Skip to content

Commit 7386fe0

Browse files
guiand888guiand888
committed
Move tls-san logic to tasks and validate existing flags
Signed-off-by: Guillaume Andre <mail@guillaumea.fr>
1 parent 24ec0ec commit 7386fe0

7 files changed

Lines changed: 50 additions & 7 deletions

File tree

‎roles/k3s_agent/tasks/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,29 @@
3535
INSTALL_K3S_EXEC: "agent"
3636
changed_when: true
3737

38+
- name: Compute final agent arguments
39+
ansible.builtin.set_fact:
40+
_api_endpoint_in_agent_config: >-
41+
{% if agent_config_yaml is defined and api_endpoint is defined and agent_config_yaml | regex_search('tls-san:.*' + api_endpoint | regex_escape(), ignorecase=True) %}
42+
true
43+
{% else %}
44+
false
45+
{% endif %}
46+
_api_endpoint_in_agent_args: >-
47+
{% if api_endpoint is defined and extra_agent_args | regex_search('--tls-san[=\s]+' + api_endpoint | regex_escape(), ignorecase=True) %}
48+
true
49+
{% else %}
50+
false
51+
{% endif %}
52+
53+
- name: Add TLS SAN to agent arguments if needed
54+
ansible.builtin.set_fact:
55+
final_agent_args: >-
56+
{{ extra_agent_args }}
57+
{% if api_endpoint is defined and api_endpoint != ansible_hostname and _api_endpoint_in_agent_config | bool == false and _api_endpoint_in_agent_args | bool == false %}
58+
--tls-san={{ api_endpoint }}
59+
{% endif %}
60+
3861
- name: Setup optional config file
3962
when: agent_config_yaml is defined
4063
block:

‎roles/k3s_agent/templates/k3s-agent.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,4 @@ RestartSec=5s
2626
ExecStartPre=/bin/sh -xc '! /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service'
2727
ExecStartPre=-/sbin/modprobe br_netfilter
2828
ExecStartPre=-/sbin/modprobe overlay
29-
ExecStart=/usr/local/bin/k3s agent --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ extra_agent_args }}
29+
ExecStart=/usr/local/bin/k3s agent --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ final_agent_args }}

‎roles/k3s_server/defaults/main.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,3 @@ server_group: server # noqa var-naming[no-role-prefix]
99
agent_group: agent # noqa var-naming[no-role-prefix]
1010
use_external_database: false # noqa var-naming[no-role-prefix]
1111
extra_server_args: "" # noqa var-naming[no-role-prefix]
12-
# Auto-computed TLS SANs to prevent certificate validation issues
13-
_computed_tls_sans: "{% if api_endpoint is defined and api_endpoint != ansible_hostname %}--tls-san={{ api_endpoint }}{% endif %}"
14-
_final_server_args: "{{ extra_server_args }} {{ _computed_tls_sans }}"

‎roles/k3s_server/tasks/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,29 @@
4141
regexp: '\.\s+<\(k3s completion bash\)'
4242
line: ". <(k3s completion bash) # Added by k3s-ansible"
4343

44+
- name: Compute final server arguments
45+
ansible.builtin.set_fact:
46+
_api_endpoint_in_config: >-
47+
{% if server_config_yaml is defined and api_endpoint is defined and server_config_yaml | regex_search('tls-san:.*' + api_endpoint | regex_escape(), ignorecase=True) %}
48+
true
49+
{% else %}
50+
false
51+
{% endif %}
52+
_api_endpoint_in_args: >-
53+
{% if api_endpoint is defined and extra_server_args | regex_search('--tls-san[=\s]+' + api_endpoint | regex_escape(), ignorecase=True) %}
54+
true
55+
{% else %}
56+
false
57+
{% endif %}
58+
59+
- name: Add TLS SAN to server arguments if needed
60+
ansible.builtin.set_fact:
61+
final_server_args: >-
62+
{{ extra_server_args }}
63+
{% if api_endpoint is defined and api_endpoint != ansible_hostname and _api_endpoint_in_config | bool == false and _api_endpoint_in_args | bool == false %}
64+
--tls-san={{ api_endpoint }}
65+
{% endif %}
66+
4467
- name: Setup optional config file
4568
when: server_config_yaml is defined
4669
block:

‎roles/k3s_server/templates/k3s-cluster-init.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,4 @@ Restart=always
2525
RestartSec=5s
2626
ExecStartPre=-/sbin/modprobe br_netfilter
2727
ExecStartPre=-/sbin/modprobe overlay
28-
ExecStart=/usr/local/bin/k3s server --cluster-init --data-dir {{ k3s_server_location }} {{ _final_server_args }}
28+
ExecStart=/usr/local/bin/k3s server --cluster-init --data-dir {{ k3s_server_location }} {{ final_server_args }}

‎roles/k3s_server/templates/k3s-ha.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,4 @@ Restart=always
2525
RestartSec=5s
2626
ExecStartPre=-/sbin/modprobe br_netfilter
2727
ExecStartPre=-/sbin/modprobe overlay
28-
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ _final_server_args }}
28+
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ final_server_args }}

‎roles/k3s_server/templates/k3s-single.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,4 @@ Restart=always
2525
RestartSec=5s
2626
ExecStartPre=-/sbin/modprobe br_netfilter
2727
ExecStartPre=-/sbin/modprobe overlay
28-
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {{ _final_server_args }}
28+
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {{ final_server_args }}

0 commit comments

Comments
 (0)