summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Butcher <abutcher@redhat.com>2016-12-09 10:55:29 -0500
committerAndrew Butcher <abutcher@redhat.com>2016-12-09 10:55:29 -0500
commit4f176b7af4a79402f2823a6d47d34addb43b1101 (patch)
tree8fc77a215fa2928c6efa4e6325da7e0263728834
parentce39c9084bc20df242bbbef3a2a5b1c8060cbe9d (diff)
downloadopenshift-4f176b7af4a79402f2823a6d47d34addb43b1101.tar.gz
openshift-4f176b7af4a79402f2823a6d47d34addb43b1101.tar.bz2
openshift-4f176b7af4a79402f2823a6d47d34addb43b1101.tar.xz
openshift-4f176b7af4a79402f2823a6d47d34addb43b1101.zip
Limit node certificate SAN to node hostnames/ips.
-rw-r--r--roles/openshift_node_certificates/tasks/main.yml14
1 files changed, 7 insertions, 7 deletions
diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml
index 35f84c2cf..717bf3cea 100644
--- a/roles/openshift_node_certificates/tasks/main.yml
+++ b/roles/openshift_node_certificates/tasks/main.yml
@@ -64,13 +64,13 @@
- name: Generate the node server certificate
command: >
{{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm ca create-server-cert
- --cert={{ openshift_node_generated_config_dir }}/server.crt
- --key={{ openshift_generated_configs_dir }}/node-{{ openshift.common.hostname }}/server.key
- --overwrite=true
- --hostnames={{ openshift.common.all_hostnames |join(",") }}
- --signer-cert={{ openshift_ca_cert }}
- --signer-key={{ openshift_ca_key }}
- --signer-serial={{ openshift_ca_serial }}
+ --cert={{ openshift_node_generated_config_dir }}/server.crt
+ --key={{ openshift_generated_configs_dir }}/node-{{ openshift.common.hostname }}/server.key
+ --overwrite=true
+ --hostnames={{ openshift.common.hostname }},{{ openshift.common.public_hostname }},{{ openshift.common.ip }},{{ openshift.common.public_ip }}
+ --signer-cert={{ openshift_ca_cert }}
+ --signer-key={{ openshift_ca_key }}
+ --signer-serial={{ openshift_ca_serial }}
args:
creates: "{{ openshift_node_generated_config_dir }}/server.crt"
when: node_certs_missing | bool