More idempotency fixes

Fixed sync_tokens fact
Fixed sync_certs for k8s tokens fact
Disabled register docker images changability
Fixed CNI dir permission
Fix idempotency for etcd pre upgrade checks

roles/kubernetes/master/tasks/main.yml

@@ -13,7 +13,6 @@
 
 - name: Install kubectl bash completion
   shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
-  #no_log: true
   when: ansible_os_family in ["Debian","RedHat"]
   tags: kubectl
 

roles/kubernetes/secrets/tasks/check-certs.yml

@@ -3,6 +3,7 @@
   find:
     paths: "{{ kube_cert_dir }}"
     patterns: "*.pem"
+    get_checksum: true
   delegate_to: "{{groups['kube-master'][0]}}"
   register: kubecert_master
   run_once: true
@@ -58,7 +59,7 @@
       {% if gen_node_certs[inventory_hostname] or    
         (not kubecert_node.results[0].stat.exists|default(False)) or
           (not kubecert_node.results[1].stat.exists|default(False)) or
-            (kubecert_node.results[1].stat.checksum|default('') != kubecert_master.files|selectattr("path", "equalto", kubecert_node.results[1].stat.path)|first|map(attribute="checksum")|default('')) -%}
+            (kubecert_node.results[1].stat.checksum|default('') != kubecert_master.files|selectattr("path", "equalto", kubecert_node.results[1].stat.path)|map(attribute="checksum")|first|default('')) -%}
               {%- set _ = certs.update({'sync': True}) -%}
       {% endif %}
       {{ certs.sync }}

roles/kubernetes/secrets/tasks/check-tokens.yml

@@ -19,7 +19,7 @@
 
 - name: "Check tokens | check if a cert already exists"
   stat:
-    path: "{{ kube_cert_dir }}/ca.pem"
+    path: "{{ kube_token_dir }}/known_tokens.csv"
   register: known_tokens
 
 - name: "Check_tokens | Set 'sync_tokens' to true"

roles/kubernetes/secrets/tasks/gen_certs_script.yml

@@ -106,6 +106,8 @@
 - name: Gen_certs | Prepare tempfile for unpacking certs
   shell: mktemp /tmp/certsXXXXX.tar.gz
   register: cert_tempfile
+  when: inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
+        inventory_hostname != groups['kube-master'][0]
 
 - name: Gen_certs | Write master certs to tempfile
   copy:
@@ -149,13 +151,9 @@
     path: "{{ kube_cert_dir }}"
     group: "{{ kube_cert_group }}"
     owner: kube
+    mode: "u=rwX,g-rwx,o-rwx"
     recurse: yes
 
-- name: Gen_certs | set permissions on keys
-  shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
-  when: inventory_hostname in groups['kube-master']
-  changed_when: false
-
 - name: Gen_certs | target ca-certificates path
   set_fact:
     ca_cert_path: |-

roles/kubernetes/secrets/tasks/gen_tokens.yml

@@ -39,9 +39,9 @@
 - name: Gen_tokens | Get list of tokens from first master
   shell: "(find {{ kube_token_dir }} -maxdepth 1 -type f)"
   register: tokens_list
-  changed_when: false
   check_mode: no
   delegate_to: "{{groups['kube-master'][0]}}"
+  run_once: true
   when: sync_tokens|default(false)
 
 - name: Gen_tokens | Gather tokens
@@ -54,6 +54,5 @@
 
 - name: Gen_tokens | Copy tokens on masters
   shell: "echo '{{ tokens_data.stdout|quote }}' | base64 -d | tar xz -C /"
-  changed_when: false
   when: inventory_hostname in groups['kube-master'] and sync_tokens|default(false) and
         inventory_hostname != groups['kube-master'][0]