mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-02-23 14:06:03 -03:30
c4346e590f
This commit uses a kubeadm join config to pull down cert for etcd in workers nodes (which is needed in some circumstances, for instance with calico or cilium). The previous way didn't allow us to pass certain parameters which was typically given in the config in other kubeadm invokations in Kubespray. This made kubeadm produced some errors for some edge cases. For example, in our deployment we don't have a default route and even though it's only to download the certificates, kubeadm produce an error `unable to select an IP from default routes` (these command are kubeadm controlplane command, so kubeadm does some additional checks). This is fixed by specifying `advertiseAddress` within the kubeadm config. Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
---
|
|
- name: Parse certificate key if not set
|
|
set_fact:
|
|
kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_certificate_key'] }}"
|
|
when: kubeadm_certificate_key is undefined
|
|
|
|
- name: Create kubeadm cert controlplane config
|
|
template:
|
|
src: "kubeadm-client.conf.{{ kubeadmConfig_api_version }}.j2"
|
|
dest: "{{ kube_config_dir }}/kubeadm-cert-controlplane.conf"
|
|
mode: 0640
|
|
vars:
|
|
kubeadm_cert_controlplane: true
|
|
|
|
- name: Pull control plane certs down
|
|
shell: >-
|
|
{{ bin_dir }}/kubeadm join phase
|
|
control-plane-prepare download-certs
|
|
--config {{ kube_config_dir }}/kubeadm-cert-controlplane.conf
|
|
&&
|
|
{{ bin_dir }}/kubeadm join phase
|
|
control-plane-prepare certs
|
|
--config {{ kube_config_dir }}/kubeadm-cert-controlplane.conf
|
|
args:
|
|
creates: "{{ kube_cert_dir }}/apiserver-etcd-client.key"
|
|
|
|
- name: Delete unneeded certificates
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- "{{ kube_cert_dir }}/apiserver.crt"
|
|
- "{{ kube_cert_dir }}/apiserver.key"
|
|
- "{{ kube_cert_dir }}/ca.key"
|
|
- "{{ kube_cert_dir }}/etcd/ca.key"
|
|
- "{{ kube_cert_dir }}/etcd/healthcheck-client.crt"
|
|
- "{{ kube_cert_dir }}/etcd/healthcheck-client.key"
|
|
- "{{ kube_cert_dir }}/etcd/peer.crt"
|
|
- "{{ kube_cert_dir }}/etcd/peer.key"
|
|
- "{{ kube_cert_dir }}/etcd/server.crt"
|
|
- "{{ kube_cert_dir }}/etcd/server.key"
|
|
- "{{ kube_cert_dir }}/front-proxy-ca.crt"
|
|
- "{{ kube_cert_dir }}/front-proxy-ca.key"
|
|
- "{{ kube_cert_dir }}/front-proxy-client.crt"
|
|
- "{{ kube_cert_dir }}/front-proxy-client.key"
|
|
- "{{ kube_cert_dir }}/sa.key"
|
|
- "{{ kube_cert_dir }}/sa.pub"
|
|
|
|
- name: Calculate etcd cert serial
|
|
command: "openssl x509 -in {{ kube_cert_dir }}/apiserver-etcd-client.crt -noout -serial"
|
|
register: "etcd_client_cert_serial_result"
|
|
changed_when: false
|
|
when:
|
|
- inventory_hostname in groups['k8s_cluster']|union(groups['calico_rr']|default([]))|unique|sort
|
|
tags:
|
|
- network
|
|
|
|
- name: Set etcd_client_cert_serial
|
|
set_fact:
|
|
etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
|
|
tags:
|
|
- network
|