kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/kubernetes/secrets/tasks/main.yml

138 lines
3.7 KiB
YAML
Raw Normal View History

generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-12 06:08:16 +08:00
---
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: check-certs.yml
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
- k8s-gen-certs
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
- facts
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: check-tokens.yml
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
- k8s-gen-tokens
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
- facts
fix add nodes to the cluster
2016-04-07 23:08:39 +08:00
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-12 06:08:16 +08:00
- name: Make sure the certificate directory exits
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
path: "{{ kube_cert_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-12 06:08:16 +08:00
- name: Make sure the tokens directory exits
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
generate secrets on deployment machine test travis with sudo=true instead of required
2016-02-12 06:08:16 +08:00
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
#
# The following directory creates make sure that the directories
# exist on the first master for cases where the first master isn't
# being run.
#
Add explicit name printing in task names for deletgated task during cert creation
2017-01-19 04:06:50 +08:00
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
file:
path: "{{ kube_config_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_certs|default(false) or gen_tokens|default(false)
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- kubelet
- k8s-secrets
- kube-controller-manager
- kube-apiserver
- apps
- network
- master
- node
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
Add explicit name printing in task names for deletgated task during cert creation
2017-01-19 04:06:50 +08:00
- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
file:
path: "{{ kube_script_dir }}"
state: directory
owner: kube
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_certs|default(false) or gen_tokens|default(false)
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
Add explicit name printing in task names for deletgated task during cert creation
2017-01-19 04:06:50 +08:00
- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
file:
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
path: "{{ kube_token_dir }}"
state: directory
mode: o-rwx
group: "{{ kube_cert_group }}"
This PR adds/or modifies a few tasks to allow for the playbook to be run by limit on each node without regard for order. The changes make sure that all of the directories needed to do certificate management are on the master[0] or etcd[0] node regardless of when the playbook gets run on each node. This allows for separate ansible playbook runs in parallel that don't have to be synchronized.
2017-01-15 13:24:34 +08:00
run_once: yes
delegate_to: "{{groups['kube-master'][0]}}"
when: gen_tokens|default(false)
Remove Vault (#3684) * Remove Vault * Remove reference to 'kargo' in the doc * change check order
2018-11-11 00:51:24 +08:00
- include_tasks: "gen_certs_script.yml"
when:
- cert_management |d('script') == 'script'
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
- k8s-gen-certs
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: upd_ca_trust.yml
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
- k8s-gen-certs
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
- name: "Gen_certs | Get certificate serials on kube masters"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "master_certificate_serials"
Avoid that some read-only tasks cause an ansible-change (#1910)
2017-11-06 21:51:07 +08:00
changed_when: false
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
with_items:
- "admin-{{ inventory_hostname }}.pem"
- "apiserver.pem"
- "kube-controller-manager.pem"
- "kube-scheduler.pem"
when: inventory_hostname in groups['kube-master']
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
tags:
- master
- kubelet
- node
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
- name: "Gen_certs | set kube master certificate serial facts"
set_fact:
etcd_admin_cert_serial: "{{ master_certificate_serials.results[0].stdout|default() }}"
apiserver_cert_serial: "{{ master_certificate_serials.results[1].stdout|default() }}"
controller_manager_cert_serial: "{{ master_certificate_serials.results[2].stdout|default() }}"
scheduler_cert_serial: "{{ master_certificate_serials.results[3].stdout|default() }}"
when: inventory_hostname in groups['kube-master']
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
tags:
- master
- kubelet
- node
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
- name: "Gen_certs | Get certificate serials on kube nodes"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "node_certificate_serials"
Avoid that some read-only tasks cause an ansible-change (#1910)
2017-11-06 21:51:07 +08:00
changed_when: false
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
with_items:
- "node-{{ inventory_hostname }}.pem"
- "kube-proxy-{{ inventory_hostname }}.pem"
[jjo] add kube-router support (#3339) * [jjo] add kube-router support Fixes cloudnativelabs/kube-router#147. * add kube-router as another network_plugin choice * support most used kube-router flags via `kube_router_foo` vars as other plugins * implement replacing kube-proxy (--run-service-proxy=true) via `kube_proxy_mode: none`, verified in a _non kubeadm_enabled_ install, should also work for recent kubeadm releases via `skipKubeProxyInstall: true` config * [jjo] address PR#3339 review from @woopstar * add busybox image used by kube-router to downloads * fix busybox download groups key * rework kubeadm_enabled + kube_router_run_service_proxy - verify it working ok w/the kubeadm_enabled and kube_router_run_service_proxy true or false - introduce `kube_proxy_remove` fact, to decouple logic from kube_proxy_mode (which affects kubeadm configmap settings, thus no-good to ab-use it to 'none') * improve kube-router.md re: kubeadm_enabled and kube_router_run_service_proxy * address @woopstar latest review * add inventory/sample/group_vars/k8s-cluster/k8s-net-kube-router.yml * fix kube_router_run_service_proxy conditional for kube-proxy removal * fix kube_proxy_remove fact (w/ |bool), add some needed kube-proxy tags on my and existing changes * update kube-router tolerations for 1.12 compatibility * add PriorityClass to kube-router DaemonSet
2018-10-16 22:15:05 +08:00
when:
- inventory_hostname in groups['k8s-cluster']
tags:
- node
- kube-proxy
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
- name: "Gen_certs | set kube node certificate serial facts"
set_fact:
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
kubelet_cert_serial: "{{ node_certificate_serials.results[0].stdout|default() }}"
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
kube_proxy_cert_serial: "{{ node_certificate_serials.results[1].stdout|default() }}"
when: inventory_hostname in groups['k8s-cluster']
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
tags:
- kubelet
- node
[jjo] add kube-router support (#3339) * [jjo] add kube-router support Fixes cloudnativelabs/kube-router#147. * add kube-router as another network_plugin choice * support most used kube-router flags via `kube_router_foo` vars as other plugins * implement replacing kube-proxy (--run-service-proxy=true) via `kube_proxy_mode: none`, verified in a _non kubeadm_enabled_ install, should also work for recent kubeadm releases via `skipKubeProxyInstall: true` config * [jjo] address PR#3339 review from @woopstar * add busybox image used by kube-router to downloads * fix busybox download groups key * rework kubeadm_enabled + kube_router_run_service_proxy - verify it working ok w/the kubeadm_enabled and kube_router_run_service_proxy true or false - introduce `kube_proxy_remove` fact, to decouple logic from kube_proxy_mode (which affects kubeadm configmap settings, thus no-good to ab-use it to 'none') * improve kube-router.md re: kubeadm_enabled and kube_router_run_service_proxy * address @woopstar latest review * add inventory/sample/group_vars/k8s-cluster/k8s-net-kube-router.yml * fix kube_router_run_service_proxy conditional for kube-proxy removal * fix kube_proxy_remove fact (w/ |bool), add some needed kube-proxy tags on my and existing changes * update kube-router tolerations for 1.12 compatibility * add PriorityClass to kube-router DaemonSet
2018-10-16 22:15:05 +08:00
- kube-proxy
Adding in certificate serial numbers to manifests (#1392)
2017-09-01 14:02:23 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: gen_tokens.yml
Normalize tags in all places to prepare for tag fixing in future (#1739)
2017-10-05 15:43:04 +08:00
tags:
- k8s-secrets
Add tags to deploy components by --tags option (#2960) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node
2018-07-06 14:12:13 +08:00
- k8s-gen-tokens