- block:
    - name: 准备kubelet 证书签名请求
      template: src=kubelet-csr.json.j2 dest={{ cluster_dir }}/ssl/{{ K8S_NODENAME }}-kubelet-csr.json

    - name: 创建 kubelet 证书与私钥
      shell: "cd {{ cluster_dir }}/ssl && {{ base_dir }}/bin/cfssl gencert \
            -ca=ca.pem \
            -ca-key=ca-key.pem \
            -config=ca-config.json \
            -profile=kubernetes {{ K8S_NODENAME }}-kubelet-csr.json | {{ base_dir }}/bin/cfssljson -bare {{ K8S_NODENAME }}-kubelet"

    - name: 设置集群参数
      shell: "{{ base_dir }}/bin/kubectl config set-cluster kubernetes \
            --certificate-authority={{ cluster_dir }}/ssl/ca.pem \
            --embed-certs=true \
            --server={{ KUBE_APISERVER }} \
            --kubeconfig={{ cluster_dir }}/{{ K8S_NODENAME }}-kubelet.kubeconfig"

    - name: 设置客户端认证参数
      shell: "{{ base_dir }}/bin/kubectl config set-credentials system:node:{{ K8S_NODENAME }} \
            --client-certificate={{ cluster_dir }}/ssl/{{ K8S_NODENAME }}-kubelet.pem \
            --embed-certs=true \
            --client-key={{ cluster_dir }}/ssl/{{ K8S_NODENAME }}-kubelet-key.pem \
            --kubeconfig={{ cluster_dir }}/{{ K8S_NODENAME }}-kubelet.kubeconfig"

    - name: 设置上下文参数
      shell: "{{ base_dir }}/bin/kubectl config set-context default \
            --cluster=kubernetes \
            --user=system:node:{{ K8S_NODENAME }} \
            --kubeconfig={{ cluster_dir }}/{{ K8S_NODENAME }}-kubelet.kubeconfig"

    - name: 选择默认上下文
      shell: "{{ base_dir }}/bin/kubectl config use-context default \
            --kubeconfig={{ cluster_dir }}/{{ K8S_NODENAME }}-kubelet.kubeconfig"
  connection: local

- name: 分发ca 证书
  copy: src={{ cluster_dir }}/ssl/ca.pem dest={{ ca_dir }}/ca.pem

- name: 分发kubelet 证书
  copy: src={{ cluster_dir }}/ssl/{{ K8S_NODENAME }}-{{ item }} dest={{ ca_dir }}/{{ item }}
  with_items:
  - kubelet.pem
  - kubelet-key.pem

- name: 分发kubeconfig
  copy: src={{ cluster_dir }}/{{ K8S_NODENAME }}-kubelet.kubeconfig dest=/etc/kubernetes/kubelet.kubeconfig