Browse Source
Merge pull request #798 from mattymo/perhostssl7
Merge pull request #798 from mattymo/perhostssl7
Individual etcd ssl certspull/813/head
committed by
GitHub
13 changed files with 140 additions and 54 deletions
Unified View
Diff Options
-
46roles/etcd/files/make-ssl-etcd.sh
-
37roles/etcd/tasks/check_certs.yml
-
39roles/etcd/tasks/gen_certs.yml
-
3roles/etcd/tasks/main.yml
-
5roles/etcd/tasks/pre_upgrade.yml
-
8roles/etcd/templates/etcd.j2
-
4roles/kubernetes-apps/ansible/templates/calico-policy-controller.yml.j2
-
20roles/kubernetes/master/tasks/pre-upgrade.yml
-
5roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2
-
17roles/network_plugin/calico/tasks/main.yml
-
4roles/network_plugin/calico/templates/cni-calico.conf.j2
-
4roles/network_plugin/canal/tasks/main.yml
-
2roles/network_plugin/flannel/templates/flannel-pod.yml
@ -1,36 +1,51 @@ |
|||||
--- |
--- |
||||
- name: "Check_certs | check if the certs have already been generated on first master" |
|
||||
|
- name: "Check_certs | check if all certs have already been generated on first master" |
||||
stat: |
stat: |
||||
path: "{{ etcd_cert_dir }}/ca.pem" |
|
||||
|
path: "{{ etcd_cert_dir }}/{{ item }}" |
||||
delegate_to: "{{groups['etcd'][0]}}" |
delegate_to: "{{groups['etcd'][0]}}" |
||||
register: etcdcert_master |
register: etcdcert_master |
||||
run_once: true |
run_once: true |
||||
|
with_items: >- |
||||
|
['ca.pem', |
||||
|
{% set all_etcd_hosts = groups['k8s-cluster']|union(groups['etcd'])|unique %} |
||||
|
{% for host in all_etcd_hosts %} |
||||
|
'node-{{ host }}-key.pem' |
||||
|
{% if not loop.last %}{{','}}{% endif %} |
||||
|
{% endfor %}] |
||||
|
|
||||
- name: "Check_certs | Set default value for 'sync_certs' and 'gen_certs' to false" |
|
||||
|
- name: "Check_certs | Set default value for 'sync_certs', 'gen_certs' and 'etcd_secret_changed' to false" |
||||
set_fact: |
set_fact: |
||||
sync_certs: false |
sync_certs: false |
||||
gen_certs: false |
gen_certs: false |
||||
|
etcd_secret_changed: false |
||||
|
|
||||
- name: "Check_certs | Set 'sync_certs' and 'gen_certs' to true" |
|
||||
|
- name: "Check_certs | Set 'gen_certs' to true" |
||||
set_fact: |
set_fact: |
||||
gen_certs: true |
gen_certs: true |
||||
when: not etcdcert_master.stat.exists |
|
||||
|
when: "not {{item.stat.exists}}" |
||||
run_once: true |
run_once: true |
||||
|
with_items: "{{etcdcert_master.results}}" |
||||
|
|
||||
- name: "Check certs | check if a cert already exists" |
- name: "Check certs | check if a cert already exists" |
||||
stat: |
stat: |
||||
path: "{{ etcd_cert_dir }}/ca.pem" |
|
||||
|
path: "{{ etcd_cert_dir }}/node-{{inventory_hostname}}-key.pem" |
||||
register: etcdcert |
register: etcdcert |
||||
|
with_items: |
||||
|
- ca.pem |
||||
|
- node-{{ inventory_hostname }}-key.pem |
||||
|
|
||||
- name: "Check_certs | Set 'sync_certs' to true" |
- name: "Check_certs | Set 'sync_certs' to true" |
||||
set_fact: |
set_fact: |
||||
sync_certs: true |
sync_certs: true |
||||
when: >- |
when: >- |
||||
{%- set certs = {'sync': False} -%} |
{%- set certs = {'sync': False} -%} |
||||
{%- for server in play_hosts |
|
||||
if (not hostvars[server].etcdcert.stat.exists|default(False)) or |
|
||||
(hostvars[server].etcdcert.stat.checksum|default('') != etcdcert_master.stat.checksum|default('')) -%} |
|
||||
{%- set _ = certs.update({'sync': True}) -%} |
|
||||
|
{% set all_etcd_hosts = groups['k8s-cluster']|union(groups['etcd'])|unique %} |
||||
|
{% for host in all_etcd_hosts %} |
||||
|
{% if host == inventory_hostname %} |
||||
|
{% if (not etcdcert.results[0].stat.exists|default(False)) or |
||||
|
(etcdcert.results[1].stat.checksum|default('') != etcdcert_master.results[loop.index].stat.checksum|default('')) -%} |
||||
|
{%- set _ = certs.update({'sync': True}) -%} |
||||
|
{% endif %} |
||||
|
{% endif %} |
||||
{%- endfor -%} |
{%- endfor -%} |
||||
{{ certs.sync }} |
{{ certs.sync }} |
||||
run_once: true |
|
Write
Preview
Loading…
Cancel
Save