mrwho
0194a6fc0e
Replace manual TLS secret creation with cert-manager Certificate resources and automatic secret provisioning, enabling dynamic certificate issuance from Let's Encrypt while improving infrastructure reliability and reducing operational overhead.
103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
---
|
|
- name: Create namespace
|
|
kubernetes.core.k8s:
|
|
api_version: v1
|
|
kind: Namespace
|
|
name: "{{ uyuni_namespace }}"
|
|
kubeconfig: "{{ uyuni_kubeconfig }}"
|
|
state: present
|
|
|
|
- name: Create uyuni-ingress-cert Certificate
|
|
kubernetes.core.k8s:
|
|
api_version: cert-manager.io/v1
|
|
kind: Certificate
|
|
name: uyuni-ingress-cert
|
|
namespace: "{{ uyuni_namespace }}"
|
|
kubeconfig: "{{ uyuni_kubeconfig }}"
|
|
definition:
|
|
spec:
|
|
secretName: uyuni-cert
|
|
dnsNames:
|
|
- uyuni.local.mrwho.ru
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
state: present
|
|
when: uyuni_create_certificates | bool
|
|
|
|
- name: Create uyuni-db-cert Certificate
|
|
kubernetes.core.k8s:
|
|
api_version: cert-manager.io/v1
|
|
kind: Certificate
|
|
name: uyuni-db-cert
|
|
namespace: "{{ uyuni_namespace }}"
|
|
kubeconfig: "{{ uyuni_kubeconfig }}"
|
|
definition:
|
|
spec:
|
|
secretName: db-cert
|
|
dnsNames:
|
|
- uyuni.local.mrwho.ru
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
state: present
|
|
when: uyuni_create_certificates | bool
|
|
|
|
- name: Wait for uyuni-ingress-cert secret
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: Secret
|
|
name: uyuni-cert
|
|
namespace: "{{ uyuni_namespace }}"
|
|
kubeconfig: "{{ uyuni_kubeconfig }}"
|
|
register: _uyuni_cert_secret
|
|
until: _uyuni_cert_secret.resources | length > 0
|
|
retries: 60
|
|
delay: 10
|
|
when: uyuni_create_certificates | bool
|
|
|
|
- name: Wait for uyuni-db-cert secret
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: Secret
|
|
name: db-cert
|
|
namespace: "{{ uyuni_namespace }}"
|
|
kubeconfig: "{{ uyuni_kubeconfig }}"
|
|
register: _db_cert_secret
|
|
until: _db_cert_secret.resources | length > 0
|
|
retries: 60
|
|
delay: 10
|
|
when: uyuni_create_certificates | bool
|
|
|
|
- name: Helm | Install or upgrade Uyuni from OCI registry
|
|
ansible.builtin.command: >
|
|
helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
|
|
--namespace {{ uyuni_namespace }}
|
|
--create-namespace
|
|
--version {{ uyuni_chart_version }}
|
|
--set {{ item.key }}={{ item.value }}
|
|
--timeout 20m0s
|
|
--wait
|
|
loop: "{{ uyuni_helm_values | dict2items }}"
|
|
environment:
|
|
KUBECONFIG: "{{ uyuni_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_install
|
|
changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
|
|
when: uyuni_helm_values is defined
|
|
|
|
- name: Helm | Install or upgrade Uyuni from OCI registry (no values)
|
|
ansible.builtin.command: >
|
|
helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
|
|
--namespace {{ uyuni_namespace }}
|
|
--create-namespace
|
|
--version {{ uyuni_chart_version }}
|
|
--timeout 20m0s
|
|
--wait
|
|
environment:
|
|
KUBECONFIG: "{{ uyuni_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_install_simple
|
|
changed_when: "'STATUS: deployed' in _helm_install_simple.stdout or 'has been upgraded' in _helm_install_simple.stdout"
|
|
when: uyuni_helm_values is not defined
|