Enable external CA mode for control-plane deployment (#8620)

roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml

@@ -19,6 +19,7 @@
   register: kubeadm_upload_cert
   when:
     - inventory_hostname == first_kube_control_plane
+    - not kube_external_ca_mode
 
 - name: Parse certificate key if not set
   set_fact:
@@ -49,11 +50,20 @@
   debug:
     msg: "{{ kubeadm_already_run.stat.exists }}"
 
-- name: Joining control plane node to the cluster.
+- name: Reset cert directory
   shell: >-
     if [ -f /etc/kubernetes/manifests/kube-apiserver.yaml ]; then
     {{ bin_dir }}/kubeadm reset -f --cert-dir {{ kube_cert_dir }};
-    fi &&
+    fi
+  environment:
+    PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
+  when:
+    - inventory_hostname != first_kube_control_plane
+    - kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
+    - not kube_external_ca_mode
+
+- name: Joining control plane node to the cluster.
+  command: >-
     {{ bin_dir }}/kubeadm join
     --config {{ kube_config_dir }}/kubeadm-controlplane.yaml
     --ignore-preflight-errors=all