## ## Copyright (c) 2020 Intel Corporation. ## ## Licensed under the Apache License, Version 2.0 (the "License"); ## you may not use this file except in compliance with the License. ## You may obtain a copy of the License at ## ## http://www.apache.org/licenses/LICENSE-2.0 ## ## Unless required by applicable law or agreed to in writing, software ## distributed under the License is distributed on an "AS IS" BASIS, ## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ## See the License for the specific language governing permissions and ## limitations under the License. ## --- - name: install epel-release on Red Hat based OS package: name=epel-release when: ansible_os_family == 'RedHat' # note: on Ubuntu, pip is installed via install_dependencies - name: install pip package: name: python-pip when: - ansible_distribution in ["RedHat", "CentOS"] - ansible_distribution_version < '8' - name: install pip package: name: python3-pip when: - ansible_distribution in ["RedHat", "CentOS"] - ansible_distribution_version >= '8' - name: install dependencies include_role: name: install_dependencies - name: install Python dependencies pip: name: - setuptools - docker - name: clone CMK repository git: repo: "{{ cmk_git_url }}" dest: "{{ cmk_dir }}" version: "{{ cmk_version }}" force: yes - name: patch CMK dockerfile (1/3) lineinfile: path: "{{ cmk_dir }}/Dockerfile" regexp: '^FROM clearlinux' line: 'FROM centos/python-36-centos7:latest' - name: patch CMK dockerfile (2/3) lineinfile: path: "{{ cmk_dir }}/Dockerfile" insertafter: '^FROM centos' line: 'USER root' state: present - name: patch CMK dockerfile (3/3) lineinfile: path: "{{ cmk_dir }}/Dockerfile" state: absent regexp: '^RUN swupd' - name: build CMK image make: chdir: "{{ cmk_dir }}" # NOTE(przemeklal): this fixes problem in CMK with ImagePullPolicy hardcoded to Never and the pod is scheduled on controller node - name: tag CMK image command: docker tag cmk:{{ cmk_img_version }} {{ registry_local_address }}/cmk:{{ cmk_img_version }} changed_when: true - name: push CMK image to local registry command: docker push {{ registry_local_address }}/cmk:{{ cmk_img_version }} when: - inventory_hostname == groups['kube-node'][0] changed_when: true - name: clean up any preexisting certs/key/CSR files file: path=/etc/ssl/cmk state=absent when: inventory_hostname == groups['kube-master'][0] failed_when: false become: yes - name: delete any preexisting certs/key/CSR from Kubernetes command: kubectl delete csr cmk-webhook-{{ item }}.{{ cmk_namespace }} when: inventory_hostname == groups['kube-master'][0] failed_when: false with_items: - "client" - "server" - name: create directory for CMK cert and key generation become: yes file: path: /etc/ssl/cmk state: directory mode: 0700 owner: root group: root - name: populate CMK CSR template template: src: "webhook_{{ item }}_csr.json.j2" dest: "/etc/ssl/cmk/cmk-webhook-{{ item }}-csr.json" force: yes mode: preserve become: yes with_items: - "client" - "server" when: - inventory_hostname == groups['kube-master'][0] - name: get GOPATH command: go env GOPATH register: gopath when: - inventory_hostname == groups['kube-master'][0] - name: generate key and CSR shell: "set -o pipefail \ && {{ gopath.stdout }}/bin/cfssl genkey cmk-webhook-{{ item }}-csr.json | {{ gopath.stdout }}/bin/cfssljson -bare cmk-webhook-{{ item }}" args: chdir: "/etc/ssl/cmk/" executable: /bin/bash with_items: - "client" - "server" when: - inventory_hostname == groups['kube-master'][0] become: yes - name: read generated server key command: cat cmk-webhook-server-key.pem args: chdir: "/etc/ssl/cmk/" register: server_key when: - inventory_hostname == groups['kube-master'][0] - name: read generated client key command: cat cmk-webhook-client-key.pem args: chdir: "/etc/ssl/cmk/" register: client_key when: - inventory_hostname == groups['kube-master'][0] - name: load generated server key set_fact: cmk_webhook_server_key: "{{ server_key.stdout | b64encode }}" when: - inventory_hostname == groups['kube-master'][0] - name: load generated client key set_fact: cmk_webhook_client_key: "{{ client_key.stdout | b64encode }}" when: - inventory_hostname == groups['kube-master'][0] - name: read generated client csr command: cat cmk-webhook-client.csr args: chdir: "/etc/ssl/cmk/" register: client_csr when: - inventory_hostname == groups['kube-master'][0] - name: load generated client csr set_fact: cmk_webhook_client_csr: "{{ client_csr.stdout | b64encode }}" when: - inventory_hostname == groups['kube-master'][0] - name: read generated server csr command: cat cmk-webhook-server.csr args: chdir: "/etc/ssl/cmk/" register: server_csr when: - inventory_hostname == groups['kube-master'][0] - name: load generated server csr set_fact: cmk_webhook_server_csr: "{{ server_csr.stdout | b64encode }}" when: - inventory_hostname == groups['kube-master'][0] - name: populate CMK Kubernetes CA CSR template template: src: "kube_{{ item }}_csr.yml.j2" dest: "/etc/ssl/cmk/cmk-webhook-kube-{{ item }}-csr.yml" force: yes mode: preserve with_items: - "client" - "server" when: - inventory_hostname == groups['kube-master'][0] - name: send CSR to the Kubernetes API Server command: kubectl apply -f /etc/ssl/cmk/cmk-webhook-kube-{{ item }}-csr.yml with_items: - "client" - "server" when: - inventory_hostname == groups['kube-master'][0] - name: approve request command: kubectl certificate approve cmk-webhook-{{ item }}.