调整安装步骤中kubectl的执行以适合公有云部署2

roles/calico/tasks/main.yml

@@ -1,48 +1,51 @@
-- name: 创建calico 相关目录
+- block:
+    - name: 在deploy 节点创建相关目录
+      file: name={{ item }} state=directory
+      with_items:
+      - /etc/calico/ssl
+      - /opt/kube/kube-system/calico
+
+    - name: 创建calico 证书请求
+      template: src=calico-csr.json.j2 dest=/etc/calico/ssl/calico-csr.json
+    
+    - name: 创建 calico证书和私钥
+      shell: "cd /etc/calico/ssl && {{ bin_dir }}/cfssl gencert \
+            -ca={{ ca_dir }}/ca.pem \
+            -ca-key={{ ca_dir }}/ca-key.pem \
+            -config={{ ca_dir }}/ca-config.json \
+            -profile=kubernetes calico-csr.json | {{ bin_dir }}/cfssljson -bare calico"
+    
+    - name: get calico-etcd-secrets info
+      shell: "{{ bin_dir }}/kubectl get secrets -n kube-system"
+      register: secrets_info
+    
+    - name: 创建 calico-etcd-secrets
+      shell: "cd /etc/calico/ssl && \
+            {{ bin_dir }}/kubectl create secret generic -n kube-system calico-etcd-secrets \
+            --from-file=etcd-ca={{ ca_dir }}/ca.pem \
+            --from-file=etcd-key=calico-key.pem \
+            --from-file=etcd-cert=calico.pem"
+      when: '"calico-etcd-secrets" not in secrets_info.stdout'
+    
+    - name: 配置 calico DaemonSet yaml文件
+      template: src=calico.yaml.j2 dest=/opt/kube/kube-system/calico/calico.yaml
+    
+    - name: 配置 calico rbac
+      template: src=calico-rbac.yaml.j2 dest=/opt/kube/kube-system/calico/calico-rbac.yaml
+    
+    - name: 检查是否已下载离线calico镜像
+      command: "ls {{ base_dir }}/down"
+      register: download_info
+  delegate_to: "{{ groups.deploy[0] }}"
+  run_once: true
+
+- name: node 节点创建calico 相关目录
   file: name={{ item }} state=directory
   with_items:
   - /etc/calico/ssl
   - /etc/cni/net.d
-  - /opt/kube/kube-system/calico
   - /opt/kube/images 
 
-- name: 创建calico 证书请求
-  template: src=calico-csr.json.j2 dest=/etc/calico/ssl/calico-csr.json
-
-- name: 创建 calico证书和私钥
-  shell: "cd /etc/calico/ssl && {{ bin_dir }}/cfssl gencert \
-        -ca={{ ca_dir }}/ca.pem \
-        -ca-key={{ ca_dir }}/ca-key.pem \
-        -config={{ ca_dir }}/ca-config.json \
-        -profile=kubernetes calico-csr.json | {{ bin_dir }}/cfssljson -bare calico"
-
-- name: get calico-etcd-secrets info
-  shell: "{{ bin_dir }}/kubectl get secrets -n kube-system"
-  register: secrets_info
-  run_once: true
-
-- name: 创建 calico-etcd-secrets
-  shell: "cd /etc/calico/ssl && \
-        {{ bin_dir }}/kubectl create secret generic -n kube-system calico-etcd-secrets \
-        --from-file=etcd-ca={{ ca_dir }}/ca.pem \
-        --from-file=etcd-key=calico-key.pem \
-        --from-file=etcd-cert=calico.pem"
-  when: '"calico-etcd-secrets" not in secrets_info.stdout'
-  ignore_errors: true
-  run_once: true
-
-- name: 配置 calico DaemonSet yaml文件
-  template: src=calico.yaml.j2 dest=/opt/kube/kube-system/calico/calico.yaml
-
-- name: 配置 calico rbac
-  template: src=calico-rbac.yaml.j2 dest=/opt/kube/kube-system/calico/calico-rbac.yaml
-
-- name: 检查是否已下载离线calico镜像
-  command: "ls {{ base_dir }}/down"
-  register: download_info
-  delegate_to: "{{ groups.deploy[0] }}"
-  run_once: true
-
 # 【可选】推送离线docker 镜像，可以忽略执行错误
 - name: 尝试推送离线docker 镜像（若执行失败，可忽略）
   copy: src={{ base_dir }}/down/{{ item }} dest=/opt/kube/images/{{ item }}
@@ -68,6 +71,7 @@
 # 只需单节点执行一次
 - name: 运行 calico网络
   shell: "{{ bin_dir }}/kubectl apply -f /opt/kube/kube-system/calico/ && sleep 5"
+  delegate_to: "{{ groups.deploy[0] }}"
   run_once: true
 
