mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-02-15 02:00:03 -03:30
68718dcb6f
* kubeadm: do not ignore preflight errors blindly The "ignoring all errors" seems to date back to the inception of the kubeadm support (it was --skip-preflight-check before). This can mask real errors and prevent users from seeing them. Do not ignore any errors by default and make the set of ignored errors configurable. * download/kubeadm: remove redundant task The mode is already set by the previous `copy` task. * Validate kubeadm configs This should help to fail early when we have invalid kubeadm configs (from a kubespray bug or a misconfiguration). * kubeadm-upgrade: remove unnecessary bool cast * Convert kubeadm join discovery timeout to v1beta4 config * CI: Ignore kubeadm:Mem errors on some setup.
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
---
|
|
- name: Parse certificate key if not set
|
|
set_fact:
|
|
kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_certificate_key'] }}"
|
|
when: kubeadm_certificate_key is undefined
|
|
|
|
- name: Create kubeadm cert controlplane config
|
|
template:
|
|
src: "kubeadm-client.conf.j2"
|
|
dest: "{{ kube_config_dir }}/kubeadm-cert-controlplane.conf"
|
|
mode: "0640"
|
|
validate: "{{ bin_dir }}/kubeadm config validate --config %s"
|
|
vars:
|
|
kubeadm_cert_controlplane: true
|
|
|
|
- name: Pull control plane certs down
|
|
shell: >-
|
|
{{ bin_dir }}/kubeadm join phase
|
|
control-plane-prepare download-certs
|
|
--config {{ kube_config_dir }}/kubeadm-cert-controlplane.conf
|
|
&&
|
|
{{ bin_dir }}/kubeadm join phase
|
|
control-plane-prepare certs
|
|
--config {{ kube_config_dir }}/kubeadm-cert-controlplane.conf
|
|
args:
|
|
creates: "{{ kube_cert_dir }}/apiserver-etcd-client.key"
|
|
|
|
- name: Delete unneeded certificates
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- "{{ kube_cert_dir }}/apiserver.crt"
|
|
- "{{ kube_cert_dir }}/apiserver.key"
|
|
- "{{ kube_cert_dir }}/ca.key"
|
|
- "{{ kube_cert_dir }}/etcd/ca.key"
|
|
- "{{ kube_cert_dir }}/etcd/healthcheck-client.crt"
|
|
- "{{ kube_cert_dir }}/etcd/healthcheck-client.key"
|
|
- "{{ kube_cert_dir }}/etcd/peer.crt"
|
|
- "{{ kube_cert_dir }}/etcd/peer.key"
|
|
- "{{ kube_cert_dir }}/etcd/server.crt"
|
|
- "{{ kube_cert_dir }}/etcd/server.key"
|
|
- "{{ kube_cert_dir }}/front-proxy-ca.crt"
|
|
- "{{ kube_cert_dir }}/front-proxy-ca.key"
|
|
- "{{ kube_cert_dir }}/front-proxy-client.crt"
|
|
- "{{ kube_cert_dir }}/front-proxy-client.key"
|
|
- "{{ kube_cert_dir }}/sa.key"
|
|
- "{{ kube_cert_dir }}/sa.pub"
|
|
|
|
- name: Calculate etcd cert serial
|
|
command: "openssl x509 -in {{ kube_cert_dir }}/apiserver-etcd-client.crt -noout -serial"
|
|
register: "etcd_client_cert_serial_result"
|
|
changed_when: false
|
|
when:
|
|
- group_names | intersect(['k8s_cluster', 'calico_rr']) | length > 0
|
|
tags:
|
|
- network
|
|
|
|
- name: Set etcd_client_cert_serial
|
|
set_fact:
|
|
etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
|
|
tags:
|
|
- network
|