refactor(uyuni): integrate cert-manager for automated TLS certificate provisioning
Replace manual TLS secret creation with cert-manager Certificate resources and automatic secret provisioning, enabling dynamic certificate issuance from Let's Encrypt while improving infrastructure reliability and reducing operational overhead.
This commit is contained in:
parent
45a7ea0d93
commit
0194a6fc0e
4 changed files with 120 additions and 53 deletions
6
playbooks/setup_uyuni.yml
Normal file
6
playbooks/setup_uyuni.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
---
|
||||
- name: Deploy Uyuni Server on Kubernetes
|
||||
hosts: manager_nodes
|
||||
become: false
|
||||
roles:
|
||||
- uyuni
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
- name: Helm | Add Jetstack chart repository
|
||||
ansible.builtin.command: helm repo add jetstack https://charts.jetstack.io
|
||||
ansible.builtin.command: helm repo add jetstack https://jetstack.io
|
||||
environment:
|
||||
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
||||
PATH: "/usr/local/bin:/usr/bin:/bin"
|
||||
|
|
@ -27,10 +27,12 @@
|
|||
|
||||
- name: Helm | Install or upgrade cert-manager
|
||||
ansible.builtin.command: >
|
||||
helm upgrade --install cert-manager jetstack/cert-manager
|
||||
helm repo update && helm upgrade --install cert-manager jetstack/cert-manager
|
||||
--namespace {{ cert_manager_namespace }}
|
||||
--create-namespace
|
||||
{% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}
|
||||
--version {{ cert_manager_chart_version }}
|
||||
{% endif %}
|
||||
{% if cert_manager_args is defined and cert_manager_args | length > 0 %}
|
||||
--set args[0]={{ cert_manager_args[0] }}
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -2,12 +2,33 @@
|
|||
# role defaults
|
||||
uyuni_namespace: uyuni-server
|
||||
uyuni_chart_version: 2026.6.0
|
||||
uyuni_kubeconfig: /root/.kube/config
|
||||
uyuni_kubeconfig: "/home/{{ ansible_user }}/.kube/config"
|
||||
uyuni_helm_values:
|
||||
global.fqdn: null
|
||||
global.fqdn: uyuni.local.mrwho.ru
|
||||
ingress.enabled: true
|
||||
ingress.type: traefik
|
||||
# ingress.annotations."cert-manager.io/cluster-issuer": "letsencrypt-prod"
|
||||
uyuni_tls_cert: null
|
||||
uyuni_tls_key: null
|
||||
db_tls_cert: null
|
||||
db_tls_key: null
|
||||
uyuni_ca_cert: null
|
||||
db_ca_cert: null
|
||||
uyuni_create_certificates: true
|
||||
uyuni_certificates:
|
||||
- name: uyuni-ingress-cert
|
||||
namespace: uyuni-server
|
||||
secretName: uyuni-cert
|
||||
dnsNames:
|
||||
- uyuni.local.mrwho.ru
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
- name: uyuni-db-cert
|
||||
namespace: uyuni-server
|
||||
secretName: db-cert
|
||||
dnsNames:
|
||||
- uyuni.local.mrwho.ru
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
|
|
|
|||
|
|
@ -3,62 +3,100 @@
|
|||
kubernetes.core.k8s:
|
||||
api_version: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: "{{ uyuni_namespace }}"
|
||||
name: "{{ uyuni_namespace }}"
|
||||
kubeconfig: "{{ uyuni_kubeconfig }}"
|
||||
state: present
|
||||
|
||||
- name: Create uyuni TLS certificate secret
|
||||
- name: Create uyuni-ingress-cert Certificate
|
||||
kubernetes.core.k8s:
|
||||
api_version: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
name: uyuni-ingress-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
kubeconfig: "{{ uyuni_kubeconfig }}"
|
||||
definition:
|
||||
spec:
|
||||
secretName: uyuni-cert
|
||||
dnsNames:
|
||||
- uyuni.local.mrwho.ru
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
state: present
|
||||
when: uyuni_create_certificates | bool
|
||||
|
||||
- name: Create uyuni-db-cert Certificate
|
||||
kubernetes.core.k8s:
|
||||
api_version: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
name: uyuni-db-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
