Ansible kubespray script looking for /etc/kubernetes/pki directory . unable to load CA certificate /etc/kubernetes/pki/etc/kubernetes/pki/ca.crt

[erdarun]

Is this a BUG REPORT or FEATURE REQUEST? (choose one): Bug

Environment:

• Cloud provider or hardware configuration: cloud

• OS (printf "$(uname -srm)\n$(cat /etc/os-release)\n"):
  Linux 3.10.0-862.9.1.el7.x86_64 x86_64
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:7"
  HOME_URL="https://www.centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

• Version of Ansible (ansible --version): 2.7.5

Kubespray version (commit) (git rev-parse --short HEAD): a6cb551

Network plugin used: calico

Copy of your inventory file:

[all]
node1 ansible_host=10.38.133.7 ip=10.38.133.7
node2 ansible_host=10.38.141.119 ip=10.38.141.119
node3 ansible_host=10.38.130.133 ip=10.38.130.133
node4 ansible_host=10.38.128.144 ip=10.38.128.144
node5 ansible_host=10.38.138.184 ip=10.38.138.184
node6 ansible_host=10.38.134.231 ip=10.38.134.231
node7 ansible_host=10.38.141.67 ip=10.38.141.67

[kube-master]
node1
node2
node7

[kube-node]
node1
node2
node3
node4
node5
node6

[etcd]
node1
node2
node3

[k8s-cluster:children]
kube-node
kube-master

[all:vars]
ansible_ssh_user="root"
ansible_become=true
ansible_python_interpreter="/usr/bin/python2.7"
etcd_multiaccess=true
loadbalancer_apiserver_localhost=false
bootstrap_os="centos"
kube_log_dir="/var/log/kubernetes"
retry_stagger=60
kube_log_level=2
kube_network_plugin="calico"
dns_mode="dnsmasq_kubedns"
#deploy_netchecker=true
docker_dns_servers_strict="no"
docker_dns_servers=[ "172.16.48.2" "10.65.84.80" ]
kube_service_addresses="172.16.48.0/22"
calico_subnet="172.16.52.1/22"
kube_pods_subnet="172.16.56.0/21"
kube_network_node_prefix=28
kubelet_load_modules=true
kernel_upgrade=true
override_system_hostname=false
kubelet_fail_swap_on=False

Command used to invoke ansible:
ansible-playbook -b cluster.yml -i inventory/lab/hosts.ini -e kube_version=v1.13.2 -vv --flush-cache

Output of ansible run:

Got stuck when initializing master and unitializing master.

Check master with journalctl -fu kubelet
received below message.
unable to load CA certificate /etc/kubernetes/pki/etc/kubernetes/pki/ca.crt

There is no pki directory available. As an working around, started creating symlinks from /etc/kubernetes/ssl to /etc/kubernetes/pki directory and everything workings well.

Scripts are ran as root user and password less login enabled.

Please guide me in how to get this sorted without manual intervention. Thanks

Anything else do we need to know:

NAME STATUS ROLES AGE VERSION
node1 Ready master 16h v1.13.3
node2 Ready master 16h v1.13.3
node3 Ready 16h v1.13.3
node4 Ready 16h v1.13.3
node5 Ready 16h v1.13.3

Roles not updated for nodes , we were suppose to manually update.

[jimk-osu]

issue 4038 has a small hack that seemed to work for me manually and I've added the following to kubespray/roles/kubernetes/master/tasks/kubeadm-certificate.yml:

- name: Sym link ssl to pki
  command: "ln -s {{ kube_cert_dir }} /etc/kubernetes/pki"