2023-01-04 12:22:35 +00:00
|
|
|
- block:
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-30 09:55:47 +00:00
|
|
|
- name: Initialize tempfile
|
|
|
|
ansible.builtin.tempfile:
|
|
|
|
state: file
|
|
|
|
register: values_file
|
|
|
|
|
|
|
|
- name: Write chart values w/ password to tempfile
|
|
|
|
ansible.builtin.copy:
|
|
|
|
dest: "{{ values_file.path }}"
|
|
|
|
content: "{{ stepca_values.stdout | regex_replace('(ca_password|provisioner_password): ', '\\1: ' ~ (vapp['metacluster.password'] | b64encode)) }}"
|
|
|
|
no_log: true
|
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Install step-ca chart
|
|
|
|
kubernetes.core.helm:
|
|
|
|
name: step-certificates
|
|
|
|
chart_ref: /opt/metacluster/helm-charts/step-certificates
|
|
|
|
release_namespace: step-ca
|
|
|
|
create_namespace: yes
|
2023-01-30 09:55:47 +00:00
|
|
|
# Unable to use REST api based readycheck due to lack of ingress
|
2023-01-05 12:48:47 +00:00
|
|
|
wait: yes
|
2023-01-04 12:22:35 +00:00
|
|
|
kubeconfig: "{{ kubeconfig.path }}"
|
2023-01-30 13:26:28 +00:00
|
|
|
values_files:
|
2023-01-30 09:55:47 +00:00
|
|
|
- "{{ values_file.path }}"
|
|
|
|
|
|
|
|
- name: Cleanup tempfile
|
|
|
|
ansible.builtin.file:
|
|
|
|
path: "{{ values_file.path }}"
|
|
|
|
state: absent
|
|
|
|
when: values_file.path is defined
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Retrieve configmap w/ root certificate
|
|
|
|
kubernetes.core.k8s_info:
|
|
|
|
kind: ConfigMap
|
|
|
|
name: step-certificates-certs
|
|
|
|
namespace: step-ca
|
|
|
|
kubeconfig: "{{ kubeconfig.path }}"
|
|
|
|
register: stepca_cm_certs
|
2022-08-28 07:07:17 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Create target namespaces
|
|
|
|
kubernetes.core.k8s:
|
|
|
|
kind: Namespace
|
|
|
|
name: "{{ item }}"
|
|
|
|
state: present
|
|
|
|
kubeconfig: "{{ kubeconfig.path }}"
|
|
|
|
loop:
|
|
|
|
- argo-cd
|
|
|
|
# - kube-system
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Store root certificate in namespaced configmaps/secrets
|
|
|
|
kubernetes.core.k8s:
|
|
|
|
state: present
|
|
|
|
template: "{{ item.kind }}.j2"
|
|
|
|
kubeconfig: "{{ kubeconfig.path }}"
|
|
|
|
vars:
|
|
|
|
_template:
|
|
|
|
name: "{{ item.name }}"
|
|
|
|
namespace: "{{ item.namespace }}"
|
|
|
|
annotations: "{{ item.annotations | default('{}') | indent(width=4, first=True) }}"
|
|
|
|
labels: "{{ item.labels | default('{}') | indent(width=4, first=True) }}"
|
|
|
|
data: "{{ item.data }}"
|
|
|
|
loop:
|
|
|
|
- name: argocd-tls-certs-cm
|
|
|
|
namespace: argo-cd
|
|
|
|
kind: configmap
|
|
|
|
annotations: |
|
|
|
|
meta.helm.sh/release-name: argo-cd
|
|
|
|
meta.helm.sh/release-namespace: argo-cd
|
|
|
|
labels: |
|
|
|
|
app.kubernetes.io/managed-by: Helm
|
|
|
|
app.kubernetes.io/name: argocd-cm
|
|
|
|
app.kubernetes.io/part-of: argocd
|
|
|
|
data:
|
|
|
|
- key: git.{{ vapp['metacluster.fqdn'] }}
|
|
|
|
value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] }}"
|
|
|
|
- name: step-certificates-certs
|
|
|
|
namespace: kube-system
|
|
|
|
kind: secret
|
|
|
|
data:
|
|
|
|
- key: root_ca.crt
|
|
|
|
value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] | b64encode }}"
|
|
|
|
loop_control:
|
2023-01-25 09:28:28 +00:00
|
|
|
label: "{{ item.kind ~ '/' ~ item.name ~ ' (' ~ item.namespace ~ ')' }}"
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Configure step-ca passthrough ingress
|
|
|
|
ansible.builtin.template:
|
|
|
|
src: ingressroutetcp.j2
|
|
|
|
dest: /var/lib/rancher/k3s/server/manifests/{{ _template.name }}-manifest.yaml
|
|
|
|
owner: root
|
|
|
|
group: root
|
|
|
|
mode: 0600
|
|
|
|
vars:
|
|
|
|
_template:
|
|
|
|
name: step-ca
|
|
|
|
namespace: step-ca
|
|
|
|
config: |2
|
|
|
|
entryPoints:
|
|
|
|
- websecure
|
|
|
|
routes:
|
|
|
|
- match: HostSNI(`ca.{{ vapp['metacluster.fqdn'] }}`)
|
|
|
|
services:
|
|
|
|
- name: step-certificates
|
|
|
|
port: 443
|
|
|
|
tls:
|
|
|
|
passthrough: true
|
|
|
|
notify:
|
|
|
|
- Apply manifests
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Inject step-ca certificate into traefik container
|
|
|
|
ansible.builtin.blockinfile:
|
|
|
|
path: /var/lib/rancher/k3s/server/manifests/traefik-config.yaml
|
|
|
|
block: |2
|
|
|
|
volumes:
|
|
|
|
- name: step-certificates-certs
|
|
|
|
mountPath: /step-ca
|
|
|
|
type: secret
|
|
|
|
env:
|
|
|
|
- name: LEGO_CA_CERTIFICATES
|
|
|
|
value: /step-ca/root_ca.crt
|
|
|
|
marker: ' # {mark} ANSIBLE MANAGED BLOCK'
|
|
|
|
notify:
|
|
|
|
- Apply manifests
|
2022-08-27 19:10:51 +00:00
|
|
|
|
2023-01-04 12:22:35 +00:00
|
|
|
- name: Trigger handlers
|
|
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
|
|
|
|
- name: Retrieve step-ca configuration
|
|
|
|
kubernetes.core.k8s_info:
|
|
|
|
kind: ConfigMap
|
|
|
|
name: step-certificates-config
|
|
|
|
namespace: step-ca
|
|
|
|
kubeconfig: "{{ kubeconfig.path }}"
|
|
|
|
register: stepca_cm_config
|
|
|
|
|
|
|
|
- name: Install root CA in system truststore
|
|
|
|
ansible.builtin.shell:
|
|
|
|
cmd: >-
|
|
|
|
step ca bootstrap \
|
|
|
|
--ca-url=https://ca.{{ vapp['metacluster.fqdn'] }} \
|
|
|
|
--fingerprint={{ stepca_cm_config.resources[0].data['defaults.json'] | from_json | json_query('fingerprint') }} \
|
|
|
|
--install \
|
|
|
|
--force
|
|
|
|
update-ca-certificates
|
|
|
|
|
|
|
|
module_defaults:
|
|
|
|
ansible.builtin.uri:
|
|
|
|
validate_certs: no
|
|
|
|
status_code: [200, 201]
|
|
|
|
body_format: json
|