Revert "Support for disabling apiserver insecure port" (#1974)

inventory/group_vars/k8s-cluster.yml

@@ -20,7 +20,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 # This is where to save basic auth file
 kube_users_dir: "{{ kube_config_dir }}/users"
 
-kube_api_anonymous_auth: true
+kube_api_anonymous_auth: false
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
 kube_version: v1.8.2
@@ -106,8 +106,6 @@ kube_network_node_prefix: 24
 kube_apiserver_ip: "{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"
 kube_apiserver_port: 6443 # (https)
 kube_apiserver_insecure_port: 8080 # (http)
-# Set to 0 to disable insecure port - Requires RBAC in authorization_modes and kube_api_anonymous_auth: true
-#kube_apiserver_insecure_port: 0 # (disabled)
 
 # DNS configuration.
 # Kubernetes cluster name, also will be used as DNS domain

roles/kubernetes-apps/ansible/tasks/main.yml

@@ -1,10 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ kube_apiserver_insecure_endpoint }}/healthz"
-    validate_certs: no
-    client_cert: "{{ kube_cert_dir }}/apiserver.pem"
-    client_key: "{{ kube_cert_dir }}/apiserver-key.pem"
   register: result
   until: result.status == 200
   retries: 10

roles/kubernetes-apps/cluster_roles/tasks/main.yml

@@ -1,10 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ kube_apiserver_insecure_endpoint }}/healthz"
-    validate_certs: no
-    client_cert: "{{ kube_cert_dir }}/apiserver.pem"
-    client_key: "{{ kube_cert_dir }}/apiserver-key.pem"
   register: result
   until: result.status == 200
   retries: 10

roles/kubernetes/master/handlers/main.yml

@@ -66,10 +66,7 @@
 
 - name: Master | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ kube_apiserver_insecure_endpoint }}/healthz"
-    validate_certs: no
-    client_cert: "{{ kube_cert_dir }}/apiserver.pem"
-    client_key: "{{ kube_cert_dir }}/apiserver-key.pem"
   register: result
   until: result.status == 200
   retries: 20

roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2

@@ -110,17 +110,9 @@ spec:
       httpGet:
         host: 127.0.0.1
         path: /healthz
-{% if kube_apiserver_insecure_port == 0 %}
-        port: {{ kube_apiserver_port }}
-        scheme: HTTPS
-{% else %}
         port: {{ kube_apiserver_insecure_port }}
-{% endif %}
+      initialDelaySeconds: 30
-      failureThreshold: 8
+      timeoutSeconds: 10
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      successThreshold: 1
-      timeoutSeconds: 15
     volumeMounts:
     - mountPath: {{ kube_config_dir }}
       name: kubernetes-config

roles/kubernetes/preinstall/tasks/verify-settings.yml

@@ -78,9 +78,3 @@
     that: ansible_swaptotal_mb == 0
   when: kubelet_fail_swap_on|default(true)
   ignore_errors: "{{ ignore_assert_errors }}"
-
-- name: Stop if RBAC and anonymous-auth are not enabled when insecure port is disabled
-  assert:
-    that: rbac_enabled and kube_api_anonymous_auth
-  when: kube_apiserver_insecure_port == 0
-  ignore_errors: "{{ ignore_assert_errors }}"