refactor: unify inconsistent variables in apiserver endpoint (#13392)

roles/kubernetes/client/tasks/main.yml

@@ -1,25 +1,4 @@
 ---
-- name: Set external kube-apiserver endpoint
-  set_fact:
-    # noqa: jinja[spacing]
-    external_apiserver_address: >-
-      {%- if loadbalancer_apiserver is defined and loadbalancer_apiserver.address is defined -%}
-      {{ loadbalancer_apiserver.address }}
-      {%- elif kubeconfig_localhost_ansible_host is defined and kubeconfig_localhost_ansible_host -%}
-      {{ hostvars[groups['kube_control_plane'][0]].ansible_host }}
-      {%- else -%}
-      {{ kube_apiserver_access_address }}
-      {%- endif -%}
-    # noqa: jinja[spacing]
-    external_apiserver_port: >-
-      {%- if loadbalancer_apiserver is defined and loadbalancer_apiserver.address is defined and loadbalancer_apiserver.port is defined -%}
-      {{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
-      {%- else -%}
-      {{ kube_apiserver_port }}
-      {%- endif -%}
-  tags:
-    - facts
-
 - name: Create kube config dir for current/ansible become user
   file:
     path: "{{ ansible_env.HOME | default('/root') }}/.kube"
@@ -47,8 +26,8 @@
 
 - name: Wait for k8s apiserver
   wait_for:
-    host: "{{ kube_apiserver_access_address }}"
-    port: "{{ kube_apiserver_port }}"
+    host: "{{ _kube_apiserver_local_endpoint | urlsplit('hostname') }}"
+    port: "{{ _kube_apiserver_local_endpoint | urlsplit('port') | default(kube_apiserver_port, true) }}"
     timeout: 180
 
 - name: Create kubeconfig localhost artifacts
@@ -73,9 +52,13 @@
       vars:
         admin_kubeconfig: "{{ kubeadm_admin_kubeconfig.stdout | from_yaml }}"
         context: "kubernetes-admin-{{ cluster_name }}@{{ cluster_name }}"
+        client_kubeconfig_endpoint: >-
+          {{ ('https://' ~ (hostvars[groups['kube_control_plane'][0]].ansible_host | ansible.utils.ipwrap) ~ ':' ~ kube_apiserver_port)
+             if (kubeconfig_localhost_ansible_host | default(false) and kube_apiserver_endpoint is not defined)
+             else _kube_apiserver_endpoint }}
         override:
           clusters:
-            - "{{ admin_kubeconfig['clusters'][0] | combine({'name': cluster_name, 'cluster': admin_kubeconfig['clusters'][0]['cluster'] | combine({'server': 'https://' + (external_apiserver_address | string  | ansible.utils.ipwrap) + ':' + (external_apiserver_port | string)})}, recursive=true) }}"
+            - "{{ admin_kubeconfig['clusters'][0] | combine({'name': cluster_name, 'cluster': admin_kubeconfig['clusters'][0]['cluster'] | combine({'server': client_kubeconfig_endpoint})}, recursive=true) }}"
           contexts:
             - "{{ admin_kubeconfig['contexts'][0] | combine({'name': context, 'context': admin_kubeconfig['contexts'][0]['context'] | combine({'cluster': cluster_name})}, recursive=true) }}"
           current-context: "{{ context }}"

roles/kubernetes/control-plane/handlers/main.yml

@@ -106,7 +106,7 @@
 
 - name: Control plane | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_local_endpoint }}/healthz"
     validate_certs: false
   register: result
   until: result.status == 200

roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml

@@ -1,16 +1,4 @@
 ---
-- name: Set kubeadm_discovery_address
-  set_fact:
-    # noqa: jinja[spacing]
-    kubeadm_discovery_address: >-
-      {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%}
-      {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}
-      {%- else -%}
-      {{ kube_apiserver_endpoint | regex_replace('https://', '') }}
-      {%- endif %}
-  tags:
-    - facts
-
 - name: Obtain kubeadm certificate key for joining control planes nodes
   when:
     - not kube_external_ca_mode
@@ -31,8 +19,8 @@
 
