kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/kubernetes/secrets/templates/openssl.conf.j2

38 lines
1.4 KiB
Plaintext
Raw Normal View History

Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs
2015-12-11 18:32:13 +08:00
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
Add kubernetes.default.svc in certs dns
2016-04-01 18:40:01 +08:00
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.{{ dns_domain }}
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
DNS.5 = localhost
add kube-masters to SSL certificate
2016-09-27 01:14:19 +08:00
{% for host in groups['kube-master'] %}
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
DNS.{{ 5 + loop.index }} = {{ host }}
add kube-masters to SSL certificate
2016-09-27 01:14:19 +08:00
{% endfor %}
Defaults for apiserver_loadbalancer_domain_name (#1993) * Defaults for apiserver_loadbalancer_domain_name When loadbalancer_apiserver is defined, use the apiserver_loadbalancer_domain_name with a given default value. Fix unconsistencies for checking if apiserver_loadbalancer_domain_name is defined AND using it with a default value provided at once. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> * Define defaults for LB modes in common defaults Adjust the defaults for apiserver_loadbalancer_domain_name and loadbalancer_apiserver_localhost to come from a single source, which is kubespray-defaults. Removes some confusion and simplefies the code. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2017-11-24 00:15:48 +08:00
{% if loadbalancer_apiserver is defined %}
fix load balancer DNS name index evaluation in openssl.conf Looks like OpenSSL still properly handles it, even with duplicated "DNS.X" items.
2017-02-16 05:13:52 +08:00
{% set idx = groups['kube-master'] | length | int + 5 + 1 %}
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
DNS.{{ idx | string }} = {{ apiserver_loadbalancer_domain_name }}
manage undefined vars for loadbalancing
2015-12-15 23:51:55 +08:00
{% endif %}
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs
2015-12-11 18:32:13 +08:00
{% for host in groups['kube-master'] %}
Add variables and defaults for multiple types of ip addresses. Each node can have 3 IPs. 1. ansible_default_ip4 - whatever ansible things is the first IPv4 address usually with the default gw. 2. ip - An address to use on the local node to bind listeners and do local communication. For example, Vagrant boxes have a first address that is the NAT bridge and is common for all nodes. The second address/interface should be used. 3. access_ip - An address to use for node-to-node access. This is assumed to be used by other nodes to access the node and may not be actually assigned on the node. For example, AWS public ip that is not assigned to node. This updates the places addresses are used to use either ip or access_ip and walk up the list to find an address.
2016-01-27 04:41:42 +08:00
IP.{{ 2 * loop.index - 1 }} = {{ hostvars[host]['access_ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
IP.{{ 2 * loop.index }} = {{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs
2015-12-11 18:32:13 +08:00
{% endfor %}
Add variables and defaults for multiple types of ip addresses. Each node can have 3 IPs. 1. ansible_default_ip4 - whatever ansible things is the first IPv4 address usually with the default gw. 2. ip - An address to use on the local node to bind listeners and do local communication. For example, Vagrant boxes have a first address that is the NAT bridge and is common for all nodes. The second address/interface should be used. 3. access_ip - An address to use for node-to-node access. This is assumed to be used by other nodes to access the node and may not be actually assigned on the node. For example, AWS public ip that is not assigned to node. This updates the places addresses are used to use either ip or access_ip and walk up the list to find an address.
2016-01-27 04:41:42 +08:00
{% set idx = groups['kube-master'] | length | int * 2 + 1 %}
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
IP.{{ idx }} = {{ kube_apiserver_ip }}
Loadbalancer Apiserver Address is missing If you configure your external loadbalancer to do a simple tcp pass-through to the api servers, and you do not use a DNS FQDN but just the ip, then you need to add the ip adress to the certificates too. Example config: ``` ## External LB example config apiserver_loadbalancer_domain_name: "10.50.63.10" loadbalancer_apiserver: address: 10.50.63.10 port: 8383 ```
2018-01-31 00:33:00 +08:00
{% if loadbalancer_apiserver is defined %}
IP.{{ idx + 1 }} = {{ loadbalancer_apiserver.address }}
{% endif %}
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
IP.{{ idx + 1 }} = 127.0.0.1
Add possibility to insert more ip adresses in certificates (#1678) * Add possibility to insert more ip adresses in certificates * Add newline at end of files * Move supp ip parameters to k8s-cluster group file * Add supplementary addresses in kubeadm master role * Improve openssl indexes
2017-10-17 18:06:07 +08:00
{% if supplementary_addresses_in_ssl_keys is defined %}
{% set is = idx + 1 %}
{% for addr in supplementary_addresses_in_ssl_keys %}
IP.{{ is + loop.index }} = {{ addr }}
{% endfor %}
{% endif %}