a13labs.infra/ansible/roles/microk8s/tasks/setupenv/main.yml

- name: Read current remote $HOME
  become: true
  ansible.builtin.user:
    name: "{{ item.username }}"
    state: present
  register: user_registered
  tags:
    - k8s::users

- name: Create required folders
  become: true
  ansible.builtin.file:
    path: "{{ folder }}"
    state: directory
    mode: "0750"
    owner: "{{ item.username }}"
  loop:
    - "{{ user_registered.home }}/.kube"
    - "{{ user_registered.home }}/.local/bin"
  loop_control:
    loop_var: folder
  tags:
    - k8s::users

- name: Check if secret exists
  ansible.builtin.shell: |
    set -o pipefail
    microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
  args:
    executable: /bin/bash
  register: secret_exists
  when: item.enabled
  tags:
    - k8s::users
  changed_when: false
  ignore_errors: true

- name: Configure user access
  when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != ""
  block:
    - name: Get the secret name
      ansible.builtin.shell: |
        set -o pipefail
        microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
      args:
        executable: /bin/bash
      register: secret_name
      when: item.enabled
      tags:
        - k8s::users
      changed_when: false

    - name: Describe the secret and extract the token
      ansible.builtin.shell: |
        set -o pipefail
        microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
      args:
        executable: /bin/bash
      register: token
      when: item.enabled
      tags:
        - k8s::users
      changed_when: false

    - name: Read system kubeconfig
      become: true
      ansible.builtin.command: "microk8s config"
      register: kubeconfig
      tags:
        - k8s::users
      changed_when: false

    - name: Set fact kubeconfig
      ansible.builtin.set_fact:
        kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
      tags:
        - k8s::users
      changed_when: false

    - name: Patch kubeconfig with user token
      ansible.builtin.set_fact:
        patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
      vars:
        new_kubeconfig:
          contexts:
            - context:
                cluster: microk8s-cluster
                user: "{{ item.username }}"
              name: microk8s
          users:
            - name: "{{ item.username }}"
              user:
                token: "{{ token.stdout }}"
      tags:
        - k8s::users

    - name: Check if a config already exists and its SHA1
      become: true
      ansible.builtin.stat:
        path: "{{ user_registered.home }}/.kube/config"
      register: kubeconfig_exists
      tags:
        - k8s::users

    - name: Get new config SHA1
      ansible.builtin.set_fact:
        patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
      tags:
        - k8s::users

    - name: Write kubeconfig
      become: true
      ansible.builtin.copy:
        content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
        dest: "{{ user_registered.home }}/.kube/config"
        owner: "{{ item.username }}"
        mode: "0600"
      when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
      tags:
        - k8s::users