mrwho
0112ca70ed
Add self-signed ClusterIssuer and test Certificate deployment to cert_manager role for verifying cert-manager functionality, while refactoring uyuni role to use self-signed issuer locally instead of external Let's Encrypt references and introduce database credential secrets generation.
100 lines
3.4 KiB
YAML
100 lines
3.4 KiB
YAML
---
|
|
- name: Helm | Add Jetstack chart repository
|
|
ansible.builtin.command: helm repo add jetstack https://jetstack.io
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_repo_add
|
|
changed_when: false
|
|
failed_when: _helm_repo_add.rc != 0 and 'already exists' not in _helm_repo_add.stderr
|
|
|
|
- name: Helm | Update chart repositories
|
|
ansible.builtin.command: helm repo update
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
changed_when: false
|
|
|
|
- name: Helm | Install or upgrade cert-manager CRDs
|
|
ansible.builtin.command: >
|
|
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/{{ cert_manager_crds_version }}/cert-manager.crds.yaml
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _cert_manager_crds
|
|
changed_when: false
|
|
failed_when: _cert_manager_crds.rc != 0
|
|
|
|
- name: Helm | Update repositories
|
|
ansible.builtin.command: helm repo update
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
changed_when: false
|
|
|
|
- name: Helm | Install or upgrade cert-manager
|
|
ansible.builtin.command: >
|
|
helm upgrade --install cert-manager jetstack/cert-manager
|
|
--namespace {{ cert_manager_namespace }}
|
|
--create-namespace
|
|
{% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}
|
|
--version {{ cert_manager_chart_version }}
|
|
{% endif %}
|
|
{% if cert_manager_args is defined and cert_manager_args | length > 0 %}
|
|
--set args[0]={{ cert_manager_args[0] }}
|
|
{% endif %}
|
|
--timeout 10m0s
|
|
--wait
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_install
|
|
changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
|
|
|
|
- name: Deploy | Self-signed ClusterIssuer
|
|
ansible.builtin.template:
|
|
src: self-signed-issuer.yml.j2
|
|
dest: /tmp/self-signed-issuer.yml
|
|
mode: "0600"
|
|
when: cert_manager_deploy_test_issuer | default(true)
|
|
|
|
- name: Apply | Self-signed ClusterIssuer
|
|
ansible.builtin.command: >
|
|
kubectl apply -f /tmp/self-signed-issuer.yml
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _issuer_apply
|
|
changed_when: false
|
|
failed_when: _issuer_apply.rc != 0
|
|
when: cert_manager_deploy_test_issuer | default(true)
|
|
|
|
- name: Deploy | Test Certificate
|
|
ansible.builtin.template:
|
|
src: test-certificate.yml.j2
|
|
dest: /tmp/test-certificate.yml
|
|
mode: "0600"
|
|
when: cert_manager_deploy_test_issuer | default(true)
|
|
|
|
- name: Apply | Test Certificate
|
|
ansible.builtin.command: >
|
|
kubectl apply -f /tmp/test-certificate.yml
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _certificate_apply
|
|
changed_when: false
|
|
failed_when: _certificate_apply.rc != 0
|
|
when: cert_manager_deploy_test_issuer | default(true)
|
|
|
|
- name: Wait | Certificate ready
|
|
ansible.builtin.command: >
|
|
kubectl wait --for=condition=Ready certificate/test-certificate -n default --timeout=120s
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _cert_wait
|
|
changed_when: false
|
|
failed_when: _cert_wait.rc != 0
|
|
when: cert_manager_deploy_test_issuer | default(true)
|