Open antoineco opened 8 years ago
You need to include debops.pki/env
and debops.secret
roles in your playbook. Check the example debops.pki playbook to see how they are used.
Oh, I see, thanks for the quick answer @drybjed !
@drybjed for some reason it doesn't work with the following addition:
roles:
- role: debops.pki/env
tags: [ 'role::pki' ]
pki_dependent_realms:
- '{{ kubernetes_pki_dependent_realms }}'
- role: debops.secret
tags: [ 'role::pki' ]
secret_directories:
- '{{ pki_env_secret_directories }}'
- role: debops.pki
tags: [ 'role::pki' ]
pki_dependent_realms:
- '{{ kubernetes_pki_dependent_realms }}'
But it should according to this template: pki_env_secret_directories.j2.
I added 2 debug tasks to env/tasks/main.yml
:
---
- name: DEBUG
debug:
var: pki_dependent_realms
- name: Prepare debops.pki environment
set_fact:
pki_env_secret_directories: '{{ lookup("template", "lookup/pki_env_secret_directories.j2") | from_yaml }}'
- name: DEBUG
debug:
var: pki_env_secret_directories
The result is surprising me:
Running Ansible playbook from:
/ansible/ansible/playbooks/kubernetes.yml ...
PLAY [Kubernetes] **************************************************************
TASK [setup] *******************************************************************
ok: [noah.host]
TASK [debops.pki/env : DEBUG] **************************************************
ok: [noah.host] => {
"pki_dependent_realms": [
[
{
"name": "k8s",
"subject_alt_names": [
"ip:192.168.3.2",
"ip:10.200.0.1",
"dns:kubernetes.default.svc.gini.cluster",
"dns:kubernetes.default.svc",
"dns:kubernetes.default",
"dns:kubernetes"
]
}
]
]
}
TASK [debops.pki/env : Prepare debops.pki environment] *************************
ok: [noah.host]
TASK [debops.pki/env : DEBUG] **************************************************
ok: [noah.host] => {
"pki_env_secret_directories": [
"pki/lib",
"pki/ca-certificates/by-host/noah.host",
"pki/ca-certificates/by-group/all",
"pki/ca-certificates/by-group/debops_service_pki",
"pki/realms/by-group/all/domain/external",
"pki/realms/by-group/all/domain/private",
"pki/realms/by-group/debops_service_pki/domain/external",
"pki/realms/by-group/debops_service_pki/domain/private",
"pki/realms/by-host/noah.host/domain/external",
"pki/realms/by-host/noah.host/domain/internal",
"pki/realms/by-host/noah.host/domain/private"
]
}
Am I missing something?
@antoineco Your playbook looks correct. I'm not sure why it doesn't want to work this way. Can you try and debug the variables inside the template? Perhaps add another task that saves the result in a temporary file to see what's happening there.
@drybjed: Got it. That's because I'm passing my variable as a list like this:
- role: debops.pki/env
tags: [ 'role::pki' ]
pki_dependent_realms:
- '{{ kubernetes_pki_dependent_realms }}'
However kubernetes_pki_dependent_realms
is already a list, so printing the value of each realm
in pki_dependent_realms
results in:
- {u'name': u'domain', u'acme': False}
- [{u'subject_alt_names': [u'ip:192.168.3.2', u'ip:10.200.0.1', u'dns:kubernetes.default.svc.gini.cluster', u'dns:kubernetes.default.svc', u'dns:kubernetes.default', u'dns:kubernetes'], u'name': u'k8s'}]
That's why the template doesn't catch it.
A quick workaround is to pass the variable as a string to the debops.pki/env
role, but in that case I can not express dependencies like I do with your other ferm
role, something like:
- role: debops.pki/env
tags: [ 'role::pki' ]
pki_dependent_realms:
- '{{ kubernetes_pki_dependent_realms }}'
- '{{ etcd_pki_dependent_realms }}'
@antoineco Right. The template in 1debops.pki/env` would need to flatten the list to work around it. I'll get to it when I have the time, for now try something like this:
- role: debops.pki/env
pki_dependent_realms: '{{ kubernetes_pki_dependent_realms + etcd_pki_dependent_realms }}'
That should make the role work correctly.
@drybjed: Sure, on my side it's easy to work around that. What I was pointing out is that the behavior of the debops.pki/env
role is not what the user might expect at first. At least people who have familiarity with the rest of the DebOps framework.
Thanks again for responding so quickly 👌
When I declare a new realm in a playbook, the task
Sign certificate requests for current hosts
fails with the following error:It looks like some directory creations are missing, since the playbooks runs perfectly when I create the following empty directory structure locally:
Extract from the playbook: