kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/vault/tasks/cluster/main.yml

56 lines
1.7 KiB
YAML
Raw Normal View History

Adding the Vault role
2017-01-14 04:31:10 +08:00
---
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size
2018-05-12 00:11:38 +08:00
- import_tasks: ../shared/check_etcd.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size
2018-05-12 00:11:38 +08:00
- import_tasks: ../shared/check_vault.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: configure.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: binary.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault and vault_deployment_type == "host"
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: systemd.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size
2018-05-12 00:11:38 +08:00
- import_tasks: ../shared/find_leader.yml
when: inventory_hostname in groups.vault
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: init.yml
Adding the Vault role
2017-01-14 04:31:10 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: unseal.yml
Adding the Vault role
2017-01-14 04:31:10 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: ../shared/find_leader.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: create_mounts.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
when: inventory_hostname == groups.vault|first
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: ../shared/gen_ca.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
vars:
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
gen_ca_cert_dir: "{{ vault_pki_mounts.kube.cert_dir }}"
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size
2018-05-12 00:11:38 +08:00
gen_ca_mount_path: "/{{ vault_pki_mounts.kube.name }}"
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
gen_ca_vault_headers: "{{ vault_headers }}"
gen_ca_vault_options: "{{ vault_ca_options.kube }}"
Copy ca-key.pem to etcd and kube-masters accordingly
2018-04-11 00:55:28 +08:00
gen_ca_copy_group: "kube-master"
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
when: inventory_hostname in groups.vault
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: ../shared/auth_backend.yml
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
vars:
auth_backend_description: A Username/Password Auth Backend primarily used for services needing to issue certificates
auth_backend_path: userpass
auth_backend_type: userpass
when: inventory_hostname == groups.vault|first
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: create_roles.yml
Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster (#1632)
2017-09-08 04:30:16 +08:00
with_items:
- "{{ vault_pki_mounts.vault }}"
- "{{ vault_pki_mounts.etcd }}"
- "{{ vault_pki_mounts.kube }}"
loop_control:
loop_var: mount
Place vault role credentials only to vault group hosts
2017-09-05 16:05:06 +08:00
when: inventory_hostname in groups.vault