ansible-create-k8s-user/tasks/create-user.yaml

---
- name: Prepare cert directory
  block:
    - name: Set workdir as fact
      set_fact:
        cert_dir: "{{ working_dir }}/.certs/{{ username }}"

    - name: Create a directory if it does not exist
      ansible.builtin.file:
        path: "{{ cert_dir }}"
        state: directory
        mode: "0775"
- block:
  - name: Generate openssl certificate
    tags: openssl
    block:
      - name: Generate an OpenSSL private key
        community.crypto.openssl_privatekey:
          path: "{{ cert_dir }}/{{ username }}.key"
          size: 2048

      - name: Generate an OpenSSL Certificate Signing Request
        community.crypto.openssl_csr:
          path: "{{ cert_dir }}/{{ username }}.csr"
          privatekey_path: "{{ cert_dir }}/{{ username }}.key"
          common_name: "{{ username }}"

      - name: Generate an OpenSSL certificate signed with your own CA certificate
        become: true
        community.crypto.x509_certificate:
          path: "{{ cert_dir }}/{{ username }}.crt"
          csr_path: "{{ cert_dir }}/{{ username }}.csr"
          ownca_path: "{{ k8s_cert_path }}/{{ k8s_cert_crt_file }}"
          ownca_privatekey_path: "{{ k8s_cert_path }}/{{ k8s_cert_key_file }}"
          provider: ownca
          entrust_not_after: "+{{ certificate_expires_in }}d"

  - name: Add user to cluster
    block:
      # --------------------------------------
      # -- Get k8s server from admin.conf
      # --------------------------------------
      - name: Get k8s server
        shell: "{{ working_dir }}/bin/yq e '.clusters[0] | select(.name == \"{{ cluster }}\").cluster.server' {{ k8s_config_path }}"
        register: kubernetes_server_output
      # --------------------------------------
      # -- Get k8s certificate authority data
      # -- from admin-conf
      # --------------------------------------
      - name: Get k8s certificate authority data
        shell: "{{ working_dir }}/bin/yq e '.clusters[0] | select(.name == \"{{ cluster }}\").cluster.certificate-authority-data' {{ k8s_config_path }}"
        register: kubernetes_cad_output

      - name: Get user cert data
        shell: cat "{{ cert_dir }}/{{ username }}.crt" | base64 -w 0
        register: user_cert_data_output

      - name: Get user key data
        shell: cat "{{ cert_dir }}/{{ username }}.key" | base64 -w 0
        register: user_key_data_output

      - name: Set variables for template
        set_fact:
          kubernetes_server: "{{ kubernetes_server | default(kubernetes_server_output.stdout) }}"
          kubernetes_cad: "{{ kubernetes_cad_output.stdout }}"
          user_cert_data: " {{ user_cert_data_output.stdout }}"
          user_key_data: " {{ user_key_data_output.stdout }}"

      - name: Create k8s user
        ansible.builtin.shell: >-
          {{ working_dir }}/bin/kubectl config set-credentials {{ username }} \
            --client-certificate="{{ cert_dir }}/{{ username }}.crt" \
            --client-key="{{ cert_dir }}/{{ username }}.key"
        notify: remove certificates

      - name: Set user context
        ansible.builtin.shell: >-
          {{ working_dir }}/bin/kubectl config set-context {{ username }}@{{ cluster }} \
            --cluster={{ cluster }} --user="{{ username }}"

      - name: Create config file from template
        template:
          src: config.j2
          dest: "{{ working_dir }}/{{ username }}.config"
          force: false
    tags: config

  - name: Bind user to role
    block:
      - name: Generate role binding yaml
        template:
          src: role-binding.j2
          dest: "{{ cert_dir }}/{{ username }}.yaml"

      - name: Apply role binding manifest
        environment:
          KUBECONFIG: "{{ k8s_config_path }}"
        shell: "{{ working_dir }}/bin/kubectl apply -f {{ cert_dir }}/{{ username }}.yaml"
    tags: add_user