k8s-sig-cluster-lifecycleawskubesprayhigh-availabilityansiblekubernetes-clustergcekubernetesbare-metal
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
115 lines
4.6 KiB
115 lines
4.6 KiB
---
|
|
|
|
# This could be a role or custom module
|
|
|
|
# Vars:
|
|
# issue_cert_alt_name: Requested Subject Alternative Names, in a list.
|
|
# issue_cert_common_name: Common Name included in the cert
|
|
# issue_cert_copy_ca: Copy issuing CA cert needed
|
|
# issue_cert_dir_mode: Mode of the placed cert directory
|
|
# issue_cert_file_group: Group of the placed cert file and directory
|
|
# issue_cert_file_mode: Mode of the placed cert file
|
|
# issue_cert_file_owner: Owner of the placed cert file and directory
|
|
# issue_cert_format: Format for returned data. Can be pem, der, or pem_bundle
|
|
# issue_cert_hosts: List of hosts to distribute the cert to
|
|
# issue_cert_ip_sans: Requested IP Subject Alternative Names, in a list
|
|
# issue_cert_mount_path: Mount point in Vault to make the request to
|
|
# issue_cert_path: Full path to the cert, include its name
|
|
# issue_cert_role: The Vault role to issue the cert with
|
|
# issue_cert_url: Url to reach Vault, including protocol and port
|
|
|
|
- name: issue_cert | Ensure target directory exists
|
|
file:
|
|
path: "{{ issue_cert_path | dirname }}"
|
|
state: directory
|
|
group: "{{ issue_cert_file_group | d('root' )}}"
|
|
mode: "{{ issue_cert_dir_mode | d('0755') }}"
|
|
owner: "{{ issue_cert_file_owner | d('root') }}"
|
|
|
|
- name: "issue_cert | Read in the local credentials"
|
|
command: cat {{ vault_roles_dir }}/{{ issue_cert_role }}/userpass
|
|
register: vault_creds_cat
|
|
delegate_to: "{{ groups.vault|first }}"
|
|
run_once: true
|
|
|
|
- name: gen_certs_vault | Set facts for read Vault Creds
|
|
set_fact:
|
|
user_vault_creds: "{{ vault_creds_cat.stdout|from_json }}"
|
|
delegate_to: "{{ groups.vault|first }}"
|
|
run_once: true
|
|
|
|
- name: gen_certs_vault | Log into Vault and obtain an token
|
|
uri:
|
|
url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}/v1/auth/userpass/login/{{ user_vault_creds.username }}"
|
|
headers:
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
method: POST
|
|
body_format: json
|
|
body:
|
|
password: "{{ user_vault_creds.password }}"
|
|
register: vault_login_result
|
|
delegate_to: "{{ groups.vault|first }}"
|
|
run_once: true
|
|
|
|
- name: gen_certs_vault | Set fact for vault_client_token
|
|
set_fact:
|
|
vault_client_token: "{{ vault_login_result.get('json', {}).get('auth', {}).get('client_token') }}"
|
|
run_once: true
|
|
|
|
- name: gen_certs_vault | Set fact for Vault API token
|
|
set_fact:
|
|
issue_cert_headers:
|
|
Accept: application/json
|
|
Content-Type: application/json
|
|
X-Vault-Token: "{{ vault_client_token }}"
|
|
run_once: true
|
|
when: vault_client_token != ""
|
|
|
|
- name: "issue_cert | Generate {{ issue_cert_path }} for {{ issue_cert_role }} role"
|
|
uri:
|
|
url: "{{ issue_cert_url }}/v1/{{ issue_cert_mount_path|d('pki') }}/issue/{{ issue_cert_role }}"
|
|
headers: "{{ issue_cert_headers }}"
|
|
method: POST
|
|
body_format: json
|
|
body:
|
|
alt_names: "{{ issue_cert_alt_names | d([]) | join(',') }}"
|
|
common_name: "{{ issue_cert_common_name | d(issue_cert_path.rsplit('/', 1)[1].rsplit('.', 1)[0]) }}"
|
|
format: "{{ issue_cert_format | d('pem') }}"
|
|
ip_sans: "{{ issue_cert_ip_sans | default([]) | join(',') }}"
|
|
register: issue_cert_result
|
|
delegate_to: "{{ issue_cert_hosts|first }}"
|
|
run_once: true
|
|
|
|
- name: "issue_cert | Copy {{ issue_cert_path }} cert to all hosts"
|
|
copy:
|
|
content: "{{ issue_cert_result['json']['data']['certificate'] }}\n"
|
|
dest: "{{ issue_cert_path }}"
|
|
group: "{{ issue_cert_file_group | d('root' )}}"
|
|
mode: "{{ issue_cert_file_mode | d('0644') }}"
|
|
owner: "{{ issue_cert_file_owner | d('root') }}"
|
|
|
|
- name: "issue_cert | Copy key for {{ issue_cert_path }} to all hosts"
|
|
copy:
|
|
content: "{{ issue_cert_result['json']['data']['private_key'] }}"
|
|
dest: "{{ issue_cert_path.rsplit('.', 1)|first }}-key.{{ issue_cert_path.rsplit('.', 1)|last }}"
|
|
group: "{{ issue_cert_file_group | d('root' )}}"
|
|
mode: "{{ issue_cert_file_mode | d('0640') }}"
|
|
owner: "{{ issue_cert_file_owner | d('root') }}"
|
|
|
|
- name: issue_cert | Copy issuing CA cert
|
|
copy:
|
|
content: "{{ issue_cert_result['json']['data']['issuing_ca'] }}\n"
|
|
dest: "{{ issue_cert_path | dirname }}/ca.pem"
|
|
group: "{{ issue_cert_file_group | d('root' )}}"
|
|
mode: "{{ issue_cert_file_mode | d('0644') }}"
|
|
owner: "{{ issue_cert_file_owner | d('root') }}"
|
|
when: issue_cert_copy_ca|default(false)
|
|
|
|
- name: issue_cert | Copy certificate serial to all hosts
|
|
copy:
|
|
content: "{{ issue_cert_result['json']['data']['serial_number'] }}"
|
|
dest: "{{ issue_cert_path.rsplit('.', 1)|first }}.serial"
|
|
group: "{{ issue_cert_file_group | d('root' )}}"
|
|
mode: "{{ issue_cert_file_mode | d('0640') }}"
|
|
owner: "{{ issue_cert_file_owner | d('root') }}"
|