From 436d31433f7d69c57a86fa54c8d3ef5086caf8b2 Mon Sep 17 00:00:00 2001
From: Paul-Henri Froidmont <git.contact-57n2p@froidmont.org>
Date: Thu, 2 Aug 2018 22:24:33 +0200
Subject: [PATCH] Move kubectl config into a specific playbook and fix certs
 path

---
 inventories/staging/.hosts.swp                | Bin 0 -> 12288 bytes
 k8s.yml                                       |   5 -----
 playbooks/group_vars                          |   1 +
 playbooks/host_vars                           |   1 +
 playbooks/kubectl-config.yml                  |   8 ++++++++
 playbooks/roles                               |   1 +
 .../kubectl/tasks/kubectl-cluster-config.yml  |   6 +++---
 roles/kubectl/tasks/kubectl-config.yml        |  14 +++++++-------
 roles/kubectl/tasks/main.yml                  |  18 ++++++++----------
 9 files changed, 29 insertions(+), 25 deletions(-)
 create mode 100644 inventories/staging/.hosts.swp
 create mode 120000 playbooks/group_vars
 create mode 120000 playbooks/host_vars
 create mode 100644 playbooks/kubectl-config.yml
 create mode 120000 playbooks/roles

diff --git a/inventories/staging/.hosts.swp b/inventories/staging/.hosts.swp
new file mode 100644
index 0000000000000000000000000000000000000000..81a4161c2a37772b7807ba8ad8951495e4166d8f
GIT binary patch
literal 12288
zcmYc?2=nw+u+TGLU|?VnU|`Uk6dzqB<;JkHih&`mC_ghLw;&NDg%78v=9T2<>!zd@
zXP4v`;8s}&Gf+REC_gJTxujUXI5j6tHzU8eBr`8vKQpfkWKvOPYO#KCNn$!k3?x^K
z+sILw(GVC70ir{Im%-S`5S-POl@t|(g+hteIjV3p1V%$(Gz3ONU^E0qLtr!nMnhmU
z1V%$(=!ZZ_0V6{_0|NsS)GM4&nh}kLa!0Ar5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S^vT0*NUM3>y3l3>o~8`F~jd|201Y!wG%{hU5GU3_JN57^d+vFihoV
zVCdmzV9123PY3B4f_@%#@@NQ*hQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2+%A9
za`KZCb3m)v6%zA`Gm~;s<CF9A@=}vaGV}9n!IBKo*%rm|$%(NH3}8MHinB|TQj<$^
Wh|~eKST{L8ucRnHCnvQimH_}Ec4_GV

literal 0
HcmV?d00001

diff --git a/k8s.yml b/k8s.yml
index 0edcd9c..194bfbf 100644
--- a/k8s.yml
+++ b/k8s.yml
@@ -31,11 +31,6 @@
       tags: role-cfssl
     - role: kubernetes-ca
       tags: role-kubernetes-ca
-- hosts: k8s_kubectl
-  become: yes
-  roles:
-    - role: kubectl
-      tags: role-kubectl
 - hosts: k8s_etcd
   roles:
     - role: etcd
diff --git a/playbooks/group_vars b/playbooks/group_vars
new file mode 120000
index 0000000..cc7e7a9
--- /dev/null
+++ b/playbooks/group_vars
@@ -0,0 +1 @@
+../group_vars
\ No newline at end of file
diff --git a/playbooks/host_vars b/playbooks/host_vars
new file mode 120000
index 0000000..e0ccba1
--- /dev/null
+++ b/playbooks/host_vars
@@ -0,0 +1 @@
+../host_vars
\ No newline at end of file
diff --git a/playbooks/kubectl-config.yml b/playbooks/kubectl-config.yml
new file mode 100644
index 0000000..a4781a6
--- /dev/null
+++ b/playbooks/kubectl-config.yml
@@ -0,0 +1,8 @@
+---
+- hosts: all
+  tasks: [ ]
+- hosts: k8s_kubectl
+  become: yes
+  roles:
+    - role: kubectl
+      tags: role-kubectl
diff --git a/playbooks/roles b/playbooks/roles
new file mode 120000
index 0000000..d8c4472
--- /dev/null
+++ b/playbooks/roles
@@ -0,0 +1 @@
+../roles
\ No newline at end of file
diff --git a/roles/kubectl/tasks/kubectl-cluster-config.yml b/roles/kubectl/tasks/kubectl-cluster-config.yml
index eb09430..9150327 100644
--- a/roles/kubectl/tasks/kubectl-cluster-config.yml
+++ b/roles/kubectl/tasks/kubectl-cluster-config.yml
@@ -1,7 +1,7 @@
 - name: kubectl config set-cluster
   shell: |
     kubectl config set-cluster {{k8s_config_cluster_name}} \
-      --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem \
+      --certificate-authority={{k8s_ca_conf_directory}}/ca.pem \
       --embed-certs=true \
       --server=https://{{hostvars[groups.k8s_master|first]['ansible_' + k8s_interface].ipv4.address}}:6443
   register: set_cluster
@@ -12,8 +12,8 @@
 - name: kubectl config set-credentials admin
   shell: |
     kubectl config set-credentials admin \
-      --client-certificate={{k8s_ca_conf_directory}}/cert-admin.pem \
-      --client-key={{k8s_ca_conf_directory}}/cert-admin-key.pem
+      --client-certificate={{k8s_ca_conf_directory}}/admin.pem \
+      --client-key={{k8s_ca_conf_directory}}/admin-key.pem
   register: set_credentials
 
 - debug:
diff --git a/roles/kubectl/tasks/kubectl-config.yml b/roles/kubectl/tasks/kubectl-config.yml
index 1f33c02..7e85dae 100644
--- a/roles/kubectl/tasks/kubectl-config.yml
+++ b/roles/kubectl/tasks/kubectl-config.yml
@@ -1,11 +1,11 @@
-- name: Generate a kubeconfig file for the {{service.name}} service (set-cluster)
-  shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem --embed-certs=true --server=https://{{apiServer}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig"
+- name: Generate a kubeconfig file for the {{service}} service (set-cluster)
+  shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca.pem --embed-certs=true --server=https://{{apiServer}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig"
 
-- name: Generate a kubeconfig file for the {{service.name}} service (set-credentials)
-  shell: "kubectl config set-credentials system:{{service.name}} --client-certificate={{k8s_ca_conf_directory}}/cert-{{service.client_cert}}.pem --client-key={{k8s_ca_conf_directory}}/cert-{{service.client_cert}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig"
+- name: Generate a kubeconfig file for the {{service}} service (set-credentials)
+  shell: "kubectl config set-credentials system:{{service}} --client-certificate={{k8s_ca_conf_directory}}/{{service}}.pem --client-key={{k8s_ca_conf_directory}}/{{service}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig"
 
-- name: Generate a kubeconfig file for the {{service.name}} service (set-context)
-  shell: "kubectl config set-context default --cluster={{k8s_config_cluster_name}} --user=system:{{service.name}} --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig"
+- name: Generate a kubeconfig file for the {{service}} service (set-context)
+  shell: "kubectl config set-context default --cluster={{k8s_config_cluster_name}} --user=system:{{service}} --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig"
 
 - name: Set use-context
-  shell: "kubectl config use-context default --kubeconfig={{k8s_config_directory}}/{{service.name}}.kubeconfig"
+  shell: "kubectl config use-context default --kubeconfig={{k8s_config_directory}}/{{service}}.kubeconfig"
diff --git a/roles/kubectl/tasks/main.yml b/roles/kubectl/tasks/main.yml
index 20fe319..8a24835 100644
--- a/roles/kubectl/tasks/main.yml
+++ b/roles/kubectl/tasks/main.yml
@@ -26,14 +26,14 @@
     - kubectl
 
 - name: Generate a kubeconfig file for each worker node (set-cluster)
-  shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca-k8s-apiserver.pem --embed-certs=true --server=https://{{hostvars[groups['k8s_master'][0]]['ansible_'+hostvars[item]['peervpn_conf_interface']].ipv4.address}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig"
+  shell: "kubectl config set-cluster {{k8s_config_cluster_name}} --certificate-authority={{k8s_ca_conf_directory}}/ca.pem --embed-certs=true --server=https://{{hostvars[groups['k8s_master'][0]]['ansible_'+hostvars[item]['peervpn_conf_interface']].ipv4.address}}:{{k8s_apiserver_secure_port}} --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig"
   with_inventory_hostnames:
     - k8s_worker
   tags:
     - k8s-auth-config-kubelet
 
 - name: Generate a kubeconfig file for each worker node (set-credentials)
-  shell: "kubectl config set-credentials system:node:{{hostvars[item]['ansible_hostname']}} --client-certificate={{k8s_ca_conf_directory}}/cert-{{item}}.pem --client-key={{k8s_ca_conf_directory}}/cert-{{item}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig"
+  shell: "kubectl config set-credentials system:node:{{hostvars[item]['ansible_hostname']}} --client-certificate={{k8s_ca_conf_directory}}/{{item}}.pem --client-key={{k8s_ca_conf_directory}}/{{item}}-key.pem --embed-certs=true --kubeconfig={{k8s_config_directory}}/{{item}}.kubeconfig"
   with_inventory_hostnames:
     - k8s_worker
   tags:
@@ -65,17 +65,15 @@
 
 - include_tasks: kubectl-config.yml
   loop:
-    - name: kube-proxy
-      client_cert: k8s-proxy
-    - name: kube-controller-manager
-      client_cert: k8s-controller-manager
-    - name: kube-scheduler
-      client_cert: k8s-scheduler
-    - name: admin
-      client_cert: admin
+    - kube-proxy
+    - kube-controller-manager
+    - kube-scheduler
+    - admin
   loop_control:
     loop_var: service
 
+- include_tasks: kubectl-cluster-config.yml
+
 - name: Create encryption config file
   template:
     src: "templates/encryption-config.yaml.j2"