-
Notifications
You must be signed in to change notification settings - Fork 0
/
playbook-kube-master.yml
80 lines (77 loc) · 2.19 KB
/
playbook-kube-master.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
- hosts: "{{ run | default('kube_master')}}"
gather_facts: true
roles:
- verify
- system
- package
- kube-inflate
- kube-apiserver
- kube-controller-manager
- kube-scheduler
- kube-ha
- cni
- role: docker
when: cri == "docker"
- role: cri-dockerd
when: ( cri == "docker" ) and ( KUBE_VER|float >=1.24 )
- role: buildkit
when: cri == "containerd"
- role: containerd
when: cri == "containerd"
- role: nerdctl
when: cri == "containerd"
- role: cri-o
when: cri == "cri-o"
- kubelet
- kube-proxy
- hosts: "{{ run | default('master-1')}}"
gather_facts: false
tasks:
- name: "deploy auto-approve"
shell: |
cat <<EOF | kubectl apply -f -
---
# enable bootstrapping nodes to create CSR
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: create-csrs-for-bootstrapping
subjects:
- kind: Group
name: system:bootstrappers
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: system:node-bootstrapper
apiGroup: rbac.authorization.k8s.io
EOF
cat <<EOF | kubectl apply -f -
# Approve all CSRs for the group "system:bootstrappers"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: auto-approve-csrs-for-group
subjects:
- kind: Group
name: system:bootstrappers
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
apiGroup: rbac.authorization.k8s.io
EOF
cat <<EOF | kubectl apply -f -
# Approve renewal CSRs for the group "system:nodes"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: auto-approve-renewals-for-nodes
subjects:
- kind: Group
name: system:nodes
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
apiGroup: rbac.authorization.k8s.io
EOF