Fix basic auth tokens for kubeadm deployment. (#3801)

* Fix basic auth tokens for kubeadm deployment.

* Tokens should be a dependancy on master, not nodes

roles/kubernetes/secrets/files/kube-gen-token.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-
-# Copyright 2015 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-token_dir=${TOKEN_DIR:-/var/srv/kubernetes}
-token_file="${token_dir}/known_tokens.csv"
-
-create_accounts=($@)
-
-if [ ! -e "${token_file}" ]; then
-  touch "${token_file}"
-fi
-
-for account in "${create_accounts[@]}"; do
-  if grep ",${account}," "${token_file}" ; then
-    continue
-  fi
-  token=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
-  echo "${token},${account},${account}" >> "${token_file}"
-  echo "${token}" > "${token_dir}/${account}.token"
-  echo "Added ${account}"
-done

roles/kubernetes/secrets/tasks/check-tokens.yml

@@ -1,35 +0,0 @@
----
-- name: "Check_tokens | check if the tokens have already been generated on first master"
-  stat:
-    path: "{{ kube_token_dir }}/known_tokens.csv"
-  delegate_to: "{{groups['kube-master'][0]}}"
-  register: known_tokens_master
-  run_once: true
-
-- name: "Check_tokens | Set default value for 'sync_tokens' and 'gen_tokens' to false"
-  set_fact:
-    sync_tokens: false
-    gen_tokens: false
-
-- name: "Check_tokens | Set 'sync_tokens' and 'gen_tokens' to true"
-  set_fact:
-    gen_tokens: true
-  when: not known_tokens_master.stat.exists and kube_token_auth|default(true)
-  run_once: true
-
-- name: "Check tokens | check if a cert already exists"
-  stat:
-    path: "{{ kube_token_dir }}/known_tokens.csv"
-  register: known_tokens
-
-- name: "Check_tokens | Set 'sync_tokens' to true"
-  set_fact:
-    sync_tokens: >-
-      {%- set tokens = {'sync': False} -%}
-      {%- for server in groups['kube-master'] | intersect(ansible_play_batch)
-         if (not hostvars[server].known_tokens.stat.exists) or
-         (hostvars[server].known_tokens.stat.checksum|default('') != known_tokens_master.stat.checksum|default('')) -%}
-         {%- set _ = tokens.update({'sync': True}) -%}
-      {%- endfor -%}
-      {{ tokens.sync }}
-  run_once: true

roles/kubernetes/secrets/tasks/gen_tokens.yml

@@ -1,60 +0,0 @@
----
-- name: Gen_tokens | copy tokens generation script
-  copy:
-    src: "kube-gen-token.sh"
-    dest: "{{ kube_script_dir }}/kube-gen-token.sh"
-    mode: 0700
-  run_once: yes
-  delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_tokens|default(false)
-
-- name: Gen_tokens | generate tokens for master components
-  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
-  environment:
-    TOKEN_DIR: "{{ kube_token_dir }}"
-  with_nested:
-    - [ "system:kubectl" ]
-    - "{{ groups['kube-master'] }}"
-  register: gentoken_master
-  changed_when: "'Added' in gentoken_master.stdout"
-  notify: set secret_changed
-  run_once: yes
-  delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_tokens|default(false)
-
-- name: Gen_tokens | generate tokens for node components
-  command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}"
-  environment:
-    TOKEN_DIR: "{{ kube_token_dir }}"
-  with_nested:
-    - [ 'system:kubelet' ]
-    - "{{ groups['kube-node'] }}"
-  register: gentoken_node
-  changed_when: "'Added' in gentoken_node.stdout"
-  notify: set secret_changed
-  run_once: yes
-  delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_tokens|default(false)
-
-- name: Gen_tokens | Get list of tokens from first master
-  shell: "(find {{ kube_token_dir }} -maxdepth 1 -type f)"
-  register: tokens_list
-  check_mode: no
-  delegate_to: "{{groups['kube-master'][0]}}"
-  run_once: true
-  when: sync_tokens|default(false)
-
-- name: Gen_tokens | Gather tokens
-  shell: "tar cfz - {{ tokens_list.stdout_lines | join(' ') }} | base64 --wrap=0"
-  args:
-    warn: false
-  register: tokens_data
-  check_mode: no
-  delegate_to: "{{groups['kube-master'][0]}}"
-  run_once: true
-  when: sync_tokens|default(false)
-
-- name: Gen_tokens | Copy tokens on masters
-  shell: "echo '{{ tokens_data.stdout|quote }}' | base64 -d | tar xz -C /"
-  when: inventory_hostname in groups['kube-master'] and sync_tokens|default(false) and
-        inventory_hostname != groups['kube-master'][0] and tokens_data.stdout != ''

roles/kubernetes/secrets/tasks/main.yml

@@ -5,12 +5,6 @@
     - k8s-gen-certs
     - facts
 
-- import_tasks: check-tokens.yml
-  tags:
-    - k8s-secrets
-    - k8s-gen-tokens
-    - facts
-
 - name: Make sure the certificate directory exits
   file:
     path: "{{ kube_cert_dir }}"
@@ -18,13 +12,6 @@
     mode: o-rwx
     group: "{{ kube_cert_group }}"
 
-- name: Make sure the tokens directory exits
-  file:
-    path: "{{ kube_token_dir }}"
-    state: directory
-    mode: o-rwx
-    group: "{{ kube_cert_group }}"
-
 #
 # The following directory creates make sure that the directories
 # exist on the first master for cases where the first master isn't
@@ -37,7 +24,7 @@
     owner: kube
   run_once: yes
   delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_certs|default(false) or gen_tokens|default(false)
+  when: gen_certs|default(false)
   tags:
     - kubelet
     - k8s-secrets
@@ -55,20 +42,10 @@
     owner: kube
   run_once: yes
   delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_certs|default(false) or gen_tokens|default(false)
+  when: gen_certs|default(false)
   tags:
     - k8s-secrets
 
-- name: "Get_tokens | Make sure the tokens directory exits (on {{groups['kube-master'][0]}})"
-  file:
-    path: "{{ kube_token_dir }}"
-    state: directory
-    mode: o-rwx
-    group: "{{ kube_cert_group }}"
-  run_once: yes
-  delegate_to: "{{groups['kube-master'][0]}}"
-  when: gen_tokens|default(false)
-
 - include_tasks: "gen_certs_script.yml"
   when:
     - cert_management |d('script') == 'script'
@@ -130,8 +107,3 @@
     - kubelet
     - node
     - kube-proxy
-
-- import_tasks: gen_tokens.yml
-  tags:
-    - k8s-secrets
-    - k8s-gen-tokens