 - name: Wait for k8s apiserver
   wait_for:
-    host: "{{ kubeadm_discovery_address | regex_replace('\\]?:\\d+$', '') | regex_replace('^\\[', '') }}"
-    port: "{{ kubeadm_discovery_address.split(':')[-1] }}"
+    host: "{{ _kube_apiserver_endpoint | urlsplit('hostname') }}"
+    port: "{{ _kube_apiserver_endpoint | urlsplit('port') | default(kube_apiserver_port, true) }}"
     timeout: 180
 
 

roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -36,8 +36,8 @@
       - "localhost"
       - "127.0.0.1"
       - "::1"
-      - "{{ apiserver_loadbalancer_domain_name | d('') }}"
-      - "{{ loadbalancer_apiserver.address | d('') }}"
+      - "{{ _kube_apiserver_endpoint | urlsplit('hostname') }}"
+      - "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }}"
       - "{{ supplementary_addresses_in_ssl_keys }}"
       - "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_access_ip') }}"
       - "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_ip') }}"
@@ -87,12 +87,6 @@
   when: kube_apiserver_tracing
   notify: Control plane | Restart apiserver
 
-# Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint.
-- name: Set kubeadm_config_api_fqdn define
-  set_fact:
-    kubeadm_config_api_fqdn: "{{ apiserver_loadbalancer_domain_name }}"
-  when: loadbalancer_apiserver is defined
-
 - name: Kubeadm | Create kubeadm config
   template:
     src: "kubeadm-config.v1beta4.yaml.j2"

roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2

@@ -116,8 +116,8 @@ featureGates:
 {%   endfor %}
 {% endif %}
 kubernetesVersion: v{{ kube_version }}
-{% if kubeadm_config_api_fqdn is defined %}
-controlPlaneEndpoint: "{{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}"
+{% if kube_apiserver_endpoint is defined %}
+controlPlaneEndpoint: "{{ _kube_apiserver_endpoint_netloc }}"
 {% else %}
 controlPlaneEndpoint: "{{ main_ip | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}"
 {% endif %}

roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2

@@ -6,11 +6,7 @@ discovery:
     kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
 {% else %}
   bootstrapToken:
-{% if kubeadm_config_api_fqdn is defined %}
-    apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
-{% else %}
-    apiServerEndpoint: "{{ kubeadm_discovery_address }}"
-{% endif %}
+    apiServerEndpoint: "{{ _kube_apiserver_endpoint_netloc }}"
     token: {{ kubeadm_token }}
     unsafeSkipCAVerification: true
 {% endif %}

roles/kubernetes/kubeadm/tasks/main.yml

@@ -1,16 +1,4 @@
 ---
-- name: Set kubeadm_discovery_address
-  set_fact:
-    # noqa: jinja[spacing]
-    kubeadm_discovery_address: >-
-      {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%}
-      {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}
-      {%- else -%}
-      {{ kube_apiserver_endpoint | replace("https://", "") }}
-      {%- endif %}
-  tags:
-    - facts
-
 - name: Check if kubelet.conf exists
   stat:
     path: "{{ kube_config_dir }}/kubelet.conf"
@@ -104,25 +92,11 @@
   lineinfile:
     dest: "{{ kube_config_dir }}/kubelet.conf"
     regexp: '^(\s+)server: https.*'
-    line: '\1server: {{ kube_apiserver_endpoint }}'
-    backrefs: true
-    backup: true
-  when:
-    - kubeadm_config_api_fqdn is not defined
-    - ('kube_control_plane' not in group_names)
-    - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "")
-  notify: Kubeadm | restart kubelet
-
-- name: Update server field in kubelet kubeconfig - external lb
-  lineinfile:
-    dest: "{{ kube_config_dir }}/kubelet.conf"
-    regexp: '^(\s+)server: https.*'
-    line: '\1server: {{ kube_apiserver_endpoint }}'
+    line: '\1server: {{ _kube_apiserver_cluster_internal_endpoint }}'
     backrefs: true
     backup: true
   when:
     - ('kube_control_plane' not in group_names)
-    - loadbalancer_apiserver is defined
   notify: Kubeadm | restart kubelet
 
