alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Encryption and major changes

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/microk8s/defaults/main.yml
+21 -18
View File
@@ -1,38 +1,41 @@
k8s_version: "1.29"
kubectl_version: "1.29.0"
microk8s_k8s_version: "1.29"
microk8s_kubectl_version: "1.29.0"
# load balancer configuration
lb_provider: "metallb"
lb_ips: "10.2.0.40-10.2.0.49"
lb_http_port: 80
lb_https_port: 443
metallb_version: 0.14.5
microk8s_lb_provider: "metallb"
microk8s_lb_ips: "10.2.0.40-10.2.0.49"
microk8s_lb_http_port: 80
microk8s_lb_https_port: 443
microk8s_metallb_version: 0.14.5
# certificate manager
issuer_email: webmaster@localhost.localdomain
certmgr_version: 1.14.5
microk8s_issuer_email: webmaster@localhost.localdomain
microk8s_certmgr_version: 1.14.5
# microk8s specific
microk8s_channel: "{{ k8s_version }}/stable"
microk8s_channel: "{{ microk8s_k8s_version }}/stable"
microk8s_privileged: true
microk8s_alt_names: "localhost.localdomain"
microk8s_status_timeout: 300
k8s_users: []
microk8s_users: []
k8s_host_public_ip: "{{ ansible_default_ipv4.address }}"
microk8s_host_public_ip: "{{ ansible_default_ipv4.address }}"
k8s_net_devices:
microk8s_net_devices:
- "cni+"
- "flannel+"
k8s_incoming_traffic:
microk8s_incoming_traffic:
- { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
- { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
- { rule: "allow", port: "10254", proto: "tcp", from: "{{ k8s_host_public_ip }}" }
- { rule: "allow", port: "10254", proto: "tcp", from: "{{ microk8s_host_public_ip }}" }
k8s_outgoing_traffic: []
microk8s_outgoing_traffic: []
k8s_allowed_hosts: []
microk8s_allowed_hosts: []
k8s_iac_user: "provision"
microk8s_iac_user: "provision"
microk8s_encryption_secret: "a13labs"
microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml"
ansible/roles/microk8s/tasks/certmanager.yml
+3 -3
View File
@@ -1,6 +1,6 @@
- name: CertManager | Copy latest manifest
ansible.builtin.get_url:
url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml"
dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
mode: "0600"
@@ -35,7 +35,7 @@
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: "{{ issuer_email }}"
email: "{{ microk8s_issuer_email }}"
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
@@ -65,7 +65,7 @@
# The ACME server URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: "{{ issuer_email }}"
email: "{{ microk8s_issuer_email }}"
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
ansible/roles/microk8s/tasks/iac.yml
+47 -43
View File
@@ -11,7 +11,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: "{{ k8s_iac_user }}"
name: "{{ microk8s_iac_user }}"
namespace: default
tags:
- k8s::iac
@@ -29,10 +29,10 @@
apiVersion: v1
kind: Secret
metadata:
name: "{{ k8s_iac_user }}-token"
name: "{{ microk8s_iac_user }}-token"
namespace: default
annotations:
kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
kubernetes.io/service-account.name: "{{ microk8s_iac_user }}"
type: kubernetes.io/service-account-token
tags:
- k8s::iac
@@ -58,14 +58,14 @@
subjects:
- kind: ServiceAccount
namespace: default
name: "{{ k8s_iac_user }}"
name: "{{ microk8s_iac_user }}"
tags:
- k8s::iac
- name: Get the secret name
ansible.builtin.shell: |
set -o pipefail
microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }'
args:
executable: /bin/bash
register: secret_name
@@ -98,44 +98,48 @@
tags:
- k8s::iac
- name: Patch kubeconfig with user token
ansible.builtin.set_fact:
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
vars:
new_kubeconfig:
contexts:
- context:
cluster: microk8s-cluster
user: "{{ k8s_iac_user }}"
name: microk8s
users:
- name: "{{ k8s_iac_user }}"
user:
token: "{{ token.stdout }}"
tags:
- k8s::iac
- name: Render kubeconfig
when: kubeconfig.stdout != ""
block:
- name: Patch kubeconfig with user token
ansible.builtin.set_fact:
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
vars:
new_kubeconfig:
contexts:
- context:
cluster: microk8s-cluster
user: "{{ microk8s_iac_user }}"
name: microk8s
users:
- name: "{{ microk8s_iac_user }}"
user:
token: "{{ token.stdout }}"
tags:
- k8s::iac
- name: Check if a config already exists and its SHA1
become: true
ansible.builtin.stat:
path: "{{ k8s_kubeconfig }}"
register: kubeconfig_exists
tags:
- k8s::iac
- name: Check if a config already exists and its SHA1
become: true
ansible.builtin.stat:
path: "{{ k8s_kubeconfig }}"
register: kubeconfig_exists
tags:
- k8s::iac
- name: Get new config SHA1
ansible.builtin.set_fact:
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
tags:
- k8s::iac
- name: Get new config SHA1
ansible.builtin.set_fact:
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
tags:
- k8s::iac
- name: Write kubeconfig
become: true
ansible.builtin.copy:
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
dest: "{{ k8s_kubeconfig }}"
owner: "{{ k8s_iac_user }}"
mode: "0600"
