kubeasz/roles/deploy/tasks/create-kubectl-kubeconfig.yml

- name: 删除原有kubeconfig
  file: path=/root/.kube/config state=absent
  ignore_errors: true

- name: 下载 group:read rbac 文件
  copy: src=read-group-rbac.yaml dest=/tmp/read-group-rbac.yaml
  when: USER_NAME == "read"

- name: 创建group:read rbac 绑定
  shell: "{{ base_dir }}/bin/kubectl apply -f /tmp/read-group-rbac.yaml"
  when: USER_NAME == "read"

- name: 准备kubectl使用的{{ USER_NAME }}证书签名请求
  template: src={{ USER_NAME }}-csr.json.j2 dest={{ base_dir }}/.cluster/ssl/{{ USER_NAME }}-csr.json

- name: 创建{{ USER_NAME }}证书与私钥
  shell: "cd {{ base_dir }}/.cluster/ssl && {{ base_dir }}/bin/cfssl gencert \
        -ca=ca.pem \
        -ca-key=ca-key.pem \
        -config=ca-config.json \
        -profile=kubernetes {{ USER_NAME }}-csr.json | {{ base_dir }}/bin/cfssljson -bare {{ USER_NAME }}"

- name: 设置集群参数
  shell: "{{ base_dir }}/bin/kubectl config set-cluster {{ CLUSTER_NAME }} \
        --certificate-authority={{ base_dir }}/.cluster/ssl/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }}"

- name: 设置客户端认证参数
  shell: "{{ base_dir }}/bin/kubectl config set-credentials {{ USER_NAME }} \
        --client-certificate={{ base_dir }}/.cluster/ssl/{{ USER_NAME }}.pem \
        --embed-certs=true \
        --client-key={{ base_dir }}/.cluster/ssl/{{ USER_NAME }}-key.pem"

- name: 设置上下文参数
  shell: "{{ base_dir }}/bin/kubectl config set-context {{ CONTEXT_NAME }} \
        --cluster={{ CLUSTER_NAME }} --user={{ USER_NAME }}"

- name: 选择默认上下文
  shell: "{{ base_dir }}/bin/kubectl config use-context {{ CONTEXT_NAME }}"