summaryrefslogtreecommitdiff
path: root/roles/kubernetes/kubeadm/master/tasks/primary-master.yml
blob: 6fb63d090f7c035a8edcc7516f082f65d242d610 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
---
- name: check if kubeconfig kubelet.conf already exists
  stat:
    path: /etc/kubernetes/kubelet.conf
  register: kubeconfig_kubelet_stats

  ## TODO: switch to kubeadm config version v1beta3 (available since 1.22)
- name: generate kubeadm.config
  template:
    src: kubeadm.config.j2
    dest: /etc/kubernetes/kubeadm.config
  register: kubeadm_config

### cluster not yet initialized

- name: create new cluster
  when: not kubeconfig_kubelet_stats.stat.exists
  block:

  #### kubeadm wants token to come from --config if --config is used
  #### i think this is stupid -> TODO: send bug report
  # - name: generate bootstrap token for new cluster
  #   command: kubeadm token generate
  #   changed_when: False
  #   check_mode: no
  #   register: kubeadm_token_generate

  - name: initialize kubernetes master and store log
    block:
    - name: initialize kubernetes master
      command: "kubeadm init --config /etc/kubernetes/kubeadm.config --node-name {{ inventory_hostname }}{% if kubernetes_network_plugin_replaces_kube_proxy %} --skip-phases addon/kube-proxy{% endif %} --skip-token-print"
  #    command: "kubeadm init --config /etc/kubernetes/kubeadm.config --node-name {{ inventory_hostname }}{% if kubernetes_network_plugin_replaces_kube_proxy %} --skip-phases addon/kube-proxy{% endif %} --token '{{ kubeadm_token_generate.stdout }}' --token-ttl 42m --skip-token-print"
      args:
        creates: /etc/kubernetes/pki/ca.crt
      register: kubeadm_init

    always:
    - name: dump output of kubeadm init to log file
      when: kubeadm_init.changed
      copy:
        content: "{{ kubeadm_init.stdout }}\n"
        dest: /etc/kubernetes/kubeadm-init.log

    - name: dump error output of kubeadm init to log file
      when: kubeadm_init.changed and kubeadm_init.stderr
      copy:
        content: "{{ kubeadm_init.stderr }}\n"
        dest: /etc/kubernetes/kubeadm-init.errors

  - name: create bootstrap token for existing cluster
    command: kubeadm token create --ttl 42m
    check_mode: no
    register: kubeadm_token_generate


### cluster is already initialized but config has changed

- name: upgrade cluster config
  when: kubeconfig_kubelet_stats.stat.exists and kubeadm_config is changed
  block:

  - name: fail for cluster upgrades
    fail:
      msg: "upgrading cluster config is currently not supported!"


### cluster is already initialized

- name: prepare cluster for new nodes
  when: kubeconfig_kubelet_stats.stat.exists and kubeadm_config is not changed
  block:

  - name: fetch list of current nodes
    command: kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name
    changed_when: False
    check_mode: no
    register: kubectl_node_list

  - name: save list of current nodes
    set_fact:
      kubernetes_current_nodes: "{{ kubectl_node_list.stdout_lines | map('replace', 'node/', '') | list }}"

  - name: create bootstrap token for existing cluster
    when: "groups['_kubernetes_nodes_'] | difference(kubernetes_current_nodes) | length > 0"
    command: kubeadm token create --ttl 42m
    check_mode: no
    register: kubeadm_token_create


## calculate certificate digest

- name: install openssl
  apt:
    name: openssl
    state: present

- name: get ca certificate digest
  shell: "set -o pipefail && openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'"
  args:
    executable: /bin/bash
  check_mode: no
  register: kube_ca_openssl
  changed_when: False

- name: set variables needed by kubernetes/nodes to join the cluster
  set_fact:
    kube_bootstrap_token: "{% if kubeadm_token_generate.stdout is defined %}{{ kubeadm_token_generate.stdout }}{% elif kubeadm_token_create.stdout is defined %}{{ kubeadm_token_create.stdout }}{% endif %}"
    kube_bootstrap_ca_cert_hash: "sha256:{{ kube_ca_openssl.stdout }}"
  delegate_to: "{{ item }}"
  delegate_facts: True
  loop: "{{ groups['_kubernetes_nodes_'] }}"


## install node-local-dns

- name: generate node-local dns cache config
  template:
    src: node-local-dns.yml.j2
    dest: /etc/kubernetes/node-local-dns.yml

  ## TODO: move to server-side apply (GA since 1.22)
- name: install  node-local dns cache
  command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/node-local-dns.yml
  register: kube_node_local_dns_apply_result
  changed_when: (kube_node_local_dns_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0


## Network Plugin

- name: install network plugin
  include_tasks: "net_{{ kubernetes_network_plugin }}.yml"