You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

48 lines
1.9 KiB

  1. ---
  2. - name: Rotate Tokens | Get default token name
  3. shell: "{{ bin_dir }}/kubectl get secrets -o custom-columns=name:{.metadata.name} --no-headers | grep -m1 default-token"
  4. register: default_token
  5. changed_when: false
  6. until: default_token.rc == 0
  7. delay: 1
  8. retries: 5
  9. - name: Rotate Tokens | Get default token data
  10. command: "{{ bin_dir }}/kubectl get secrets {{ default_token.stdout }} -ojson"
  11. register: default_token_data
  12. changed_when: false
  13. - name: Rotate Tokens | Test if default certificate is expired
  14. uri:
  15. url: https://{{ kube_apiserver_ip }}/api/v1/nodes
  16. method: GET
  17. return_content: no
  18. validate_certs: no
  19. headers:
  20. Authorization: "Bearer {{ (default_token_data.stdout|from_json)['data']['token']|b64decode }}"
  21. register: check_secret
  22. failed_when: false
  23. - name: Rotate Tokens | Determine if certificate is expired
  24. set_fact:
  25. needs_rotation: '{{ check_secret.status not in [200, 403] }}'
  26. # FIXME(mattymo): Exclude built in secrets that were automatically rotated,
  27. # instead of filtering manually
  28. - name: Rotate Tokens | Get all serviceaccount tokens to expire
  29. shell: >-
  30. {{ bin_dir }}/kubectl get secrets --all-namespaces
  31. -o 'jsonpath={range .items[*]}{"\n"}{.metadata.namespace}{" "}{.metadata.name}{" "}{.type}{end}'
  32. | grep kubernetes.io/service-account-token
  33. | egrep 'default-token|kube-proxy|kube-dns|dnsmasq|netchecker|weave|calico|canal|flannel|dashboard|cluster-proportional-autoscaler|tiller|local-volume-provisioner'
  34. register: tokens_to_delete
  35. when: needs_rotation
  36. - name: Rotate Tokens | Delete expired tokens
  37. command: "{{ bin_dir }}/kubectl delete secrets -n {{ item.split(' ')[0] }} {{ item.split(' ')[1] }}"
  38. with_items: "{{ tokens_to_delete.stdout_lines }}"
  39. when: needs_rotation
  40. - name: Rotate Tokens | Delete pods in system namespace
  41. command: "{{ bin_dir }}/kubectl delete pods -n kube-system --all"
  42. when: needs_rotation