---
- import_tasks: pre-upgrade.yml
  tags:
    - k8s-pre-upgrade

- name: Create webhook token auth config
  template:
    src: webhook-token-auth-config.yaml.j2
    dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
  when: kube_webhook_token_auth|default(false)

- name: Create webhook authorization config
  template:
    src: webhook-authorization-config.yaml.j2
    dest: "{{ kube_config_dir }}/webhook-authorization-config.yaml"
  when: kube_webhook_authorization|default(false)

- import_tasks: encrypt-at-rest.yml
  when:
    - kube_encrypt_secret_data

- name: Install | Copy kubectl binary from download dir
  synchronize:
    src: "{{ local_release_dir }}/kubectl-{{ kube_version }}-{{ image_arch }}"
    dest: "{{ bin_dir }}/kubectl"
    compress: no
    perms: yes
    owner: no
    group: no
  changed_when: false
  delegate_to: "{{ inventory_hostname }}"
  tags:
    - kubectl
    - upgrade

- name: install | Set kubectl binary permissions
  file:
    path: "{{ bin_dir }}/kubectl"
    mode: "0755"
    state: file
  tags:
    - kubectl
    - upgrade

- name: Install kubectl bash completion
  shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
  when: ansible_os_family in ["Debian","RedHat"]
  tags:
    - kubectl
  ignore_errors: True

- name: Set kubectl bash completion file permissions
  file:
    path: /etc/bash_completion.d/kubectl.sh
    owner: root
    group: root
    mode: 0755
  when: ansible_os_family in ["Debian","RedHat"]
  tags:
    - kubectl
    - upgrade
  ignore_errors: True

- name: Disable SecurityContextDeny admission-controller and enable PodSecurityPolicy
  set_fact:
    kube_apiserver_enable_admission_plugins: "{{ kube_apiserver_enable_admission_plugins | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
  when: podsecuritypolicy_enabled

- name: Include kubeadm setup
  import_tasks: kubeadm-setup.yml

- name: Include kubeadm etcd extra tasks
  include_tasks: kubeadm-etcd.yml
  when: etcd_kubeadm_enabled

- name: Include kubeadm secondary server apiserver fixes
  include_tasks: kubeadm-fix-apiserver.yml