kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert "wip pr for improved cert sync" (#2849)

pull/2851/head
Matthew Mosesohn 2018-06-06 17:22:25 +03:00 committed by GitHub
parent cb0a257349
commit 59be578842
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 63 additions and 258 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

199
library/vault_cert_issue.py
View File

@ -1,199 +0,0 @@
#!/usr/bin/env python
DOCUMENTATION = '''
---
module: hashivault_pki_issue
version_added: "0.1"
short_description: Hashicorp Vault PKI issue module
description:
- Module to issue PKI certs from Hashicorp Vault.
options:
url:
description:
- url for vault
default: to environment variable VAULT_ADDR
ca_cert:
description:
- "path to a PEM-encoded CA cert file to use to verify the Vault server TLS certificate"
default: to environment variable VAULT_CACERT
ca_path:
description:
- "path to a directory of PEM-encoded CA cert files to verify the Vault server TLS certificate : if ca_cert is specified, its value will take precedence"
default: to environment variable VAULT_CAPATH
client_cert:
description:
- "path to a PEM-encoded client certificate for TLS authentication to the Vault server"
default: to environment variable VAULT_CLIENT_CERT
client_key:
description:
- "path to an unencrypted PEM-encoded private key matching the client certificate"
default: to environment variable VAULT_CLIENT_KEY
verify:
description:
- "if set, do not verify presented TLS certificate before communicating with Vault server : setting this variable is not recommended except during testing"
default: to environment variable VAULT_SKIP_VERIFY
authtype:
description:
- "authentication type to use: token, userpass, github, ldap, approle"
default: token
token:
description:
- token for vault
default: to environment variable VAULT_TOKEN
username:
description:
- username to login to vault.
default: to environment variable VAULT_USER
password:
description:
- password to login to vault.
default: to environment variable VAULT_PASSWORD
secret:
description:
- secret to read.
data:
description:
- Keys and values to write.
update:
description:
- Update rather than overwrite.
default: False
min_ttl:
description:
- Issue new cert if existing cert has lower TTL expressed in hours or a percentage. Examples: 70800h, 50%
force:
description:
- Force issue of new cert
'''
EXAMPLES = '''
---
- hosts: localhost
tasks:
- hashivault_write:
secret: giant
data:
foo: foe
fie: fum
'''
def main():
argspec = hashivault_argspec()
argspec['secret'] = dict(required=True, type='str')
argspec['update'] = dict(required=False, default=False, type='bool')
argspec['data'] = dict(required=False, default={}, type='dict')
module = hashivault_init(argspec, supports_check_mode=True)
result = hashivault_write(module)
if result.get('failed'):
module.fail_json(**result)
else:
module.exit_json(**result)
def _convert_to_seconds(original_value):
try:
value = str(original_value)
seconds = 0
if 'h' in value:
ray = value.split('h')
seconds = int(ray.pop(0)) * 3600
value = ''.join(ray)
if 'm' in value:
ray = value.split('m')
seconds += int(ray.pop(0)) * 60
value = ''.join(ray)
if value:
ray = value.split('s')
seconds += int(ray.pop(0))
return seconds
except Exception:
pass
return original_value
def hashivault_needs_refresh(old_data, min_ttl):
print("Checking refresh")
print_r(old_data)
return False
# if sorted(old_data.keys()) != sorted(new_data.keys()):
# return True
# for key in old_data:
# old_value = old_data[key]
# new_value = new_data[key]
# if old_value == new_value:
# continue
# if key != 'ttl' and key != 'max_ttl':
# return True
# old_value = _convert_to_seconds(old_value)
# new_value = _convert_to_seconds(new_value)
# if old_value != new_value:
# return True
# return False
#
def hashivault_changed(old_data, new_data):
if sorted(old_data.keys()) != sorted(new_data.keys()):
return True
for key in old_data:
old_value = old_data[key]
new_value = new_data[key]
if old_value == new_value:
continue
if key != 'ttl' and key != 'max_ttl':
return True
old_value = _convert_to_seconds(old_value)
new_value = _convert_to_seconds(new_value)
if old_value != new_value:
return True
return False
from ansible.module_utils.hashivault import *
@hashiwrapper
def hashivault_write(module):
result = {"changed": False, "rc": 0}
params = module.params
client = hashivault_auth_client(params)
secret = params.get('secret')
force = params.get('force', False)
min_ttl = params.get('min_ttl', "100%")
returned_data = None
if secret.startswith('/'):
secret = secret.lstrip('/')
#else:
# secret = ('secret/%s' % secret)
data = params.get('data')
with warnings.catch_warnings():
warnings.simplefilter("ignore")
changed = True
write_data = data
if params.get('update') or module.check_mode:
# Do not move this read outside of the update
read_data = client.read(secret) or {}
read_data = read_data.get('data', {})
write_data = dict(read_data)
write_data.update(data)
result['write_data'] = write_data
result['read_data'] = read_data
changed = hashivault_changed(read_data, write_data)
if not changed:
changed = hashivault_needs_refresh(read_data, min_ttl)
if changed:
if not module.check_mode:
returned_data = client.write((secret), **write_data)
if returned_data:
result['data'] = returned_data
result['msg'] = "Secret %s written" % secret
result['changed'] = changed
return result
if __name__ == '__main__':
main()

