Add documentation about having HA for etcd

roles/etcd/defaults/main.yml

@@ -20,6 +20,7 @@ etcd_cert_alt_names:
   - "etcd.kube-system.svc"
   - "etcd.kube-system"
   - "etcd"
+etcd_cert_alt_ips: []
 
 etcd_script_dir: "{{ bin_dir }}/etcd-scripts"
 

roles/etcd/tasks/gen_certs_vault.yml

@@ -26,6 +26,9 @@
         "{{ hostvars[host]['ip'] }}",
         {%- endif -%}
         {%- endfor -%}
+        {%- for cert_alt_ip in etcd_cert_alt_ips -%}
+        "{{ cert_alt_ip }}",
+        {%- endfor -%}
         "127.0.0.1","::1"
         ]
     issue_cert_path: "{{ item }}"

roles/etcd/templates/openssl.conf.j2

@@ -39,4 +39,7 @@ IP.{{ counter["ip"] }} = {{ hostvars[host]['access_ip'] }}{{ increment(counter,
 {% endif %}
 IP.{{ counter["ip"] }} = {{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}{{ increment(counter, 'ip') }}
 {% endfor %}
+{% for cert_alt_ip in etcd_cert_alt_ips %}
+IP.{{ counter["ip"] }} = {{ cert_alt_ip }}{{ increment(counter, 'ip') }}
+{% endfor %}
 IP.{{ counter["ip"] }} = 127.0.0.1