diff --git a/inventories/staging/.hosts.swp b/inventories/staging/.hosts.swp new file mode 100644 index 0000000..81a4161 Binary files /dev/null and b/inventories/staging/.hosts.swp differ diff --git a/k8s.yml b/k8s.yml index 0edcd9c..194bfbf 100644 --- a/k8s.yml +++ b/k8s.yml @@ -31,11 +31,6 @@ tags: role-cfssl - role: kubernetes-ca tags: role-kubernetes-ca -- hosts: k8s_kubectl - become: yes - roles: - - role: kubectl - tags: role-kubectl - hosts: k8s_etcd roles: - role: etcd diff --git a/playbooks/group_vars b/playbooks/group_vars new file mode 120000 index 0000000..cc7e7a9 --- /dev/null +++ b/playbooks/group_vars @@ -0,0 +1 @@ +../group_vars \ No newline at end of file diff --git a/playbooks/host_vars b/playbooks/host_vars new file mode 120000 index 0000000..e0ccba1 --- /dev/null +++ b/playbooks/host_vars @@ -0,0 +1 @@ +../host_vars \ No newline at end of file diff --git a/playbooks/kubectl-config.yml b/playbooks/kubectl-config.yml new file mode 100644 index 0000000..a4781a6 --- /dev/null +++ b/playbooks/kubectl-config.yml @@ -0,0 +1,8 @@ +--- +- hosts: all + tasks: [ ] +- hosts: k8s_kubectl + become: yes + roles: + - role: kubectl + tags: role-kubectl diff --git a/playbooks/roles b/playbooks/roles new file mode 120000 index 0000000..d8c4472 --- /dev/null +++ b/playbooks/roles @@ -0,0 +1 @@ +../roles \ No newline at end of file diff --git a/roles/kubectl/tasks/kubectl-cluster-config.yml b/roles/kubectl/tasks/kubectl-cluster-config.yml index eb09430..9150327 100644 --- a/roles/kubectl/tasks/kubectl-cluster-config.yml +++ b/roles/kubectl/tasks/kubectl-cluster-config.yml @@ -1,7 +1,7 @@ - name: kubectl config set-cluster shell: | kubectl config set-cluster {{k8s_config_cluster_name}} \ - --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem \ + --certificate-authority={{k8s_ca_conf_directory}}/ca.pem \ --embed-certs=true \ --server=https://{{hostvars[groups.k8s_master|first]['ansible_' + k8s_interface].ipv4.address}}:6443 register: set_cluster @@ -12,8 +12,8 @@ - name: kubectl config set-credentials admin shell: | kubectl config set-credentials admin \ - --client-certificate={{k8s_ca_conf_directory}}/cert-admin.pem \ - --client-key={{k8s_ca_conf_directory}}/cert-admin-key.pem + --client-certificate={{k8s_ca_conf_directory}}/admin.pem \ + --client-key={{k8s_ca_conf_directory}}/admin-key.pem register: set_credentials - debug: diff --git a/roles/kubectl/tasks/kubectl-config.yml b/roles/kubectl/tasks/kubectl-config.yml index 1f33c02..7e85dae 100644 --- a/roles/kubectl/tasks/kubectl-config.yml +++ b/roles/kubectl/tasks/kubectl-config.yml @@ -1,11 +1,11 @@ -- name: Generate a kubeconfig file for the {{service.name}} service (set-cluster) - shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem --embed-certs=true --server=https://{{apiServer}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig" +- name: Generate a kubeconfig file for the {{service}} service (set-cluster) + shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca.pem --embed-certs=true --server=https://{{apiServer}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig" -- name: Generate a kubeconfig file for the {{service.name}} service (set-credentials) - shell: "kubectl config set-credentials system:{{service.name}} --client-certificate={{k8s_ca_conf_directory}}/cert-{{service.client_cert}}.pem --client-key={{k8s_ca_conf_directory}}/cert-{{service.client_cert}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig" +- name: Generate a kubeconfig file for the {{service}} service (set-credentials) + shell: "kubectl config set-credentials system:{{service}} --client-certificate={{k8s_ca_conf_directory}}/{{service}}.pem --client-key={{k8s_ca_conf_directory}}/{{service}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig" -- name: Generate a kubeconfig file for the {{service.name}} service (set-context) - shell: "kubectl config set-context default --cluster={{k8s_config_cluster_name}} --user=system:{{service.name}} --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig" +- name: Generate a kubeconfig file for the {{service}} service (set-context) + shell: "kubectl config set-context default --cluster={{k8s_config_cluster_name}} --user=system:{{service}} --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig" - name: Set use-context - shell: "kubectl config use-context default --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig" + shell: "kubectl config use-context default --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig" diff --git a/roles/kubectl/tasks/main.yml b/roles/kubectl/tasks/main.yml index 20fe319..8a24835 100644 --- a/roles/kubectl/tasks/main.yml +++ b/roles/kubectl/tasks/main.yml @@ -26,14 +26,14 @@ - kubectl - name: Generate a kubeconfig file for each worker node (set-cluster) - shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem --embed-certs=true --server=https://{{hostvars[groups['k8s_master'][0]]['ansible_'+hostvars[item]['peervpn_conf_interface']].ipv4.address}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig" + shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca.pem --embed-certs=true --server=https://{{hostvars[groups['k8s_master'][0]]['ansible_'+hostvars[item]['peervpn_conf_interface']].ipv4.address}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig" with_inventory_hostnames: - k8s_worker tags: - k8s-auth-config-kubelet - name: Generate a kubeconfig file for each worker node (set-credentials) - shell: "kubectl config set-credentials system:node:{{hostvars[item]['ansible_hostname']}} --client-certificate={{k8s_ca_conf_directory}}/cert-{{item}}.pem --client-key={{k8s_ca_conf_directory}}/cert-{{item}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig" + shell: "kubectl config set-credentials system:node:{{hostvars[item]['ansible_hostname']}} --client-certificate={{k8s_ca_conf_directory}}/{{item}}.pem --client-key={{k8s_ca_conf_directory}}/{{item}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig" with_inventory_hostnames: - k8s_worker tags: @@ -65,17 +65,15 @@ - include_tasks: kubectl-config.yml loop: - - name: kube-proxy - client_cert: k8s-proxy - - name: kube-controller-manager - client_cert: k8s-controller-manager - - name: kube-scheduler - client_cert: k8s-scheduler - - name: admin - client_cert: admin + - kube-proxy + - kube-controller-manager + - kube-scheduler + - admin loop_control: loop_var: service +- include_tasks: kubectl-cluster-config.yml + - name: Create encryption config file template: src: "templates/encryption-config.yaml.j2"