Etcd certs: use symlink in kubeadm config

Author: ant31

roles/kubernetes/control-plane/defaults/main/etcd.yml

@@ -27,3 +27,11 @@ etcd_extra_vars: {}
 # etcd_max_request_bytes: "1572864"
 
 etcd_compaction_retention: "8"
+
+
+# Harlink to etcd certs
+etcd_cert_paths:
+  client:
+    ca: "{{ etcd_cert_dir }}/ca.pem"
+    cert: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem"
+    key: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem"

roles/kubernetes/control-plane/defaults/main/main.yml

@@ -23,10 +23,6 @@ kube_apiserver_etcd_compaction_interval: "5m0s"
 # in the request is actually present in etcd.
 kube_apiserver_service_account_lookup: true
 
-kube_etcd_cacert_file: ca.pem
-kube_etcd_cert_file: node-{{ inventory_hostname }}.pem
-kube_etcd_key_file: node-{{ inventory_hostname }}-key.pem
-
 # Associated interfaces must be reachable by the rest of the cluster, and by
 # CLI/web clients.
 kube_controller_manager_bind_address: "::"

roles/kubernetes/control-plane/tasks/0010-etcd-link.yml

@@ -0,0 +1,24 @@
+---
+- name: Create etcd cert directory
+  ansible.builtin.file:
+    path: "{{ etcd_cert_dir }}"
+    state: directory
+    mode: '0750'
+  when:
+    - inventory_hostname  in groups['kube_control_plane']
+
+- name: Generate symlink to etcd certs
+  ansible.builtin.file:
+    src: "{{item.src}}"
+    dest: "{{item.dest}}"
+    state: link
+    force: true
+  loop:
+    - src: "{{etcd_cert_paths.client.ca}}"
+      dest: "{{ etcd_cert_dir }}/{{kube_etcd_cacert_file}}"
+    - src: "{{etcd_cert_paths.client.cert}}"
+      dest: "{{ etcd_cert_dir }}/{{kube_etcd_cert_file}}"
+    - src: "{{etcd_cert_paths.client.key}}"
+      dest: "{{ etcd_cert_dir }}/{{kube_etcd_key_file}}"
+  when:
+    - inventory_hostname  in groups['kube_control_plane']

roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -96,6 +96,10 @@
     mode: "0640"
     validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}"
 
+- name: Kubeadm | debug config
+  ansible.builtin.debug:
+    var: lookup('ansible.builtin.file', "{{ kube_config_dir }}/kubeadm-config.yaml")
+
 - name: Kubeadm | Create directory to store admission control configurations
   file:
     path: "{{ kube_config_dir }}/admission-controls"

roles/kubernetes/control-plane/tasks/main.yml

@@ -4,6 +4,11 @@
   tags:
     - k8s-pre-upgrade
 
+- name: Create etcd cert symbolic links
+  import_tasks: 0010-etcd-link.yml
+  when:
+    - etcd_deployment_type != "kubeadm"
+
 - name: Create webhook token auth config
   template:
     src: webhook-token-auth-config.yaml.j2

roles/kubernetes/control-plane/vars/main.yaml

@@ -7,3 +7,7 @@ kube_apiserver_admission_plugins_needs_configuration:
 - PodSecurity
 - PodNodeSelector
 - ResourceQuota
+
+kube_etcd_cacert_file: "kube-client-ca.pem"
+kube_etcd_cert_file: "kube-client-cert.pem"
+kube_etcd_key_file: "kube-client-key.pem"

roles/kubespray-defaults/defaults/main/main.yml

@@ -763,3 +763,15 @@ system_upgrade_reboot: on-upgrade  # never, always
 
 # Enables or disables the scheduler plugins.
 scheduler_plugins_enabled: false
+
+# Symlinks to etcd certs
+kube_etcd_cacert_file: "kube-client-ca.pem"
+kube_etcd_cert_file: "kube-client-cert.pem"
+kube_etcd_key_file: "kube-client-key.pem"
+
+# Harlink to etcd certs
+etcd_cert_paths:
+  client:
+    ca: "{{ etcd_cert_dir }}/ca.pem"
+    cert: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem"
+    key: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem"