Fix basic auth tokens for kubeadm deployment. (#3801)

* Fix basic auth tokens for kubeadm deployment.

* Tokens should be a dependancy on master, not nodes

roles/kubernetes/tokens/tasks/check-tokens.yml

@@ -0,0 +1,35 @@
+---
+- name: "Check_tokens | check if the tokens have already been generated on first master"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+  delegate_to: "{{groups['kube-master'][0]}}"
+  register: known_tokens_master
+  run_once: true
+
+- name: "Check_tokens | Set default value for 'sync_tokens' and 'gen_tokens' to false"
+  set_fact:
+    sync_tokens: false
+    gen_tokens: false
+
+- name: "Check_tokens | Set 'sync_tokens' and 'gen_tokens' to true"
+  set_fact:
+    gen_tokens: true
+  when: not known_tokens_master.stat.exists and kube_token_auth|default(true)
+  run_once: true
+
+- name: "Check tokens | check if a cert already exists"
+  stat:
+    path: "{{ kube_token_dir }}/known_tokens.csv"
+  register: known_tokens
+
+- name: "Check_tokens | Set 'sync_tokens' to true"
+  set_fact:
+    sync_tokens: >-
+      {%- set tokens = {'sync': False} -%}
+      {%- for server in groups['kube-master'] | intersect(ansible_play_batch)
+         if (not hostvars[server].known_tokens.stat.exists) or
+         (hostvars[server].known_tokens.stat.checksum|default('') != known_tokens_master.stat.checksum|default('')) -%}
+         {%- set _ = tokens.update({'sync': True}) -%}
+      {%- endfor -%}
+      {{ tokens.sync }}
+  run_once: true