Encryption and major changes

ansible/roles/microk8s/tasks/iac.yml

@@ -11,7 +11,7 @@
       apiVersion: v1
       kind: ServiceAccount
       metadata:
-        name: "{{ k8s_iac_user }}"
+        name: "{{ microk8s_iac_user }}"
         namespace: default
   tags:
     - k8s::iac
@@ -29,10 +29,10 @@
       apiVersion: v1
       kind: Secret
       metadata:
-        name: "{{ k8s_iac_user }}-token"
+        name: "{{ microk8s_iac_user }}-token"
         namespace: default
         annotations:
-          kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
+          kubernetes.io/service-account.name: "{{ microk8s_iac_user }}"
       type: kubernetes.io/service-account-token
   tags:
     - k8s::iac
@@ -58,14 +58,14 @@
       subjects:
         - kind: ServiceAccount
           namespace: default
-          name: "{{ k8s_iac_user }}"
+          name: "{{ microk8s_iac_user }}"
   tags:
     - k8s::iac
 
 - name: Get the secret name
   ansible.builtin.shell: |
     set -o pipefail
-    microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
+    microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }'
   args:
     executable: /bin/bash
   register: secret_name
@@ -98,44 +98,48 @@
   tags:
     - k8s::iac
 
-- name: Patch kubeconfig with user token
-  ansible.builtin.set_fact:
-    patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
-  vars:
-    new_kubeconfig:
-      contexts:
-        - context:
-            cluster: microk8s-cluster
-            user: "{{ k8s_iac_user }}"
-          name: microk8s
-      users:
-        - name: "{{ k8s_iac_user }}"
-          user:
-            token: "{{ token.stdout }}"
-  tags:
-    - k8s::iac
+- name: Render kubeconfig
+  when: kubeconfig.stdout != ""
+  block:
+    - name: Patch kubeconfig with user token
+      ansible.builtin.set_fact:
+        patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
+      vars:
+        new_kubeconfig:
+          contexts:
+            - context:
+                cluster: microk8s-cluster
+                user: "{{ microk8s_iac_user }}"
+              name: microk8s
+          users:
+            - name: "{{ microk8s_iac_user }}"
+              user:
+                token: "{{ token.stdout }}"
+      tags:
+        - k8s::iac
 
-- name: Check if a config already exists and its SHA1
-  become: true
-  ansible.builtin.stat:
-    path: "{{ k8s_kubeconfig }}"
-  register: kubeconfig_exists
-  tags:
-    - k8s::iac
+    - name: Check if a config already exists and its SHA1
+      become: true
+      ansible.builtin.stat:
+        path: "{{ k8s_kubeconfig }}"
+      register: kubeconfig_exists
+      tags:
+        - k8s::iac
 
-- name: Get new config SHA1
-  ansible.builtin.set_fact:
-    patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
-  tags:
-    - k8s::iac
+    - name: Get new config SHA1
+      ansible.builtin.set_fact:
+        patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
+      tags:
+        - k8s::iac
 
-- name: Write kubeconfig
-  become: true
-  ansible.builtin.copy:
-    content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
-    dest: "{{ k8s_kubeconfig }}"
-    owner: "{{ k8s_iac_user }}"
-    mode: "0600"
-  when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
-  tags:
-    - k8s::iac
+    - name: Write kubeconfig
+      become: true
+      ansible.builtin.copy:
+        content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
+        dest: "{{ k8s_kubeconfig }}"
+        owner: "{{ microk8s_iac_user }}"
+        mode: "0600"
+      when:
+        - not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      tags:
+        - k8s::iac