From 83e11f9ef75aa6f2e0ea2ace4885933ed4196887 Mon Sep 17 00:00:00 2001 From: Thomas Rogeat Date: Thu, 27 Dec 2018 18:15:37 +0100 Subject: [PATCH] kubespray: fix missing ca-certificate path in apiserver --- .../master/templates/kubeadm-config.v1alpha1.yaml.j2 | 10 +++++++++- .../master/templates/kubeadm-config.v1alpha2.yaml.j2 | 10 +++++++++- .../master/templates/kubeadm-config.v1alpha3.yaml.j2 | 10 +++++++++- .../master/templates/kubeadm-config.v1beta1.yaml.j2 | 10 +++++++++- 4 files changed, 36 insertions(+), 4 deletions(-) diff --git a/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2 b/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2 index 0957824d9..acfbf7e35 100644 --- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2 +++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2 @@ -155,7 +155,7 @@ schedulerExtraArgs: {{ key }}: "{{ kube_kubeadm_scheduler_extra_args[key] }}" {% endfor %} {% endif %} -{% if kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) %} +{% if kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ssl_ca_dirs|length %} apiServerExtraVolumes: {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %} - name: cloud-config @@ -177,6 +177,14 @@ apiServerExtraVolumes: hostPath: {{ kube_config_dir }}/webhook-token-auth-config.yaml mountPath: {{ kube_config_dir }}/webhook-token-auth-config.yaml {% endif %} +{% if ssl_ca_dirs|length %} +{% for dir in ssl_ca_dirs %} +- name: {{ dir | regex_replace('^/(.*)$', '\\1' ) | regex_replace('/', '-') }} + hostPath: {{ dir }} + mountPath: {{ dir }} + writable: false +{% endfor %} +{% endif %} {% endif %} apiServerCertSANs: {% for san in apiserver_sans.split() | unique %} diff --git a/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2 b/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2 index 1743d03aa..3bc7d9ee2 100644 --- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2 +++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2 @@ -149,7 +149,7 @@ controllerManagerExtraVolumes: mountPath: {{ kube_config_dir }}/cloud_config {% endif %} {% endif %} -{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) %} +{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ssl_ca_dirs|length %} apiServerExtraVolumes: {% if kube_basic_auth|default(true) %} - name: basic-auth-config @@ -177,6 +177,14 @@ apiServerExtraVolumes: writable: true {% endif %} {% endif %} +{% if ssl_ca_dirs|length %} +{% for dir in ssl_ca_dirs %} +- name: {{ dir | regex_replace('^/(.*)$', '\\1' ) | regex_replace('/', '-') }} + hostPath: {{ dir }} + mountPath: {{ dir }} + writable: false +{% endfor %} +{% endif %} {% endif %} {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %} - name: cloud-config diff --git a/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2 b/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2 index 5a526790f..6d7ca628f 100644 --- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2 +++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2 @@ -152,7 +152,7 @@ schedulerExtraArgs: {{ key }}: "{{ kube_kubeadm_scheduler_extra_args[key] }}" {% endfor %} {% endif %} -{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes %} +{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes or ssl_ca_dirs|length %} apiServerExtraVolumes: {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %} - name: cloud-config @@ -191,6 +191,14 @@ apiServerExtraVolumes: mountPath: {{ volume.mountPath }} writable: {{ volume.writable | default(false)}} {% endfor %} +{% if ssl_ca_dirs|length %} +{% for dir in ssl_ca_dirs %} +- name: {{ dir | regex_replace('^/(.*)$', '\\1' ) | regex_replace('/', '-') }} + hostPath: {{ dir }} + mountPath: {{ dir }} + writable: false +{% endfor %} +{% endif %} {% endif %} {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] or controller_manager_extra_volumes %} controllerManagerExtraVolumes: diff --git a/roles/kubernetes/master/templates/kubeadm-config.v1beta1.yaml.j2 b/roles/kubernetes/master/templates/kubeadm-config.v1beta1.yaml.j2 index 9966ebac2..d347d23b7 100644 --- a/roles/kubernetes/master/templates/kubeadm-config.v1beta1.yaml.j2 +++ b/roles/kubernetes/master/templates/kubeadm-config.v1beta1.yaml.j2 @@ -121,7 +121,7 @@ apiServer: {% elif cloud_provider is defined and cloud_provider in ["external"] %} cloud-config: {{ kube_config_dir }}/cloud_config {% endif %} -{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes %} +{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes or ssl_ca_dirs|length %} extraVolumes: {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %} - name: cloud-config @@ -160,6 +160,14 @@ apiServer: mountPath: {{ volume.mountPath }} readOnly: {{ volume.readOnly | d(not (volume.writable | d(false))) }} {% endfor %} +{% if ssl_ca_dirs|length %} +{% for dir in ssl_ca_dirs %} + - name: {{ dir | regex_replace('^/(.*)$', '\\1' ) | regex_replace('/', '-') }} + hostPath: {{ dir }} + mountPath: {{ dir }} + readOnly: true +{% endfor %} +{% endif %} {% endif %} certSANs: {% for san in apiserver_sans.split() | unique %}