Fixed generate front proxy client certs with vault (#2359)

* Fixed generate front proxy client certs with vault

* fix vault cert management

* Distrebute etcd node certs to vault hosts
pull/2354/merge
Maxim Krasilnikov 2018-02-22 15:08:50 +03:00 committed by Matthew Mosesohn
parent 42a0f46268
commit ba91304636
4 changed files with 24 additions and 4 deletions

View File

@ -32,7 +32,7 @@ etcd_memory_limit: "{% if ansible_memtotal_mb < 4096 %}512M{% else %}0{% endif %
etcd_blkio_weight: 1000 etcd_blkio_weight: 1000
etcd_node_cert_hosts: "{{ groups['k8s-cluster'] | union(groups.get('calico-rr', [])) }}" etcd_node_cert_hosts: "{{ groups['k8s-cluster'] | union(groups.get('calico-rr', [])) | union(groups.get('vault', [])) }}"
etcd_compaction_retention: "8" etcd_compaction_retention: "8"

View File

@ -116,6 +116,6 @@
issue_cert_role: front-proxy-client issue_cert_role: front-proxy-client
issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}" issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
issue_cert_mount_path: "{{ kube_vault_mount_path }}" issue_cert_mount_path: "{{ kube_vault_mount_path }}"
with_items: "{{ kube_master_components_certs_needed|d([]) }}" with_items: "{{ kube_front_proxy_clients_certs_needed|d([]) }}"
when: inventory_hostname in groups['kube-master'] when: inventory_hostname in groups['kube-master']
notify: set secret_changed notify: set secret_changed

View File

@ -32,7 +32,7 @@
sync_file_hosts: "{{ groups['kube-master'] }}" sync_file_hosts: "{{ groups['kube-master'] }}"
sync_file_is_cert: true sync_file_is_cert: true
sync_file_owner: kube sync_file_owner: kube
with_items: ["apiserver.pem", "kube-scheduler.pem", "kube-controller-manager.pem", "front-proxy-client.pem"] with_items: ["apiserver.pem", "kube-scheduler.pem", "kube-controller-manager.pem"]
- name: sync_kube_master_certs | Set facts for kube master components sync_file results - name: sync_kube_master_certs | Set facts for kube master components sync_file results
set_fact: set_fact:
@ -44,6 +44,26 @@
set_fact: set_fact:
sync_file_results: [] sync_file_results: []
- include_tasks: ../../../vault/tasks/shared/sync_file.yml
vars:
sync_file: "{{ item }}"
sync_file_dir: "{{ kube_cert_dir }}"
sync_file_group: "{{ kube_cert_group }}"
sync_file_hosts: "{{ groups['kube-master'] }}"
sync_file_is_cert: true
sync_file_owner: kube
with_items: ["front-proxy-client.pem"]
- name: sync_kube_master_certs | Set facts for front-proxy-client certs sync_file results
set_fact:
kube_front_proxy_clients_certs_needed: "{{ kube_front_proxy_clients_certs_needed|d([]) + [item.path] }}"
with_items: "{{ sync_file_results|d([]) }}"
when: item.no_srcs|bool
- name: sync_kube_master_certs | Unset sync_file_results after front-proxy-client sync
set_fact:
sync_file_results: []
- include_tasks: ../../../vault/tasks/shared/sync_file.yml - include_tasks: ../../../vault/tasks/shared/sync_file.yml
vars: vars:
sync_file: ca.pem sync_file: ca.pem

View File

@ -6,7 +6,7 @@ mode: separate
# Instance settings # Instance settings
bootstrap_os: ubuntu bootstrap_os: ubuntu
cert_mgmt: vault cert_management: vault
kube_network_plugin: canal kube_network_plugin: canal
deploy_netchecker: true deploy_netchecker: true
kubedns_min_replicas: 1 kubedns_min_replicas: 1