Initial ansible onboard
This commit is contained in:
@@ -0,0 +1,76 @@
|
||||
- name: CertManager | Copy latest manifest
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
|
||||
dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
|
||||
mode: "0600"
|
||||
|
||||
- name: CertManager | Apply manifest
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
src: "{{ k8s_etc }}/k8s-certmanager.yaml"
|
||||
wait: true
|
||||
|
||||
- name: CertManager | Register LetsEncrypt (prod)
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: "{{ issuer_email }}"
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
# Enable the HTTP-01 challenge provider
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: public
|
||||
|
||||
- name: CertManager | Register LetsEncrypt (staging)
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: "{{ issuer_email }}"
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
# Enable the HTTP-01 challenge provider
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: public
|
||||
@@ -0,0 +1,141 @@
|
||||
- name: Create user k8s service account
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ k8s_iac_user }}"
|
||||
namespace: default
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Create secret token
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ k8s_iac_user }}-token"
|
||||
namespace: default
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
|
||||
type: kubernetes.io/service-account-token
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Enabled IaC admin access to k8s
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-role-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
namespace: default
|
||||
name: "{{ k8s_iac_user }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Get the secret name
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_name
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Describe the secret and extract the token
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n default describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: token
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Read system kubeconfig
|
||||
become: true
|
||||
ansible.builtin.command: "microk8s config"
|
||||
register: kubeconfig
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact kubeconfig
|
||||
ansible.builtin.set_fact:
|
||||
kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Patch kubeconfig with user token
|
||||
ansible.builtin.set_fact:
|
||||
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
|
||||
vars:
|
||||
new_kubeconfig:
|
||||
contexts:
|
||||
- context:
|
||||
cluster: microk8s-cluster
|
||||
user: "{{ k8s_iac_user }}"
|
||||
name: microk8s
|
||||
users:
|
||||
- name: "{{ k8s_iac_user }}"
|
||||
user:
|
||||
token: "{{ token.stdout }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Check if a config already exists and its SHA1
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: "{{ k8s_kubeconfig }}"
|
||||
register: kubeconfig_exists
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Get new config SHA1
|
||||
set_fact:
|
||||
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Write kubeconfig
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
|
||||
dest: "{{ k8s_kubeconfig }}"
|
||||
owner: "{{ k8s_iac_user }}"
|
||||
mode: "0600"
|
||||
when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
|
||||
tags:
|
||||
- k8s::iac
|
||||
@@ -0,0 +1,31 @@
|
||||
- name: Loadbalancer | Setup '{{ lb_provider }}'
|
||||
ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml"
|
||||
|
||||
- name: Loadbalancer | Create Loadbalancer for Nginx ingress
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ingress
|
||||
namespace: ingress
|
||||
spec:
|
||||
selector:
|
||||
name: nginx-ingress-microk8s
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: "{{ lb_http_port }}"
|
||||
targetPort: 80
|
||||
- name: https
|
||||
protocol: TCP
|
||||
port: "{{ lb_https_port }}"
|
||||
targetPort: 443
|
||||
@@ -0,0 +1,51 @@
|
||||
- name: MetalLB | Copy manifest files to host
|
||||
ansible.builtin.get_url:
|
||||
url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml"
|
||||
dest: "{{ k8s_etc }}/metallb.yaml"
|
||||
mode: "0600"
|
||||
|
||||
- name: MetalLB | Apply manifests
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
src: "{{ k8s_etc }}/metallb.yaml"
|
||||
wait: true
|
||||
|
||||
- name: MetalLB | Create IPAddressPool
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: IPAddressPool
|
||||
metadata:
|
||||
name: metallb-system
|
||||
namespace: metallb-system
|
||||
spec:
|
||||
addresses:
|
||||
- "{{ lb_ips }}"
|
||||
|
||||
- name: MetalLB | Create L2Advertisement
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: L2Advertisement
|
||||
metadata:
|
||||
name: example
|
||||
namespace: metallb-system
|
||||
@@ -0,0 +1,84 @@
|
||||
- name: Install requirements
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- python3-pip
|
||||
- python3-virtualenv
|
||||
