152 lines
5.0 KiB
YAML
152 lines
5.0 KiB
YAML
# --------------------------------------
|
|
# -- Create kubernetes user
|
|
# --------------------------------------
|
|
# -- 1. Install packages
|
|
# -- 2. Generate certificate
|
|
# -- 3. Add user to kubernetes
|
|
# -- 4. Remove certificates (Optional)
|
|
# --------------------------------------
|
|
---
|
|
- name: Prepare working directory
|
|
block:
|
|
- name: Set workdir as fact
|
|
set_fact:
|
|
working_dir: "{{ working_dir | ansible_env.HOME }}/.certs/{{ username }}"
|
|
|
|
- name: Create a directory if it does not exist
|
|
ansible.builtin.file:
|
|
path: "{{ working_dir }}"
|
|
state: directory
|
|
mode: "0775"
|
|
|
|
- name: Ensure required packages are installed
|
|
tags: packages
|
|
block:
|
|
# -------------------------
|
|
# -- Prepare kubectl repo
|
|
# -------------------------
|
|
- name: Add an apt signing key for Kubernetes
|
|
become: yes
|
|
apt_key:
|
|
url: https://packages.cloud.google.com/apt/doc/apt-key.gpg
|
|
state: present
|
|
|
|
- name: Adding apt repository for Kubernetes
|
|
become: yes
|
|
apt_repository:
|
|
repo: deb https://apt.kubernetes.io/ kubernetes-xenial main
|
|
state: present
|
|
filename: kubernetes.list
|
|
|
|
# --------------------------------------
|
|
# -- Install yq
|
|
# --------------------------------------
|
|
- name: Ensure yq is installed
|
|
become: yes
|
|
get_url:
|
|
url: "https://github.com/mikefarah/yq/releases/download/{{ yq.version }}/{{ yq.binary }}"
|
|
dest: /usr/bin/yq
|
|
mode: "0777"
|
|
|
|
- name: Ensure kubectl and openssl are installed
|
|
become: yes
|
|
package:
|
|
name: "{{ packages }}"
|
|
state: present
|
|
vars:
|
|
packages:
|
|
- kubectl
|
|
- openssl
|
|
|
|
- name: Generate openssl certificate
|
|
tags: openssl
|
|
block:
|
|
- name: Generate an OpenSSL private key
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ working_dir }}/{{ username }}.key"
|
|
size: 2048
|
|
|
|
- name: Generate an OpenSSL Certificate Signing Request
|
|
community.crypto.openssl_csr:
|
|
path: "{{ working_dir }}/{{ username }}.csr"
|
|
privatekey_path: "{{ working_dir }}/{{ username }}.key"
|
|
common_name: "{{ username }}"
|
|
|
|
- name: Generate an OpenSSL certificate signed with your own CA certificate
|
|
become: yes
|
|
community.crypto.x509_certificate:
|
|
path: "{{ working_dir }}/{{ username }}.crt"
|
|
csr_path: "{{ working_dir }}/{{ username }}.csr"
|
|
ownca_path: "{{ k8s_cert_path }}/{{ k8s_cert_crt_file }}"
|
|
ownca_privatekey_path: "{{ k8s_cert_path }}/{{ k8s_cert_key_file }}"
|
|
provider: ownca
|
|
entrust_not_after: "+{{ certificate_expires_in }}d"
|
|
|
|
- name: Add user to cluster
|
|
block:
|
|
# --------------------------------------
|
|
# -- Get k8s server from admin.conf
|
|
# --------------------------------------
|
|
- name: Get k8s server
|
|
shell: yq e '.clusters[0] | select(.name == "{{ cluster }}").cluster.server' "{{ k8s_config_path }}"
|
|
register: kubernetes_server_output
|
|
# --------------------------------------
|
|
# -- Get k8s certificate authority data
|
|
# -- from admin-conf
|
|
# --------------------------------------
|
|
- name: Get k8s certificate authority data
|
|
shell: yq e '.clusters[0] | select(.name == "{{ cluster }}").cluster.certificate-authority-data' "{{ k8s_config_path }}"
|
|
register: kubernetes_cad_output
|
|
|
|
- name: Get user cert data
|
|
shell: cat "{{ working_dir }}/{{ username }}.crt" | base64 -w 0
|
|
register: user_cert_data_output
|
|
|
|
- name: Get user key data
|
|
shell: cat "{{ working_dir }}/{{ username }}.key" | base64 -w 0
|
|
register: user_key_data_output
|
|
|
|
- name: Set variables for template
|
|
set_fact:
|
|
kubernetes_server: "{{ kubernetes_server_output.stdout }}"
|
|
kubernetes_cad: "{{ kubernetes_cad_output.stdout }}"
|
|
user_cert_data: " {{ user_cert_data_output.stdout }}"
|
|
user_key_data: " {{ user_key_data_output.stdout }}"
|
|
|
|
- name: Create k8s user
|
|
ansible.builtin.shell: |
|
|
kubectl config set-credentials "{{ username }}"\
|
|
--client-certificate="{{ working_dir }}/{{ username }}.crt" \
|
|
--client-key="{{ working_dir }}/{{ username }}.key"
|
|
notify: remove certificates
|
|
|
|
- name: Set user context
|
|
ansible.builtin.shell: |
|
|
kubectl config set-context "{{ username }}@{{ cluster }}" \
|
|
--cluster={{ cluster }} --user="{{ username }}"
|
|
|
|
- name: Create config file from template
|
|
template:
|
|
src: config.j2
|
|
dest: "{{ working_dir }}/config"
|
|
|
|
- name: Storing config on the local machine
|
|
ansible.builtin.fetch:
|
|
src: "{{ working_dir }}/config"
|
|
dest: ./
|
|
flat: yes
|
|
tags: config
|
|
|
|
- name: Bind user to role
|
|
block:
|
|
- name: Generate role binding yaml
|
|
template:
|
|
src: role-binding.j2
|
|
dest: "{{ working_dir }}/{{ username }}.yaml"
|
|
|
|
- name: Apply role binding manifest
|
|
environment:
|
|
KUBECONFIG: "{{ k8s_config_path }}"
|
|
shell: kubectl apply -f "{{ working_dir }}/{{ username }}.yaml"
|
|
tags: add_user
|