kubeasz/roles/kube-node/tasks/create-kubelet-kubeconfig.yml

- name: 准备kubelet 证书签名请求
  template: src=kubelet-csr.json.j2 dest={{ cluster_dir }}/ssl/kubelet-csr.json
  connection: local

- name: 创建 kubelet 证书与私钥
  shell: "cd {{ cluster_dir }}/ssl && {{ base_dir }}/bin/cfssl gencert \
        -ca=ca.pem \
        -ca-key=ca-key.pem \
        -config=ca-config.json \
        -profile=kubernetes kubelet-csr.json | {{ base_dir }}/bin/cfssljson -bare kubelet"
  connection: local

- name: 分发kubelet证书相关
  copy: src={{ cluster_dir }}/ssl/{{ item }} dest={{ ca_dir }}/{{ item }}
  with_items:
  - ca.pem
  - kubelet.pem
  - kubelet-key.pem

# 创建kubelet.kubeconfig
- name: 设置集群参数
  shell: "{{ bin_dir }}/kubectl config set-cluster kubernetes \
        --certificate-authority={{ ca_dir }}/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }} \
   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"

- name: 设置客户端认证参数
  shell: "{{ bin_dir }}/kubectl config set-credentials system:node:{{ inventory_hostname }} \
        --client-certificate={{ ca_dir }}/kubelet.pem \
        --embed-certs=true \
        --client-key={{ ca_dir }}/kubelet-key.pem \
   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"

- name: 设置上下文参数
  shell: "{{ bin_dir }}/kubectl config set-context default \
        --cluster=kubernetes \
   --user=system:node:{{ inventory_hostname }} \
   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"

- name: 选择默认上下文
  shell: "{{ bin_dir }}/kubectl config use-context default \
   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"