Generate TLS certs for calico typha (#5258)

* Generate TLS certs for calico typha

Change-Id: I3883f49c124c52d0fc5b900ca2b44e4e2ed0d707

* Add group vars note

Change-Id: I63550dfef616e884efdbd42010a90b2c04c5eb69

roles/network_plugin/calico/tasks/install.yml

@@ -57,6 +57,12 @@
     - {s: "{{ kube_etcd_key_file }}", d: "key.pem"}
   when: calico_datastore == "etcd"
 
+- name: Calico | Generate typha certs
+  include_tasks: typha_certs.yml
+  when:
+    - typha_secure
+    - inventory_hostname == groups['kube-master'][0]
+
 - name: Calico | Install calicoctl wrapper script
   template:
     src: "calicoctl.{{ calico_datastore }}.sh.j2"

roles/network_plugin/calico/tasks/typha_certs.yml

@@ -0,0 +1,49 @@
+---
+- name: Calico | Check if typha-server exists
+  command: "{{ bin_dir }}/kubectl -n kube-system get secret typha-server"
+  register: typha_server_secret
+  changed_when: false
+  failed_when: false
+
+- name: Calico | Ensure calico certs dir
+  file:
+    path: /etc/calico/certs
+    state: directory
+  when: typha_server_secret.rc != 0
+
+- name: Calico | Copy ssl script for typha certs
+  copy:
+    src: make-ssl-typha.sh
+    dest: "{{ bin_dir }}/make-ssl-typha.sh"
+    mode: 0755
+  when: typha_server_secret.rc != 0
+
+- name: Calico | Copy ssl config for typha certs
+  copy:
+    src: openssl.conf
+    dest: /etc/calico/certs/openssl.conf
+    mode: 0644
+  when: typha_server_secret.rc != 0
+
+- name: Calico | Generate typha certs
+  command: >-
+    {{ bin_dir }}/make-ssl-typha.sh
+    -f /etc/calico/certs/openssl.conf
+    -c {{ kube_cert_dir }}
+    -d /etc/calico/certs
+  when: typha_server_secret.rc != 0
+
+- name: Calico | Create typha tls secrets
+  command: >-
+    {{ bin_dir }}/kubectl -n kube-system
+    create secret tls {{ item.name }}
+    --cert {{ item.cert }}
+    --key {{ item.key }}
+  with_items:
+    - name: typha-server
+      cert: /etc/calico/certs/typha-server.crt
+      key: /etc/calico/certs/typha-server.key
+    - name: typha-client
+      cert: /etc/calico/certs/typha-client.crt
+      key: /etc/calico/certs/typha-client.key
+  when: typha_server_secret.rc != 0