kubernetes: kubeadm/master node some more cleanup (WIP)

5 files changed, 31 insertions, 42 deletions

diff --git a/roles/kubernetes/kubeadm/master/tasks/main.yml b/roles/kubernetes/kubeadm/master/tasks/main.yml
index 9ffdbeee..7f96ff6a 100644
--- a/roles/kubernetes/kubeadm/master/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/master/tasks/main.yml
@@ -1,15 +1,15 @@
 ---
-- name: create direcotry for encryption config
-  file:
-    name: /etc/kubernetes/encryption
-    state: directory
-    mode: 0700
-
-- name: install encryption config
-  template:
-    src: encryption-config.j2
-    dest: /etc/kubernetes/encryption/config
-    mode: 0600
+# - name: create direcotry for encryption config
+#   file:
+#     name: /etc/kubernetes/encryption
+#     state: directory
+#     mode: 0700
+
+# - name: install encryption config
+#   template:
+#     src: encryption-config.j2
+#     dest: /etc/kubernetes/encryption/config
+#     mode: 0600
 
 
 - name: install primary master
diff --git a/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml b/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml
index f7e25fb4..fc85a37d 100644
--- a/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml
+++ b/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml
@@ -16,7 +16,7 @@
 
   - name: upload certs
     when: "groups['_kubernetes_masters_'] | map('extract', hostvars) | map(attribute='host_name') | difference(kubernetes_current_nodes) | length > 0"
-    command: kubeadm init phase upload-certs --experimental-upload-certs
+    command: kubeadm init phase upload-certs --upload-certs
     check_mode: no
     register: kubeadm_upload_certs
 
@@ -26,7 +26,7 @@
     kubeadm_upload_certs_key: "{% if kubeadm_upload_certs.stdout is defined %}{{ kubeadm_upload_certs.stdout_lines | last }}{% endif %}"
 