- snapd
|
||||
- jq
|
||||
tags: always
|
||||
|
||||
- name: Read current remote $HOME
|
||||
ansible.builtin.shell: "echo $HOME"
|
||||
register: remote_home_dir
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
tags: always
|
||||
|
||||
- name: Set working folders
|
||||
ansible.builtin.set_fact:
|
||||
k8s_etc: "{{ remote_home_dir.stdout }}/.kube"
|
||||
k8s_kubeconfig: "{{ remote_home_dir.stdout }}/.kube/config"
|
||||
k8s_venv: "{{ remote_home_dir.stdout }}/.venv"
|
||||
tags: always
|
||||
|
||||
- name: Create required folders
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
loop:
|
||||
- "{{ k8s_etc }}"
|
||||
- "{{ k8s_venv }}"
|
||||
tags: always
|
||||
|
||||
- name: Install required PIP packages
|
||||
ansible.builtin.pip:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
virtualenv: "{{ k8s_venv }}"
|
||||
virtualenv_site_packages: true
|
||||
loop:
|
||||
- kubernetes
|
||||
- yq
|
||||
tags: always
|
||||
|
||||
- name: Install Microk8s
|
||||
ansible.builtin.include_tasks: microk8s/install.yml
|
||||
tags:
|
||||
- k8s::install
|
||||
|
||||
- name: Download kubectl
|
||||
become: true
|
||||
ansible.builtin.get_url:
|
||||
url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl"
|
||||
dest: "/usr/local/bin/kubectl"
|
||||
mode: "0755"
|
||||
owner: "root"
|
||||
tags:
|
||||
- k8s::install
|
||||
- k8s::kubectl
|
||||
|
||||
- name: Setup LoadBalancer
|
||||
ansible.builtin.include_tasks: loadbalancer.yml
|
||||
tags:
|
||||
- k8s::loadbalancer
|
||||
|
||||
- name: Setup CertManager
|
||||
ansible.builtin.include_tasks: certmanager.yml
|
||||
tags:
|
||||
- k8s::certmanager
|
||||
|
||||
- name: Setup IAC access
|
||||
ansible.builtin.include_tasks: iac.yml
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: "Setup local user access to k8s - {{ item.username }}"
|
||||
ansible.builtin.include_tasks: "setupenv/main.yml"
|
||||
loop: "{{ k8s_users }}"
|
||||
when: k8s_users is defined
|
||||
tags:
|
||||
- k8s::users
|
||||
@@ -0,0 +1,88 @@
|
||||
# Install a snap with classic confinement
|
||||
- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
|
||||
become: true
|
||||
community.general.snap:
|
||||
name: microk8s
|
||||
channel: "{{ microk8s_channel }}"
|
||||
classic: true
|
||||
|
||||
- name: Microk8s | Patch microk8s configuration
|
||||
notify: ["Restart microk8s"]
|
||||
block:
|
||||
- name: Microk8s | Enable privileged mode
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/args/kube-apiserver
|
||||
line: "--allow-privileged=true"
|
||||
insertafter: "^--insecure-port=0$"
|
||||
|
||||
- name: Microk8s | Fixing Disk Pressure
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/args/kubelet
|
||||
line: "{{ item }}"
|
||||
insertafter: "^--read-only-port=0$"
|
||||
with_items:
|
||||
- "--image-gc-high-threshold=70"
|
||||
- "--image-gc-low-threshold=60"
|
||||
|
||||
- name: Microk8s | Setup alternative DNS names
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/certs/csr.conf.template
|
||||
line: "DNS.6 = {{ microk8s_alt_names }}"
|
||||
insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"
|
||||
|
||||
- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
|
||||
register: microk8s_wait_result
|
||||
failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
|
||||
changed_when: false
|
||||
|
||||
- name: Microk8s | Adding required users to group microk8s
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups:
|
||||
- microk8s
|
||||
append: true
|
||||
register: user_group_task
|
||||
|
||||
- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
|
||||
when: user_group_task.changed
|
||||
ansible.builtin.meta: reset_connection
|
||||
|
||||
- name: Microk8s | Required plugins (microk8s)
|
||||
ansible.builtin.include_tasks: microk8s/plugins.yml
|
||||
loop:
|
||||
- { plugin: "ha-cluster", wait: 90, args: "", enabled: false }
|
||||
- { plugin: "rbac", wait: 30, args: "", enabled: true }
|
||||
- { plugin: "dns", wait: 30, args: "", enabled: true }
|
||||
- { plugin: "storage", wait: 10, args: "", enabled: true }
|
||||
- { plugin: "ingress", wait: 60, args: "", enabled: true }
|
||||
- { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
|
||||
|
||||
- name: Microk8s | Check if ufw is enabled
|
||||
become: true
|
||||
ansible.builtin.shell:
|
||||
cmd: "ufw status"
|
||||
register: ufw_status
|
||||
changed_when: false
|
||||
|
||||
- name: Microk8s | Configure required ufw rules
|
||||
ansible.builtin.include_tasks: microk8s/ufw.yml
|
||||
when:
|
||||
- ufw_status.stdout.find("Status: active") != -1
|
||||
|
||||
- name: Microk8s | Store kubeconfig
|
||||
ansible.builtin.shell:
|
||||
cmd: "microk8s config > {{ k8s_kubeconfig }}"
|
||||
creates: "{{ k8s_kubeconfig }}"
|
||||
|
||||
- name: Microk8s | Hardening kubeconfig permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ k8s_kubeconfig }}"
|
||||
state: file
|
||||
mode: "0600"
|
||||
@@ -0,0 +1,36 @@
|
||||
- name: Checking plugin '{{ item.plugin }}'
|
||||
