更改os-harden为手动选择执行

android-cq · May 29, 2018 · af31805 · af31805
1 parent 6e9eb60
commit af31805
Show file tree

Hide file tree

Showing 11 changed files with 8 additions and 22 deletions.
diff --git a/01.prepare.yml b/01.prepare.yml
@@ -1,8 +1,3 @@
-# [可选]操作系统安全加固 https://github.com/dev-sec/ansible-os-hardening
-- hosts: all
-  roles:
-  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
-
 # 在deploy节点生成CA相关证书，以及kubedns.yaml配置文件
 - hosts: deploy
   roles:

diff --git a/11.harbor.yml b/11.harbor.yml
@@ -1,6 +1,5 @@
 - hosts: harbor
   roles:
-  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
   - prepare
   - docker
   - harbor

diff --git a/20.addnode.yml b/20.addnode.yml
@@ -1,6 +1,5 @@
 - hosts: new-node
   roles:
-  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
   - prepare
   - docker
   - kube-node

diff --git a/21.addmaster.yml b/21.addmaster.yml
@@ -8,7 +8,6 @@
 
 - hosts: new-master 
   roles:
-  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
   - prepare
   - docker
   - kube-master

diff --git a/90.setup.yml b/90.setup.yml
@@ -1,8 +1,3 @@
-# [可选]操作系统安全加固 https://github.com/dev-sec/ansible-os-hardening
-- hosts: all
-  roles:
-  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
-
 # 在deploy节点生成CA相关证书，以供整个集群使用
 # 以及初始化kubedns.yaml配置文件
 - hosts: deploy

diff --git a/docs/00-集群规划和基础参数设定.md b/docs/00-集群规划和基础参数设定.md
@@ -112,6 +112,7 @@ ansible all -m ping
 }
 ```
 + 开始集群安装，如果你对集群安装流程不熟悉，请阅读分步安装讲解后一步一步安装，并对每步都进行验证
++ [可选]安装集群前对所有节点进行操作系统层面的安全加固 `ansible-playbook roles/os-harden/os-harden.yml`，详情请参考[os-harden项目](https://github.com/dev-sec/ansible-os-hardening)
 
 ``` bash
 # 分步安装

diff --git a/docs/quickStart.md b/docs/quickStart.md
@@ -92,6 +92,8 @@ ansible-playbook 06.network.yml
 ```
 如果执行成功，k8s集群就安装好了。详细分步讲解请查看项目目录 `/docs` 下相关文档
 
++ [可选]对节点进行操作系统层面的安全加固 `ansible-playbook roles/os-harden/os-harden.yml`，详情请参考[os-harden项目](https://github.com/dev-sec/ansible-os-hardening)
+
 ### 5.验证安装
 ``` bash
 # 如果提示kubectl: command not found，退出重新ssh登陆一下，环境变量生效即可

diff --git a/example/hosts.allinone.example b/example/hosts.allinone.example
@@ -75,9 +75,6 @@ BASIC_AUTH_USER="admin"
 BASIC_AUTH_PASS="test1234"
 
 # ---------附加参数--------------------
-#是否对操作系统进行安全加固 "yes"/"no"
-OS_HARDEN="no"
-
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"
 

diff --git a/example/hosts.m-masters.example b/example/hosts.m-masters.example
@@ -92,9 +92,6 @@ BASIC_AUTH_USER="admin"
 BASIC_AUTH_PASS="test1234"
 
 # ---------附加参数--------------------
-#是否对操作系统进行安全加固 "yes"/"no"
-OS_HARDEN="no"
-
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"
 

diff --git a/example/hosts.s-master.example b/example/hosts.s-master.example
@@ -79,9 +79,6 @@ BASIC_AUTH_USER="admin"
 BASIC_AUTH_PASS="test1234"
 
 # ---------附加参数--------------------
-#是否对操作系统进行安全加固 "yes"/"no"
-OS_HARDEN="no"
-
 #默认二进制文件目录
 bin_dir="/opt/kube/bin"
 

diff --git a/roles/os-harden/os-harden.yml b/roles/os-harden/os-harden.yml
@@ -0,0 +1,5 @@
+# [可选]操作系统安全加固 https://github.com/dev-sec/ansible-os-hardening
+- hosts: all
+  roles:
+  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
+
-Original file line number
+Diff line change
@@ Expand Up / @@ -8,7 +8,6 @@ @@
     - hosts: new-master
       roles:
-      - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }
       - prepare
       - docker
       - kube-master
@@ Expand Down @@