blob: 72e9ac4bb39f5e8f22a7263887ed8ca9e3176c90 [file] [log] [blame] [edit]
# Copyright (c) 2024 VEXXHOST, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
- name: Create self-signed cluster issuer
run_once: true
kubernetes.core.k8s:
state: present
definition:
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: self-signed
spec:
selfSigned: {}
- name: Import tasks for ClusterIssuer type
ansible.builtin.include_tasks: "type/{{ cluster_issuer_type }}/main.yml"
- name: Bootstrap PKI
when: cluster_issuer_type in ("self-signed", "ca")
block:
- name: Wait till the secret is created
run_once: true
kubernetes.core.k8s_info:
api_version: v1
kind: Secret
name: "{{ (cluster_issuer_type == 'self-signed') | ternary(cluster_issuer_self_signed_secret_name, cluster_issuer_ca_secret_name) }}"
namespace: cert-manager
wait: true
wait_sleep: 1
wait_timeout: 600
register: _cluster_issuer_ca_secret
- name: Copy CA certificate on host
ansible.builtin.copy:
content: "{{ _cluster_issuer_ca_secret.resources[0].data['tls.crt'] | b64decode }}"
dest: "{{ '/usr/local/share/ca-certificates' if ansible_facts['os_family'] in ['Debian'] else '/etc/pki/ca-trust/source/anchors' }}/atmosphere.crt"
mode: "0644"
notify:
- Update CA certificates on host
- name: Flush all handlers
ansible.builtin.meta: flush_handlers