a644b7c267
Introducing credentials_dir in order to be able to override it
2018-09-03 18:04:50 +02:00
2f1fe44762
update images to use arch
2018-08-31 13:45:08 +02:00
26bf719a02
Merge branch 'master' into multi-arch-support
2018-08-17 16:35:50 +02:00
e8447e3d71
Service file binary place mismatch
...
According to cluster/binary.yml vault binary will be placed to `{{ bin_dir }}` and according to `inventory/sample/group_vars/all.yml` that is
`inventory/sample/group_vars/all.yml`
2018-08-06 14:44:13 +03:00
97e0de7e29
Fix vault file owner issues and k8s apiserver cert creation ( #2985 )
...
apiserver cert should be created only once
2018-07-11 14:58:02 +03:00
0b939a495b
Improve vault etcd initialization check ( #2959 )
2018-07-05 12:27:45 +03:00
77c910c1c3
Fixup vault etcd check ( #2938 )
...
* Fixup vault etcd
* Update main.yml
2018-07-02 15:37:37 +03:00
20dba8b388
Adding uuidfile for rkt based vault to properly cleanup after itself
2018-06-23 15:14:40 -05:00
a8715f9f0f
Adding wait for vault up handler in service restart
2018-06-06 10:40:27 -05:00
59be578842
Revert "wip pr for improved cert sync" ( #2849 )
2018-06-06 17:22:25 +03:00
1081f620d2
add support for non-amd64 arch gcr.io images
...
Currently all the gcr.io images used in kubespray can only run on x86.
Also gcr.io has not fully support multi-arch docker images.
Add extra var "image_arch" (default is amd64) to support running other
platforms, like arm64.
Change-Id: I8e1c9af533c021cb96ade291a1ce58773b40e271
2018-06-05 17:29:02 +08:00
7433348aae
wip pr for improved cert sync
2018-05-30 12:15:11 +03:00
07cc981971
refactor vault role ( #2733 )
...
* Move front-proxy-client certs back to kube mount
We want the same CA for all k8s certs
* Refactor vault to use a third party module
The module adds idempotency and reduces some of the repetitive
logic in the vault role
Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves
Add upgrade test scenario
Remove bootstrap-os tags from tasks
* fix upgrade issues
* improve unseal logic
* specify ca and fix etcd check
* Fix initialization check
bump machine size
2018-05-11 19:11:38 +03:00
d87b6fd9f3
Use dedicated front-proxy-ca for front-proxy-client
2018-04-12 11:03:22 -05:00
3fa7468d54
Copy ca-key.pem to etcd and kube-masters accordingly
2018-04-12 10:17:54 +03:00
c1eb975545
Merge pull request #2557 from chenhonggc/vault_health_check_delay
...
Maybe vault health check needs delay
2018-03-30 21:39:15 +02:00
03bcfa7ff5
Stop templating kube-system namespace and creating it ( #2545 )
...
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
2018-03-30 14:29:13 +03:00
4a705b3fba
May vault health check needs delay
2018-03-30 16:42:08 +08:00
ee8f678010
Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly ( #2446 )
2018-03-21 10:50:32 +03:00
c874f16c02
Fixing credential lookup for fe proxy and vault ( #2361 )
2018-02-22 15:09:26 +03:00
57e7a5a34a
Merge pull request #2233 from hswong3i/multiple_inventory_dir
...
Support multiple inventory files under individual inventory directory
2018-02-08 11:57:04 +01:00
7bce70339f
Merge pull request #2251 from woopstar/metrics-server-patch-2
...
Adding metrics-server support for K8s version 1.9
2018-02-08 11:16:44 +01:00
1a1d154e14
Support multiple inventory files under individual inventory directory
2018-02-08 08:08:15 +08:00
f9df692056
Issue front proxy certs for vault
2018-02-07 11:03:10 +01:00
16629d0b8e
Vault should use cert auth for etcd
2018-01-31 20:37:14 +03:00
dc6a17e092
Use include/import tasks ( #2192 )
...
