62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
---
|
|
# tasks file for secrets
|
|
|
|
# Role for creating k8s cluster encryption key and config
|
|
|
|
# Documentation: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
|
|
|
|
# Generate a 32 byte random key and base64 encode it
|
|
- name: Generate a 32 byte random key and base64 encode it
|
|
shell: head -c 32 /dev/urandom | base64
|
|
register: secret
|
|
when: inventory_hostname == groups['masters'][0]
|
|
tags:
|
|
- encryption_config
|
|
|
|
# Takes the secret generated above and place it into a .j2 template
|
|
# to create the encryption config
|
|
- name: Place encryption config template onto master
|
|
template:
|
|
src: encryption-config.yaml.j2
|
|
dest: /etc/pki/encryption-config.yaml
|
|
when: inventory_hostname == groups['masters'][0]
|
|
tags:
|
|
- encryption_config
|
|
|
|
# Resgister the encryption config file for fetching
|
|
- name: Register encryption config for fetching from master01
|
|
find:
|
|
paths: /etc/pki
|
|
recurse: no
|
|
patterns: "encryption-config.yaml"
|
|
register: files_to_copy
|
|
tags:
|
|
- encryption_config
|
|
when: inventory_hostname == groups['masters'][0]
|
|
|
|
##########################################
|
|
## WARNING: ADD THIS ROLES /FILES ##
|
|
## DIRECTORY TO YOUR .GITIGNORE ##
|
|
## OR EVERYONE WILL ##
|
|
# HAVE YOUR encryption-config ##
|
|
##########################################
|
|
|
|
# Bring encryption config to the ansible controller
|
|
- name: Fetch Encryption Config
|
|
fetch:
|
|
src: "{{ item.path }}"
|
|
dest: roles/secrets/files/
|
|
flat: yes
|
|
with_items: "{{ files_to_copy.files }}"
|
|
tags:
|
|
- encryption_config
|
|
when: inventory_hostname == groups['masters'][0]
|
|
|
|
# This task is reserved for when you have 2 or more control nodes
|
|
#- name: Distribute encryption config to other control nodes ( masters )
|
|
# copy:
|
|
# src: "encryption-config.yaml"
|
|
# dest: "/etc/pki"
|
|
# when: inventory_hostname == groups['management'][0]
|
|
# tags:
|
|
# - encryption_config |