kubeconfig.yaml

- hosts: localhost
  gather_facts: true
  vars:
    kube_proxy: "{{ lookup('env', 'KUBE_PROXY')|default(none, true) }}"
    kube_internal: "{{ true if lookup('env', 'KUBE_INTERNAL')|default(none, true) else false }}"
  tasks:
    - name: Read kube config from initializer
      delegate_to: "{{ hostvars[groups.node|first].k8s_initializer }}"
      slurp:
        src: /etc/kubernetes/admin.conf
      register: k8s_admin_conf_result

    - name: Decode kube config from initializer
      set_fact:
        k8s_admin_conf: "{{ k8s_admin_conf_result.content|b64decode|from_yaml }}"

    - name: Create kube config directory
      file:
        path: "{{ ansible_env.HOME }}/.kube"
        state: directory

    - name: Create kube config file
      copy:
        content: ""
        dest: "{{ ansible_env.HOME }}/.kube/config"
        force: false

    - name: Read kube config
      slurp:
        src: "{{ ansible_env.HOME }}/.kube/config"
      register: k8s_kube_conf_result

    - name: Generate new kube config
      vars:
        k8s_kube_conf_default:
          apiVersion: v1
          kind: Config
          preferences: {}
          current-context:
        k8s_kube_conf: "{{ k8s_kube_conf_result.content|b64decode|from_yaml|default(k8s_kube_conf_default, true) }}"
        k8s_cluster_name: "{{ hostvars[groups.node|first].k8s_cluster_name }}"
        k8s_control_plane_endpoint: "{{ hostvars[groups.node|first].k8s_control_plane_endpoint }}"
        k8s_private_control_plane_endpoint: "{{ hostvars[groups.node|first].k8s_private_control_plane_endpoint_ip }}:{{ hostvars[groups.node|first].k8s_private_control_plane_endpoint_port }}"
        k8s_kube_conf_cluster_update:
          name: "{{ k8s_cluster_name }}"
          cluster:
            server: "https://{{ k8s_private_control_plane_endpoint if kube_internal else k8s_control_plane_endpoint }}"
        k8s_kube_conf_cluster_update_if_kube_proxy:
          cluster:
            certificate-authority-data: "{{ (lookup('pipe', \"cat /etc/ssl/cert.pem 2> /dev/null || cat /etc/ssl/certs/*.pem\") + '\n' + ((k8s_admin_conf.clusters|first).cluster['certificate-authority-data']|b64decode))|b64encode }}"
            proxy-url: "{{ kube_proxy }}"
        k8s_kube_conf_user_update:
          name: "{{ k8s_cluster_name }}"
        k8s_kube_conf_context_update:
          name: "{{ k8s_cluster_name }}"
          context:
            cluster: "{{ k8s_cluster_name }}"
            user: "{{ k8s_cluster_name }}"
        k8s_kube_conf_update:
          clusters: "{{ k8s_kube_conf.clusters|default([]) + [k8s_admin_conf.clusters|first|combine(k8s_kube_conf_cluster_update, k8s_kube_conf_cluster_update_if_kube_proxy if kube_proxy else {}, recursive=true)] }}"
          users: "{{ k8s_kube_conf.clusters|default([]) + [k8s_admin_conf.users|first|combine(k8s_kube_conf_user_update, recursive=true)] }}"
          contexts: "{{ k8s_kube_conf.clusters|default([]) + [k8s_admin_conf.contexts|first|combine(k8s_kube_conf_context_update, recursive=true)] }}"
      set_fact:
        k8s_kube_conf: "{{ k8s_kube_conf|combine(k8s_kube_conf_update, recursive=true) }}"

    - name: Write new kube config
      copy:
        content: "{{ k8s_kube_conf|to_nice_yaml(indent=2) }}"
        dest: "{{ ansible_env.HOME }}/.kube/config"