74 lines
2.2 KiB
YAML
74 lines
2.2 KiB
YAML
---
|
|
- name: Wait for the sandbox SPIRE token reviewer credential
|
|
ansible.builtin.command:
|
|
argv:
|
|
- k3s
|
|
- kubectl
|
|
- --namespace
|
|
- "{{ sandbox_spire_bootstrap_source_namespace }}"
|
|
- get
|
|
- secret
|
|
- "{{ sandbox_spire_bootstrap_source_secret }}"
|
|
- --output=json
|
|
register: sandbox_spire_bootstrap_reviewer_secret
|
|
changed_when: false
|
|
retries: 60
|
|
delay: 10
|
|
until:
|
|
- sandbox_spire_bootstrap_reviewer_secret.rc == 0
|
|
- (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data.token is defined
|
|
- (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data['ca.crt'] is defined
|
|
no_log: true
|
|
|
|
- name: Extract the sandbox TokenReview credential data
|
|
ansible.builtin.set_fact:
|
|
sandbox_spire_bootstrap_secret_data: >-
|
|
{{ (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data }}
|
|
no_log: true
|
|
|
|
- name: Build the restricted sandbox TokenReview kubeconfig
|
|
ansible.builtin.set_fact:
|
|
sandbox_spire_bootstrap_kubeconfig: |
|
|
apiVersion: v1
|
|
kind: Config
|
|
clusters:
|
|
- name: sandbox
|
|
cluster:
|
|
server: {{ sandbox_spire_bootstrap_api_server }}
|
|
certificate-authority-data: {{ sandbox_spire_bootstrap_secret_data['ca.crt'] }}
|
|
users:
|
|
- name: spire-server-token-reviewer
|
|
user:
|
|
token: {{ sandbox_spire_bootstrap_secret_data.token | b64decode }}
|
|
contexts:
|
|
- name: sandbox
|
|
context:
|
|
cluster: sandbox
|
|
user: spire-server-token-reviewer
|
|
current-context: sandbox
|
|
no_log: true
|
|
|
|
- name: Reconcile the central SPIRE external kubeconfig Secret
|
|
ansible.builtin.command:
|
|
argv:
|
|
- k3s
|
|
- kubectl
|
|
- apply
|
|
- --filename=-
|
|
stdin: |
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ sandbox_spire_bootstrap_target_secret }}
|
|
namespace: {{ sandbox_spire_bootstrap_target_namespace }}
|
|
type: Opaque
|
|
data:
|
|
sandbox: {{ sandbox_spire_bootstrap_kubeconfig | b64encode }}
|
|
delegate_to: localhost
|
|
become: true
|
|
register: sandbox_spire_bootstrap_target
|
|
changed_when: >-
|
|
' created' in sandbox_spire_bootstrap_target.stdout or
|
|
' configured' in sandbox_spire_bootstrap_target.stdout
|
|
no_log: true
|