diff options
Diffstat (limited to 'roles/kubernetes/addons/node-feature-discovery/tasks')
3 files changed, 225 insertions, 0 deletions
diff --git a/roles/kubernetes/addons/node-feature-discovery/tasks/main.yml b/roles/kubernetes/addons/node-feature-discovery/tasks/main.yml new file mode 100644 index 00000000..80acb7b9 --- /dev/null +++ b/roles/kubernetes/addons/node-feature-discovery/tasks/main.yml @@ -0,0 +1,45 @@ +--- +- name: create base directory for node-feature-discovery addon + run_once: true + delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}" + file: + path: /etc/kubernetes/addons/node-feature-discovery + state: directory + +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: generate certificate authority and master certificate + run_once: true + delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}" + import_tasks: tls-ca-master.yml + +- name: generate certificate + import_tasks: tls-worker.yml + +- name: deploy node-feature-discovery addon + run_once: true + delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}" + block: + - name: copy config for node-feature-discovery + template: + src: "config.{{ kubernetes_node_feature_discovery_version }}.yml.j2" + dest: /etc/kubernetes/addons/node-feature-discovery/config.yml + + - name: generate kustomization file + template: + src: "kustomization.yml.j2" + dest: /etc/kubernetes/addons/node-feature-discovery/kustomization.yml + + - name: check if node-feature-discovery is already installed + check_mode: no + command: kubectl --kubeconfig /etc/kubernetes/admin.conf diff -k /etc/kubernetes/addons/node-feature-discovery/ + failed_when: false + changed_when: false + register: kube_node_feature_discovery_diff_result + + - name: install node-feature-discovery onto the cluster + when: kube_node_feature_discovery_diff_result.rc != 0 + command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -k /etc/kubernetes/addons/node-feature-discovery/ diff --git a/roles/kubernetes/addons/node-feature-discovery/tasks/tls-ca-master.yml b/roles/kubernetes/addons/node-feature-discovery/tasks/tls-ca-master.yml new file mode 100644 index 00000000..a433ab32 --- /dev/null +++ b/roles/kubernetes/addons/node-feature-discovery/tasks/tls-ca-master.yml @@ -0,0 +1,101 @@ +--- +- name: create CA directory + file: + path: /etc/kubernetes/addons/node-feature-discovery/ca + state: directory + owner: root + group: root + mode: 0700 + +- name: create CA private key + openssl_privatekey: + path: /etc/kubernetes/addons/node-feature-discovery/ca/key.pem + type: RSA + size: 4096 + owner: root + group: root + mode: 0600 + +- name: create signing request for CA certificate + openssl_csr: + path: /etc/kubernetes/addons/node-feature-discovery/ca/csr.pem + privatekey_path: /etc/kubernetes/addons/node-feature-discovery/ca/key.pem + CN: "CA for kubernetes cluster addon node-feature discovery" + useCommonNameForSAN: no + key_usage: + - cRLSign + - keyCertSign + key_usage_critical: yes + basic_constraints: + - 'CA:TRUE' + - 'pathlen:0' + basic_constraints_critical: yes + +- name: create self-signed CA certificate + openssl_certificate: + path: /etc/kubernetes/addons/node-feature-discovery/ca/crt.pem + csr_path: /etc/kubernetes/addons/node-feature-discovery/ca/csr.pem + privatekey_path: /etc/kubernetes/addons/node-feature-discovery/ca/key.pem + provider: selfsigned + selfsigned_digest: sha256 + selfsigned_not_after: "+18250d" ## 50 years + selfsigned_create_subject_key_identifier: always_create + +- name: slurp CA certificate for worker to use + slurp: + src: /etc/kubernetes/addons/node-feature-discovery/ca/crt.pem + register: node_feature_discovery_ca_certificate + + +- name: create private key for master certificate + openssl_privatekey: + path: /etc/kubernetes/addons/node-feature-discovery/ca/master.key + type: RSA + size: 4096 + owner: root + group: root + mode: 0600 + +- name: create signing request for master certificate + openssl_csr: + path: /etc/kubernetes/addons/node-feature-discovery/ca/master.csr + privatekey_path: /etc/kubernetes/addons/node-feature-discovery/ca/master.key + CN: nfd-master + subject_alt_name: + - "DNS:nfd-master" + - "DNS:nfd-master.node-feature-discovery.svc.