From a2c62c0855c3318405638d027ad5b376d8f2bee1 Mon Sep 17 00:00:00 2001 From: Jan Chaloupka Date: Tue, 4 Jul 2017 10:37:04 +0200 Subject: use master etcd certificates when delegating oadm migrate etcd-ttl --- roles/etcd_common/defaults/main.yml | 4 ++++ roles/etcd_migrate/tasks/migrate.yml | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/roles/etcd_common/defaults/main.yml b/roles/etcd_common/defaults/main.yml index b5b38c1e1..b1bfa4592 100644 --- a/roles/etcd_common/defaults/main.yml +++ b/roles/etcd_common/defaults/main.yml @@ -44,6 +44,10 @@ etcd_ca_serial: "{{ etcd_ca_dir }}/serial" etcd_ca_crl_number: "{{ etcd_ca_dir }}/crlnumber" etcd_ca_default_days: 1825 +r_etcd_common_master_peer_cert_file: /etc/origin/master/master.etcd-client.crt +r_etcd_common_master_peer_key_file: /etc/origin/master/master.etcd-client.key +r_etcd_common_master_peer_ca_file: /etc/origin/master/master.etcd-ca.crt + # etcd server & certificate vars etcd_hostname: "{{ inventory_hostname }}" etcd_ip: "{{ ansible_default_ipv4.address }}" diff --git a/roles/etcd_migrate/tasks/migrate.yml b/roles/etcd_migrate/tasks/migrate.yml index 7f441568a..4f987a051 100644 --- a/roles/etcd_migrate/tasks/migrate.yml +++ b/roles/etcd_migrate/tasks/migrate.yml @@ -36,9 +36,9 @@ - name: Re-introduce leases (as a replacement for key TTLs) command: > oadm migrate etcd-ttl \ - --cert {{ etcd_peer_cert_file }} \ - --key {{ etcd_peer_key_file }} \ - --cacert {{ etcd_peer_ca_file }} \ + --cert {{ r_etcd_common_master_peer_cert_file }} \ + --key {{ r_etcd_common_master_peer_key_file }} \ + --cacert {{ r_etcd_common_master_peer_ca_file }} \ --etcd-address 'https://{{ etcd_peer }}:{{ etcd_client_port }}' \ --ttl-keys-prefix {{ item }} \ --lease-duration 1h -- cgit v1.2.3