Revert "Drop linux capabilities and rework users/groups"

roles/etcd/tasks/gen_certs.yml

@@ -4,15 +4,14 @@
     path={{ etcd_cert_dir }}
     group={{ etcd_cert_group }}
     state=directory
-    mode=0750
-    owner={{ etcd_user }}
+    owner=root
     recurse=yes
 
 - name: "Gen_certs | create etcd script dir (on {{groups['etcd'][0]}})"
   file:
     path: "{{ etcd_script_dir }}"
     state: directory
-    owner: "{{ etcd_user }}"
+    owner: root
   run_once: yes
   delegate_to: "{{groups['etcd'][0]}}"
 
@@ -21,8 +20,7 @@
     path={{ etcd_cert_dir }}
     group={{ etcd_cert_group }}
     state=directory
-    mode=0750
-    owner={{ etcd_user }}
+    owner=root
     recurse=yes
   run_once: yes
   delegate_to: "{{groups['etcd'][0]}}"
@@ -126,12 +124,12 @@
     path={{ etcd_cert_dir }}
     group={{ etcd_cert_group }}
     state=directory
-    owner={{ etcd_user }}
+    owner=kube
     recurse=yes
   tags: facts
 
-- name: Gen_certs | set shared group permissions on keys
-  shell: chmod 0640 {{ etcd_cert_dir}}/*.pem
+- name: Gen_certs | set permissions on keys
+  shell: chmod 0600 {{ etcd_cert_dir}}/*key.pem
   when: inventory_hostname in groups['etcd']
   changed_when: false
 

roles/etcd/tasks/main.yml

@@ -1,8 +1,6 @@
 ---
 - include: pre_upgrade.yml
   tags: etcd-pre-upgrade
-- include: set_facts.yml
-  tags: [bootstrap-os, facts]
 - include: check_certs.yml
   tags: [etcd-secrets, facts]
 - include: gen_certs.yml

roles/etcd/tasks/pre_upgrade.yml

@@ -1,4 +1,3 @@
----
 - name: "Pre-upgrade | check for etcd-proxy unit file"
   stat:
     path: /etc/systemd/system/etcd-proxy.service
@@ -50,7 +49,3 @@
     awk -F"[: =]" '{print "{{ bin_dir }}/etcdctl --peers={{ etcd_access_addresses | regex_replace('https','http') }} member update "$1" https:"$7":"$8}' | bash
   run_once: true
   when: 'etcd_member_list.rc == 0 and "http://" in etcd_member_list.stdout'
-
-- name: "Pre-upgrade | share access to etcd certs for its users"
-  shell: chmod g+r {{ etcd_cert_dir }}/*.pem
-  failed_when: false

roles/etcd/tasks/set_facts.yml

@@ -1,17 +0,0 @@
----
-- name: Etcd | get etcd user ID
-  shell: /usr/bin/id -u {{ etcd_user }} || echo 0
-  register: etcd_uid
-
-- name: Etcd | get etcd group ID
-  shell: /usr/bin/getent group {{ etcd_group }} | cut -d':' -f3 || echo 0
-  register: etcd_gid
-
-- name: Etcd | get etcd cert group ID
-  shell: /usr/bin/getent group {{ etcd_cert_group }} | cut -d':' -f3 || echo 0
-  register: etcd_cert_gid
-
-- set_fact:
-    etcd_user_id: "{{ etcd_uid.stdout }}"
-    etcd_group_id: "{{ etcd_gid.stdout }}"
-    etcd_cert_group_id: "{{ etcd_cert_gid.stdout }}"