=/etc/chrony/chrony.conf
@@ -19,17 +20,17 @@
 
   - name: 启动 chrony server
     service: name=chronyd state=restarted enabled=yes
-    when: (ansible_distribution == "CentOS" or ansible_distribution == "RedHat") and ansible_distribution_major_version == "7"
-  
+    when: 'ansible_distribution in ["CentOS","RedHat","Amazon"]' 
+
   - name: 启动 chrony server
     service: name=chrony state=restarted enabled=yes
     when: ansible_distribution == "Ubuntu" and ansible_distribution_major_version|int >= 16 
-  when: 'inventory_hostname == groups.deploy[0]'
+  when: 'inventory_hostname == groups.chrony[0]'
 
 - block:
   - name: 配置 chrony client
     template: src=client-centos.conf.j2 dest=/etc/chrony.conf
-    when: (ansible_distribution == "CentOS" or ansible_distribution == "RedHat") and ansible_distribution_major_version == "7"
+    when: 'ansible_distribution in ["CentOS","RedHat","Amazon"]' 
 
   - name: 配置 chrony client
     template: src=client-ubuntu.conf.j2 dest=/etc/chrony/chrony.conf
@@ -37,10 +38,10 @@
 
   - name: 启动 chrony client 
     service: name=chronyd state=restarted enabled=yes
-    when: (ansible_distribution == "CentOS" or ansible_distribution == "RedHat") and ansible_distribution_major_version == "7"
+    when: 'ansible_distribution in ["CentOS","RedHat","Amazon"]' 
 
   - name: 启动 chrony client
     service: name=chrony state=restarted enabled=yes
     when: ansible_distribution == "Ubuntu" and ansible_distribution_major_version|int >= 16
-  when: 'inventory_hostname != groups.deploy[0]'
+  when: 'inventory_hostname != groups.chrony[0]'
 

roles/deploy/defaults/main.yml

@@ -2,12 +2,12 @@
 CA_EXPIRY: "876000h"
 CERT_EXPIRY: "438000h"
 
-# kubeconfig 配置参数
-CLUSTER_NAME: "cluster1"
-USER_NAME: "user1"
-CONTEXT_NAME: "context1"
+# apiserver 默认第一个master节点
+KUBE_APISERVER: "https://{{ groups['kube-master'][0] }}:6443"
 
-# kubectl 权限配置
+# kubeconfig 配置参数，注意权限根据‘CLUSTER_NAME’设置：
 # 'admin' 表示创建集群管理员（所有）权限的 kubeconfig 
 # 'read' 表示创建只读权限的 kubeconfig
-KUBECTL_USER: "admin"
+CLUSTER_NAME: "cluster1"
+USER_NAME: "admin"
+CONTEXT_NAME: "context-{{ CLUSTER_NAME }}-{{ USER_NAME }}"

roles/deploy/tasks/main.yml

@@ -1,146 +1,112 @@
 - name: prepare some dirs
   file: name={{ item }} state=directory
   with_items:
-  - "{{ bin_dir }}"
-  - "{{ ca_dir }}"
-  - "{{ base_dir }}"
-  - "/etc/kubernetes"
-  - "/opt/kube/kube-system"
+  - "{{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl"
+  - "{{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/yaml"
 
-- name: 下载证书工具 CFSSL和 kubectl
-  copy: src={{ base_dir }}/bin/{{ item }} dest={{ bin_dir }}/{{ item }} mode=0755
-  with_items:
-  - cfssl
-  - cfssl-certinfo
-  - cfssljson
-  - kubectl
+- name: 本地设置 bin 目录权限
+  file: path={{ base_dir }}/bin state=directory mode=0755 recurse=yes
 
 # 注册变量p，根据p的stat信息判断是否已经生成过ca证书，如果没有，下一步生成证书
 # 如果已经有ca证书，为了保证整个安装的幂等性，跳过证书生成的步骤
 - name: 读取ca证书stat信息
-  stat: path="{{ ca_dir }}/ca.pem"
+  stat: path="{{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/ca.pem"
   register: p
 
-- name: 准备CA配置文件
-  template: src=ca-config.json.j2 dest={{ ca_dir }}/ca-config.json
-  when: p.stat.isreg is not defined
-
-- name: 准备CA签名请求
-  template: src=ca-csr.json.j2 dest={{ ca_dir }}/ca-csr.json
+- name: 准备CA配置文件和签名请求
+  template: src={{ item }}.j2 dest={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/{{ item }}
+  with_items:
+  - "ca-config.json"
+  - "ca-csr.json"
   when: p.stat.isreg is not defined
 
 - name: 生成 CA 证书和私钥
   when: p.stat.isreg is not defined
-  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert -initca ca-csr.json | {{ bin_dir }}/cfssljson -bare ca" 
+  shell: "cd {{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl && \
+	 {{ base_dir }}/bin/cfssl gencert -initca ca-csr.json | {{ base_dir }}/bin/cfssljson -bare ca" 
 
