111 lines
4.0 KiB
YAML
111 lines
4.0 KiB
YAML
---
|
|
- name: "Gen_helm_tiller_certs | Create helm config directory (on {{ groups['kube-master'][0] }})"
|
|
run_once: yes
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
file:
|
|
path: "{{ helm_config_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
|
|
- name: "Gen_helm_tiller_certs | Create helm script directory (on {{ groups['kube-master'][0] }})"
|
|
run_once: yes
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
file:
|
|
path: "{{ helm_script_dir }}"
|
|
state: directory
|
|
owner: kube
|
|
|
|
- name: Gen_helm_tiller_certs | Copy certs generation script
|
|
run_once: yes
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
template:
|
|
src: "helm-make-ssl.sh.j2"
|
|
dest: "{{ helm_script_dir }}/helm-make-ssl.sh"
|
|
mode: 0700
|
|
|
|
- name: "Check_helm_certs | check if helm client certs have already been generated on first master (on {{ groups['kube-master'][0] }})"
|
|
find:
|
|
paths: "{{ helm_home_dir }}"
|
|
patterns: "*.pem"
|
|
get_checksum: true
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
register: helmcert_master
|
|
run_once: true
|
|
|
|
- name: Gen_helm_tiller_certs | run cert generation script # noqa 301
|
|
run_once: yes
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
command: "{{ helm_script_dir }}/helm-make-ssl.sh -e {{ helm_home_dir }} -d {{ helm_tiller_cert_dir }}"
|
|
|
|
- name: Check_helm_client_certs | Set helm_client_certs
|
|
set_fact:
|
|
helm_client_certs: ['ca.pem', 'cert.pem', 'key.pem']
|
|
|
|
- name: "Check_helm_client_certs | check if a cert already exists on master node"
|
|
find:
|
|
paths: "{{ helm_home_dir }}"
|
|
patterns: "*.pem"
|
|
get_checksum: true
|
|
register: helmcert_node
|
|
when: inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: "Check_helm_client_certs | Set 'sync_helm_certs' to true on masters"
|
|
set_fact:
|
|
sync_helm_certs: (not item in helmcert_node.files | map(attribute='path') | map("basename") | list or helmcert_node.files | selectattr("path", "equalto", "{{ helm_home_dir }}/{{ item }}") | map(attribute="checksum")|first|default('') != helmcert_master.files | selectattr("path", "equalto", "{{ helm_home_dir }}/{{ item }}") | map(attribute="checksum")|first|default(''))
|
|
when:
|
|
- inventory_hostname != groups['kube-master'][0]
|
|
with_items:
|
|
- "{{ helm_client_certs }}"
|
|
|
|
- name: Gen_helm_tiller_certs | Gather helm client certs
|
|
# noqa 303 - tar is called intentionally here, but maybe this should be done with the slurp module
|
|
shell: "set -o pipefail && tar cfz - -C {{ helm_home_dir }} {{ helm_client_certs|join(' ') }} | base64 --wrap=0"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
register: helm_client_cert_data
|
|
check_mode: no
|
|
delegate_to: "{{ groups['kube-master'][0] }}"
|
|
when: sync_helm_certs|default(false) and inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_helm_tiller_certs | Use tempfile for unpacking certs on masters
|
|
tempfile:
|
|
state: file
|
|
path: /tmp
|
|
prefix: helmcertsXXXXX
|
|
suffix: tar.gz
|
|
register: helm_cert_tempfile
|
|
when: sync_helm_certs|default(false) and inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_helm_tiller_certs | Write helm client certs to tempfile
|
|
copy:
|
|
content: "{{ helm_client_cert_data.stdout }}"
|
|
dest: "{{ helm_cert_tempfile.path }}"
|
|
owner: root
|
|
mode: "0600"
|
|
when: sync_helm_certs|default(false) and inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_helm_tiller_certs | Unpack helm certs on
|
|
shell: "set -o pipefail && base64 -d < {{ helm_cert_tempfile.path }} | tar xz -C {{ helm_home_dir }}"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
changed_when: false
|
|
check_mode: no
|
|
when: sync_helm_certs|default(false) and inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_helm_tiller_certs | Cleanup tempfile on masters
|
|
file:
|
|
path: "{{ helm_cert_tempfile.path }}"
|
|
state: absent
|
|
when: sync_helm_certs|default(false) and inventory_hostname != groups['kube-master'][0]
|
|
|
|
- name: Gen_certs | check certificate permissions
|
|
file:
|
|
path: "{{ helm_home_dir }}"
|
|
group: "{{ helm_cert_group }}"
|
|
state: directory
|
|
owner: "{{ helm_cert_owner }}"
|
|
mode: "u=rwX,g-rwx,o-rwx"
|
|
recurse: yes
|