---
- name: Kubernetes Certs | create temp folder
  file:
    path: "{{ kubernetes_certificates.tmp_generate_path }}"
    state: directory
    mode: 0755

- name: Kubernetes Certs | create make-certs
  lineinfile:
    path: "{{ kubernetes_certificates.tmp_generate_path }}/make-certs"
    create: yes
    mode: 0755
    line: |
      #!/bin/bash -

      set -o errexit
      set -o nounset
      set -o pipefail

      cert_group=kube-cert
      cert_dir={{ kubernetes_certificates.directory }}

      pem_ca=$cert_dir/ca.pem
      pem_ca_key=$cert_dir/ca-key.pem
      pem_server=$cert_dir/apiserver.pem
      pem_server_key=$cert_dir/apiserver-key.pem
      pem_server_csr=$cert_dir/apiserver-csr.pem

      pem_admin=$cert_dir/admin.pem
      pem_admin_key=$cert_dir/admin-key.pem
      pem_admin_csr=$cert_dir/admin-csr.pem

      # Make sure cert group exists
      [ $(getent group $cert_group) ] || groupadd -r $cert_group

      # Generate TLS artifacts
      rm -rf $cert_dir
      mkdir -p $cert_dir

      openssl genrsa -out $pem_ca_key 2048
      openssl req -x509 -new -nodes -key $pem_ca_key -days 10000 -out $pem_ca -subj "/CN=kube-ca"

      openssl genrsa -out $pem_server_key 2048
      openssl req -new -key $pem_server_key -out $pem_server_csr -subj "/CN={{ansible_hostname}}" -config openssl.cnf
      openssl x509 -req -in $pem_server_csr -CA $pem_ca -CAkey $pem_ca_key -CAcreateserial -out $pem_server -days 365 -extensions v3_req -extfile openssl.cnf

      # Make server certs accessible to apiserver.
      chgrp $cert_group $pem_ca $pem_ca_key $pem_server $pem_server_key
      chmod 600 $pem_ca_key $pem_server_key
      chmod 660 $pem_ca $pem_server

      # Generate admin
      openssl genrsa -out $pem_admin_key 2048
      openssl req -new -key $pem_admin_key -out $pem_admin_csr -subj "/CN=kube-admin"
      openssl x509 -req -in $pem_admin_csr -CA $pem_ca -CAkey $pem_ca_key -CAcreateserial -out $pem_admin -days 365

- name: Kubernetes Certs | create openssl.cnf
  lineinfile:
    path: "{{ kubernetes_certificates.tmp_generate_path }}/openssl.cnf"
    create: yes
    line: |
      [req]
      req_extensions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
      [ v3_req ]
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = kubernetes
      DNS.2 = kubernetes.default
      DNS.3 = kubernetes.default.svc
      DNS.4 = kubernetes.default.svc.{{ kubernetes_cluster_info.K8S_DNS_DOMAIN }}
      IP.1 = {{ kubernetes_cluster_info.K8S_API_SERVICE_IP }}
      IP.2 = {{ host_internal_ip }}

- name: Kubernetes Certs | remove existing kubernetes certs
  file:
    path: /etc/kubernetes
    state: absent

- name: Kubernetes Certs | create kubernetes certs folder
  file:
    path: /etc/kubernetes
    state: directory
    mode: 0755

- name: Kubernetes Certs | Generating Certificates
  shell: |
    set -o errexit
    cd {{ kubernetes_certificates.tmp_generate_path }}
    ./make-certs

- name: Kubernetes Certs | Removing temp directory
  file:
    path: "{{ kubernetes_certificates.tmp_generate_path }}"
    state: absent
