- block:
    - name: 在deploy 节点创建cilium 相关目录
      file: name={{ item }} state=directory
      with_items:
      - /etc/cilium/ssl
      - /opt/kube/kube-system/cilium

    - name: 创建cilium 证书请求
      template: src=cilium-csr.json.j2 dest=/etc/cilium/ssl/cilium-csr.json
    
    - name: 创建 cilium证书和私钥
      shell: "cd /etc/cilium/ssl && {{ bin_dir }}/cfssl gencert \
            -ca={{ ca_dir }}/ca.pem \
            -ca-key={{ ca_dir }}/ca-key.pem \
            -config={{ ca_dir }}/ca-config.json \
            -profile=kubernetes cilium-csr.json | {{ bin_dir }}/cfssljson -bare cilium"
    
    - name: get cilium-etcd-secrets info
      shell: "{{ bin_dir }}/kubectl get secrets -n kube-system"
      register: secrets_info
    
    - name: 创建 cilium-etcd-secrets
      shell: "cd /etc/cilium/ssl && \
    	{{ bin_dir }}/kubectl create secret generic -n kube-system cilium-etcd-secrets \
    	--from-file=etcd-ca={{ ca_dir }}/ca.pem \
    	--from-file=etcd-client-key=cilium-key.pem \
    	--from-file=etcd-client-crt=cilium.pem"
      when: '"cilium-etcd-secrets" not in secrets_info.stdout'
    
    - name: 配置 cilium DaemonSet yaml文件
      template: src=cilium.yaml.j2 dest=/opt/kube/kube-system/cilium/cilium.yaml
      tags: reconf  
  delegate_to: "{{ groups.deploy[0] }}"
  run_once: true
    
- name: 检查是否已下载离线cilium镜像
  command: "ls {{ base_dir }}/down"
  register: download_info
  connection: local
  run_once: true

- name: node 节点创建cilium 相关目录
  file: name={{ item }} state=directory
  with_items:
  - /etc/cilium/ssl
  - /etc/cni/net.d
  - /var/run/cilium
  - /opt/kube/images 

- name: Optional-Mount BPF FS
  mount:
    fstype: "bpf"
    src: "bpffs"
    path: "/sys/fs/bpf"
    state: "mounted" 

# 【可选】推送离线docker 镜像，可以忽略执行错误
- name: 尝试推送离线docker 镜像（若执行失败，可忽略）
  copy: src={{ base_dir }}/down/{{ item }} dest=/opt/kube/images/{{ item }}
  when: 'item in download_info.stdout'
  with_items:
  - "pause_3.1.tar"
  - "{{ cilium_offline }}"
  - "{{ busybox_offline }}"
  ignore_errors: true

- name: 获取cilium离线镜像推送情况
  command: "ls /opt/kube/images"
  register: image_info

# 如果目录下有离线镜像，就把它导入到node节点上
- name: 导入 cilium的离线镜像（若执行失败，可忽略）
  shell: "{{ bin_dir }}/docker load -i /opt/kube/images/{{ item }}"
  when: 'item in image_info.stdout'
  with_items:
  - "pause_3.1.tar"
  - "{{ cilium_offline }}"
  - "{{ busybox_offline }}"
  ignore_errors: true

# 只需单节点执行一次
- name: 运行 cilium网络
  shell: "{{ bin_dir }}/kubectl apply -f /opt/kube/kube-system/cilium/ && sleep 5"
  delegate_to: "{{ groups.deploy[0] }}"
  run_once: true

# 删除原有cni配置
- name: 删除默认cni配置
  file: path=/etc/cni/net.d/10-default.conf state=absent

# 等待网络插件部署成功，视下载镜像速度而定
- name: 轮询等待cilium-node 运行，视下载镜像速度而定
  shell: "{{ bin_dir }}/kubectl get pod -n kube-system -o wide|grep 'cilium'|grep ' {{ inventory_hostname }} '|awk '{print $3}'"
  register: pod_status
  until: pod_status.stdout == "Running"
  delegate_to: "{{ groups.deploy[0] }}"
  retries: 15
  delay: 8