45 lines
1.8 KiB
Diff
45 lines
1.8 KiB
Diff
--- a/ansible/bootstrap.yml
|
|
+++ b/ansible/bootstrap.yml
|
|
@@ -9,7 +9,6 @@
|
|
vars:
|
|
k3s_version: "v1.35.1+k3s1"
|
|
helm_version: "v3.17.3"
|
|
- kubeconfig_local_path: "~/.kube/config-hosteurope"
|
|
|
|
tasks:
|
|
# ── Base packages ────────────────────────────────────────────────────────
|
|
@@ -27,7 +26,7 @@
|
|
shell: |
|
|
curl -sfL https://get.k3s.io | \
|
|
INSTALL_K3S_VERSION="{{ k3s_version }}" \
|
|
- INSTALL_K3S_EXEC="server --cluster-init --write-kubeconfig-mode=644" \
|
|
+ INSTALL_K3S_EXEC="server --cluster-init --write-kubeconfig-mode=600" \
|
|
sh -
|
|
args:
|
|
creates: /usr/local/bin/k3s
|
|
@@ -77,17 +76,11 @@
|
|
|
|
- debug: var=helm_ver.stdout
|
|
|
|
- # ── Kubeconfig ───────────────────────────────────────────────────────────
|
|
- - name: Fetch kubeconfig to control node
|
|
- fetch:
|
|
- src: /etc/rancher/k3s/k3s.yaml
|
|
- dest: "{{ kubeconfig_local_path }}"
|
|
- flat: yes
|
|
-
|
|
- - name: Fix server address in fetched kubeconfig
|
|
- delegate_to: localhost
|
|
- become: false
|
|
- replace:
|
|
- path: "{{ kubeconfig_local_path }}"
|
|
- regexp: 'server: https://127\.0\.0\.1:6443'
|
|
- replace: "server: https://{{ ansible_host }}:6443"
|
|
+ # Admin kubeconfig stays on the host. Attended administration uses
|
|
+ # sudo k3s kubectl; agent identity issuance belongs to railiance-platform.
|
|
+ - name: Restrict existing admin kubeconfig permissions
|
|
+ ansible.builtin.file:
|
|
+ path: /etc/rancher/k3s/k3s.yaml
|
|
+ owner: root
|
|
+ group: root
|
|
+ mode: "0600"
|