{{ cmk_namespace }} with_items: - "client" - "server" when: - inventory_hostname == groups['kube-master'][0] - name: get approved server certificate shell: kubectl get csr cmk-webhook-server.{{ cmk_namespace }} -o jsonpath='{.status.certificate}' args: chdir: "/etc/ssl/cmk/" register: server_cert when: - inventory_hostname == groups['kube-master'][0] retries: 30 delay: 1 until: server_cert.rc == 0 - name: get approved client certificate shell: kubectl get csr cmk-webhook-client.{{ cmk_namespace }} -o jsonpath='{.status.certificate}' args: chdir: "/etc/ssl/cmk/" register: client_cert when: - inventory_hostname == groups['kube-master'][0] retries: 30 delay: 1 until: client_cert.rc == 0 - name: load generated server cert set_fact: cmk_webhook_server_cert: "{{ server_cert.stdout }}" when: - inventory_hostname == groups['kube-master'][0] - name: load generated client cert set_fact: cmk_webhook_client_cert: "{{ client_cert.stdout }}" when: - inventory_hostname == groups['kube-master'][0] - name: populate cmk-webhook.conf file template: src: "cmk-webhook.conf.j2" dest: "/etc/kubernetes/admission-control/cmk-webhook.conf" force: yes mode: preserve when: - inventory_hostname == groups['kube-master'][0] - name: add MutatingAdmissionWebhook to AdmissionConfiguration blockinfile: path: /etc/kubernetes/admission-control/config.yaml insertafter: "plugins:" block: | - name: MutatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: /etc/kubernetes/admission-control/cmk-webhook.conf when: - inventory_hostname == groups['kube-master'][0] - name: restart kube-apiserver after updating admission control configuration when: inventory_hostname == groups['kube-master'][0] block: - name: remove kube-apiserver Docker container shell: docker ps -af name=k8s_kube-apiserver* -q | xargs --no-run-if-empty docker rm -f args: executable: /bin/bash register: remove_apiserver_container retries: 10 until: remove_apiserver_container.rc == 0 delay: 1 - name: wait for kube-apiserver to be up uri: url: "https://127.0.0.1:6443/healthz" client_cert: "/etc/kubernetes/ssl/ca.crt" client_key: "/etc/kubernetes/ssl/ca.key" validate_certs: no register: result until: result.status == 200 retries: 120 delay: 1 - name: create Helm charts directory if needed file: path: /usr/src/charts state: directory mode: 0755 when: - inventory_hostname == groups['kube-master'][0] - name: copy CMK Helm chart to the controller node copy: src: "{{ role_path }}/charts/cpu-manager-for-kubernetes" dest: "/usr/src/charts/" mode: 0755 when: - inventory_hostname == groups['kube-master'][0] # adds all kube-nodes to the list of CMK nodes - name: build list of CMK hosts set_fact: cmk_hosts_list: "{{ groups['kube-node'] | join(',') }}" when: - not cmk_use_all_hosts - (cmk_hosts_list is undefined) or (cmk_hosts_list | length == 0) - name: set values for CMK Helm chart values set_fact: cmk_image: "{{ registry_local_address }}/cmk" cmk_tag: "{{ cmk_img_version }}" when: - inventory_hostname == groups['kube-master'][0] - name: read ca cert command: cat ca.crt args: chdir: "/etc/kubernetes/ssl/" register: ca_cert when: - inventory_hostname == groups['kube-master'][0] - name: load ca cert set_fact: caBundle_cert: "{{ ca_cert.stdout | b64encode }}" when: - inventory_hostname == groups['kube-master'][0] - name: populate CMK Helm chart values template and push to controller node template: src: "helm_values.yml.j2" dest: "/usr/src/charts/cmk-values.yml" force: yes mode: preserve when: - inventory_hostname == groups['kube-master'][0] # remove any preexisting configmaps before cmk redeployment - name: remove any preexisting configmaps before CMK deployment command: kubectl delete cm cmk-config-{{ inventory_hostname }} when: - inventory_hostname in cmk_hosts_list.split(',') delegate_to: "{{ groups['kube-master']|first }}" failed_when: false - name: install CMK helm chart command: helm upgrade --install cmk --namespace {{ cmk_namespace }} -f /usr/src/charts/cmk-values.yml /usr/src/charts/cpu-manager-for-kubernetes when: - inventory_hostname == groups['kube-master'][0] - name: clean up any certs/key/CSR files file: path=/etc/ssl/cmk state=absent when: inventory_hostname == groups['kube-master'][0] failed_when: false become: yes