2
roles/etcd/tasks/gen_certs_vault.yml
View File

@ -62,5 +62,3 @@
with_items: "{{ etcd_node_certs_needed|d([]) }}"
when: inventory_hostname in etcd_node_cert_hosts
notify: set etcd_secret_changed
- fail:

40
roles/etcd/tasks/sync_etcd_master_certs.yml
View File

@ -8,13 +8,13 @@
"member-" + inventory_hostname + ".pem"
] }}
#- include_tasks: ../../vault/tasks/shared/sync_file.yml
# vars:
# sync_file: "{{ item }}"
# sync_file_dir: "{{ etcd_cert_dir }}"
# sync_file_hosts: [ "{{ inventory_hostname }}" ]
# sync_file_is_cert: true
# with_items: "{{ etcd_master_cert_list|d([]) }}"
- include_tasks: ../../vault/tasks/shared/sync_file.yml
vars:
sync_file: "{{ item }}"
sync_file_dir: "{{ etcd_cert_dir }}"
sync_file_hosts: [ "{{ inventory_hostname }}" ]
sync_file_is_cert: true
with_items: "{{ etcd_master_cert_list|d([]) }}"
- name: sync_etcd_certs | Set facts for etcd sync_file results
set_fact:
@ -22,16 +22,16 @@
with_items: "{{ sync_file_results|d([]) }}"
when: item.no_srcs|bool
#- name: sync_etcd_certs | Unset sync_file_results after etcd certs sync
# set_fact:
# sync_file_results: []
#
#- include_tasks: ../../vault/tasks/shared/sync_file.yml
# vars:
# sync_file: ca.pem
# sync_file_dir: "{{ etcd_cert_dir }}"
# sync_file_hosts: [ "{{ inventory_hostname }}" ]
#
#- name: sync_etcd_certs | Unset sync_file_results after ca.pem sync
# set_fact:
# sync_file_results: []
- name: sync_etcd_certs | Unset sync_file_results after etcd certs sync
set_fact:
sync_file_results: []
- include_tasks: ../../vault/tasks/shared/sync_file.yml
vars:
sync_file: ca.pem
sync_file_dir: "{{ etcd_cert_dir }}"
sync_file_hosts: [ "{{ inventory_hostname }}" ]
- name: sync_etcd_certs | Unset sync_file_results after ca.pem sync
set_fact:
sync_file_results: []

42
roles/etcd/tasks/sync_etcd_node_certs.yml
View File

@ -4,30 +4,30 @@
set_fact:
etcd_node_cert_list: "{{ etcd_node_cert_list|default([]) + ['node-' + inventory_hostname + '.pem'] }}"
#- include_tasks: ../../vault/tasks/shared/sync_file.yml
# vars:
# sync_file: "{{ item }}"
# sync_file_dir: "{{ etcd_cert_dir }}"
# sync_file_hosts: [ "{{ inventory_hostname }}" ]
# sync_file_is_cert: true
# with_items: "{{ etcd_node_cert_list|d([]) }}"
#
- include_tasks: ../../vault/tasks/shared/sync_file.yml
vars:
sync_file: "{{ item }}"
sync_file_dir: "{{ etcd_cert_dir }}"
sync_file_hosts: [ "{{ inventory_hostname }}" ]
sync_file_is_cert: true
with_items: "{{ etcd_node_cert_list|d([]) }}"
- name: sync_etcd_node_certs | Set facts for etcd sync_file results
set_fact:
etcd_node_certs_needed: "{{ etcd_node_certs_needed|default([]) + [item.path] }}"
with_items: "{{ sync_file_results|d([]) }}"
when: item.no_srcs|bool
#- name: sync_etcd_node_certs | Unset sync_file_results after etcd node certs
# set_fact:
# sync_file_results: []
#
#- include_tasks: ../../vault/tasks/shared/sync_file.yml
# vars:
# sync_file: ca.pem
# sync_file_dir: "{{ etcd_cert_dir }}"
# sync_file_hosts: "{{ groups['etcd'] }}"
#
#- name: sync_etcd_node_certs | Unset sync_file_results after ca.pem
# set_fact:
# sync_file_results: []
- name: sync_etcd_node_certs | Unset sync_file_results after etcd node certs
set_fact:
sync_file_results: []
- include_tasks: ../../vault/tasks/shared/sync_file.yml
vars:
sync_file: ca.pem
sync_file_dir: "{{ etcd_cert_dir }}"
sync_file_hosts: "{{ groups['etcd'] }}"
- name: sync_etcd_node_certs | Unset sync_file_results after ca.pem
set_fact:
sync_file_results: []