 #----------- 创建kubectl kubeconfig文件: /root/.kube/config
-- name: 删除原有kubeconfig
-  file: path=/root/.kube state=absent
-  tags: create_kctl_cfg
-
-- name: 下载 group:read rbac 文件
-  copy: src=read-group-rbac.yaml dest=/opt/kube/kube-system/read-group-rbac.yaml
-  when: KUBECTL_USER == "read"
-  tags: create_kctl_cfg
-
-- name: 创建group:read rbac 绑定
-  shell: "{{ bin_dir }}/kubectl apply -f /opt/kube/kube-system/read-group-rbac.yaml"
-  when: KUBECTL_USER == "read"
-  tags: create_kctl_cfg
-
-- name: 准备kubectl使用的{{ KUBECTL_USER }}证书签名请求
-  template: src={{ KUBECTL_USER }}-csr.json.j2 dest={{ ca_dir }}/{{ KUBECTL_USER }}-csr.json
-  tags: create_kctl_cfg
-
-- name: 创建{{ KUBECTL_USER }}证书与私钥
-  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert \
-        -ca={{ ca_dir }}/ca.pem \
-        -ca-key={{ ca_dir }}/ca-key.pem \
-        -config={{ ca_dir }}/ca-config.json \
-        -profile=kubernetes {{ KUBECTL_USER }}-csr.json | {{ bin_dir }}/cfssljson -bare {{ KUBECTL_USER }}"
-  tags: create_kctl_cfg
-
-- name: 设置集群参数
-  shell: "{{ bin_dir }}/kubectl config set-cluster {{ CLUSTER_NAME }} \
-        --certificate-authority={{ ca_dir }}/ca.pem \
-        --embed-certs=true \
-        --server={{ KUBE_APISERVER }}"
-  tags: create_kctl_cfg
-
-- name: 设置客户端认证参数
-  shell: "{{ bin_dir }}/kubectl config set-credentials {{ USER_NAME }} \
-        --client-certificate={{ ca_dir }}/{{ KUBECTL_USER }}.pem \
-        --embed-certs=true \
-        --client-key={{ ca_dir }}/{{ KUBECTL_USER }}-key.pem"
-  tags: create_kctl_cfg
-
-- name: 设置上下文参数
-  shell: "{{ bin_dir }}/kubectl config set-context {{ CONTEXT_NAME }} \
-        --cluster={{ CLUSTER_NAME }} --user={{ USER_NAME }}"
-  tags: create_kctl_cfg
-
-- name: 选择默认上下文
-  shell: "{{ bin_dir }}/kubectl config use-context {{ CONTEXT_NAME }}"
+- block:
+    - name: 删除原有kubeconfig
+      file: path=/root/.kube state=absent
+    
+    - name: 下载 group:read rbac 文件
+      copy: src=read-group-rbac.yaml dest={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/yaml/read-group-rbac.yaml
+      when: USER_NAME == "read"
+    
+    - name: 创建group:read rbac 绑定
+      shell: "{{ base_dir }}/bin/kubectl apply -f {{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/yaml/read-group-rbac.yaml"
+      when: USER_NAME == "read"
+    
+    - name: 准备kubectl使用的{{ USER_NAME }}证书签名请求
+      template: src={{ USER_NAME }}-csr.json.j2 dest={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/{{ USER_NAME }}-csr.json
+    
+    - name: 创建{{ USER_NAME }}证书与私钥
+      shell: "cd {{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl && {{ base_dir }}/bin/cfssl gencert \
+            -ca=ca.pem \
+            -ca-key=ca-key.pem \
+            -config=ca-config.json \
+            -profile=kubernetes {{ USER_NAME }}-csr.json | {{ base_dir }}/bin/cfssljson -bare {{ USER_NAME }}"
+    
+    - name: 设置集群参数
+      shell: "{{ base_dir }}/bin/kubectl config set-cluster {{ CLUSTER_NAME }} \
+            --certificate-authority={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/ca.pem \
+            --embed-certs=true \
+            --server={{ KUBE_APISERVER }}"
+    
+    - name: 设置客户端认证参数
+      shell: "{{ base_dir }}/bin/kubectl config set-credentials {{ USER_NAME }} \
+            --client-certificate={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/{{ USER_NAME }}.pem \
+            --embed-certs=true \
+            --client-key={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/{{ USER_NAME }}-key.pem"
+    
+    - name: 设置上下文参数
+      shell: "{{ base_dir }}/bin/kubectl config set-context {{ CONTEXT_NAME }} \
+            --cluster={{ CLUSTER_NAME }} --user={{ USER_NAME }}"
+    
+    - name: 选择默认上下文
+      shell: "{{ base_dir }}/bin/kubectl config use-context {{ CONTEXT_NAME }}"
   tags: create_kctl_cfg
 
 #------------创建kube-proxy.kubeconfig配置文件: /root/kube-proxy.kubeconfig
 - name: 准备kube-proxy 证书签名请求
-  template: src=kube-proxy-csr.json.j2 dest={{ ca_dir }}/kube-proxy-csr.json
+  template: src=kube-proxy-csr.json.j2 dest={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/kube-proxy-csr.json
 
