|
1 | 1 | --- |
2 | | -- name: Check kubelet serving certificates approved with kubelet_csr_approver |
3 | | - when: |
4 | | - - kubelet_rotate_server_certificates | default(false) |
5 | | - - kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false)) |
6 | | - vars: |
7 | | - csrs: "{{ csr_json.stdout | from_json }}" |
8 | | - block: |
9 | | - |
10 | | - - name: Get certificate signing requests |
11 | | - command: "{{ bin_dir }}/kubectl get csr -o jsonpath-as-json={.items[*]}" |
12 | | - register: csr_json |
13 | | - changed_when: false |
14 | | - |
15 | | - - name: Check there are csrs |
16 | | - assert: |
17 | | - that: csrs | length > 0 |
18 | | - fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found |
19 | | - |
20 | | - - name: Check there are Denied/Pending csrs |
21 | | - assert: |
22 | | - that: |
23 | | - - csrs | rejectattr('status') | length == 0 # Pending == no status |
24 | | - - csrs | map(attribute='status.conditions') | flatten | selectattr('type', 'equalto', 'Denied') | length == 0 # Denied |
25 | | - |
26 | | - fail_msg: kubelet_csr_approver is enabled but CSRs are not approved |
27 | | - |
28 | | -- name: Approve kubelet serving certificates |
29 | | - when: |
30 | | - - kubelet_rotate_server_certificates | default(false) |
31 | | - - not (kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false))) |
32 | | - block: |
33 | | - |
34 | | - - name: Get certificate signing requests |
35 | | - command: "{{ bin_dir }}/kubectl get csr -o name" |
36 | | - register: get_csr |
37 | | - changed_when: false |
38 | | - |
39 | | - - name: Check there are csrs |
40 | | - assert: |
41 | | - that: get_csr.stdout_lines | length > 0 |
42 | | - fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found |
43 | | - |
44 | | - - name: Approve certificates |
45 | | - command: "{{ bin_dir }}/kubectl certificate approve {{ get_csr.stdout_lines | join(' ') }}" |
46 | | - register: certificate_approve |
47 | | - when: get_csr.stdout_lines | length > 0 |
48 | | - changed_when: certificate_approve.stdout |
49 | | - |
50 | 2 | - name: Run the hydrophone checks |
51 | 3 | vars: |
52 | 4 | networking_check: "\\[sig-network\\] Networking Granular Checks.+\\[Conformance\\]" |
|
0 commit comments