Remove Vault (#3684)

* Remove Vault

* Remove reference to 'kargo' in the doc

* change check order

roles/kubernetes/secrets/tasks/gen_certs_vault.yml

@@ -1,134 +0,0 @@
----
-- import_tasks: sync_kube_master_certs.yml
-  when: inventory_hostname in groups['kube-master']
-
-- import_tasks: sync_kube_node_certs.yml
-  when: inventory_hostname in groups['k8s-cluster']
-
-# Issue admin certs to kube-master hosts
-- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
-  vars:
-    issue_cert_common_name: "admin"
-    issue_cert_copy_ca: "{{ item == kube_admin_certs_needed|first }}"
-    issue_cert_file_group: "{{ kube_cert_group }}"
-    issue_cert_file_owner: kube
-    issue_cert_hosts: "{{ groups['kube-master'] }}"
-    issue_cert_path: "{{ item }}"
-    issue_cert_role: kube-master
-    issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
-    issue_cert_mount_path: "{{ kube_vault_mount_path }}"
-  with_items: "{{ kube_admin_certs_needed|d([]) }}"
-  when: inventory_hostname in groups['kube-master']
-
-- name: gen_certs_vault | Set fact about certificate alt names
-  set_fact:
-    kube_cert_alt_names: >-
-      {{
-      groups['kube-master'] +
-      ['kubernetes.default.svc.'+cluster_name, 'kubernetes.default.svc', 'kubernetes.default', 'kubernetes'] +
-      ['localhost']
-      }}
-  run_once: true
-
-- name: gen_certs_vault | Add external load balancer domain name to certificate alt names
-  set_fact:
-    kube_cert_alt_names: "{{ kube_cert_alt_names + [apiserver_loadbalancer_domain_name] }}"
-  when: loadbalancer_apiserver is defined
-  run_once: true
-
-# Issue master components certs to kube-master hosts
-- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
-  vars:
-    issue_cert_common_name: "kubernetes"
-    issue_cert_alt_names: "{{ kube_cert_alt_names }}"
-    issue_cert_file_group: "{{ kube_cert_group }}"
-    issue_cert_file_owner: kube
-    issue_cert_hosts: "{{ groups['kube-master'] }}"
-    issue_cert_run_once: true
-    issue_cert_ip_sans: >-
-        [
-        {%- for host in groups['kube-master']  -%}
-        "{{ hostvars[host]['ansible_default_ipv4']['address'] }}",
-        {%- if hostvars[host]['ip'] is defined -%}
-        "{{ hostvars[host]['ip'] }}",
-        {%- endif -%}
-        {%- endfor -%}
-        {%- if supplementary_addresses_in_ssl_keys is defined -%}
-        {%- for ip_item in supplementary_addresses_in_ssl_keys -%}
-        "{{ ip_item }}",
-        {%- endfor -%}
-        {%- endif -%}
-        "127.0.0.1","::1","{{ kube_apiserver_ip }}"
-        ]
-    issue_cert_path: "{{ item }}"
-    issue_cert_role: kube-master
-    issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
-    issue_cert_mount_path: "{{ kube_vault_mount_path }}"
-  with_items: "{{ kube_master_components_certs_needed|d([]) }}"
-  when: inventory_hostname in groups['kube-master']
-  notify: set secret_changed
-
-# Issue node certs to k8s-cluster nodes
-- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
-  vars:
-    # Need to strip out the 'node-' prefix from the cert name so it can be used
-    # with the node authorization plugin ( CN matches kubelet node name )
-    issue_cert_common_name: "system:node:{{ item.rsplit('/', 1)[1].rsplit('.', 1)[0] | regex_replace('^node-', '') }}"
-    issue_cert_copy_ca: "{{ item == kube_node_certs_needed|first }}"
-    issue_cert_file_group: "{{ kube_cert_group }}"
-    issue_cert_file_owner: kube
-    issue_cert_hosts: "{{ groups['k8s-cluster'] }}"
-    issue_cert_path: "{{ item }}"
-    issue_cert_role: kube-node
-    issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
-    issue_cert_mount_path: "{{ kube_vault_mount_path }}"
-  with_items: "{{ kube_node_certs_needed|d([]) }}"
-  when: inventory_hostname in groups['k8s-cluster']
-
-# Issue proxy certs to k8s-cluster nodes
-- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
-  vars:
-    issue_cert_common_name: "system:kube-proxy"
-    issue_cert_copy_ca: "{{ item == kube_proxy_certs_needed|first }}"
-    issue_cert_file_group: "{{ kube_cert_group }}"
-    issue_cert_file_owner: kube
-    issue_cert_hosts: "{{ groups['k8s-cluster'] }}"
-    issue_cert_path: "{{ item }}"
-    issue_cert_role: kube-proxy
-    issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
-    issue_cert_mount_path: "{{ kube_vault_mount_path }}"
-  with_items: "{{ kube_proxy_certs_needed|d([]) }}"
-  when: inventory_hostname in groups['k8s-cluster']
-
-# Issue front proxy cert to kube-master hosts
-- include_tasks: ../../../vault/tasks/shared/issue_cert.yml
-  vars:
-    issue_cert_common_name: "front-proxy-client"
-    issue_cert_copy_ca: "{{ item == kube_front_proxy_clients_certs_needed|first }}"
-    issue_cert_ca_filename: front-proxy-ca.pem
-    issue_cert_alt_names: "{{ kube_cert_alt_names }}"
-    issue_cert_file_group: "{{ kube_cert_group }}"
-    issue_cert_file_owner: kube
-    issue_cert_hosts: "{{ groups['kube-master'] }}"
-    issue_cert_ip_sans: >-
-        [
-        {%- for host in groups['kube-master']  -%}
-        "{{ hostvars[host]['ansible_default_ipv4']['address'] }}",
-        {%- if hostvars[host]['ip'] is defined -%}
-        "{{ hostvars[host]['ip'] }}",
-        {%- endif -%}
-        {%- endfor -%}
-        {%- if supplementary_addresses_in_ssl_keys is defined -%}
-        {%- for ip_item in supplementary_addresses_in_ssl_keys -%}
-        "{{ ip_item }}",
-        {%- endfor -%}
-        {%- endif -%}
-        "127.0.0.1","::1","{{ kube_apiserver_ip }}"
-        ]
-    issue_cert_path: "{{ item }}"
-    issue_cert_role: front-proxy-client
-    issue_cert_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
-    issue_cert_mount_path: "{{ kube_vault_mount_path }}"
-  with_items: "{{ kube_front_proxy_clients_certs_needed|d([]) }}"
-  when: inventory_hostname in groups['kube-master']
-  notify: set secret_changed

roles/kubernetes/secrets/tasks/main.yml

@@ -69,7 +69,9 @@
   delegate_to: "{{groups['kube-master'][0]}}"
   when: gen_tokens|default(false)
 
-- include_tasks: "gen_certs_{{ cert_management }}.yml"
+- include_tasks: "gen_certs_script.yml"
+  when:
+    - cert_management |d('script') == 'script'
   tags:
     - k8s-secrets
     - k8s-gen-certs

roles/kubernetes/secrets/tasks/sync_kube_master_certs.yml

@@ -1,89 +0,0 @@
----
-
-- name: sync_kube_master_certs | Create list of needed kube admin certs
-  set_fact:
-    kube_admin_cert_list: "{{ kube_admin_cert_list|d([]) + ['admin-' + inventory_hostname + '.pem'] }}"
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: "{{ item }}"
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: [ "{{ inventory_hostname }}" ]
-    sync_file_is_cert: true
-    sync_file_owner: kube
-  with_items: "{{ kube_admin_cert_list|d([]) }}"
-
-- name: sync_kube_master_certs | Set facts for kube admin sync_file results
-  set_fact:
-    kube_admin_certs_needed: "{{ kube_admin_certs_needed|default([]) + [item.path] }}"
-  with_items: "{{ sync_file_results|d([]) }}"
-  when: item.no_srcs|bool
-
-- name: sync_kube_master_certs | Unset sync_file_results after kube admin certs
-  set_fact:
-    sync_file_results: []
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: "{{ item }}"
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: "{{ groups['kube-master'] }}"
-    sync_file_is_cert: true
-    sync_file_owner: kube
-  with_items: ["apiserver.pem", "kube-scheduler.pem", "kube-controller-manager.pem", "service-account.pem"]
-
-- name: sync_kube_master_certs | Set facts for kube master components sync_file results
-  set_fact:
-    kube_master_components_certs_needed: "{{ kube_master_components_certs_needed|d([]) + [item.path] }}"
-  with_items: "{{ sync_file_results|d([]) }}"
-  when: item.no_srcs|bool
-
-- name: sync_kube_master_certs | Unset sync_file_results after kube master components cert
-  set_fact:
-    sync_file_results: []
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: front-proxy-ca.pem
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: "{{ groups['kube-master'] }}"
-    sync_file_owner: kube
-
-- name: sync_kube_master_certs | Unset sync_file_results after front-proxy-ca.pem
-  set_fact:
-    sync_file_results: []
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: "{{ item }}"
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: "{{ groups['kube-master'] }}"
-    sync_file_is_cert: true
-    sync_file_owner: kube
-  with_items: ["front-proxy-client.pem"]
-
-- name: sync_kube_master_certs | Set facts for front-proxy-client certs sync_file results
-  set_fact:
-    kube_front_proxy_clients_certs_needed: "{{ kube_front_proxy_clients_certs_needed|d([]) + [item.path] }}"
-  with_items: "{{ sync_file_results|d([]) }}"
-  when: item.no_srcs|bool
-
-- name: sync_kube_master_certs | Unset sync_file_results after front-proxy-client sync
-  set_fact:
-    sync_file_results: []
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: ca.pem
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: "{{ groups['kube-master'] }}"
-    sync_file_owner: kube
-
-- name: sync_kube_master_certs | Unset sync_file_results after ca.pem
-  set_fact:
-    sync_file_results: []

roles/kubernetes/secrets/tasks/sync_kube_node_certs.yml

@@ -1,60 +0,0 @@
----
-
-- name: sync_kube_node_certs | Create list of needed certs
-  set_fact:
-    kube_node_cert_list: "{{ kube_node_cert_list|default([]) + ['node-' + inventory_hostname + '.pem'] }}"
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: "{{ item }}"
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: [ "{{ inventory_hostname }}" ]
-    sync_file_is_cert: true
-    sync_file_owner: kube
-  with_items: "{{ kube_node_cert_list|default([]) }}"
-
-- name: sync_kube_node_certs | Set facts for kube-master sync_file results
-  set_fact:
-    kube_node_certs_needed: "{{ kube_node_certs_needed|default([]) + [item.path] }}"
-  with_items: "{{ sync_file_results|d([]) }}"
-  when: item.no_srcs|bool
-
-- name: sync_kube_node_certs | Unset sync_file_results after kube node certs
-  set_fact:
-    sync_file_results: []
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: ca.pem
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: "{{ groups['k8s-cluster'] }}"
-    sync_file_owner: kube
-
-- name: sync_kube_node_certs | Unset sync_file_results after ca.pem
-  set_fact:
-    sync_file_results: []
-
-- name: sync_kube_node_certs | Create list of needed kube-proxy certs
-  set_fact:
-    kube_proxy_cert_list: "{{ kube_proxy_cert_list|default([]) + ['kube-proxy-' + inventory_hostname + '.pem'] }}"
-
-- include_tasks: ../../../vault/tasks/shared/sync_file.yml
-  vars:
-    sync_file: "{{ item }}"
-    sync_file_dir: "{{ kube_cert_dir }}"
-    sync_file_group: "{{ kube_cert_group }}"
-    sync_file_hosts: [ "{{ inventory_hostname }}" ]
-    sync_file_owner: kube
-  with_items: "{{ kube_proxy_cert_list|default([]) }}"
-
-- name: sync_kube_node_certs | Set facts for kube-proxy sync_file results
-  set_fact:
-    kube_proxy_certs_needed: "{{ kube_proxy_certs_needed|default([]) + [item.path] }}"
-  with_items: "{{ sync_file_results|d([]) }}"
-  when: item.no_srcs|bool
-
-- name: sync_kube_node_certs | Unset sync_file_results after kube proxy certs
-  set_fact:
-    sync_file_results: []