{{ kubernetes.dns_domain | default('cluster.local') }}" + - "DNS:localhost" + key_usage: + - digitalSignature + key_usage_critical: yes + extended_key_usage: + - serverAuth + - clientAuth ## this cert is also used for health checks + extended_key_usage_critical: yes + basic_constraints: + - 'CA:FALSE' + basic_constraints_critical: yes + +- name: check if master certificate exists + stat: + path: /etc/kubernetes/addons/node-feature-discovery/ca/master.crt + register: node_feature_discovery_master_certificate_stat + +- name: check master certificate validity + when: node_feature_discovery_master_certificate_stat.stat.exists + openssl_certificate_info: + path: /etc/kubernetes/addons/node-feature-discovery/ca/master.crt + valid_at: + ten_years: '+3650d' + register: node_feature_discovery_master_certificate_info + +- name: create master certificate + openssl_certificate: + path: /etc/kubernetes/addons/node-feature-discovery/ca/master.crt + csr_path: /etc/kubernetes/addons/node-feature-discovery/ca/master.csr + provider: ownca + ownca_path: /etc/kubernetes/addons/node-feature-discovery/ca/crt.pem + ownca_privatekey_path: /etc/kubernetes/addons/node-feature-discovery/ca/key.pem + ownca_digest: sha256 + ownca_not_after: "+18250d" ## 50 years + force: "{{ node_feature_discovery_master_certificate_stat.stat.exists and (not node_feature_discovery_master_certificate_info.valid_at.ten_years) }}" diff --git a/roles/kubernetes/addons/node-feature-discovery/tasks/tls-worker.yml b/roles/kubernetes/addons/node-feature-discovery/tasks/tls-worker.yml new file mode 100644 index 00000000..888c0872 --- /dev/null +++ b/roles/kubernetes/addons/node-feature-discovery/tasks/tls-worker.yml @@ -0,0 +1,79 @@ +--- +- name: create certs directory for nfd-worker + file: + path: /etc/kubernetes/node-feature-discovery/certs + state: directory + owner: nobody + group: root + mode: 0500 + +- name: install CA certificate + copy: + content: "{{ node_feature_discovery_ca_certificate.content | b64decode }}" + dest: /etc/kubernetes/node-feature-discovery/certs/ca.crt + +- name: create private key for worker certificate + openssl_privatekey: + path: /etc/kubernetes/node-feature-discovery/certs/tls.key + type: RSA + size: 4096 + owner: nobody + group: root + mode: 0400 + +- name: create signing request for worker certificate + openssl_csr: + path: /etc/kubernetes/node-feature-discovery/certs/tls.csr + privatekey_path: /etc/kubernetes/node-feature-discovery/certs/tls.key + CN: "{{ kubernetes_node_name }}" + key_usage: + - digitalSignature + key_usage_critical: yes + extended_key_usage: + - clientAuth + extended_key_usage_critical: yes + basic_constraints: + - 'CA:FALSE' + basic_constraints_critical: yes + +- name: slurp CSR for worker certificate + slurp: + src: /etc/kubernetes/node-feature-discovery/certs/tls.csr + register: node_feature_discovery_worker_csr + +- name: check if worker certificate already exists + stat: + path: /etc/kubernetes/node-feature-discovery/certs/tls.crt + register: node_feature_discovery_worker_certificate_stat + +- name: read worker certificate validity + when: node_feature_discovery_worker_certificate_stat.stat.exists + openssl_certificate_info: + path: /etc/kubernetes/node-feature-discovery/certs/tls.crt + valid_at: + ten_years: '+3650d' + register: node_feature_discovery_worker_certificate_info + +- name: slurp existing worker certificate + when: node_feature_discovery_worker_certificate_stat.stat.exists + slurp: + src: /etc/kubernetes/node-feature-discovery/certs/tls.crt + register: node_feature_discovery_worker_certificate_current + +- name: generate worker certificate + delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}" + community.crypto.x509_certificate_pipe: + content: "{{ node_feature_discovery_worker_certificate_current.content | default('') | b64decode }}" + csr_content: "{{ node_feature_discovery_worker_csr.content | b64decode }}" + provider: ownca + ownca_path: /etc/kubernetes/addons/node-feature-discovery/ca/crt.pem + ownca_privatekey_path: /etc/kubernetes/addons/node-feature-discovery/ca/key.pem + ownca_digest: sha256 + ownca_not_after: "+18250d" ## 50 years + force: "{{ node_feature_discovery_worker_certificate_stat.stat.exists and (not node_feature_discovery_worker_certificate_info.valid_at.ten_years) }}" + register: node_feature_discovery_worker_cert + +- name: store worker certificate + copy: + content: "{{ node_feature_discovery_worker_cert.certificate }}" + dest: /etc/kubernetes/node-feature-discovery/certs/tls.crt |