More idempotency fixes

Fixed sync_tokens fact
Fixed sync_certs for k8s tokens fact
Disabled register docker images changability
Fixed CNI dir permission
Fix idempotency for etcd pre upgrade checks

roles/etcd/tasks/check_certs.yml

@@ -3,6 +3,7 @@
   find:
     paths: "{{ etcd_cert_dir }}"
     patterns: "ca.pem,node*.pem"
+    get_checksum: true
   delegate_to: "{{groups['etcd'][0]}}"
   register: etcdcert_master
   run_once: true
@@ -58,7 +59,7 @@
     sync_certs: true
   when: >-
       {%- set certs = {'sync': False} -%}
-      {% if gen_node_certs[inventory_hostname] or 
+      {% if gen_node_certs[inventory_hostname] or
         (not etcdcert_node.results[0].stat.exists|default(False)) or
           (not etcdcert_node.results[1].stat.exists|default(False)) or
             (etcdcert_node.results[1].stat.checksum|default('') != etcdcert_master.files|selectattr("path", "equalto", etcdcert_node.results[1].stat.path)|first|map(attribute="checksum")|default('')) -%}

roles/etcd/tasks/gen_certs_script.yml

@@ -107,38 +107,38 @@
         sync_certs|default(false) and inventory_hostname not in groups['etcd']
   notify: set etcd_secret_changed
 
-#NOTE(mattymo): Use temporary file to copy master certs because we have a ~200k 
-#char limit when using shell command                                            
-                                                                                
-#FIXME(mattymo): Use tempfile module in ansible 2.3                             
-- name: Gen_certs | Prepare tempfile for unpacking certs                        
-  shell: mktemp /tmp/certsXXXXX.tar.gz                                          
-  register: cert_tempfile                                                       
-                                                                                
-- name: Gen_certs | Write master certs to tempfile                              
-  copy:                                                                         
-    content: "{{etcd_master_cert_data.stdout}}"                                      
-    dest: "{{cert_tempfile.stdout}}"                                            
-    owner: root                                                                 
-    mode: "0600"                                                                
+#NOTE(mattymo): Use temporary file to copy master certs because we have a ~200k
+#char limit when using shell command
+
+#FIXME(mattymo): Use tempfile module in ansible 2.3
+- name: Gen_certs | Prepare tempfile for unpacking certs
+  shell: mktemp /tmp/certsXXXXX.tar.gz
+  register: cert_tempfile
+
+- name: Gen_certs | Write master certs to tempfile
+  copy:
+    content: "{{etcd_master_cert_data.stdout}}"
+    dest: "{{cert_tempfile.stdout}}"
+    owner: root
+    mode: "0600"
   when: inventory_hostname in groups['etcd'] and sync_certs|default(false) and
-        inventory_hostname != groups['etcd'][0]                          
-                                                                                
-- name: Gen_certs | Unpack certs on masters                                     
+        inventory_hostname != groups['etcd'][0]
+
+- name: Gen_certs | Unpack certs on masters
   shell: "base64 -d < {{ cert_tempfile.stdout }} | tar xz -C {{ etcd_cert_dir }}"
-  no_log: true                                                                  
-  changed_when: false                                                           
-  check_mode: no                                                                
+  no_log: true
+  changed_when: false
+  check_mode: no
   when: inventory_hostname in groups['etcd'] and sync_certs|default(false) and
-        inventory_hostname != groups['etcd'][0]                          
-  notify: set secret_changed                                                    
-                                                                                
-- name: Gen_certs | Cleanup tempfile                                            
-  file:                                                                         
-    path: "{{cert_tempfile.stdout}}"                                            
-    state: absent                                                               
+        inventory_hostname != groups['etcd'][0]
+  notify: set secret_changed
+
+- name: Gen_certs | Cleanup tempfile
+  file:
+    path: "{{cert_tempfile.stdout}}"
+    state: absent
   when: inventory_hostname in groups['etcd'] and sync_certs|default(false) and
-        inventory_hostname != groups['etcd'][0]  
+        inventory_hostname != groups['etcd'][0]
 
 - name: Gen_certs | Copy certs on nodes
   shell: "base64 -d <<< '{{etcd_node_cert_data.stdout|quote}}' | tar xz -C {{ etcd_cert_dir }}"

roles/etcd/tasks/main.yml

@@ -16,7 +16,7 @@
   tags: etcd-secrets
 
 - include: sync_etcd_node_certs.yml
-  when: cert_management == "vault" and inventory_hostname in etcd_node_cert_hosts 
+  when: cert_management == "vault" and inventory_hostname in etcd_node_cert_hosts
   tags: etcd-secrets
 
 - include: gen_certs_vault.yml

roles/etcd/tasks/pre_upgrade.yml

@@ -28,6 +28,7 @@
 - name: "Pre-upgrade | find etcd-proxy container"
   command: "{{ docker_bin_dir }}/docker ps -aq --filter 'name=etcd-proxy*'"
   register: etcd_proxy_container
+  changed_when: false
   failed_when: false
 
 - name: "Pre-upgrade | remove etcd-proxy if it exists"
@@ -47,6 +48,7 @@
   until: etcd_member_list.rc != 2
   run_once: true
   when: etcdctl_installed.stat.exists
+  changed_when: false
   failed_when: false
 
 - name: "Pre-upgrade | change peer names to SSL"