95 lines
2.5 KiB
YAML
95 lines
2.5 KiB
YAML
---
|
|
- name: Require explicit approval before cert-manager reconciliation
|
|
ansible.builtin.assert:
|
|
that:
|
|
- cert_manager_enabled | bool
|
|
fail_msg: >-
|
|
Refusing cert-manager changes. Re-run with cert_manager_enabled=true after
|
|
confirming public TCP 80 and 443 reach Traefik.
|
|
|
|
- name: Require Helm and the K3s kubeconfig
|
|
ansible.builtin.stat:
|
|
path: "{{ item }}"
|
|
loop:
|
|
- /usr/local/bin/helm
|
|
- "{{ cert_manager_kubeconfig }}"
|
|
register: cert_manager_prerequisites
|
|
|
|
- name: Assert Helm and kubeconfig are available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.stat.exists
|
|
fail_msg: "Missing cert-manager prerequisite: {{ item.item }}"
|
|
loop: "{{ cert_manager_prerequisites.results }}"
|
|
|
|
- name: Add or update the Jetstack Helm repository
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- repo
|
|
- add
|
|
- "{{ cert_manager_chart_repository_name }}"
|
|
- "{{ cert_manager_chart_repository_url }}"
|
|
- --force-update
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
changed_when: false
|
|
|
|
- name: Update Helm repositories
|
|
ansible.builtin.command:
|
|
argv: [helm, repo, update]
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
changed_when: false
|
|
|
|
- name: Install or reconcile cert-manager
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- "{{ cert_manager_release_name }}"
|
|
- "{{ cert_manager_chart_ref }}"
|
|
- --namespace
|
|
- "{{ cert_manager_namespace }}"
|
|
- --create-namespace
|
|
- --version
|
|
- "{{ cert_manager_chart_version }}"
|
|
- --set
|
|
- crds.enabled=true
|
|
- --wait
|
|
- --timeout
|
|
- 10m
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Install ClusterIssuer manifest without secret material
|
|
ansible.builtin.template:
|
|
src: clusterissuer.yaml.j2
|
|
dest: "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
|
|
- name: Apply ClusterIssuer manifest
|
|
ansible.builtin.command:
|
|
argv:
|
|
- k3s
|
|
- kubectl
|
|
- apply
|
|
- -f
|
|
- "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
|
|
changed_when: false
|
|
|
|
- name: Wait for ClusterIssuer readiness
|
|
ansible.builtin.command:
|
|
argv:
|
|
- k3s
|
|
- kubectl
|
|
- wait
|
|
- --for=condition=Ready
|
|
- "clusterissuer/{{ cert_manager_cluster_issuer_name }}"
|
|
- --timeout=180s
|
|
changed_when: false
|