 - name: Get current resourceVersion of kube-proxy configmap
@@ -136,31 +110,14 @@
   tags:
     - kube-proxy
 
-# FIXME(mattymo): Need to point to localhost, otherwise control plane nodes will all point
-#                 incorrectly to first control plane node, creating SPoF.
 - name: Update server field in kube-proxy kubeconfig
   shell: >-
-    set -o pipefail && {{ kubectl }} get configmap kube-proxy -n kube-system -o yaml
-    | sed 's#server:.*#server: https://127.0.0.1:{{ kube_apiserver_port }}#g'
-    | {{ kubectl }} replace -f -
-  args:
-    executable: /bin/bash
-  run_once: true
-  delegate_to: "{{ groups['kube_control_plane'] | first }}"
-  delegate_facts: false
-  when:
-    - kubeadm_config_api_fqdn is not defined
-    - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "")
-    - kube_proxy_deployed
-    - loadbalancer_apiserver_localhost
-  tags:
-    - kube-proxy
-
-- name: Update server field in kube-proxy kubeconfig - external lb
-  shell: >-
-    set -o pipefail && {{ kubectl }} get configmap kube-proxy -n kube-system -o yaml
-    | sed 's#server:.*#server: {{kube_apiserver_endpoint}}#g'
-    | {{ kubectl }} replace -f -
+    set -o pipefail &&
+    if ! {{ kubectl }} get configmap kube-proxy -n kube-system -o yaml | grep -Fq "server: {{ _kube_apiserver_cluster_internal_endpoint }}"; then
+      {{ kubectl }} get configmap kube-proxy -n kube-system -oyaml |
+      sed 's#server:.*#server: {{ _kube_apiserver_cluster_internal_endpoint }}#g' |
+      {{ kubectl }} replace -f -
+    fi
   args:
     executable: /bin/bash
   run_once: true
@@ -168,7 +125,6 @@
   delegate_facts: false
   when:
     - kube_proxy_deployed
-    - loadbalancer_apiserver is defined
   tags:
     - kube-proxy
 
@@ -196,8 +152,6 @@
   delegate_to: "{{ groups['kube_control_plane'] | first }}"
   delegate_facts: false
   when:
-    - kubeadm_config_api_fqdn is not defined or loadbalancer_apiserver is defined
-    - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "") or loadbalancer_apiserver is defined
     - kube_proxy_deployed
     - original_configmap_resource_version.stdout != new_configmap_resource_version.stdout
   tags:

roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2

@@ -7,11 +7,7 @@ discovery:
     kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
 {% else %}
   bootstrapToken:
-{% if kubeadm_config_api_fqdn is defined %}
-    apiServerEndpoint: "{{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}"
-{% else %}
-    apiServerEndpoint: "{{ kubeadm_discovery_address }}"
-{% endif %}
+    apiServerEndpoint: "{{ _kube_apiserver_endpoint_netloc }}"
     token: {{ kubeadm_token }}
 {% if ca_cert_content is defined %}
     caCertHashes:

roles/kubernetes/node-label/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_local_endpoint }}/healthz"
     validate_certs: false
     client_cert: "{{ kube_apiserver_client_cert }}"
     client_key: "{{ kube_apiserver_client_key }}"

roles/kubernetes/preinstall/handlers/main.yml

@@ -107,7 +107,7 @@
 # When running this as the last phase ensure we wait for kube-apiserver to come up
 - name: Preinstall | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_local_endpoint }}/healthz"
     validate_certs: false
   register: result
   until: result.status == 200