External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-01 09:38:12 -03:30
Code Issues Packages Projects Releases Wiki Activity

Updated etcd cert check tasks to detect when new cert gen is required (#7219)

Browse Source 
* Added force_etcd_cert_refresh var to maintain existing functionality. Broke out etcd node cert syncing from member and admin cert sync logic. Now first etcd will sync node certs to other etcd members on every run to keep all etcds up to date after adding additional worker nodes to the cluster

* Updated etcd cert check tasks to better detect when new certificates need to be generated

* Move usage of force_etcd_cert_refresh var to gen_certs fact set

* Force etcd cert generation per server if force_etcd_cert_refresh is set to true

* Include gathering of node certs even if k8s-cluster member and in etcd group.

* Removed run_once due to when statement
This commit is contained in:
David Louks
2021-02-09 03:53:22 -06:00
committed by GitHub
parent e3ab665e90
commit aad78840a0
3 changed files with 116 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
roles/etcd/defaults/main.yml
View File

@@ -12,6 +12,7 @@ etcd_data_dir: "/var/lib/etcd"
# Number of etcd backups to retain. Set to a value < 0 to retain all backups
etcd_backup_retention_count: -1
force_etcd_cert_refresh: true
etcd_config_dir: /etc/ssl/etcd
etcd_cert_dir: "{{ etcd_config_dir }}/ssl"
etcd_cert_dir_mode: "0700"