94 lines
3.0 KiB
YAML
94 lines
3.0 KiB
YAML
---
|
|
- name: 在成员本地生成私钥
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.key"
|
|
type: ECC
|
|
curve: secp256r1
|
|
owner: root
|
|
group: "{{ etcd_cert.group }}"
|
|
mode: '0640'
|
|
|
|
- name: 本地生成 CSR
|
|
community.crypto.openssl_csr:
|
|
path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.csr"
|
|
privatekey_path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.key"
|
|
common_name: "{{ etcd_cert.cn | default(omit, true) }}"
|
|
subject_alt_name: >-
|
|
{{ ['IP:' ~ etcd_address, 'DNS:' ~ inventory_hostname] if etcd_cert.name in ['server', 'peer']
|
|
else (['DNS:' ~ inventory_hostname] if etcd_cert.name == 'gateway' else []) }}
|
|
use_common_name_for_san: false
|
|
extended_key_usage: "{{ etcd_cert.eku }}"
|
|
key_usage: [digitalSignature]
|
|
mode: '0644'
|
|
register: etcd_csr_state
|
|
|
|
- name: 检查已有证书
|
|
ansible.builtin.stat:
|
|
path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
|
|
register: etcd_cert_file
|
|
|
|
- name: 检查续签窗口
|
|
community.crypto.x509_certificate_info:
|
|
path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
|
|
valid_at:
|
|
renewal: "{{ etcd_renew_before }}"
|
|
register: etcd_cert_info
|
|
when: etcd_cert_file.stat.exists
|
|
|
|
- name: 通过中央 CA 签发需更新的证书
|
|
when: >-
|
|
not etcd_cert_file.stat.exists or etcd_csr_state is changed or
|
|
not (etcd_cert_info.valid_at.renewal | default(false))
|
|
block:
|
|
- name: 仅在确需签发时要求 Bao 凭据
|
|
ansible.builtin.assert:
|
|
that: etcd_bao_token | length > 0
|
|
no_log: true
|
|
|
|
- name: 读取 CSR 公共内容
|
|
ansible.builtin.slurp:
|
|
src: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.csr"
|
|
register: etcd_csr
|
|
|
|
- name: 控制端提交 Bao 签名请求
|
|
ansible.builtin.uri:
|
|
url: "{{ etcd_bao_url }}/v1/{{ etcd_bao_pki_mount }}/sign/{{ etcd_cert.role }}"
|
|
method: POST
|
|
headers:
|
|
X-Vault-Token: "{{ etcd_bao_token }}"
|
|
body_format: json
|
|
body:
|
|
csr: "{{ etcd_csr.content | b64decode }}"
|
|
ttl: "{{ etcd_certificate_ttl }}"
|
|
status_code: 200
|
|
delegate_to: localhost
|
|
become: false
|
|
register: etcd_signed
|
|
no_log: true
|
|
when: not ansible_check_mode
|
|
|
|
- name: 保存签发的证书链
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ etcd_signed.json.data.certificate }}
|
|
{{ etcd_signed.json.data.ca_chain | join('\n') }}
|
|
dest: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
|
|
owner: root
|
|
group: "{{ etcd_cert.group }}"
|
|
mode: '0644'
|
|
when: not ansible_check_mode
|
|
|
|
- name: 保存中央 CA 信任链
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ etcd_signed.json.data.ca_chain | join('\n') }}
|
|
dest: "{{ etcd_config_dir }}/ca.crt"
|
|
owner: root
|
|
group: homelab-etcd
|
|
mode: '0644'
|
|
when: not ansible_check_mode
|
|
|
|
- name: 标记证书已更新
|
|
ansible.builtin.set_fact:
|
|
etcd_certificates_changed: true
|