when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
tags:
- k8s::iac
- name: Write kubeconfig
become: true
ansible.builtin.copy:
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
dest: "{{ k8s_kubeconfig }}"
owner: "{{ microk8s_iac_user }}"
mode: "0600"
when:
- not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
tags:
- k8s::iac
ansible/roles/microk8s/tasks/loadbalancer.yml
+4 -4
View File
@@ -1,5 +1,5 @@
- name: Loadbalancer | Setup '{{ lb_provider }}'
ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml"
- name: Loadbalancer | Setup '{{ microk8s_lb_provider }}'
ansible.builtin.include_tasks: "loadbalancer/{{ microk8s_lb_provider }}.yaml"
- name: Loadbalancer | Create Loadbalancer for Nginx ingress
environment:
@@ -23,9 +23,9 @@
ports:
- name: http
protocol: TCP
port: "{{ lb_http_port }}"
port: "{{ microk8s_lb_http_port }}"
targetPort: 80
- name: https
protocol: TCP
port: "{{ lb_https_port }}"
port: "{{ microk8s_lb_https_port }}"
targetPort: 443
ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml
+2 -2
View File
@@ -1,6 +1,6 @@
- name: MetalLB | Copy manifest files to host
ansible.builtin.get_url:
url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml"
url: "https://raw.githubusercontent.com/metallb/metallb/v{{ microk8s_metallb_version }}/config/manifests/metallb-native.yaml"
dest: "{{ k8s_etc }}/metallb.yaml"
mode: "0600"
@@ -32,7 +32,7 @@
namespace: metallb-system
spec:
addresses:
- "{{ lb_ips }}"
- "{{ microk8s_lb_ips }}"
- name: MetalLB | Create L2Advertisement
environment:
ansible/roles/microk8s/tasks/main.yml
+3 -3
View File
@@ -53,7 +53,7 @@
- name: Download kubectl
become: true
ansible.builtin.get_url:
url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl"
url: "https://dl.k8s.io/release/v{{ microk8s_kubectl_version }}/bin/linux/amd64/kubectl"
dest: "/usr/local/bin/kubectl"
mode: "0755"
owner: "root"
@@ -78,7 +78,7 @@
- name: "Setup local user access to k8s - {{ item.username }}"
ansible.builtin.include_tasks: "setupenv/main.yml"
loop: "{{ k8s_users }}"
when: k8s_users is defined
loop: "{{ microk8s_users }}"
when: microk8s_users is defined
tags:
- k8s::users
ansible/roles/microk8s/tasks/microk8s/encryption.yml
View File
ansible/roles/microk8s/tasks/microk8s/install.yml
+26 -10
View File
@@ -1,4 +1,3 @@
# Install a snap with classic confinement
- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
become: true
community.general.snap:
@@ -6,6 +5,25 @@
channel: "{{ microk8s_channel }}"
classic: true
- name: Create encryption configuration
become: true
ansible.builtin.copy:
content: |
---
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- aescbc:
keys:
- name: k8s-crypto
secret: {{ microk8s_encryption_secret }}
- identity: {}
dest: "{{ microk8s_encryption_cfg }}"
mode: "0600"
- name: Microk8s | Patch microk8s configuration
notify: ["Restart microk8s"]
block:
@@ -16,6 +34,13 @@
line: "--allow-privileged=true"
insertafter: "^--insecure-port=0$"
- name: Microk8s | Enable encryption provider
become: true
ansible.builtin.lineinfile:
path: /var/snap/microk8s/current/args/kube-apiserver
line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml"
insertafter: "^--insecure-port=0$"
- name: Microk8s | Fixing Disk Pressure
become: true
ansible.builtin.lineinfile:
@@ -64,17 +89,8 @@
- { plugin: "ingress", wait: 60, args: "", enabled: true }
- { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
- name: Microk8s | Check if ufw is enabled
become: true
ansible.builtin.shell:
cmd: "ufw status"
register: ufw_status
changed_when: false
- name: Microk8s | Configure required ufw rules
ansible.builtin.include_tasks: microk8s/ufw.yml
when:
- ufw_status.stdout.find("Status: active") != -1
- name: Microk8s | Store kubeconfig
ansible.builtin.shell:
ansible/roles/microk8s/tasks/microk8s/ufw.yml
+5 -5
View File
@@ -6,7 +6,7 @@
interface: "{{ item }}"
comment: ansible managed
with_items:
- "{{ k8s_net_devices }}"
- "{{ microk8s_net_devices }}"
retries: 5
delay: 10
@@ -18,7 +18,7 @@
interface: "{{ item }}"
comment: ansible managed
with_items:
- "{{ k8s_net_devices }}"
- "{{ microk8s_net_devices }}"
retries: 5
delay: 10
@@ -31,7 +31,7 @@
proto: "{{ item.proto }}"
comment: ansible managed
with_items:
- "{{ k8s_incoming_traffic }}"
- "{{ microk8s_incoming_traffic }}"
retries: 5
delay: 10
@@ -43,7 +43,7 @@
direction: out
comment: ansible managed
with_items:
- "{{ k8s_outgoing_traffic }}"
- "{{ microk8s_outgoing_traffic }}"
retries: 5
delay: 10
@@ -56,6 +56,6 @@
proto: tcp
comment: ansible managed
with_items:
- "{{ k8s_allowed_hosts }}"
- "{{ microk8s_allowed_hosts }}"
retries: 5
delay: 10
ansible/roles/microk8s/tasks/setupenv/main.yml
+1 -1
View File
@@ -36,7 +36,7 @@
ignore_errors: true
- name: Configure user access
when: item.enabled and secret_exists.stdout != "0"
when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != ""
block:
- name: Get the secret name
ansible.builtin.shell: |