From ba913046368976fc2576343c85d5b145ad6b80a5 Mon Sep 17 00:00:00 2001 From: Maxim Krasilnikov Date: Thu, 22 Feb 2018 15:08:50 +0300 Subject: [PATCH] Fixed generate front proxy client certs with vault (#2359) * Fixed generate front proxy client certs with vault * fix vault cert management * Distrebute etcd node certs to vault hosts --- roles/etcd/defaults/main.yml | 2 +- .../secrets/tasks/gen_certs_vault.yml | 2 +- .../secrets/tasks/sync_kube_master_certs.yml | 22 ++++++++++++++++++- tests/files/gce_ubuntu-vault-sep.yml | 2 +- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/roles/etcd/defaults/main.yml b/roles/etcd/defaults/main.yml index f394e41aa..4e122e719 100644 --- a/roles/etcd/defaults/main.yml +++ b/roles/etcd/defaults/main.yml @@ -32,7 +32,7 @@ etcd_memory_limit: "{% if ansible_memtotal_mb < 4096 %}512M{% else %}0{% endif % etcd_blkio_weight: 1000 -etcd_node_cert_hosts: "{{ groups['k8s-cluster'] | union(groups.get('calico-rr', [])) }}" +etcd_node_cert_hosts: "{{ groups['k8s-cluster'] | union(groups.get('calico-rr', [])) | union(groups.get('vault', [])) }}" etcd_compaction_retention: "8" diff --git a/roles/kubernetes/secrets/tasks/gen_certs_vault.yml b/roles/kubernetes/secrets/tasks/gen_certs_vault.yml index 5b3b46edc..cc16b749b 100644 --- a/roles/kubernetes/secrets/tasks/gen_certs_vault.yml +++ b/roles/kubernetes/secrets/tasks/gen_certs_vault.yml @@ -116,6 +116,6 @@ issue_cert_role: front-proxy-client issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}" issue_cert_mount_path: "{{ kube_vault_mount_path }}" - with_items: "{{ kube_master_components_certs_needed|d([]) }}" + with_items: "{{ kube_front_proxy_clients_certs_needed|d([]) }}" when: inventory_hostname in groups['kube-master'] notify: set secret_changed diff --git a/roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml b/roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml index f675f6eca..d74704448 100644 --- a/roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml +++ b/roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml @@ -32,7 +32,7 @@ sync_file_hosts: "{{ groups['kube-master'] }}" sync_file_is_cert: true sync_file_owner: kube - with_items: ["apiserver.pem", "kube-scheduler.pem", "kube-controller-manager.pem", "front-proxy-client.pem"] + with_items: ["apiserver.pem", "kube-scheduler.pem", "kube-controller-manager.pem"] - name: sync_kube_master_certs | Set facts for kube master components sync_file results set_fact: @@ -44,6 +44,26 @@ set_fact: sync_file_results: [] +- include_tasks: ../../../vault/tasks/shared/sync_file.yml + vars: + sync_file: "{{ item }}" + sync_file_dir: "{{ kube_cert_dir }}" + sync_file_group: "{{ kube_cert_group }}" + sync_file_hosts: "{{ groups['kube-master'] }}" + sync_file_is_cert: true + sync_file_owner: kube + with_items: ["front-proxy-client.pem"] + +- name: sync_kube_master_certs | Set facts for front-proxy-client certs sync_file results + set_fact: + kube_front_proxy_clients_certs_needed: "{{ kube_front_proxy_clients_certs_needed|d([]) + [item.path] }}" + with_items: "{{ sync_file_results|d([]) }}" + when: item.no_srcs|bool + +- name: sync_kube_master_certs | Unset sync_file_results after front-proxy-client sync + set_fact: + sync_file_results: [] + - include_tasks: ../../../vault/tasks/shared/sync_file.yml vars: sync_file: ca.pem diff --git a/tests/files/gce_ubuntu-vault-sep.yml b/tests/files/gce_ubuntu-vault-sep.yml index 2e4926f21..60ce0c37f 100644 --- a/tests/files/gce_ubuntu-vault-sep.yml +++ b/tests/files/gce_ubuntu-vault-sep.yml @@ -6,7 +6,7 @@ mode: separate # Instance settings bootstrap_os: ubuntu -cert_mgmt: vault +cert_management: vault kube_network_plugin: canal deploy_netchecker: true kubedns_min_replicas: 1