mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-01-11 10:00:03 -03:30
0b2e5b2f82
This allows this task to work with a forks count > 10 and the default configuration of sshd, which is to limit sessions to 10. (see MaxSessions in sshd_config). Since this is a delegate_to task, it connects to the same host (first etcd) for each node in the cluster, thus easily going above 10. Raising the ssh connection attempts allow for more robustness, without decreasing the forks count or serialising the tasks, which could slow the task (or the playbook as a whole, if decreasing forks).
34 lines
1.0 KiB
YAML
34 lines
1.0 KiB
YAML
---
|
|
- name: Gen_certs | Set cert names per node
|
|
set_fact:
|
|
my_etcd_node_certs: [ 'ca.pem',
|
|
'node-{{ inventory_hostname }}.pem',
|
|
'node-{{ inventory_hostname }}-key.pem']
|
|
tags:
|
|
- facts
|
|
|
|
- name: "Check_certs | Set 'sync_certs' to true on nodes"
|
|
set_fact:
|
|
sync_certs: true
|
|
with_items:
|
|
- "{{ my_etcd_node_certs }}"
|
|
|
|
- name: Gen_certs | Gather node certs
|
|
vars:
|
|
ansible_ssh_retries: 10
|
|
shell: "set -o pipefail && tar cfz - -C {{ etcd_cert_dir }} {{ my_etcd_node_certs | join(' ') }} | base64 --wrap=0"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: "{{ not (unsafe_show_logs | bool) }}"
|
|
register: etcd_node_certs
|
|
check_mode: no
|
|
delegate_to: "{{ groups['etcd'][0] }}"
|
|
changed_when: false
|
|
|
|
- name: Gen_certs | Copy certs on nodes
|
|
shell: "set -o pipefail && base64 -d <<< '{{ etcd_node_certs.stdout | quote }}' | tar xz -C {{ etcd_cert_dir }}"
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: "{{ not (unsafe_show_logs | bool) }}"
|
|
changed_when: false
|