如何使用Ansible批准Kubernetes证书签名请求（CSR）

你可以借助kubernetes.core集合中的模块实现幂等的CSR批准操作，无需依赖command模块直接调用kubectl。以下是两种可行的方案：

方案一：使用k8s_json_patch模块 #

先通过k8s_info获取CSR当前状态，仅当CSR未被批准时执行补丁操作：

- name: 获取myuser CSR的状态信息
  kubernetes.core.k8s_info:
    api_version: certificates.k8s.io/v1
    kind: CertificateSigningRequest
    name: myuser
  register: csr_status

- name: 批准未通过的myuser CSR
  kubernetes.core.k8s_json_patch:
    api_version: certificates.k8s.io/v1
    kind: CertificateSigningRequest
    name: myuser
    patch: |
      [
        {
          "op": "add",
          "path": "/status/conditions/-",
          "value": {
            "type": "Approved",
            "status": "True",
            "reason": "AnsibleApproval",
            "message": "CSR approved via Ansible",
            "lastUpdateTime": "{{ ansible_date_time.iso8601 }}"
          }
        }
      ]
  when: >
    csr_status.resources | length > 0 and
    not (csr_status.resources[0].status.conditions | selectattr('type', 'equalto', 'Approved') | selectattr('status', 'equalto', 'True') | list | length > 0)

方案二：使用k8s模块（更简洁） #

直接通过k8s模块的patch参数实现，同时嵌入状态判断逻辑：

- name: 幂等批准myuser CSR
  kubernetes.core.k8s:
    api_version: certificates.k8s.io/v1
    kind: CertificateSigningRequest
    name: myuser
    state: present
    patch:
      type: json
      content:
        - op: add
          path: "/status/conditions/-"
          value:
            type: Approved
            status: "True"
            reason: AnsibleApproval
            message: CSR approved via Ansible
            lastUpdateTime: "{{ ansible_date_time.iso8601 }}"
  when: >
    (lookup('kubernetes.core.k8s', api_version='certificates.k8s.io/v1', kind='CertificateSigningRequest', name='myuser') | 
    json_query('status.conditions[?type==`Approved` && status==`True`]') | length == 0)

关键说明 #

1. 幂等性保证：通过when条件判断CSR是否已存在Approved且状态为True的条件，仅当未批准时才执行操作，避免重复执行。
2. 依赖前提：确保已安装kubernetes.core集合，可通过以下命令安装：

   ansible-galaxy collection install kubernetes.core
   

3. 补丁逻辑：向CSR的status.conditions数组中添加一条类型为Approved的条件，与kubectl certificate approve的操作逻辑完全一致。

内容的提问来源于stack exchange，提问作者Raman Babich