mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-10-30 06:13:29 -02:30
Max Gautier
c554ee816d
2.19 disallow methods with side effects in Jinja. Use a simple loop by adding all the SANs source in one list. Also check the sources before hand for failing on CIDR notation. Link: https://github.com/ansible/ansible/issues/85202
44 lines
1.3 KiB
Django/Jinja
44 lines
1.3 KiB
Django/Jinja
[req]
|
|
req_extensions = v3_req
|
|
distinguished_name = req_distinguished_name
|
|
|
|
[req_distinguished_name]
|
|
|
|
[ v3_req ]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[ ssl_client ]
|
|
extendedKeyUsage = clientAuth, serverAuth
|
|
basicConstraints = CA:FALSE
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid,issuer
|
|
subjectAltName = @alt_names
|
|
|
|
[ v3_ca ]
|
|
basicConstraints = CA:TRUE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
authorityKeyIdentifier=keyid:always,issuer
|
|
|
|
[alt_names]
|
|
{#
|
|
List all possible ways etcd instances can be contacted
|
|
|
|
main_{access_,}ips: those variables are explicitly set by network_facts role
|
|
and thus don't need a defined check
|
|
#}
|
|
{% for san in (
|
|
groups['etcd'] | map('extract', hostvars, morekeys='etcd_access_address') | select('defined')
|
|
+ groups['etcd']
|
|
+ etcd_cert_alt_names
|
|
+ groups['etcd'] | map('extract', hostvars, morekeys='main_access_ips')
|
|
+ groups['etcd'] | map('extract', hostvars, morekeys='main_ips')
|
|
+ etcd_cert_alt_ips
|
|
+ ['localhost', '127.0.0.1', '::1']
|
|
) | flatten | unique
|
|
%}
|
|
{{ 'IP' if san is ansible.utils.ip_address else 'DNS' }}.{{ loop.index }} = {{ san }}
|
|
{% endfor %}
|