kubeasz/roles/deploy/tasks/main.yml

- name: prepare some dirs
  file: name={{ item }} state=directory
  with_items:
  - "{{ bin_dir }}"
  - "{{ ca_dir }}"
  - "/etc/kubernetes"

- name: 下载证书工具 CFSSL和 kubectl
  copy: src={{ base_dir }}/bin/{{ item }} dest={{ bin_dir }}/{{ item }} mode=0755
  with_items:
  - cfssl
  - cfssl-certinfo
  - cfssljson
  - kubectl

# 注册变量result，根据result结果判断是否已经生成过ca证书
# result|failed 说明没有生成过证书，下一步生成证书
# result|succeeded 说明已经有ca证书，为了保证整个安装的幂等性，跳过证书生成的步骤
- name: 注册变量result
  command: "ls {{ ca_dir }}/ca.pem" 
  register: result
  ignore_errors: True

- name: 准备CA配置文件
  template: src=ca-config.json.j2 dest={{ ca_dir }}/ca-config.json
  when: result|failed

- name: 准备CA签名请求
  template: src=ca-csr.json.j2 dest={{ ca_dir }}/ca-csr.json
  when: result|failed

- name: 生成 CA 证书和私钥
  when: result|failed
  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert -initca ca-csr.json | {{ bin_dir }}/cfssljson -bare ca" 

# 创建kubectl kubeconfig文件: /root/.kube/config
- name: 准备kubectl使用的admin 证书签名请求
  template: src=admin-csr.json.j2 dest={{ ca_dir }}/admin-csr.json

- name: 创建 admin证书与私钥
  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert \
        -ca={{ ca_dir }}/ca.pem \
        -ca-key={{ ca_dir }}/ca-key.pem \
        -config={{ ca_dir }}/ca-config.json \
        -profile=kubernetes admin-csr.json | {{ bin_dir }}/cfssljson -bare admin"

- name: 设置集群参数
  shell: "{{ bin_dir }}/kubectl config set-cluster kubernetes \
        --certificate-authority={{ ca_dir }}/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }}"
- name: 设置客户端认证参数
  shell: "{{ bin_dir }}/kubectl config set-credentials admin \
        --client-certificate={{ ca_dir }}/admin.pem \
        --embed-certs=true \
        --client-key={{ ca_dir }}/admin-key.pem"
- name: 设置上下文参数
  shell: "{{ bin_dir }}/kubectl config set-context kubernetes \
        --cluster=kubernetes --user=admin"
- name: 选择默认上下文
  shell: "{{ bin_dir }}/kubectl config use-context kubernetes"

#创建bootstrap.kubeconfig配置文件: /root/bootstrap.kubeconfig
- name: 设置集群参数
  shell: "{{ bin_dir }}/kubectl config set-cluster kubernetes \
        --certificate-authority={{ ca_dir }}/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }} \
        --kubeconfig=bootstrap.kubeconfig"
- name: 设置客户端认证参数
  shell: "{{ bin_dir }}/kubectl config set-credentials kubelet-bootstrap \
        --token={{ BOOTSTRAP_TOKEN }} \
        --kubeconfig=bootstrap.kubeconfig"
- name: 设置上下文参数
  shell: "{{ bin_dir }}/kubectl config set-context default \
        --cluster=kubernetes \
        --user=kubelet-bootstrap \
        --kubeconfig=bootstrap.kubeconfig"
- name: 选择默认上下文
  shell: "{{ bin_dir }}/kubectl config use-context default --kubeconfig=bootstrap.kubeconfig"

- name: 移动 bootstrap.kubeconfig
  shell: "mv /root/bootstrap.kubeconfig /etc/kubernetes/"

#创建kube-proxy.kubeconfig配置文件: /root/kube-proxy.kubeconfig
- name: 准备kube-proxy 证书签名请求
  template: src=kube-proxy-csr.json.j2 dest={{ ca_dir }}/kube-proxy-csr.json

- name: 创建 kube-proxy证书与私钥
  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert \
        -ca={{ ca_dir }}/ca.pem \
        -ca-key={{ ca_dir }}/ca-key.pem \
        -config={{ ca_dir }}/ca-config.json \
        -profile=kubernetes kube-proxy-csr.json | {{ bin_dir }}/cfssljson -bare kube-proxy"

- name: 设置集群参数
  shell: "{{ bin_dir }}/kubectl config set-cluster kubernetes \
        --certificate-authority={{ ca_dir }}/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }} \
        --kubeconfig=kube-proxy.kubeconfig"
- name: 设置客户端认证参数
  shell: "{{ bin_dir }}/kubectl config set-credentials kube-proxy \
        --client-certificate={{ ca_dir }}/kube-proxy.pem \
        --client-key={{ ca_dir }}/kube-proxy-key.pem \
        --embed-certs=true \
        --kubeconfig=kube-proxy.kubeconfig"
- name: 设置上下文参数
  shell: "{{ bin_dir }}/kubectl config set-context default \
        --cluster=kubernetes \
        --user=kube-proxy \
        --kubeconfig=kube-proxy.kubeconfig"
- name: 选择默认上下文
  shell: "{{ bin_dir }}/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig"

- name: 移动 kube-proxy.kubeconfig
  shell: "mv /root/kube-proxy.kubeconfig /etc/kubernetes/"

# kubedns.yaml文件中部分参数根据hosts文件设置而定，因此需要用template模块替换参数
- name: 准备 kubedns的部署文件 kubedns.yaml
  template: src=kubedns.yaml.j2 dest={{ base_dir }}/manifests/kubedns/kubedns.yaml