调整prepare tasks，避免把证书和kubeconfig分发到不需要的节点

roles/deploy/tasks/main.yml

@@ -97,6 +97,9 @@
   shell: "mv /root/kube-proxy.kubeconfig /etc/kubernetes/"
 
 # --- 以下为兼容ansible执行节点与deploy节点分离情况-------
+- name: 安装 rsync
+  package: name=rsync state=present
+
 - name: 复制 manifests至 deploy节点
   #copy: src={{ base_dir }}/manifests dest={{ base_dir }}
   synchronize: src={{ base_dir }}/manifests dest={{ base_dir }}

roles/etcd/tasks/main.yml

@@ -1,3 +1,11 @@
+- name: prepare some dirs
+  file: name={{ item }} state=directory
+  with_items:
+  - "{{ bin_dir }}"
+  - "{{ ca_dir }}"
+  - "/etc/etcd/ssl"    # etcd 证书目录
+  - "/var/lib/etcd"    # etcd 工作目录
+
 - name: 下载etcd二进制文件
   copy: src={{ base_dir }}/bin/{{ item }} dest={{ bin_dir }}/{{ item }} mode=0755
   with_items:
@@ -5,8 +13,14 @@
   - etcdctl
   tags: upgrade_etcd
 
-- name: 创建etcd证书目录
+- name: 分发证书相关
-  file: name=/etc/etcd/ssl state=directory
+  synchronize: src={{ ca_dir }}/{{ item }} dest={{ ca_dir }}/{{ item }}
+  with_items:
+  - ca.pem
+  - ca-key.pem
+  - ca.csr
+  - ca-config.json
+  delegate_to: "{{ groups.deploy[0] }}"
 
 # 注册变量p，根据p的stat信息判断是否已经生成过etcd证书，如果没有，下一步生成证书
 # 如果已经有etcd证书，为了保证整个安装的幂等性，跳过证书生成的步骤
@@ -26,9 +40,6 @@
         -config={{ ca_dir }}/ca-config.json \
         -profile=kubernetes etcd-csr.json | {{ bin_dir }}/cfssljson -bare etcd"
 
-- name: 创建etcd工作目录
-  file: name=/var/lib/etcd state=directory
-
 - name: 创建etcd的systemd unit文件
   template: src=etcd.service.j2 dest=/etc/systemd/system/etcd.service
   tags: upgrade_etcd

roles/kube-master/tasks/main.yml

@@ -6,6 +6,17 @@
   - kube-scheduler
   tags: upgrade_k8s
 
+- name: 分发证书相关
+  synchronize: src={{ ca_dir }}/{{ item }} dest={{ ca_dir }}/{{ item }}
+  with_items:
+  - admin.pem
+  - admin-key.pem
+  - ca.pem
+  - ca-key.pem
+  - ca.csr
+  - ca-config.json
+  delegate_to: "{{ groups.deploy[0] }}"
+
 - name: 创建 kubernetes 证书签名请求
   template: src=kubernetes-csr.json.j2 dest={{ ca_dir }}/kubernetes-csr.json
   tags: change_cert

roles/kube-node/tasks/main.yml

@@ -5,10 +5,12 @@
   - /var/lib/kubelet
   - /var/lib/kube-proxy
   - /etc/cni/net.d
+  - /root/.kube
 
 - name: 下载 kubelet,kube-proxy 二进制和基础 cni plugins
   copy: src={{ base_dir }}/bin/{{ item }} dest={{ bin_dir }}/{{ item }} mode=0755
   with_items:
+  - kubectl
   - kubelet
   - kube-proxy
   - bridge
@@ -16,6 +18,26 @@
   - loopback
   tags: upgrade_k8s
 
+- name: 分发 kubeconfig配置文件
+  synchronize: src=/root/.kube/config dest=/root/.kube/config
+  delegate_to: "{{ groups.deploy[0] }}"
+
+- name: 添加 kubectl 命令自动补全
+  lineinfile:
+    dest: ~/.bashrc
+    state: present
+    regexp: 'kubectl completion'
+    line: 'source <(kubectl completion bash)'
+
+- name: 分发证书相关
+  synchronize: src={{ ca_dir }}/{{ item }} dest={{ ca_dir }}/{{ item }}
+  with_items:
+  - ca.pem
+  - ca-key.pem
+  - ca.csr
+  - ca-config.json
+  delegate_to: "{{ groups.deploy[0] }}"
+
 ##----------kubelet 配置部分--------------
 - name: 准备kubelet 证书签名请求
   template: src=kubelet-csr.json.j2 dest={{ ca_dir }}/kubelet-csr.json

roles/prepare/tasks/main.yml

@@ -13,7 +13,6 @@
   with_items:
   - "{{ bin_dir }}"
   - "{{ ca_dir }}"
-  - /root/.kube
 
 - name: 分发证书工具 CFSSL
   copy: src={{ base_dir }}/bin/{{ item }} dest={{ bin_dir }}/{{ item }} mode=0755
@@ -22,35 +21,9 @@
   - cfssl-certinfo
   - cfssljson
 
-- name: 分发 kubectl
-  copy: src={{ base_dir }}/bin/kubectl dest={{ bin_dir }}/kubectl mode=0755
-  tags: upgrade_k8s
-
-- name: 分发 kubeconfig配置文件
-  synchronize: src=/root/.kube/config dest=/root/.kube/config
-  delegate_to: "{{ groups.deploy[0] }}"
-
-- name: 分发证书相关
-  synchronize: src={{ ca_dir }}/{{ item }} dest={{ ca_dir }}/{{ item }}
-  with_items:
-  - admin.pem
-  - admin-key.pem
-  - ca.pem
-  - ca-key.pem
-  - ca.csr
-  - ca-config.json
-  delegate_to: "{{ groups.deploy[0] }}"
-
 - name: 写入环境变量$PATH 
   lineinfile:
     dest: ~/.bashrc
     state: present
     regexp: 'kubeasz'
     line: 'export PATH={{ bin_dir }}:$PATH # generated by kubeasz'
-
-- name: 添加 kubectl 命令自动补全
-  lineinfile:
-    dest: ~/.bashrc
-    state: present
-    regexp: 'kubectl completion'
-    line: 'source <(kubectl completion bash)'