@when('leadership.is_leader')
@when_not('authentication.setup')
def setup_leader_authentication():
    'Setup basic authentication and token access for the cluster.'
    api_opts = FlagManager('kube-apiserver')
    controller_opts = FlagManager('kube-controller-manager')
    service_key = '/root/cdk/serviceaccount.key'
    basic_auth = '/root/cdk/basic_auth.csv'
    known_tokens = '/root/cdk/known_tokens.csv'
    api_opts.add('basic-auth-file', basic_auth)
    api_opts.add('token-auth-file', known_tokens)
    hookenv.status_set('maintenance', 'Rendering authentication templates.')
    keys = [service_key, basic_auth, known_tokens]
    if ((not get_keys_from_leader(keys)) or is_state('reconfigure.authentication.setup')):
        last_pass = get_password('basic_auth.csv', 'admin')
        setup_basic_auth(last_pass, 'admin', 'admin')
        if (not os.path.isfile(known_tokens)):
            setup_tokens(None, 'admin', 'admin')
            setup_tokens(None, 'kubelet', 'kubelet')
            setup_tokens(None, 'kube_proxy', 'kube_proxy')
        os.makedirs('/root/cdk', exist_ok=True)
        if (not os.path.isfile(service_key)):
            cmd = ['openssl', 'genrsa', '-out', service_key, '2048']
            check_call(cmd)
        remove_state('reconfigure.authentication.setup')
    api_opts.add('service-account-key-file', service_key)
    controller_opts.add('service-account-private-key-file', service_key)
    leader_data = {}
    for f in [known_tokens, basic_auth, service_key]:
        with open(f, 'r') as fp:
            leader_data[f] = fp.read()
    charms.leadership.leader_set(leader_data)
    remove_state('kubernetes-master.components.started')
    set_state('authentication.setup')
Setup basic authentication and token access for the cluster.
@when('leadership.is_leader')
@when_not('authentication.setup')
def setup_leader_authentication():
    
    api_opts = FlagManager('kube-apiserver')
    controller_opts = FlagManager('kube-controller-manager')
    service_key = '/root/cdk/serviceaccount.key'
    basic_auth = '/root/cdk/basic_auth.csv'
    known_tokens = '/root/cdk/known_tokens.csv'
    api_opts.add('basic-auth-file', basic_auth)
    api_opts.add('token-auth-file', known_tokens)
    hookenv.status_set('maintenance', 'Rendering authentication templates.')
    keys = [service_key, basic_auth, known_tokens]
    if ((not get_keys_from_leader(keys)) or is_state('reconfigure.authentication.setup')):
        last_pass = get_password('basic_auth.csv', 'admin')
        setup_basic_auth(last_pass, 'admin', 'admin')
        if (not os.path.isfile(known_tokens)):
            setup_tokens(None, 'admin', 'admin')
            setup_tokens(None, 'kubelet', 'kubelet')
            setup_tokens(None, 'kube_proxy', 'kube_proxy')
        os.makedirs('/root/cdk', exist_ok=True)
        if (not os.path.isfile(service_key)):
            cmd = ['openssl', 'genrsa', '-out', service_key, '2048']
            check_call(cmd)
        remove_state('reconfigure.authentication.setup')
    api_opts.add('service-account-key-file', service_key)
    controller_opts.add('service-account-private-key-file', service_key)
    leader_data = {}
    for f in [known_tokens, basic_auth, service_key]:
        with open(f, 'r') as fp:
            leader_data[f] = fp.read()
    charms.leadership.leader_set(leader_data)
    remove_state('kubernetes-master.components.started')
    set_state('authentication.setup')