 - name: join kubernetes secondary master node
-  command: "kubeadm join 127.0.0.1:{{ kubernetes_api_lb_port | default('6443') }} --apiserver-bind-port 6442{% if kubernetes_cri_socket is defined %} --cri-socket {{ kubernetes_cri_socket }}{% endif %} --token '{{ kube_bootstrap_token }}' --discovery-token-ca-cert-hash '{{ kube_bootstrap_ca_cert_hash }}' --experimental-control-plane --certificate-key {{ kubeadm_upload_certs_key }}"
+  command: "kubeadm join {{ host_vars[groups['_kubernetes_primary_master_']].kubernetes_kubelet_node_ip }}:6443{% if kubernetes_cri_socket is defined %} --cri-socket {{ kubernetes_cri_socket }}{% endif %} --token '{{ kube_bootstrap_token }}' --discovery-token-ca-cert-hash '{{ kube_bootstrap_ca_cert_hash }}' --control-plane --certificate-key {{ kubeadm_upload_certs_key }}"
   args:
     creates: /etc/kubernetes/kubelet.conf
   register: kubeadm_join
diff --git a/roles/kubernetes/kubeadm/master/templates/encryption-config.j2 b/roles/kubernetes/kubeadm/master/templates/encryption-config.j2
index a69ae84b..345c9bf9 100644
--- a/roles/kubernetes/kubeadm/master/templates/encryption-config.j2
+++ b/roles/kubernetes/kubeadm/master/templates/encryption-config.j2
@@ -6,7 +6,7 @@ resources:
     providers:
     - secretbox:
         keys:
-{% for key in kubernetes.encryption_config_keys %}
+{% for key in kubernetes_secrets.encryption_config_keys %}
         - name: key{{ loop.index }}
           secret: {{ key }}
 {% endfor %}
diff --git a/roles/kubernetes/kubeadm/master/templates/kubeadm-cluster.config.j2 b/roles/kubernetes/kubeadm/master/templates/kubeadm.config.j2
index 78e9d7a7..e03ea6f6 100644
--- a/roles/kubernetes/kubeadm/master/templates/kubeadm-cluster.config.j2
+++ b/roles/kubernetes/kubeadm/master/templates/kubeadm.config.j2
@@ -12,36 +12,30 @@ kind: ClusterConfiguration
 kubernetesVersion: {{ kubernetes_version }}
 clusterName: {{ kubernetes.cluster_name }}
 imageRepository: k8s.gcr.io
-{% if kubernetes.api_advertise_ip %}
-controlPlaneEndpoint: "{{ kubernetes.api_advertise_ip }}:6443"
-{% endif %}
+controlPlaneEndpoint: "{{ kubernetes_kubelet_node_ip }}:6443"
 networking:
-  dnsDomain: cluster.local
+  dnsDomain: {{ kubernetes.dns_domain | default('cluster.local') }}
   podSubnet: {{ kubernetes.pod_ip_range }}
   serviceSubnet: {{ kubernetes.service_ip_range }}
 apiServer:
   extraArgs:
-{% if kubernetes.api_advertise_ip %}
-    advertise-address: {{ kubernetes.api_advertise_ip }}
-{% endif %}
-    encryption-provider-config: /etc/kubernetes/encryption/config
-  extraVolumes:
-  - name: encryption-config
-    hostPath: /etc/kubernetes/encryption
-    mountPath: /etc/kubernetes/encryption
-    readOnly: true
-    pathType: Directory
-{% if (kubernetes.api_extra_sans | length) == 0 %}
+    advertise-address: {{ kubernetes_kubelet_node_ip }}
+  #   encryption-provider-config: /etc/kubernetes/encryption/config
+  # extraVolumes:
+  # - name: encryption-config
+  #   hostPath: /etc/kubernetes/encryption
+  #   mountPath: /etc/kubernetes/encryption
+  #   readOnly: true
+  #   pathType: Directory
+{% if (kubernetes.api_extra_sans | default([]) | length) == 0 %}
   certSANs: []
 {% else %}
   certSANs:
-{%   for san in kubernetes.api_extra_sans %}
-  - {{ san }}
-{%   endfor %}
+  {{ kubernetes.api_extra_sans | to_nice_yaml | indent(width=2) }}
 {% endif %}
 controllerManager:
   extraArgs:
-    node-cidr-mask-size: "{{ kubernetes_network_node_cidr_size }}"
+    node-cidr-mask-size: "{{ kubernetes.pod_ip_range_size }}"
 scheduler: {}
 dns:
   type: CoreDNS
diff --git a/roles/kubernetes/kubeadm/node/tasks/main.yml b/roles/kubernetes/kubeadm/node/tasks/main.yml
index 9f0057f9..2a140099 100644
--- a/roles/kubernetes/kubeadm/node/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/node/tasks/main.yml
@@ -1,18 +1,13 @@
 ---
-- name: get master vars
-  set_fact:
-    kube_bootstrap_token: "{{ hostvars[kubernetes_master].kube_bootstrap_token }}"
-    kube_bootstrap_ca_cert_hash: "{{ hostvars[kubernetes_master].kube_bootstrap_ca_cert_hash }}"
-    kube_master_addr: "{{ kubernetes.api_advertise_ip | default(hostvars[kubernetes_master].ansible_default_ipv4.address) }}"
-
 - name: join kubernetes node
-  command: "kubeadm join --token {{ kube_bootstrap_token }} {{ kube_master_addr }}:6443 --discovery-token-ca-cert-hash {{ kube_bootstrap_ca_cert_hash }}"
+  command: "kubeadm join {{ host_vars[groups['_kubernetes_primary_master_']].kubernetes_kubelet_node_ip }}:6443{% if kubernetes_cri_socket is defined %} --cri-socket {{ kubernetes_cri_socket }}{% endif %} --token '{{ kube_bootstrap_token }}' --discovery-token-ca-cert-hash '{{ kube_bootstrap_ca_cert_hash }}'"
   args:
     creates: /etc/kubernetes/kubelet.conf
   register: kubeadm_join
 
 - name: dump output of kubeadm join to log file
-  when: kubeadm_join.changed
-  copy:
+  when: kubeadm_join is changed
+  # This is not a handler by design to make sure this action runs at this point of the play.
+  copy: # noqa 503
     content: "{{ kubeadm_join.stdout }}\n"
     dest: /etc/kubernetes/kubeadm-join.log