ansible.builtin.shell:
|
||||
cmd: 'set -o pipefail && microk8s.status --format short | grep {{ item.plugin }} | awk ''{split($0,a,": "); print(a[2]);}'''
|
||||
executable: /bin/bash
|
||||
register: plugin_status
|
||||
changed_when: false
|
||||
|
||||
- name: Enable plugin '{{ item.plugin }}'
|
||||
when: plugin_status.stdout == "disabled" and item.enabled
|
||||
block:
|
||||
- name: Compose microk8s command args
|
||||
ansible.builtin.set_fact:
|
||||
micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
|
||||
|
||||
- name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.enable {{ micro_k8s_args }}"
|
||||
|
||||
- name: Waiting for plugin to apply '{{ item.wait }}'
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ item.wait }}"
|
||||
|
||||
- name: Disable plugin '{{ item.plugin }}'
|
||||
when: plugin_status.stdout == "enabled" and not item.enabled
|
||||
block:
|
||||
- name: Compose microk8s command args
|
||||
ansible.builtin.set_fact:
|
||||
micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
|
||||
|
||||
- name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.disable {{ micro_k8s_args }}"
|
||||
|
||||
- name: Waiting for plugin to apply '{{ item.wait }}'
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ item.wait }}"
|
||||
@@ -0,0 +1,51 @@
|
||||
- name: Allow in required devices
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
direction: in
|
||||
interface: "{{ item }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_net_devices }}"
|
||||
|
||||
- name: Allow out required devices
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
direction: out
|
||||
interface: "{{ item }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_net_devices }}"
|
||||
|
||||
- name: Allow incoming specific ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: "{{ item.rule }}"
|
||||
src: "{{ item.from | d('any') }}"
|
||||
port: "{{ item.port | int }}"
|
||||
proto: "{{ item.proto }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_incoming_traffic }}"
|
||||
|
||||
- name: Allow outgoing specified ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item | int }}"
|
||||
direction: out
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_outgoing_traffic }}"
|
||||
|
||||
- name: Allow hosts to access the API
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
src: "{{ item }}"
|
||||
port: 16443
|
||||
proto: tcp
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_allowed_hosts }}"
|
||||
@@ -0,0 +1,119 @@
|
||||
- name: Read current remote $HOME
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.username }}"
|
||||
state: present
|
||||
register: user_registered
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Create required folders
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ folder }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
owner: "{{ item.username }}"
|
||||
loop:
|
||||
- "{{ user_registered.home }}/.kube"
|
||||
- "{{ user_registered.home }}/.local/bin"
|
||||
loop_control:
|
||||
loop_var: folder
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Check if secret exists
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_exists
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Configure user access
|
||||
when: item.enabled and secret_exists.stdout != "0"
|
||||
block:
|
||||
- name: Get the secret name
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_name
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Describe the secret and extract the token
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: token
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Read system kubeconfig
|
||||
become: true
|
||||
ansible.builtin.command: "microk8s config"
|
||||
register: kubeconfig
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact kubeconfig
|
||||
ansible.builtin.set_fact:
|
||||
kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Patch kubeconfig with user token
|
||||
ansible.builtin.set_fact:
|
||||
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
|
||||
vars:
|
||||
new_kubeconfig:
|
||||
contexts:
|
||||
- context:
|
||||
cluster: microk8s-cluster
|
||||
user: "{{ item.username }}"
|
||||
name: microk8s
|
||||
users:
|
||||
- name: "{{ item.username }}"
|
||||
user:
|
||||
token: "{{ token.stdout }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Check if a config already exists and its SHA1
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: "{{ user_registered.home }}/.kube/config"
|
||||
register: kubeconfig_exists
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Get new config SHA1
|
||||
set_fact:
|
||||
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Write kubeconfig
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
|
||||
dest: "{{ user_registered.home }}/.kube/config"
|
||||
owner: "{{ item.username }}"
|
||||
mode: "0600"
|
||||
when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
|
||||
tags:
|
||||
- k8s::users
|
||||
Reference in New Issue
Block a user