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
2018-01-29 14:37:48 +03:00
bfb25fa47b
Change vault cert ttl to 8y ( #2013 )
2017-12-15 13:34:00 +00:00
d3850a4da5
Fixing alt_names for vault cert generation
2017-12-11 17:28:18 -06:00
19def41fdf
Merge pull request #2047 from bradbeam/vaulttime
...
Adding retries for vault-temp to come online
2017-12-11 09:04:57 -06:00
fa5a538fe5
Merge pull request #2050 from jbonachera/fix-vault-tls-validation
...
append newline char to vault generated certs
2017-12-11 08:41:34 -06:00
93f3614382
Fixes #2039 - changing alt_names to be string instead of list ( #2043 )
2017-12-11 12:48:07 +00:00
290bc993a5
append newline char to vault generated certs
2017-12-10 13:06:28 +01:00
3694657eb6
Adding retries for vault-init to come online
2017-12-09 17:40:44 -06:00
27ead5d4fa
Merge pull request #2003 from abelgana/master
...
Change altnames to alt_names
2017-12-05 08:48:32 -06:00
4d3326b542
Raise default vault lease TTL to 10y ( #2008 )
2017-11-29 10:38:59 +00:00
fe3290601a
The variable altnames is used by this task.
...
Since the value will change on the default. It needs to change here also.
2017-11-27 06:57:16 -05:00
e7173e1d62
Change altnames to alt_names
...
Hi,
Could you please check if it was a typo?
https://www.vaultproject.io/api/secret/pki/
Regards,
2017-11-25 17:29:21 -05:00
c115e5677e
Merge pull request #1828 from hzamani/patch-1
...
Use etcd_access_addresses for vault_etcd_url
2017-11-10 10:56:37 -05:00
6df104b275
don't check for no_proxy, only http/https_proxy. fix linting issues.
2017-10-30 11:42:14 -04:00
b27453d8d8
improved proxy support
2017-10-30 11:42:14 -04:00
0b60201a1e
fix etcd health check bug ( #1480 )
2017-10-24 16:10:56 +01:00
fc9a65be2b
Refactor downloads to use download role directly ( #1824 )
...
* Refactor downloads to use download role directly
Also disable fact delegation so download delegate works acros OSes.
* clean up bools and ansible_os_family conditionals
2017-10-19 09:17:11 +01:00
3acc42c5b3
Use etcd_access_addresses for vault_etcd_url
2017-10-17 19:27:36 +03:30
f2db15873d
Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix
...
add hosts to rkt kubelet
2017-10-10 10:37:36 -04:00
7c663de6c9
add /etc/hosts volume to rkt templates
2017-10-09 16:41:51 +02:00
9c86da1403
Normalize tags in all places to prepare for tag fixing in future ( #1739 )
2017-10-05 08:43:04 +01:00
f2ae16e71d
Merge pull request #1651 from bradbeam/vaultnocontent
...
Fixing condition where vault CA already exists
2017-09-14 17:04:15 -05:00
ac281476c8
Prune unnecessary certs from vault setup ( #1652 )
...
* Cleaning up cert checks for vault
* Removing all unnecessary etcd certs from each node
* Removing all unnecessary kube certs from each node
2017-09-14 12:28:11 +01:00
4b587aaf99
Adding ability to specify altnames for vault cert ( #1640 )
2017-09-14 07:19:44 +01:00
0a89f88b89
Fixing condition where CA already exists
2017-09-13 03:40:46 +00:00
Erwan Miran
Antoine Legrand
Aleksey Shirokih
Matthew Mosesohn
Brad Beam
Brad Beam
Di Xu
Matthew Mosesohn
Chad Swenson
Andreas Krüger
Chen Hong
mirwan
Brad Beam
Antoine Legrand
Wong Hoi Sing Edison
Julien BONACHERA
abelgana
Spencer Smith
Peter Lee
Hassan Zamani
Spencer Smith
ArchiFleKs
Aivars Sterns