 - name: 创建 kube-proxy证书与私钥
-  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert \
-        -ca={{ ca_dir }}/ca.pem \
-        -ca-key={{ ca_dir }}/ca-key.pem \
-        -config={{ ca_dir }}/ca-config.json \
-        -profile=kubernetes kube-proxy-csr.json | {{ bin_dir }}/cfssljson -bare kube-proxy"
+  shell: "cd {{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl && {{ base_dir }}/bin/cfssl gencert \
+        -ca=ca.pem \
+        -ca-key=ca-key.pem \
+        -config=ca-config.json \
+        -profile=kubernetes kube-proxy-csr.json | {{ base_dir }}/bin/cfssljson -bare kube-proxy"
 
 - name: 设置集群参数
-  shell: "{{ bin_dir }}/kubectl config set-cluster kubernetes \
-        --certificate-authority={{ ca_dir }}/ca.pem \
+  shell: "{{ base_dir }}/bin/kubectl config set-cluster kubernetes \
+        --certificate-authority={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/ca.pem \
         --embed-certs=true \
         --server={{ KUBE_APISERVER }} \
-        --kubeconfig=kube-proxy.kubeconfig"
+        --kubeconfig={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/kube-proxy.kubeconfig"
 - name: 设置客户端认证参数
-  shell: "{{ bin_dir }}/kubectl config set-credentials kube-proxy \
-        --client-certificate={{ ca_dir }}/kube-proxy.pem \
-        --client-key={{ ca_dir }}/kube-proxy-key.pem \
+  shell: "{{ base_dir }}/bin/kubectl config set-credentials kube-proxy \
+        --client-certificate={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/kube-proxy.pem \
+        --client-key={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/ssl/kube-proxy-key.pem \
         --embed-certs=true \
-        --kubeconfig=kube-proxy.kubeconfig"
+        --kubeconfig={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/kube-proxy.kubeconfig"
 - name: 设置上下文参数
-  shell: "{{ bin_dir }}/kubectl config set-context default \
+  shell: "{{ base_dir }}/bin/kubectl config set-context default \
         --cluster=kubernetes \
         --user=kube-proxy \
-        --kubeconfig=kube-proxy.kubeconfig"
+        --kubeconfig={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/kube-proxy.kubeconfig"
 - name: 选择默认上下文
-  shell: "{{ bin_dir }}/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig"
+  shell: "{{ base_dir }}/bin/kubectl config use-context default \
+	--kubeconfig={{ base_dir }}/.cluster/{{ CLUSTER_NAME }}/kube-proxy.kubeconfig"
 
-- name: 移动 kube-proxy.kubeconfig
-  shell: "mv /root/kube-proxy.kubeconfig /etc/kubernetes/"
+- name: 本地创建 easzctl 工具的软连接
+  file: src={{ base_dir }}/tools/easzctl dest=/usr/bin/easzctl state=link
 
-# --- 以下为兼容ansible执行节点与deploy节点分离情况-------
-- block:
-  - name: 在 ansible 执行节点创建 .kube 目录
-    file: path=/root/.kube state=directory
-
-  - name: 获取 kubeconfig 文件
-    fetch: src=/root/.kube/config dest=/root/.kube/config flat=yes
-
-  - name: 创建 kubectl 命令的软连接
-    file: src={{ base_dir }}/bin/kubectl dest=/usr/bin/kubectl state=link
-    connection: local
-
-  - name: 安装 rsync
-    package: name=rsync state=present
-  
-  - name: 复制 manifests至 deploy节点
-    #copy: src={{ base_dir }}/manifests dest={{ base_dir }}
-    synchronize: src={{ base_dir }}/manifests dest={{ base_dir }}
-  
-  - name: 推送 ssh 密钥对至 deploy节点
-    copy: src=~/.ssh/{{ item }} dest=~/.ssh/{{ item }} mode=0600
-    with_items:
-    - id_rsa
-    - id_rsa.pub
-    - known_hosts
-  run_once: true
-  when: "ansible_env['SSH_CLIENT'].split(' ')[0] != inventory_hostname"
+- name: 本地写入环境变量$PATH
+  lineinfile:
+    dest: ~/.bashrc
+    state: present
+    regexp: 'kubeasz'
+    line: 'export PATH={{ base_dir }}/bin/:$PATH # generated by kubeasz'
+  ignore_errors: true

roles/prepare/tasks/main.yml

@@ -21,16 +21,6 @@
   - cfssl-certinfo
   - cfssljson
 
-- name: 本地设置 bin 目录权限
-  file: path={{ base_dir }}/bin state=directory mode=0755 recurse=yes
-  connection: local
-  run_once: true
-
-- name: 本地创建 easzctl 工具的软连接
-  file: src={{ base_dir }}/tools/easzctl dest=/usr/bin/easzctl state=link
-  connection: local
-  run_once: true
-
 - name: 写入环境变量$PATH 
   lineinfile:
     dest: ~/.bashrc