forked from edevil/kubernetes-deployment
-
Notifications
You must be signed in to change notification settings - Fork 0
/
generate_certs.yml
111 lines (107 loc) · 4.11 KB
/
generate_certs.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
- name: Generate CA Cert
hosts: localhost
connection: local
tags: cacert
tasks:
- name: Create certs dir
file: path=certs state=directory
- name: Generate CA primary key
shell: openssl genrsa -out ca-key.pem 2048
args:
chdir: certs/
creates: ca-key.pem
- name: Generate CA certificate
shell: openssl req -x509 -new -nodes -key ca-key.pem -days 10000 -out ca.pem -subj "/CN=kube-ca"
args:
chdir: certs/
creates: ca.pem
- name: Generate apiserver Cert
hosts: localhost
connection: local
tags: apiservercert
tasks:
- name: Generate apiserver template
template: src=openssl.cnf dest=certs/openssl.cnf
- name: Generate apiserver primary key
shell: openssl genrsa -out apiserver-key.pem 2048
args:
chdir: certs/
creates: apiserver-key.pem
- name: Generate apiserver CSR
shell: openssl req -new -key apiserver-key.pem -out apiserver.csr -subj "/CN=kube-apiserver" -config openssl.cnf
args:
chdir: certs/
creates: apiserver.csr
- name: Generate apiserver certificate
shell: openssl x509 -req -in apiserver.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out apiserver.pem -days 720 -extensions v3_req -extfile openssl.cnf
args:
chdir: certs/
creates: apiserver.pem
- name: Generate kube-proxy Cert
hosts: localhost
connection: local
tags: proxycert
tasks:
- name: Generate kube-proxy primary key
shell: openssl genrsa -out proxy-key.pem 2048
args:
chdir: certs/
creates: proxy-key.pem
- name: Generate kube-proxy CSR
shell: openssl req -new -key proxy-key.pem -out proxy.csr -subj "/CN=system:kube-proxy" -config ../files/proxy-openssl.cnf
args:
chdir: certs/
creates: proxy.csr
- name: Generate kube-proxy certificate
shell: openssl x509 -req -in proxy.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out proxy.pem -days 720 -extensions v3_req -extfile ../files/proxy-openssl.cnf
args:
chdir: certs/
creates: proxy.pem
- name: Generate workers Certs
hosts: node:&{{ resource_group }}
connection: local
tags: workerscerts
vars:
ansible_python_interpreter: "python"
tasks:
- name: Generate worker template
template: src=worker-openssl.cnf dest=certs/{{ name }}-worker-openssl.cnf
- name: Generate worker primary key
shell: openssl genrsa -out {{ name }}-worker-key.pem 2048
args:
chdir: certs/
creates: "{{ name }}-worker-key.pem"
- name: Generate worker CSR
shell: openssl req -new -key {{ name }}-worker-key.pem -out {{ name }}-worker.csr -subj "/CN=system:node:{{ name }}/O=system:nodes" -config {{ name }}-worker-openssl.cnf
args:
chdir: certs/
creates: "{{ name }}-worker.csr"
- name: Generate worker certificate
shell: openssl x509 -req -in {{ name }}-worker.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out {{ name }}-worker.pem -days 720 -extensions v3_req -extfile {{ name }}-worker-openssl.cnf
args:
chdir: certs/
creates: "{{ name }}-worker.pem"
- name: Generate etcd Certs
hosts: etcd:&{{ resource_group }}
connection: local
tags: etcdcerts
vars:
ansible_python_interpreter: "python"
tasks:
- name: Generate worker template
template: src=worker-openssl.cnf dest=certs/{{ name }}-worker-openssl.cnf
- name: Generate worker primary key
shell: openssl genrsa -out {{ name }}-worker-key.pem 2048
args:
chdir: certs/
creates: "{{ name }}-worker-key.pem"
- name: Generate worker CSR
shell: openssl req -new -key {{ name }}-worker-key.pem -out {{ name }}-worker.csr -subj "/CN={{ name }}" -config {{ name }}-worker-openssl.cnf
args:
chdir: certs/
creates: "{{ name }}-worker.csr"
- name: Generate worker certificate
shell: openssl x509 -req -in {{ name }}-worker.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out {{ name }}-worker.pem -days 720 -extensions v3_req -extfile {{ name }}-worker-openssl.cnf
args:
chdir: certs/
creates: "{{ name }}-worker.pem"