update

kubespray/extra_playbooks/roles/kubernetes/tokens/files/kube-gen-token.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Copyright 2015 The Kubernetes Authors All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+token_dir=${TOKEN_DIR:-/var/srv/kubernetes}
+token_file="${token_dir}/known_tokens.csv"
+
+create_accounts=($@)
+
+if [ ! -e "${token_file}" ]; then
+  touch "${token_file}"
+fi
+
+for account in "${create_accounts[@]}"; do
+  if grep ",${account}," "${token_file}" ; then
+    continue
+  fi
+  token=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
+  echo "${token},${account},${account}" >> "${token_file}"
+  echo "${token}" > "${token_dir}/${account}.token"
+  echo "Added ${account}"
+done

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/check-tokens.yml

@@ -0,0 +1,41 @@
+---
+- name: "Check_tokens | check if the tokens have already been generated on first master"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+    get_attributes: no
+    get_checksum: yes
+    get_mime: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  register: known_tokens_master
+  run_once: true
+
+- name: "Check_tokens | Set default value for 'sync_tokens' and 'gen_tokens' to false"
+  set_fact:
+    sync_tokens: false
+    gen_tokens: false
+
+- name: "Check_tokens | Set 'sync_tokens' and 'gen_tokens' to true"
+  set_fact:
+    gen_tokens: true
+  when: not known_tokens_master.stat.exists and kube_token_auth|default(true)
+  run_once: true
+
+- name: "Check tokens | check if a cert already exists"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+    get_attributes: no
+    get_checksum: yes
+    get_mime: no
+  register: known_tokens
+
+- name: "Check_tokens | Set 'sync_tokens' to true"
+  set_fact:
+    sync_tokens: >-
+      {%- set tokens = {'sync': False} -%}
+      {%- for server in groups['kube_control_plane'] | intersect(ansible_play_batch)
+        if (not hostvars[server].known_tokens.stat.exists) or
+        (hostvars[server].known_tokens.stat.checksum|default('') != known_tokens_master.stat.checksum|default('')) -%}
+        {%- set _ = tokens.update({'sync': True}) -%}
+      {%- endfor -%}
+      {{ tokens.sync }}
+  run_once: true

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/gen_tokens.yml

@@ -0,0 +1,64 @@
+---
+- name: Gen_tokens | copy tokens generation script
+  copy:
+    src: "kube-gen-token.sh"
+    dest: "{{ kube_script_dir }}/kube-gen-token.sh"
+    mode: 0700
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | generate tokens for master components
+  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
+  environment:
+    TOKEN_DIR: "{{ kube_token_dir }}"
+  with_nested:
+    - [ "system:kubectl" ]
+    - "{{ groups['kube_control_plane'] }}"
+  register: gentoken_master
+  changed_when: "'Added' in gentoken_master.stdout"
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | generate tokens for node components
+  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
+  environment:
+    TOKEN_DIR: "{{ kube_token_dir }}"
+  with_nested:
+    - [ 'system:kubelet' ]
+    - "{{ groups['kube_node'] }}"
+  register: gentoken_node
+  changed_when: "'Added' in gentoken_node.stdout"
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | Get list of tokens from first master
+  command: "find {{ kube_token_dir }} -maxdepth 1 -type f"
+  register: tokens_list
+  check_mode: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  run_once: true
+  when: sync_tokens|default(false)
+
+- name: Gen_tokens | Gather tokens
+  shell: "set -o pipefail && tar cfz - {{ tokens_list.stdout_lines | join(' ') }} | base64 --wrap=0"
+  args:
+    warn: false
+    executable: /bin/bash
+  register: tokens_data
+  check_mode: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  run_once: true
+  when: sync_tokens|default(false)
+
+- name: Gen_tokens | Copy tokens on masters
+  shell: "set -o pipefail && echo '{{ tokens_data.stdout|quote }}' | base64 -d | tar xz -C /"
+  args:
+    executable: /bin/bash
+  when:
+    - inventory_hostname in groups['kube_control_plane']
+    - sync_tokens|default(false)
+    - inventory_hostname != groups['kube_control_plane'][0]
+    - tokens_data.stdout

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+
+- import_tasks: check-tokens.yml
+  tags:
+    - k8s-secrets
+    - k8s-gen-tokens
+    - facts
+
+- name: Make sure the tokens directory exits
+  file:
+    path: "{{ kube_token_dir }}"
+    state: directory
+    mode: 0644
+    group: "{{ kube_cert_group }}"
+
+- import_tasks: gen_tokens.yml
+  tags:
+    - k8s-secrets
+    - k8s-gen-tokens