Migrate the role to a separate repo

tasks/main.yml

@@ -0,0 +1,151 @@
+# --------------------------------------
+# -- Create kubernetes user
+# --------------------------------------
+# -- 1. Install packages
+# -- 2. Generate certificate
+# -- 3. Add user to kubernetes
+# -- 4. Remove certificates (Optional)
+# --------------------------------------
+---
+- name: Prepare working directory
+  block:
+    - name: Set workdir as fact
+      set_fact:
+        working_dir: "{{ working_dir | ansible_env.HOME }}/.certs/{{ username }}"
+
+    - name: Create a directory if it does not exist
+      ansible.builtin.file:
+        path: "{{ working_dir }}"
+        state: directory
+        mode: "0775"
+
+- name: Ensure required packages are installed
+  tags: packages
+  block:
+  # -------------------------
+  # -- Prepare kubectl repo
+  # -------------------------
+    - name: Add an apt signing key for Kubernetes
+      become: yes
+      apt_key:
+        url: https://packages.cloud.google.com/apt/doc/apt-key.gpg
+        state: present
+
+    - name: Adding apt repository for Kubernetes
+      become: yes
+      apt_repository:
+        repo: deb https://apt.kubernetes.io/ kubernetes-xenial main
+        state: present
+        filename: kubernetes.list
+
+    # --------------------------------------
+    # -- Install yq
+    # --------------------------------------
+    - name: Ensure yq is installed
+      become: yes
+      get_url:
+        url: "https://github.com/mikefarah/yq/releases/download/{{ yq.version }}/{{ yq.binary }}"
+        dest: /usr/bin/yq
+        mode: "0777"
+
+    - name: Ensure kubectl and openssl are installed
+      become: yes
+      package:
+        name: "{{ packages }}"
+        state: present
+      vars: 
+        packages:
+          - kubectl
+          - openssl
+
+- name: Generate openssl certificate
+  tags: openssl
+  block:
+    - name: Generate an OpenSSL private key
+      community.crypto.openssl_privatekey:
+        path: "{{ working_dir }}/{{ username }}.key"
+        size: 2048
+
+    - name: Generate an OpenSSL Certificate Signing Request
+      community.crypto.openssl_csr:
+        path: "{{ working_dir }}/{{ username }}.csr"
+        privatekey_path: "{{ working_dir }}/{{ username }}.key"
+        common_name: "{{ username }}"
+
+    - name: Generate an OpenSSL certificate signed with your own CA certificate
+      become: yes
+      community.crypto.x509_certificate:
+        path: "{{ working_dir }}/{{ username }}.crt"
+        csr_path: "{{ working_dir }}/{{ username }}.csr"
+        ownca_path: "{{ k8s_cert_path }}/{{ k8s_cert_crt_file }}"
+        ownca_privatekey_path: "{{ k8s_cert_path }}/{{ k8s_cert_key_file }}"
+        provider: ownca
+        entrust_not_after: "+{{ certificate_expires_in }}d"
+
+- name: Add user to cluster
+  block:
+    # --------------------------------------
+    # -- Get k8s server from admin.conf
+    # --------------------------------------
+    - name: Get k8s server
+      shell: yq e '.clusters[0] | select(.name == "{{ cluster }}").cluster.server' "{{ k8s_config_path }}"
+      register: kubernetes_server_output
+    # --------------------------------------
+    # -- Get k8s certificate authority data
+    # -- from admin-conf
+    # --------------------------------------
+    - name: Get k8s certificate authority data
+      shell: yq e '.clusters[0] | select(.name == "{{ cluster }}").cluster.certificate-authority-data' "{{ k8s_config_path }}"
+      register: kubernetes_cad_output
+
+    - name: Get user cert data
+      shell: cat "{{ working_dir }}/{{ username }}.crt" | base64 -w 0
+      register: user_cert_data_output
+
+    - name: Get user key data
+      shell: cat "{{ working_dir }}/{{ username }}.key" | base64 -w 0
+      register: user_key_data_output
+
+    - name: Set variables for template
+      set_fact:
+        kubernetes_server: "{{ kubernetes_server_output.stdout }}"
+        kubernetes_cad: "{{ kubernetes_cad_output.stdout }}"
+        user_cert_data: " {{ user_cert_data_output.stdout }}"
+        user_key_data: " {{ user_key_data_output.stdout }}"
+
+    - name: Create k8s user
+      ansible.builtin.shell: |
+        kubectl config set-credentials  "{{ username }}"\
+          --client-certificate="{{ working_dir }}/{{ username }}.crt" \
+          --client-key="{{ working_dir }}/{{ username }}.key"
+      notify: remove certificates
+
+    - name: Set user context
+      ansible.builtin.shell: |
+        kubectl config set-context "{{ username }}@{{ cluster }}" \
+          --cluster={{ cluster }} --user="{{ username }}"
+
+    - name: Create config file from template
+      template:
+        src: config.j2
+        dest: "{{ working_dir }}/config"
+
+    - name: Storing config on the local machine
+      ansible.builtin.fetch:
+        src: "{{ working_dir }}/config"
+        dest: ./
+        flat: yes
+  tags: config
+
+- name: Bind user to role
+  block:
+    - name: Generate role binding yaml
+      template:
+        src: role-binding.j2
+        dest: "{{ working_dir }}/{{ username }}.yaml"
+
+    - name: Apply role binding manifest
+      environment:
+        KUBECONFIG: "{{ k8s_config_path }}"
+      shell: kubectl apply -f "{{ working_dir }}/{{ username }}.yaml"
+  tags: add_user