调整ca证书有效期等配置

roles/deploy/defaults/main.yml

@@ -1,4 +1,9 @@
+# CA 证书相关参数
+CA_EXPIRY: "876000h"
+CERT_EXPIRY: "438000h"
+
 # kubeconfig 配置参数
 CLUSTER_NAME: "cluster1"
 USER_NAME: "user1"
 CONTEXT_NAME: "context1"
+

roles/deploy/templates/ca-config.json.j2

@@ -1,7 +1,7 @@
 {
   "signing": {
     "default": {
-      "expiry": "87600h"
+      "expiry": "{{ CERT_EXPIRY }}"
     },
     "profiles": {
       "kubernetes": {
@@ -11,7 +11,7 @@
             "server auth",
             "client auth"
         ],
-        "expiry": "87600h"
+        "expiry": "{{ CERT_EXPIRY }}"
       }
     }
   }

roles/deploy/templates/ca-csr.json.j2

@@ -14,6 +14,6 @@
     }
   ],
   "ca": {
-    "expiry": "131400h"
+    "expiry": "{{ CA_EXPIRY }}"
   }
 }

roles/etcd/tasks/main.yml

@@ -18,7 +18,6 @@
   with_items:
   - ca.pem
   - ca-key.pem
-  - ca.csr
   - ca-config.json
   delegate_to: "{{ groups.deploy[0] }}"
 

roles/harbor/tasks/main.yml

@@ -29,7 +29,6 @@
       with_items:
       - ca.pem
       - ca-key.pem
-      - ca.csr
       - ca-config.json
       delegate_to: "{{ groups.deploy[0] }}"
     

roles/kube-master/tasks/main.yml

@@ -13,7 +13,6 @@
   - admin-key.pem
   - ca.pem
   - ca-key.pem
-  - ca.csr
   - ca-config.json
   delegate_to: "{{ groups.deploy[0] }}"
 

roles/kube-node/tasks/main.yml

@@ -44,7 +44,6 @@
   with_items:
   - ca.pem
   - ca-key.pem
-  - ca.csr
   - ca-config.json
   delegate_to: "{{ groups.deploy[0] }}"