kubeconfig: "{{ uyuni_kubeconfig }}"
|
||||
definition:
|
||||
spec:
|
||||
secretName: db-cert
|
||||
dnsNames:
|
||||
- uyuni.local.mrwho.ru
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
state: present
|
||||
when: uyuni_create_certificates | bool
|
||||
|
||||
- name: Wait for uyuni-ingress-cert secret
|
||||
kubernetes.core.k8s_info:
|
||||
api_version: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: uyuni-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: "{{ uyuni_tls_cert | b64encode }}"
|
||||
tls.key: "{{ uyuni_tls_key | b64encode }}"
|
||||
state: present
|
||||
when: uyuni_tls_cert is defined and uyuni_tls_key is defined
|
||||
name: uyuni-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
kubeconfig: "{{ uyuni_kubeconfig }}"
|
||||
register: _uyuni_cert_secret
|
||||
until: _uyuni_cert_secret.resources | length > 0
|
||||
retries: 60
|
||||
delay: 10
|
||||
when: uyuni_create_certificates | bool
|
||||
|
||||
- name: Create database TLS certificate secret
|
||||
kubernetes.core.k8s:
|
||||
- name: Wait for uyuni-db-cert secret
|
||||
kubernetes.core.k8s_info:
|
||||
api_version: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: db-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: "{{ db_tls_cert | b64encode }}"
|
||||
tls.key: "{{ db_tls_key | b64encode }}"
|
||||
state: present
|
||||
when: db_tls_cert is defined and db_tls_key is defined
|
||||
name: db-cert
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
kubeconfig: "{{ uyuni_kubeconfig }}"
|
||||
register: _db_cert_secret
|
||||
until: _db_cert_secret.resources | length > 0
|
||||
retries: 60
|
||||
delay: 10
|
||||
when: uyuni_create_certificates | bool
|
||||
|
||||
- name: Create uyuni CA ConfigMap
|
||||
kubernetes.core.k8s:
|
||||
api_version: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uyuni-ca
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
data:
|
||||
ca.crt: "{{ uyuni_ca_cert | string }}"
|
||||
state: present
|
||||
when: uyuni_ca_cert is defined
|
||||
- name: Helm | Install or upgrade Uyuni from OCI registry
|
||||
ansible.builtin.command: >
|
||||
helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
|
||||
--namespace {{ uyuni_namespace }}
|
||||
--create-namespace
|
||||
--version {{ uyuni_chart_version }}
|
||||
--set {{ item.key }}={{ item.value }}
|
||||
--timeout 20m0s
|
||||
--wait
|
||||
loop: "{{ uyuni_helm_values | dict2items }}"
|
||||
environment:
|
||||
KUBECONFIG: "{{ uyuni_kubeconfig }}"
|
||||
PATH: "/usr/local/bin:/usr/bin:/bin"
|
||||
register: _helm_install
|
||||
changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
|
||||
when: uyuni_helm_values is defined
|
||||
|
||||
- name: Create database CA ConfigMap
|
||||
kubernetes.core.k8s:
|
||||
api_version: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: db-ca
|
||||
namespace: "{{ uyuni_namespace }}"
|
||||
data:
|
||||
ca.crt: "{{ db_ca_cert | string }}"
|
||||
state: present
|
||||
when: db_ca_cert is defined
|
||||
|
||||
- name: Include Helm installation
|
||||
ansible.builtin.include_tasks: helm.yml
|
||||
run_once: true
|
||||
- name: Helm | Install or upgrade Uyuni from OCI registry (no values)
|
||||
ansible.builtin.command: >
|
||||
helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
|
||||
--namespace {{ uyuni_namespace }}
|
||||
--create-namespace
|
||||
--version {{ uyuni_chart_version }}
|
||||
--timeout 20m0s
|
||||
--wait
|
||||
environment:
|
||||
KUBECONFIG: "{{ uyuni_kubeconfig }}"
|
||||
PATH: "/usr/local/bin:/usr/bin:/bin"
|
||||
register: _helm_install_simple
|
||||
changed_when: "'STATUS: deployed' in _helm_install_simple.stdout or 'has been upgraded' in _helm_install_simple.stdout"
|
||||
when: uyuni_helm_values is not defined
|
||||
|
|
|
|||
Loading…
Reference in a new issue