Skip to content

Conversation

@ksuderman
Copy link
Collaborator

The certificates that are generated for the kubeconfig file are only valid for for localhost (127.0.0.1) and cannot be downloaded and used from a remote machine. This PR adds two things to address this problem:

  1. Adds {{ ansible_ssh_host }} to the tls-san section of the rke_config.j2 template so that the certificates generated are also valid for the instance's public IP address, and
  2. Downloads a copy of the kubeconfig (/etc/rancher/rke2/rke2.yaml) and saves it locally so it can be used to manage the cluster with kubectl and helm commands.

Issues

  • The kubeconfig file is downloaded to a directory named outputs in the current directory on localhost. However, no checks are performed to ensure the directory exists and no attempt is made to create the directory if it is missing. Since creating the output directory needs to be performed on localhost it can't be added to the rke role and would have to be part of the main playbook. Otherwise the human operator needs to ensure the directory exists before running the playbook. One simple alternative would be to have the outputs directory as part of the GitHub repository so it would be created for the user when they checkout the playbook(s).

  • This solution may be slightly less secure as now access is permitted to the cluster where none was allowed before. However, this is true for SSH keys and other certificates that allow direct access to the underlying instances. While the cluster can typically be managed through the Rancher web interface this can be problematic when it is Rancher itself that is having problems or the web interface is too slow and clunky (think satellite internet from northern Canada say...)

@ksuderman
Copy link
Collaborator Author

Replaced by #49

@ksuderman ksuderman closed this May 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant