epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-03-06 18:17:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adding in certificate serial numbers to manifests (#1392)

Browse Source
This commit is contained in:
Brad Beam
2017-09-01 01:02:23 -05:00
committed by Matthew Mosesohn
parent 783924e671
commit 8ae77e955e
8 changed files with 56 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
roles/kubernetes/secrets/tasks/main.yml
View File

@@ -75,5 +75,37 @@
- include: upd_ca_trust.yml
tags: k8s-secrets
- name: "Gen_certs | Get certificate serials on kube masters"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "master_certificate_serials"
with_items:
- "admin-{{ inventory_hostname }}.pem"
- "apiserver.pem"
- "kube-controller-manager.pem"
- "kube-scheduler.pem"
when: inventory_hostname in groups['kube-master']
- name: "Gen_certs | set kube master certificate serial facts"
set_fact:
etcd_admin_cert_serial: "{{ master_certificate_serials.results[0].stdout|default() }}"
apiserver_cert_serial: "{{ master_certificate_serials.results[1].stdout|default() }}"
controller_manager_cert_serial: "{{ master_certificate_serials.results[2].stdout|default() }}"
scheduler_cert_serial: "{{ master_certificate_serials.results[3].stdout|default() }}"
when: inventory_hostname in groups['kube-master']
- name: "Gen_certs | Get certificate serials on kube nodes"
shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
register: "node_certificate_serials"
with_items:
- "node-{{ inventory_hostname }}.pem"
- "kube-proxy-{{ inventory_hostname }}.pem"
when: inventory_hostname in groups['k8s-cluster']
- name: "Gen_certs | set kube node certificate serial facts"
set_fact:
etcd_node_cert_serial: "{{ node_certificate_serials.results[0].stdout|default() }}"
kube_proxy_cert_serial: "{{ node_certificate_serials.results[1].stdout|default() }}"
when: inventory_hostname in groups['k8s-cluster']
- include: gen_tokens.yml
tags: k8s-secrets