mirror of https://github.com/easzlab/kubeasz.git
98 lines
3.7 KiB
YAML
98 lines
3.7 KiB
YAML
# [optional] to set up a HARBOR, and to integrate the HARBOR with k8s cluster
|
|
# read the guide: 'guide/harbor.md'
|
|
|
|
- hosts: harbor
|
|
roles:
|
|
- { role: os-harden, when: "OS_HARDEN|bool" }
|
|
- { role: chrony, when: "NEW_INSTALL == 'yes' and groups['chrony']|length > 0" }
|
|
- { role: prepare, when: "NEW_INSTALL == 'yes'" }
|
|
- { role: docker, when: "NEW_INSTALL == 'yes'" }
|
|
- { role: harbor, when: "NEW_INSTALL == 'yes'" }
|
|
tasks:
|
|
- name: Fetching the HARBOR SERVER's CA cert
|
|
fetch:
|
|
src: "{{ ca_dir }}/ca.pem"
|
|
dest: "{{ base_dir }}/down/"
|
|
flat: yes
|
|
when: hostvars[groups.harbor[0]]['SELF_SIGNED_CERT'] == 'yes'
|
|
|
|
- hosts:
|
|
- kube_master
|
|
- kube_node
|
|
tasks:
|
|
- name: Define 'harbor_hostname', a domain name
|
|
set_fact: harbor_hostname={{ hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] }}
|
|
|
|
- name: Define 'harbor_hostname', an IP Addr
|
|
set_fact: harbor_hostname={{ groups['harbor'][0] }}
|
|
when: hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] == ''
|
|
|
|
- block:
|
|
- block:
|
|
- name: Creating cert dir for the docker daemon
|
|
file: name=/etc/docker/certs.d/{{ harbor_hostname }} state=directory
|
|
|
|
- name: Installing the HARBOR SERVER's CA cert for docker
|
|
copy: src={{ base_dir }}/down/ca.pem dest=/etc/docker/certs.d/{{ harbor_hostname }}/ca.crt
|
|
when: CONTAINER_RUNTIME == 'docker'
|
|
|
|
- block:
|
|
- name: Installing the HARBOR SERVER's CA cert on k8s nodes
|
|
copy: src={{ base_dir }}/down/ca.pem dest=/usr/share/ca-certificates/harbor-ca.crt
|
|
|
|
- name: Add the HARBOR SERVER's CA cert
|
|
lineinfile:
|
|
dest: /etc/ca-certificates.conf
|
|
state: present
|
|
regexp: 'harbor-ca'
|
|
line: 'harbor-ca.crt'
|
|
|
|
- name: Update the trusted ca-certificates
|
|
shell: 'update-ca-certificates'
|
|
|
|
- name: restart containerd
|
|
service: name=containerd state=restarted
|
|
when:
|
|
- 'CONTAINER_RUNTIME == "containerd"'
|
|
- 'ansible_distribution == "Ubuntu"'
|
|
|
|
- block:
|
|
- name: Installing the HARBOR SERVER's CA cert on k8s nodes
|
|
copy: src={{ base_dir }}/down/ca.pem dest=/etc/pki/ca-trust/source/anchors/harbor-ca.crt
|
|
|
|
- name: Update the trusted ca-certificates
|
|
shell: 'update-ca-trust'
|
|
|
|
- name: restart containerd
|
|
service: name=containerd state=restarted
|
|
when:
|
|
- 'CONTAINER_RUNTIME == "containerd"'
|
|
- 'ansible_distribution in ["CentOS","RedHat","Amazon","Aliyun"]'
|
|
when: hostvars[groups.harbor[0]]['SELF_SIGNED_CERT'] == 'yes'
|
|
|
|
# [optional] if you have a DNS server, add an 'A record' instead
|
|
- name: Adding an '/etc/hosts' entry for the HARBOR DOMAIN
|
|
lineinfile:
|
|
dest: /etc/hosts
|
|
state: present
|
|
regexp: '{{ harbor_hostname }}'
|
|
line: "{{ groups['harbor'][0] }} {{ harbor_hostname }}"
|
|
when: "hostvars[groups.harbor[0]]['HARBOR_DOMAIN'] != ''"
|
|
|
|
# [optional] 使用 cloud-init 初始化的虚拟机，/etc/hosts 后会重启时被替换，需修改对应的模板文件
|
|
- name: Adding cloud-init hosts template (debian) entry for the HARBOR DOMAIN
|
|
lineinfile:
|
|
dest: /etc/cloud/templates/hosts.debian.tmpl
|
|
state: present
|
|
regexp: '{{ harbor_hostname }}'
|
|
line: "{{ groups['harbor'][0] }} {{ harbor_hostname }}"
|
|
when: 'ansible_distribution in ["Ubuntu","Debian"]'
|
|
|
|
- name: Adding cloud-init hosts template (redhat) entry for the HARBOR DOMAIN
|
|
lineinfile:
|
|
dest: /etc/cloud/templates/hosts.redhat.tmpl
|
|
state: present
|
|
regexp: '{{ harbor_hostname }}'
|
|
line: "{{ groups['harbor'][0] }} {{ harbor_hostname }}"
|
|
when: 'ansible_distribution in ["CentOS","RedHat","Amazon","Aliyun"]'
|