Open antoineco opened 8 years ago
Sounds like one of the kubernetes_*
variables is a dictionary instead of a string. Check all of them to see their value during the role execution by setting some debug
tasks in the debops.pki
role.
@drybjed I don't think the issue is related to these variables, they are both explicitly set to a string value:
TASK [DEBUG kubernetes_services_net] *******************************************
ok: [nemo] => {
"kubernetes_services_net": "10.0.0.0/16"
}
TASK [DEBUG kubernetes_cluster_domain] *******************************************************************
ok: [nemo] => {
"kubernetes_cluster_domain": "my.cluster"
}
Can you show the debug value of custom_pki_realms
variable?
Sure thing:
TASK [Print 'custom_pki_realms' on each node] **********************************
ok: [nemo] => {
"custom_pki_realms": [
{
"name": "k8s",
"subject_alt_names": [
"ip:192.168.3.1",
"ip:10.0.0.1",
"dns:kubernetes.default.svc.my.cluster",
"dns:kubernetes.default.svc",
"dns:kubernetes.default",
"dns:kubernetes"
]
},
{
"name": "etcd",
"subject_alt_names": [
"ip:192.168.3.1",
"ip:10.0.0.3",
"dns:etcd.kube-system.svc.my.cluster",
"dns:etcd.kube-system.svc",
"dns:etcd.kube-system",
"dns:etcd"
]
}
]
}
Well, hmm, they look ok... How about this - can you remove all subject_alt_names that contain any variables and see if the result works? Just to eliminate any other issues elsewhere.
Done, I left only the 3 last dns: entries, without success.
It works when custom_pki_realms
contains a single entry (single dictionary).
And the normal debops.pki
role runs fine?
If yes then I'm out of ideas... How about this, before that problematic task, add:
- name: Show all the things
debug:
msg: '{{ pki_realms + pki_group_realms + pki_host_realms + pki_default_realms + pki_dependent_realms }}'
Let's see whats templated just before it.
Hmm, OK - it might be the same problem that with debops.pki/env
because this specific task is nested, and not flattened. Try moving the variable the same way as with debops.pki/env
.
I guess it's time for a custom lookup for these tasks.
It also works with multiple entries (see first post) if I call the role as follows:
- role: debops.pki
tags: [ 'role::pki' ]
pki_dependent_realms: '{{ custom_pki_realms }}'
This definitely reminds me of #78, as you mentioned.
The normal debops.pki
role runs fine.
The debug you asked me to post, just in case it helps:
TASK [Show all the things] *****************************************************
ok: [noah] => {
"msg": [
{
"acme": false,
"name": "domain"
}
]
}
@antoineco So when you move the custom_pki_realms
variable in the playbook it works? I guess that confirms the issue, these lists need to be flattened by templates in specific places.
The execution of the following playbook...
..throws the following error: