refactor: resolve apiserver endpoints via internal vars

kajal-jotwani · kajal-jotwani · commit 85c7ebdc38df · 2026-02-13T12:38:32.000+05:30
diff --git a/roles/kubernetes-apps/ansible/tasks/main.yml b/roles/kubernetes-apps/ansible/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_endpoint }}/healthz"
     validate_certs: false
     client_cert: "{{ kube_apiserver_client_cert }}"
     client_key: "{{ kube_apiserver_client_key }}"
diff --git a/roles/kubernetes-apps/cluster_roles/tasks/main.yml b/roles/kubernetes-apps/cluster_roles/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_endpoint }}/healthz"
     validate_certs: false
     client_cert: "{{ kube_apiserver_client_cert }}"
     client_key: "{{ kube_apiserver_client_key }}"
diff --git a/roles/kubernetes/client/tasks/main.yml b/roles/kubernetes/client/tasks/main.yml
@@ -26,8 +26,8 @@
 
 - name: Wait for k8s apiserver
   wait_for:
-    host: "{{ kube_apiserver_endpoint | urlsplit('hostname') }}"
-    port: "{{ kube_apiserver_endpoint | urlsplit('port') | default(kube_apiserver_port) }}"
+    host: "{{ _kube_apiserver_endpoint | urlsplit('hostname') }}"
+    port: "{{ _kube_apiserver_endpoint | urlsplit('port') | default(kube_apiserver_port) }}"
     timeout: 180
 
 - name: Get admin kubeconfig from remote host
@@ -50,7 +50,7 @@
     user_certs: "{{ admin_kubeconfig['users'][0]['user'] }}"
     username: "kubernetes-admin-{{ cluster_name }}"
     context: "kubernetes-admin-{{ cluster_name }}@{{ cluster_name }}"
-    override_cluster_name: "{{ {'clusters': [{'cluster': (cluster_infos | combine({'server': kube_apiserver_endpoint})), 'name': cluster_name}]} }}"
+    override_cluster_name: "{{ {'clusters': [{'cluster': (cluster_infos | combine({'server': _kube_apiserver_endpoint})), 'name': cluster_name}]} }}"
     override_context: "{{ {'contexts': [{'context': {'user': username, 'cluster': cluster_name}, 'name': context}], 'current-context': context} }}"
     override_user: "{{ {'users': [{'name': username, 'user': user_certs}]} }}"
   when: kubeconfig_localhost
diff --git a/roles/kubernetes/control-plane/handlers/main.yml b/roles/kubernetes/control-plane/handlers/main.yml
@@ -106,7 +106,7 @@
 
 - name: Control plane | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_endpoint }}/healthz"
     validate_certs: false
   register: result
   until: result.status == 200
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml b/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml
@@ -4,7 +4,7 @@
   lineinfile:
     dest: "{{ kube_config_dir }}/{{ item }}"
     regexp: '^    server: https'
-    line: '    server: {{ kube_apiserver_endpoint }}'
+    line: '    server: {{ _kube_apiserver_endpoint }}'
     backup: true
   with_items:
     - admin.conf
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml b/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml
@@ -3,10 +3,10 @@
   set_fact:
     # noqa: jinja[spacing]
     kubeadm_discovery_address: >-
-      {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%}
+      {%- if "127.0.0.1" in _kube_apiserver_endpoint or "localhost" in _kube_apiserver_endpoint -%}
       {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}
       {%- else -%}
-      {{ kube_apiserver_endpoint | regex_replace('https://', '') }}
+      {{ _kube_apiserver_endpoint | regex_replace('https://', '') }}
       {%- endif %}
   tags:
     - facts
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
@@ -36,7 +36,7 @@
       - "localhost"
       - "127.0.0.1"
       - "::1"
-      - "{{ kube_apiserver_endpoint | urlsplit('hostname') }}"
+      - "{{ _kube_apiserver_endpoint | urlsplit('hostname') }}"
       - "{{ supplementary_addresses_in_ssl_keys }}"
       - "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_access_ip') }}"
       - "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_ip') }}"
diff --git a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2
@@ -97,7 +97,7 @@ featureGates:
 {%   endfor %}
 {% endif %}
 kubernetesVersion: v{{ kube_version }}
-controlPlaneEndpoint: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
+controlPlaneEndpoint: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
 certificatesDir: {{ kube_cert_dir }}
 imageRepository: {{ kubeadm_image_repo }}
 apiServer:
diff --git a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2 b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2
@@ -116,7 +116,7 @@ featureGates:
 {%   endfor %}
 {% endif %}
 kubernetesVersion: v{{ kube_version }}
-controlPlaneEndpoint: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
+controlPlaneEndpoint: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
 certificatesDir: {{ kube_cert_dir }}
 imageRepository: {{ kubeadm_image_repo }}
 apiServer:
diff --git a/roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2 b/roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2
@@ -6,7 +6,7 @@ discovery:
     kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
 {% else %}
   bootstrapToken:
-    apiServerEndpoint: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
+    apiServerEndpoint: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
     token: {{ kubeadm_token }}
     unsafeSkipCAVerification: true
 {% endif %}
diff --git a/roles/kubernetes/kubeadm/tasks/main.yml b/roles/kubernetes/kubeadm/tasks/main.yml
@@ -3,10 +3,10 @@
   set_fact:
     # noqa: jinja[spacing]
     kubeadm_discovery_address: >-
-      {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%}
+      {%- if "127.0.0.1" in _kube_apiserver_endpoint or "localhost" in _kube_apiserver_endpoint -%}
       {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}
       {%- else -%}
-      {{ kube_apiserver_endpoint | replace("https://", "") }}
+      {{ _kube_apiserver_endpoint | replace("https://", "") }}
       {%- endif %}
   tags:
     - facts
@@ -104,19 +104,19 @@
   lineinfile:
     dest: "{{ kube_config_dir }}/kubelet.conf"
     regexp: 'server:'
-    line: '    server: {{ kube_apiserver_cluster_internal_endpoint }}'
+    line: '    server: {{ _kube_apiserver_cluster_internal_endpoint }}'
     backup: true
   when:
     - not (kubeadm_use_control_plane_endpoint | default(false))
     - ('kube_control_plane' not in group_names)
-    - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "")
+    - kubeadm_discovery_address != _kube_apiserver_endpoint | replace("https://", "")
   notify: Kubeadm | restart kubelet
 
 - name: Update server field in kubelet kubeconfig - when using control plane endpoint
   lineinfile:
     dest: "{{ kube_config_dir }}/kubelet.conf"
     regexp: '^    server: https'
-    line: '    server: {{ kube_apiserver_cluster_internal_endpoint }}'
+    line: '    server: {{ _kube_apiserver_cluster_internal_endpoint }}'
     backup: true
   when:
     - ('kube_control_plane' not in group_names)
@@ -148,7 +148,7 @@
   delegate_facts: false
   when:
     - not (kubeadm_use_control_plane_endpoint | default(false))
-    - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "")
+    - kubeadm_discovery_address != _kube_apiserver_endpoint | replace("https://", "")
     - kube_proxy_deployed
     - loadbalancer_apiserver_localhost
   tags:
@@ -157,7 +157,7 @@
 - name: Update server field in kube-proxy kubeconfig - when using control plane endpoint
   shell: >-
     set -o pipefail && {{ kubectl }} get configmap kube-proxy -n kube-system -o yaml
-    | sed 's#server:.*#server: {{ kube_apiserver_cluster_internal_endpoint }}#g'
+    | sed 's#server:.*#server: {{ _kube_apiserver_cluster_internal_endpoint }}#g'
     | {{ kubectl }} replace -f -
   args:
     executable: /bin/bash
@@ -196,7 +196,7 @@
   when:
     - kube_proxy_deployed
     - original_configmap_resource_version.stdout != new_configmap_resource_version.stdout
-    - (not (kubeadm_use_control_plane_endpoint | default(false)) and kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "")) or (kubeadm_use_control_plane_endpoint | default(false))
+    - (not (kubeadm_use_control_plane_endpoint | default(false)) and kubeadm_discovery_address != _kube_apiserver_endpoint | replace("https://", "")) or (kubeadm_use_control_plane_endpoint | default(false))
   tags:
     - kube-proxy
 
diff --git a/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2 b/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2
@@ -7,7 +7,7 @@ discovery:
     kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
 {% else %}
   bootstrapToken:
-    apiServerEndpoint: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
+    apiServerEndpoint: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('netloc') }}"
     token: {{ kubeadm_token }}
 {% if ca_cert_content is defined %}
     caCertHashes:
diff --git a/roles/kubernetes/node-label/tasks/main.yml b/roles/kubernetes/node-label/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Kubernetes Apps | Wait for kube-apiserver
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_endpoint }}/healthz"
     validate_certs: false
     client_cert: "{{ kube_apiserver_client_cert }}"
     client_key: "{{ kube_apiserver_client_key }}"
diff --git a/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2 b/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2
@@ -5,7 +5,7 @@ clusters:
 - name: local
   cluster:
     certificate-authority: {{ kube_cert_dir }}/ca.pem
-    server: "{{ kube_apiserver_endpoint }}"
+    server: "{{ _kube_apiserver_endpoint }}"
 users:
 - name: kubelet
   user:
diff --git a/roles/kubernetes/preinstall/handlers/main.yml b/roles/kubernetes/preinstall/handlers/main.yml
@@ -108,7 +108,7 @@
 # When running this as the last phase ensure we wait for kube-apiserver to come up
 - name: Preinstall | wait for the apiserver to be running
   uri:
-    url: "{{ kube_apiserver_endpoint }}/healthz"
+    url: "{{ _kube_apiserver_endpoint }}/healthz"
     validate_certs: false
   register: result
   until: result.status == 200
diff --git a/roles/kubespray_defaults/defaults/main/main.yml b/roles/kubespray_defaults/defaults/main/main.yml
@@ -641,18 +641,18 @@ kube_apiserver_address: "{{ hostvars[inventory_hostname]['main_ip'] }}"
 kube_apiserver_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}"
 first_kube_control_plane_address: "{{ hostvars[groups['kube_control_plane'][0]]['main_access_ip'] }}"
 # Loadbalancer configuration
-loadbalancer_apiserver_localhost: true
+loadbalancer_apiserver_localhost: "{{ loadbalancer_apiserver is not defined }}"
 loadbalancer_apiserver_type: "nginx"
 loadbalancer_apiserver_port: "{{ kube_apiserver_port }}"
 
 # Primary API endpoint for external access (e.g., kubectl).
 # User should set this in their inventory if they have a Load Balancer.
-# If not provided, we default to the first control plane node's IP.
-kube_apiserver_endpoint: "https://{{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}"
+# If not provided, resolved internally in vars.
+kube_apiserver_endpoint: "{{ undef() }}"
 
 # Internal endpoint for cluster traffic.
-# Defaults to the global endpoint, unless we are using a localhost API load balancer.
-kube_apiserver_cluster_internal_endpoint: "{{ ('https://127.0.0.1:' ~ loadbalancer_apiserver_port) if loadbalancer_apiserver_localhost else kube_apiserver_endpoint }}"
+# Optional override; resolved internally in vars if not provided.
+kube_apiserver_cluster_internal_endpoint: "{{ undef() }}"
 
 kube_apiserver_client_cert: "{{ kube_cert_dir }}/ca.crt"
 kube_apiserver_client_key: "{{ kube_cert_dir }}/ca.key"
diff --git a/roles/kubespray_defaults/vars/main/main.yml b/roles/kubespray_defaults/vars/main/main.yml
@@ -43,3 +43,13 @@ kube_pods_subnets: >-
   {%- else -%}
   {{ kube_pods_subnet_ipv6 }}
   {%- endif -%}
+
+# Internal API server endpoints (cannot be overridden by inventory).
+_kube_apiserver_endpoint: >-
+  {{ kube_apiserver_endpoint
+     | d('https://' ~ (first_kube_control_plane_address | ansible.utils.ipwrap) ~ ':' ~ kube_apiserver_port) }}
+
+_kube_apiserver_cluster_internal_endpoint: >-
+  {{ kube_apiserver_cluster_internal_endpoint
+     | d('https://127.0.0.1:' ~ loadbalancer_apiserver_port)
+     if loadbalancer_apiserver_localhost else _kube_apiserver_endpoint }}
diff --git a/roles/network_facts/tasks/no_proxy.yml b/roles/network_facts/tasks/no_proxy.yml
@@ -3,7 +3,7 @@
   set_fact:
     # noqa: jinja[spacing]
     no_proxy_prepare: >-
-      {{ kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }},
+      {{ _kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }},
       {%- if no_proxy_exclude_workers | default(false) -%}
       {% set cluster_or_control_plane = 'kube_control_plane' %}
       {%- else -%}
diff --git a/roles/network_plugin/calico/templates/kubernetes-services-endpoint.yml.j2 b/roles/network_plugin/calico/templates/kubernetes-services-endpoint.yml.j2
@@ -6,6 +6,6 @@ metadata:
   name: kubernetes-services-endpoint
 data:
 {% if calico_bpf_enabled or loadbalancer_apiserver_localhost %}
-  KUBERNETES_SERVICE_HOST: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }}"
-  KUBERNETES_SERVICE_PORT: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('port') }}"
+  KUBERNETES_SERVICE_HOST: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }}"
+  KUBERNETES_SERVICE_PORT: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('port') }}"
 {% endif %}
diff --git a/roles/network_plugin/cilium/templates/values.yaml.j2 b/roles/network_plugin/cilium/templates/values.yaml.j2
@@ -7,8 +7,8 @@ image:
   repository: {{ cilium_image_repo }}
   tag: {{ cilium_image_tag }}
 
-k8sServiceHost: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }}"
-k8sServicePort: "{{ kube_apiserver_cluster_internal_endpoint | urlsplit('port') }}"
+k8sServiceHost: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('hostname') }}"
+k8sServicePort: "{{ _kube_apiserver_cluster_internal_endpoint | urlsplit('port') }}"
 
 ipv4:
   enabled: {{ cilium_enable_ipv4 | to_json }}
diff --git a/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2 b/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2
@@ -5,7 +5,7 @@ clusters:
 - name: cluster
   cluster:
     certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-    server: {{ kube_apiserver_endpoint }}
+    server: {{ _kube_apiserver_endpoint }}
 users:
 - name: kube-router
   user:
