update

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/check-tokens.yml

@@ -0,0 +1,41 @@
+---
+- name: "Check_tokens | check if the tokens have already been generated on first master"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+    get_attributes: no
+    get_checksum: yes
+    get_mime: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  register: known_tokens_master
+  run_once: true
+
+- name: "Check_tokens | Set default value for 'sync_tokens' and 'gen_tokens' to false"
+  set_fact:
+    sync_tokens: false
+    gen_tokens: false
+
+- name: "Check_tokens | Set 'sync_tokens' and 'gen_tokens' to true"
+  set_fact:
+    gen_tokens: true
+  when: not known_tokens_master.stat.exists and kube_token_auth|default(true)
+  run_once: true
+
+- name: "Check tokens | check if a cert already exists"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+    get_attributes: no
+    get_checksum: yes
+    get_mime: no
+  register: known_tokens
+
+- name: "Check_tokens | Set 'sync_tokens' to true"
+  set_fact:
+    sync_tokens: >-
+      {%- set tokens = {'sync': False} -%}
+      {%- for server in groups['kube_control_plane'] | intersect(ansible_play_batch)
+        if (not hostvars[server].known_tokens.stat.exists) or
+        (hostvars[server].known_tokens.stat.checksum|default('') != known_tokens_master.stat.checksum|default('')) -%}
+        {%- set _ = tokens.update({'sync': True}) -%}
+      {%- endfor -%}
+      {{ tokens.sync }}
+  run_once: true

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/gen_tokens.yml

@@ -0,0 +1,64 @@
+---
+- name: Gen_tokens | copy tokens generation script
+  copy:
+    src: "kube-gen-token.sh"
+    dest: "{{ kube_script_dir }}/kube-gen-token.sh"
+    mode: 0700
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | generate tokens for master components
+  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
+  environment:
+    TOKEN_DIR: "{{ kube_token_dir }}"
+  with_nested:
+    - [ "system:kubectl" ]
+    - "{{ groups['kube_control_plane'] }}"
+  register: gentoken_master
+  changed_when: "'Added' in gentoken_master.stdout"
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | generate tokens for node components
+  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
+  environment:
+    TOKEN_DIR: "{{ kube_token_dir }}"
+  with_nested:
+    - [ 'system:kubelet' ]
+    - "{{ groups['kube_node'] }}"
+  register: gentoken_node
+  changed_when: "'Added' in gentoken_node.stdout"
+  run_once: yes
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  when: gen_tokens|default(false)
+
+- name: Gen_tokens | Get list of tokens from first master
+  command: "find {{ kube_token_dir }} -maxdepth 1 -type f"
+  register: tokens_list
+  check_mode: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  run_once: true
+  when: sync_tokens|default(false)
+
+- name: Gen_tokens | Gather tokens
+  shell: "set -o pipefail && tar cfz - {{ tokens_list.stdout_lines | join(' ') }} | base64 --wrap=0"
+  args:
+    warn: false
+    executable: /bin/bash
+  register: tokens_data
+  check_mode: no
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  run_once: true
+  when: sync_tokens|default(false)
+
+- name: Gen_tokens | Copy tokens on masters
+  shell: "set -o pipefail && echo '{{ tokens_data.stdout|quote }}' | base64 -d | tar xz -C /"
+  args:
+    executable: /bin/bash
+  when:
+    - inventory_hostname in groups['kube_control_plane']
+    - sync_tokens|default(false)
+    - inventory_hostname != groups['kube_control_plane'][0]
+    - tokens_data.stdout

kubespray/extra_playbooks/roles/kubernetes/tokens/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+
+- import_tasks: check-tokens.yml
+  tags:
+    - k8s-secrets
+    - k8s-gen-tokens
+    - facts
+
+- name: Make sure the tokens directory exits
+  file:
+    path: "{{ kube_token_dir }}"
+    state: directory
+    mode: 0644
+    group: "{{ kube_cert_group }}"
+
+- import_tasks: gen_tokens.yml
+  tags:
+    - k8s-secrets
+    - k8s-gen-tokens