c12s-kubespray/roles/kubernetes/secrets/tasks/main.yml

---
- include: check-certs.yml
  tags: [k8s-secrets, facts]

- include: check-tokens.yml
  tags: [k8s-secrets, facts]

- name: Make sure the certificate directory exits
  file:
    path: "{{ kube_cert_dir }}"
    state: directory
    mode: o-rwx
    group: "{{ kube_cert_group }}"

- name: Make sure the tokens directory exits
  file:
    path: "{{ kube_token_dir }}"
    state: directory
    mode: o-rwx
    group: "{{ kube_cert_group }}"

- name: Make sure the users directory exits
  file:
    path: "{{ kube_users_dir }}"
    state: directory
    mode: o-rwx
    group: "{{ kube_cert_group }}"

- name: Populate users for basic auth in API
  template:
    src: known_users.csv.j2
    dest: "{{ kube_users_dir }}/known_users.csv"
    backup: yes
  when: inventory_hostname in "{{ groups['kube-master'] }}" and kube_basic_auth|default(true)
  notify: set secret_changed

#
# The following directory creates make sure that the directories
# exist on the first master for cases where the first master isn't
# being run.
#
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
  file:
    path: "{{ kube_config_dir }}"
    state: directory
    owner: kube
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  tags: [kubelet, k8s-secrets, kube-controller-manager, kube-apiserver, bootstrap-os, apps, network, master, node]
  when: gen_certs|default(false) or gen_tokens|default(false)

- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
  file:
    path: "{{ kube_script_dir }}"
    state: directory
    owner: kube
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  tags: [k8s-secrets, bootstrap-os]
  when: gen_certs|default(false) or gen_tokens|default(false)

- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
  file:
    path: "{{ kube_token_dir }}"
    state: directory
    mode: o-rwx
    group: "{{ kube_cert_group }}"
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_tokens|default(false)

- include: "gen_certs_{{ cert_management }}.yml"
  tags: k8s-secrets

- include: upd_ca_trust.yml
  tags: k8s-secrets

- name: "Gen_certs | Get certificate serials on kube masters"
  shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
  register: "master_certificate_serials"
  with_items:
    - "admin-{{ inventory_hostname }}.pem"
    - "apiserver.pem"
    - "kube-controller-manager.pem"
    - "kube-scheduler.pem"
  when: inventory_hostname in groups['kube-master']

- name: "Gen_certs | set kube master certificate serial facts"
  set_fact:
    etcd_admin_cert_serial: "{{ master_certificate_serials.results[0].stdout|default() }}"
    apiserver_cert_serial: "{{ master_certificate_serials.results[1].stdout|default() }}"
    controller_manager_cert_serial: "{{ master_certificate_serials.results[2].stdout|default() }}"
    scheduler_cert_serial: "{{ master_certificate_serials.results[3].stdout|default() }}"
  when: inventory_hostname in groups['kube-master']

- name: "Gen_certs | Get certificate serials on kube nodes"
  shell: "openssl x509 -in {{ kube_cert_dir }}/{{ item }} -noout -serial | cut -d= -f2"
  register: "node_certificate_serials"
  with_items:
    - "node-{{ inventory_hostname }}.pem"
    - "kube-proxy-{{ inventory_hostname }}.pem"
  when: inventory_hostname in groups['k8s-cluster']

- name: "Gen_certs | set kube node certificate serial facts"
  set_fact:
    etcd_node_cert_serial: "{{ node_certificate_serials.results[0].stdout|default() }}"
    kube_proxy_cert_serial: "{{ node_certificate_serials.results[1].stdout|default() }}"
  when: inventory_hostname in groups['k8s-cluster']

- include: gen_tokens.yml
  tags: k8s-secrets