kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/vault/tasks/bootstrap/main.yml

67 lines
2.2 KiB
YAML
Raw Normal View History

Adding the Vault role
2017-01-14 04:31:10 +08:00
---
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: ../shared/check_vault.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: sync_secrets.yml
Adding the Vault role
2017-01-14 04:31:10 +08:00
when: inventory_hostname in groups.vault
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: ../shared/find_leader.yml
Remove node name from kube-proxy and admin certificates
2017-09-05 19:40:26 +08:00
when: inventory_hostname in groups.vault and vault_cluster_is_initialized
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: sync_vault_certs.yml
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
when: inventory_hostname in groups.vault
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: sync_etcd_certs.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
when: inventory_hostname in groups.etcd
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: start_vault_temp.yml
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
when: inventory_hostname == groups.vault|first and not vault_cluster_is_initialized
Fixing reference to vault leader url (#1569)
2017-08-25 04:21:39 +08:00
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
- name: vault | Set fact about vault leader url
Fixing reference to vault leader url (#1569)
2017-08-25 04:21:39 +08:00
set_fact:
vault_leader_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
when: not vault_cluster_is_initialized
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: create_mounts.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
when: inventory_hostname == groups.vault|first
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: ../shared/auth_backend.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
vars:
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
auth_backend_description: A Username/Password Auth Backend primarily used for services needing to issue certificates
auth_backend_path: userpass
auth_backend_type: userpass
when: inventory_hostname == groups.vault|first
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: create_roles.yml
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
with_items:
- "{{ vault_pki_mounts.vault }}"
- "{{ vault_pki_mounts.etcd }}"
loop_control:
loop_var: mount
Place vault role credentials only to vault group hosts
2017-09-05 16:05:06 +08:00
when: inventory_hostname in groups.vault
Adding the Vault role
2017-01-14 04:31:10 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: ../shared/gen_ca.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
vars:
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
gen_ca_cert_dir: "{{ vault_pki_mounts.vault.cert_dir }}"
gen_ca_mount_path: "{{ vault_pki_mounts.vault.name }}"
gen_ca_vault_headers: "{{ vault_headers }}"
gen_ca_vault_options: "{{ vault_ca_options.vault }}"
when: >-
inventory_hostname in groups.vault
and not vault_cluster_is_initialized
and vault_ca_cert_needed
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- include_tasks: ../shared/gen_ca.yml
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
vars:
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
gen_ca_cert_dir: "{{ vault_pki_mounts.etcd.cert_dir }}"
gen_ca_mount_path: "{{ vault_pki_mounts.etcd.name }}"
gen_ca_vault_headers: "{{ vault_headers }}"
gen_ca_vault_options: "{{ vault_ca_options.etcd }}"
Copy ca-key.pem to etcd and kube-masters accordingly
2018-04-11 00:55:28 +08:00
gen_ca_copy_group: "etcd"
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.
2017-08-30 21:03:22 +08:00
when: inventory_hostname in groups.etcd and vault_etcd_ca_cert_needed
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: gen_vault_certs.yml
Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;
2017-09-02 03:51:37 +08:00
when: inventory_hostname in groups.vault and vault_api_cert_needed
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-18 05:22:34 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible.
2018-01-29 19:37:48 +08:00
- import_tasks: ca_trust.yml