 # 删除原有cni配置
@@ -83,6 +87,13 @@
   #- loopback
   - calicoctl
 
+- name: 分发 calico 证书
+  synchronize: src=/etc/calico/ssl/{{ item }} dest=/etc/calico/ssl/{{ item }}
+  with_items:
+  - calico.pem
+  - calico-key.pem
+  delegate_to: "{{ groups.deploy[0] }}"
+
 - name: 准备 calicoctl配置文件
   template: src=calicoctl.cfg.j2 dest=/etc/calico/calicoctl.cfg
 
@@ -91,6 +102,6 @@
   shell: "{{ bin_dir }}/kubectl get pod -n kube-system -o wide|grep 'calico-node'|grep ' {{ inventory_hostname }} '|awk '{print $3}'"
   register: pod_status
   until: pod_status.stdout == "Running"
+  delegate_to: "{{ groups.deploy[0] }}"
   retries: 15
   delay: 8
-

roles/cluster-addon/tasks/main.yml

@@ -1,24 +1,24 @@
-- name: 创建相关目录
-  file: path={{ item }} state=directory
-  with_items:
-  - /opt/kube/kube-system/kubedns
-  - /opt/kube/kube-system/coredns
-
-# DNS文件中部分参数根据hosts文件设置而定，因此需要用template模块替换参数
-- name: 准备 DNS的部署文件
-  template: src={{ item }}.yaml.j2 dest=/opt/kube/kube-system/{{ item }}/{{ item }}.yaml
-  with_items:
-  - kubedns
-  - coredns
-
-- name: 获取所有已经创建的POD信息
-  command: "{{ bin_dir }}/kubectl get pod -n kube-system"
-  register: pod_info
-  run_once: true
-
-- name: 获取已下载离线镜像信息
-  command: "ls {{ base_dir }}/down"
-  register: download_info
+- block:
+    - name: 在deploy 节点创建相关目录
+      file: path={{ item }} state=directory
+      with_items:
+      - /opt/kube/kube-system/kubedns
+      - /opt/kube/kube-system/coredns
+    
+    # DNS文件中部分参数根据hosts文件设置而定，因此需要用template模块替换参数
+    - name: 准备 DNS的部署文件
+      template: src={{ item }}.yaml.j2 dest=/opt/kube/kube-system/{{ item }}/{{ item }}.yaml
+      with_items:
+      - kubedns
+      - coredns
+    
+    - name: 获取所有已经创建的POD信息
+      command: "{{ bin_dir }}/kubectl get pod -n kube-system"
+      register: pod_info
+    
+    - name: 获取已下载离线镜像信息
+      command: "ls {{ base_dir }}/down"
+      register: download_info
   delegate_to: "{{ groups.deploy[0] }}"
   run_once: true
 
@@ -38,6 +38,7 @@
     - name: 创建{{ dns_backend }}部署
       shell: "{{ bin_dir }}/kubectl apply -f /opt/kube/kube-system/{{ dns_backend }}"
       run_once: true
+      delegate_to: "{{ groups.deploy[0] }}"
   when: 
   - '"kube-dns" not in pod_info.stdout'
   - '"coredns" not in pod_info.stdout'