mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-01-29 07:14:45 -03:30
2740c13c0c
etcd does not use the apiserver load balancer, there is no reason to include it's DNS into etcd certificates.
51 lines
2.1 KiB
Django/Jinja
51 lines
2.1 KiB
Django/Jinja
{% set counter = {'dns': 2,'ip': 1,} %}{% macro increment(dct, key, inc=1)%}{% if dct.update({key: dct[key] + inc}) %} {% endif %}{% endmacro %}[req]
|
|
req_extensions = v3_req
|
|
distinguished_name = req_distinguished_name
|
|
|
|
[req_distinguished_name]
|
|
|
|
[ v3_req ]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[ ssl_client ]
|
|
extendedKeyUsage = clientAuth, serverAuth
|
|
basicConstraints = CA:FALSE
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid,issuer
|
|
subjectAltName = @alt_names
|
|
|
|
[ v3_ca ]
|
|
basicConstraints = CA:TRUE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
authorityKeyIdentifier=keyid:always,issuer
|
|
|
|
[alt_names]
|
|
DNS.1 = localhost
|
|
{% for host in groups['etcd'] %}
|
|
{% if hostvars[host]['etcd_access_address'] is defined and not (hostvars[host]['etcd_access_address'] | ansible.utils.ipaddr) %}
|
|
{# If defined, the address which etcd uses to access its members must be included in the SAN, otherwise etcd will fail with a TLS error upon startup. #}
|
|
DNS.{{ counter["dns"] }} = {{ hostvars[host]['etcd_access_address'] }}{{ increment(counter, 'dns') }}
|
|
{% endif %}
|
|
{# This will always expand to inventory_hostname, which can be a completely arbitrary name, that etcd will not know or care about, hence this line is (probably) redundant. #}
|
|
DNS.{{ counter["dns"] }} = {{ host }}{{ increment(counter, 'dns') }}
|
|
{% endfor %}
|
|
{% for etcd_alt_name in etcd_cert_alt_names %}
|
|
DNS.{{ counter["dns"] }} = {{ etcd_alt_name }}{{ increment(counter, 'dns') }}
|
|
{% endfor %}
|
|
{% for host in groups['etcd'] %}
|
|
{% for address in hostvars[host]['main_access_ips'] %}
|
|
IP.{{ counter["ip"] }} = {{ address }}{{ increment(counter, 'ip') }}
|
|
{% endfor %}
|
|
{% for address in hostvars[host]['main_ips'] %}
|
|
IP.{{ counter["ip"] }} = {{ address }}{{ increment(counter, 'ip') }}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% for cert_alt_ip in etcd_cert_alt_ips %}
|
|
IP.{{ counter["ip"] }} = {{ cert_alt_ip }}{{ increment(counter, 'ip') }}
|
|
{% endfor %}
|
|
IP.{{ counter["ip"] }} = 127.0.0.1{{ increment(counter, 'ip') }}
|
|
IP.{{ counter["ip"] }} = ::1
|