- name: 准备kube-controller-manager 证书签名请求
  template: src=kube-controller-manager-csr.json.j2 dest={{ cluster_dir }}/ssl/kube-controller-manager-csr.json

- name: 创建 kube-controller-manager证书与私钥
  shell: "cd {{ cluster_dir }}/ssl && {{ base_dir }}/bin/cfssl gencert \
        -ca=ca.pem \
        -ca-key=ca-key.pem \
        -config=ca-config.json \
        -profile=kubernetes kube-controller-manager-csr.json | {{ base_dir }}/bin/cfssljson -bare kube-controller-manager"

- name: 设置集群参数
  shell: "{{ base_dir }}/bin/kubectl config set-cluster kubernetes \
        --certificate-authority={{ cluster_dir }}/ssl/ca.pem \
        --embed-certs=true \
        --server={{ KUBE_APISERVER }} \
        --kubeconfig={{ cluster_dir }}/kube-controller-manager.kubeconfig"

- name: 设置认证参数
  shell: "{{ base_dir }}/bin/kubectl config set-credentials system:kube-controller-manager \
        --client-certificate={{ cluster_dir }}/ssl/kube-controller-manager.pem \
        --client-key={{ cluster_dir }}/ssl/kube-controller-manager-key.pem \
        --embed-certs=true \
        --kubeconfig={{ cluster_dir }}/kube-controller-manager.kubeconfig"

- name: 设置上下文参数
  shell: "{{ base_dir }}/bin/kubectl config set-context default \
        --cluster=kubernetes \
        --user=system:kube-controller-manager \
        --kubeconfig={{ cluster_dir }}/kube-controller-manager.kubeconfig"

- name: 选择默认上下文
  shell: "{{ base_dir }}/bin/kubectl config use-context default \
   --kubeconfig={{ cluster_dir }}/kube-controller-manager.kubeconfig"