fix create kubelet cert

ezctl

@@ -106,7 +106,7 @@ function help-info() {
 
 function new() {
     # check if already existed
-    [[ -d "clusters/$1" ]] && { logger error "cluster: $1 already existed"; exit 1; }
+    [[ -d "clusters/$1" ]] && { logger error "cluster:$1 already existed, if cluster:$1 setup failed, try 'rm -rf clusters/$1' first!"; exit 1; }
 
     logger debug "generate custom cluster files in clusters/$1"
     mkdir -p "clusters/$1"
@@ -383,7 +383,7 @@ function main() {
   readlink /proc/$$/exe|grep -q "dash" && { logger error "you should use bash shell only"; exit 1; }
 
   # check 'ansible' executable
-  which ansible > /dev/null 2>&1 || { logger error "need 'ansible', try: 'pip install ansible==2.6.18'"; exit 1; }
+  which ansible > /dev/null 2>&1 || { logger error "need 'ansible', try: 'pip install ansible==2.6.18'"; usage; exit 1; }
   
   [ "$#" -gt 0 ] || { usage >&2; exit 2; }
   

roles/kube-node/tasks/create-kubelet-kubeconfig.yml

@@ -1,21 +1,19 @@
-- name: 准备kubelet 证书签名请求
+- name: 分发证书相关
-  template: src=kubelet-csr.json.j2 dest={{ cluster_dir }}/ssl/kubelet-csr.json
-  connection: local
-
-- name: 创建 kubelet 证书与私钥
-  shell: "cd {{ cluster_dir }}/ssl && {{ base_dir }}/bin/cfssl gencert \
-        -ca=ca.pem \
-        -ca-key=ca-key.pem \
-        -config=ca-config.json \
-        -profile=kubernetes kubelet-csr.json | {{ base_dir }}/bin/cfssljson -bare kubelet"
-  connection: local
-
-- name: 分发kubelet证书相关
   copy: src={{ cluster_dir }}/ssl/{{ item }} dest={{ ca_dir }}/{{ item }}
   with_items:
   - ca.pem
-  - kubelet.pem
+  - ca-key.pem
-  - kubelet-key.pem
+  - ca-config.json
+
+- name: 准备kubelet 证书签名请求
+  template: src=kubelet-csr.json.j2 dest={{ ca_dir }}/kubelet-csr.json
+
+- name: 创建 kubelet 证书与私钥
+  shell: "cd {{ ca_dir }} && {{ bin_dir }}/cfssl gencert \
+        -ca={{ ca_dir }}/ca.pem \
+        -ca-key={{ ca_dir }}/ca-key.pem \
+        -config={{ ca_dir }}/ca-config.json \
+        -profile=kubernetes kubelet-csr.json | {{ bin_dir }}/cfssljson -bare kubelet"
 
 # 创建kubelet.kubeconfig
 - name: 设置集群参数
@@ -23,21 +21,21 @@
         --certificate-authority={{ ca_dir }}/ca.pem \
         --embed-certs=true \
         --server={{ KUBE_APISERVER }} \
-   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
+        --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
 
 - name: 设置客户端认证参数
   shell: "{{ bin_dir }}/kubectl config set-credentials system:node:{{ inventory_hostname }} \
         --client-certificate={{ ca_dir }}/kubelet.pem \
         --embed-certs=true \
         --client-key={{ ca_dir }}/kubelet-key.pem \
-   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
+        --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
 
 - name: 设置上下文参数
   shell: "{{ bin_dir }}/kubectl config set-context default \
         --cluster=kubernetes \
-   --user=system:node:{{ inventory_hostname }} \
+        --user=system:node:{{ inventory_hostname }} \
-   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
+        --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
 
 - name: 选择默认上下文
   shell: "{{ bin_dir }}/kubectl config use-context default \
-   --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"
+        --kubeconfig=/etc/kubernetes/kubelet.kubeconfig"

roles/kube-node/templates/kubelet-csr.json.j2

@@ -1,10 +1,8 @@
 {
   "CN": "system:node:{{ inventory_hostname }}",
   "hosts": [
-{% for host in groups['kube-node'] %}
+    "127.0.0.1",
-    "{{ host }}",
+    "{{ inventory_hostname }}"
-{% endfor %}
-    "127.0.0.1"
   ],
   "key": {
     "algo": "rsa",