- include_tasks: install_binaries.yaml

- include_tasks: high-availability/main.yaml

- name: PreKubernetes | Ensure the 'kube' system user exists
  command: |
    id kube &>/dev/null || useradd -M -c 'Kubernetes user' -s /sbin/nologin -r kube

- name: PreKubernetes | Create and set ownership for required Kubernetes directories
  command: |
    if [ ! -d "{{ .item.path }}" ]; then
      mkdir -p {{ .item.path }} && chown kube -R {{ .item.chown }}
    fi
  loop:
    - {path: "/usr/local/bin", chown: "/usr/local/bin"}
    - {path: "/etc/kubernetes", chown: "/etc/kubernetes"}
    - {path: "/etc/kubernetes/pki", chown: "/etc/kubernetes/pki"}
    - {path: "/etc/kubernetes/manifests", chown: "/etc/kubernetes/manifests"}
    - {path: "/usr/local/bin/kube-scripts", chown: "/usr/local/bin/kube-scripts"}
    - {path: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec", chown: "/usr/libexec/kubernetes"}
    - {path: "/etc/cni/net.d", chown: "/etc/cni"}
    - {path: "/opt/cni/bin", chown: "/opt/cni"}
    - {path: "/var/lib/calico", chown: "/var/lib/calico"}

- name: PreKubernetes | Synchronize audit policy file to remote node
  copy:
    src: audit
    dest: /etc/kubernetes/audit/
  when: .audit

- name: PreKubernetes | Synchronize cluster CA files to control plane nodes
  when: 
    - .kubernetes.certs.ca_cert | empty | not
    - .kubernetes.certs.ca_key | empty | not
    - .groups.kube_control_plane | has .inventory_hostname
  block:
    - name: PreKubernetes | Copy CA certificate to control plane node
      copy: 
        src: >-
          {{ .kubernetes.certs.ca_cert }}
        dest: /etc/kubernetes/pki/ca.crt
    - name: PreKubernetes | Copy CA private key to control plane node
      copy:
        src: >-
          {{ .kubernetes.certs.ca_key }}
        dest: /etc/kubernetes/pki/ca.key

- name: PreKubernetes | Ensure external etcd certificates are present on control plane nodes
  when: 
    - .etcd.deployment_type | eq "external"
    - .groups.kube_control_plane | default list | has .inventory_hostname
  block:
    - name: PreKubernetes | Copy etcd CA certificate to control plane node
      copy:
        src: >-
          {{ .etcd.ca_file }}
        dest: /etc/kubernetes/pki/etcd/ca.crt
    - name: PreKubernetes | Copy etcd client certificate to control plane node
      copy:
        src: >-
          {{ .etcd.cert_file }}
        dest: /etc/kubernetes/pki/etcd/client.crt
    - name: PreKubernetes | Copy etcd client key to control plane node
      copy:
        src: >-
          {{ .etcd.key_file }}
        dest: /etc/kubernetes/pki/etcd/client.key

- name: PreKubernetes | Synchronize front-proxy CA files to control plane nodes
  when:
    - .kubernetes.certs.front_proxy_cert | empty | not
    - .kubernetes.certs.front_proxy_key | empty | not
    - .groups.kube_control_plane | has .inventory_hostname
  block:
    - name: PreKubernetes | Copy front-proxy CA certificate to control plane node
      copy: 
        src: >-
          {{ .kubernetes.certs.front_proxy_cert }}
        dest: /etc/kubernetes/pki/front-proxy-ca.crt
    - name: PreKubernetes | Copy front-proxy CA private key to control plane node
      copy:
        src: >-
          {{ .kubernetes.certs.front_proxy_key }}
        dest: /etc/kubernetes/pki/front-proxy-ca.key