35
roles/kubernetes/secrets/tasks/gen_certs_vault.yml
View File

@ -1,22 +1,23 @@
---
#- import_tasks: sync_kube_master_certs.yml
# when: inventory_hostname in groups['kube-master']
#
#- import_tasks: sync_kube_node_certs.yml
# when: inventory_hostname in groups['k8s-cluster']
- import_tasks: sync_kube_master_certs.yml
when: inventory_hostname in groups['kube-master']
- import_tasks: sync_kube_node_certs.yml
when: inventory_hostname in groups['k8s-cluster']
# Issue admin certs to kube-master hosts
- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
vars:
issue_cert_common_name: "admin"
issue_cert_copy_ca: true
issue_cert_copy_ca: "{{ item == kube_admin_certs_needed|first }}"
issue_cert_file_group: "{{ kube_cert_group }}"
issue_cert_file_owner: kube
issue_cert_hosts: "{{ groups['kube-master'] }}"
issue_cert_path: "{{ inventory_hostname }}"
issue_cert_path: "{{ item }}"
issue_cert_role: kube-master
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_admin_certs_needed|d([]) }}"
when: inventory_hostname in groups['kube-master']
- name: gen_certs_vault | Set fact about certificate alt names
@ -58,10 +59,11 @@
{%- endif -%}
"127.0.0.1","::1","{{ kube_apiserver_ip }}"
]
issue_cert_path: "{{ inventory_hostname }}"
issue_cert_path: "{{ item }}"
issue_cert_role: kube-master
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_master_components_certs_needed|d([]) }}"
when: inventory_hostname in groups['kube-master']
notify: set secret_changed
@ -71,33 +73,37 @@
# Need to strip out the 'node-' prefix from the cert name so it can be used
# with the node authorization plugin ( CN matches kubelet node name )
issue_cert_common_name: "system:node:{{ item.rsplit('/', 1)[1].rsplit('.', 1)[0] | regex_replace('^node-', '') }}"
issue_cert_copy_ca: yes
issue_cert_copy_ca: "{{ item == kube_node_certs_needed|first }}"
issue_cert_file_group: "{{ kube_cert_group }}"
issue_cert_file_owner: kube
issue_cert_hosts: "{{ groups['k8s-cluster'] }}"
issue_cert_path: "{{ inventory_hostname }}"
issue_cert_path: "{{ item }}"
issue_cert_role: kube-node
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_node_certs_needed|d([]) }}"
when: inventory_hostname in groups['k8s-cluster']
# Issue proxy certs to k8s-cluster nodes
- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
vars:
issue_cert_common_name: "system:kube-proxy"
issue_cert_copy_ca: true
issue_cert_copy_ca: "{{ item == kube_proxy_certs_needed|first }}"
issue_cert_file_group: "{{ kube_cert_group }}"
issue_cert_file_owner: kube
issue_cert_hosts: "{{ groups['k8s-cluster'] }}"
issue_cert_path: "{{ inventory_hostname }}"
issue_cert_path: "{{ item }}"
issue_cert_role: kube-proxy
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_proxy_certs_needed|d([]) }}"
when: inventory_hostname in groups['k8s-cluster']
# Issue front proxy cert to kube-master hosts
- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
vars:
issue_cert_common_name: "front-proxy-client"
issue_cert_copy_ca: true
issue_cert_copy_ca: "{{ item == kube_front_proxy_clients_certs_needed|first }}"
issue_cert_ca_filename: front-proxy-ca.pem
issue_cert_alt_names: "{{ kube_cert_alt_names }}"
issue_cert_file_group: "{{ kube_cert_group }}"
@ -118,9 +124,10 @@
{%- endif -%}
"127.0.0.1","::1","{{ kube_apiserver_ip }}"
]
issue_cert_path: "{{ inventory_hostname }}"
issue_cert_path: "{{ item }}"
issue_cert_role: front-proxy-client
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_front_proxy_clients_certs_needed|d([]) }}"
when: inventory_hostname in groups['kube-master']
notify: set secret_changed

3
roles/vault/tasks/shared/issue_cert.yml
View File

@ -76,8 +76,7 @@
run_once: true
- name: "issue_cert | Generate {{ issue_cert_path }} for {{ issue_cert_role }} role"
#hashivault_write:
vault_cert_issue:
hashivault_write:
url: "{{ issue_cert_url }}"
token: "{{ vault_client_token }}"
ca_cert: "{% if 'https' in issue_cert_url %}{{ vault_cert_dir }}/ca.pem{% endif %}"