Merge pull request #2019 from chadswen/disable-api-insecure-port

Support for disabling apiserver insecure port (the sequel)

roles/kubernetes/master/handlers/main.yml

@@ -78,7 +78,10 @@
 
 - name: Master | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_insecure_endpoint }}/healthz"
+    url: "{{ kube_apiserver_endpoint }}/healthz"
+    validate_certs: no
+    client_cert: "{{ kube_apiserver_client_cert }}"
+    client_key: "{{ kube_apiserver_client_key }}"
   register: result
   until: result.status == 200
   retries: 20

roles/kubernetes/master/tasks/kubeadm-migrate-certs.yml

@@ -6,7 +6,7 @@
     remote_src: yes
   with_items:
     - {src: apiserver.pem, dest: apiserver.crt}
-    - {src: apiserver.pem, dest: apiserver.key}
+    - {src: apiserver-key.pem, dest: apiserver.key}
     - {src: ca.pem, dest: ca.crt}
     - {src: ca-key.pem, dest: ca.key}
   register: kubeadm_copy_old_certs

roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2

@@ -111,9 +111,17 @@ spec:
       httpGet:
         host: 127.0.0.1
         path: /healthz
+{% if kube_apiserver_insecure_port == 0 %}
+        port: {{ kube_apiserver_port }}
+        scheme: HTTPS
+{% else %}
         port: {{ kube_apiserver_insecure_port }}
-      initialDelaySeconds: 30
-      timeoutSeconds: 10
+{% endif %}
+      failureThreshold: 8
+      initialDelaySeconds: 15
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 15
     volumeMounts:
     - mountPath: {{ kube_config_dir }}
       name: kubernetes-config