Always create service account even rbac_enabled = false

roles/dnsmasq/tasks/main.yml

@@ -59,7 +59,6 @@
   with_items:
     - "dnsmasq-clusterrolebinding.yml"
     - "dnsmasq-serviceaccount.yml"
-  when: rbac_enabled
   delegate_to: "{{ groups['kube-master'][0] }}"
   run_once: true
 
@@ -68,7 +67,6 @@
   with_items:
     - "dnsmasq-clusterrolebinding.yml"
     - "dnsmasq-serviceaccount.yml"
-  when: rbac_enabled
   delegate_to: "{{ groups['kube-master'][0] }}"
   run_once: true
 

roles/dnsmasq/templates/dnsmasq-autoscaler.yml.j2

@@ -31,9 +31,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
     spec:
-{% if rbac_enabled %}
       serviceAccountName: dnsmasq
-{% endif %}
       tolerations:
         - effect: NoSchedule
           operator: Exists

roles/kubernetes-apps/ansible/defaults/main.yml

@@ -66,8 +66,3 @@ dashboard_token_ttl: 900
 # SSL
 etcd_cert_dir: "/etc/ssl/etcd/ssl"
 canal_cert_dir: "/etc/canal/certs"
-
-rbac_resources:
-  - sa
-  - clusterrole
-  - clusterrolebinding

roles/kubernetes-apps/ansible/tasks/coredns.yml

@@ -16,7 +16,6 @@
   when:
     - dns_mode in ['coredns', 'coredns_dual']
     - inventory_hostname == groups['kube-master'][0]
-    - rbac_enabled or item.type not in rbac_resources
   tags:
     - coredns
 
@@ -34,6 +33,5 @@
   when:
     - dns_mode == 'coredns_dual'
     - inventory_hostname == groups['kube-master'][0]
-    - rbac_enabled or item.type not in rbac_resources
   tags:
     - coredns

roles/kubernetes-apps/ansible/tasks/kubedns.yml

@@ -16,7 +16,6 @@
   when:
     - dns_mode in ['kubedns','dnsmasq_kubedns']
     - inventory_hostname == groups['kube-master'][0]
-    - rbac_enabled or item.type not in rbac_resources
   tags:
     - dnsmasq
     - kubedns

roles/kubernetes-apps/ansible/tasks/netchecker.yml

@@ -35,7 +35,6 @@
   register: manifests
   when:
     - inventory_hostname == groups['kube-master'][0]
-    - rbac_enabled or item.type not in rbac_resources
 
 - name: Kubernetes Apps | Purge old Netchecker server
   kube:

roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2

@@ -26,9 +26,7 @@ spec:
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
-{% if rbac_enabled %}
       serviceAccountName: coredns
-{% endif %}
       tolerations:
         - key: node-role.kubernetes.io/master
           effect: NoSchedule

roles/kubernetes-apps/ansible/templates/kubedns-autoscaler.yml.j2

@@ -64,6 +64,4 @@ spec:
         - --default-params={"linear":{"nodesPerReplica":{{ kubedns_nodes_per_replica }},"min":{{ kubedns_min_replicas }}}}
         - --logtostderr=true
         - --v=2
-{% if rbac_enabled %}
       serviceAccountName: cluster-proportional-autoscaler
-{% endif %}

roles/kubernetes-apps/ansible/templates/kubedns-deploy.yml.j2

@@ -172,6 +172,4 @@ spec:
             memory: 20Mi
             cpu: 10m
       dnsPolicy: Default  # Don't use cluster DNS.
-{% if rbac_enabled %}
       serviceAccountName: kube-dns
-{% endif %}

roles/kubernetes-apps/ansible/templates/netchecker-server-deployment.yml.j2

@@ -33,6 +33,4 @@ spec:
       tolerations:
         - effect: NoSchedule
           operator: Exists
-{% if rbac_enabled %}
       serviceAccountName: netchecker-server
-{% endif %}

roles/kubernetes-apps/efk/elasticsearch/tasks/main.yml

@@ -7,7 +7,6 @@
     - "efk-sa.yml"
     - "efk-clusterrolebinding.yml"
   run_once: true
-  when: rbac_enabled
 
 - name: "ElasticSearch | Create Serviceaccount and Clusterrolebinding (RBAC)"
   command: "{{ bin_dir }}/kubectl apply -f {{ kube_config_dir }}/{{ item }} -n kube-system"
@@ -15,7 +14,6 @@
     - "efk-sa.yml"
     - "efk-clusterrolebinding.yml"
   run_once: true
-  when: rbac_enabled
 
 - name: "ElasticSearch | Write ES deployment"
   template:

roles/kubernetes-apps/efk/elasticsearch/templates/elasticsearch-deployment.yml.j2

@@ -52,9 +52,7 @@ spec:
       volumes:
       - name: es-persistent-storage
         emptyDir: {}
-{% if rbac_enabled %}
       serviceAccountName: efk 
-{% endif %}
       initContainers:
       - image: alpine:3.6
         command: ["/sbin/sysctl", "-w", "vm.max_map_count=262144"]

roles/kubernetes-apps/efk/fluentd/templates/fluentd-ds.yml.j2

@@ -28,9 +28,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       priorityClassName: system-node-critical
-{% if rbac_enabled %}
       serviceAccountName: efk
-{% endif %}
       containers:
       - name: fluentd-es
         image: "{{ fluentd_image_repo }}:{{ fluentd_image_tag }}"

roles/kubernetes-apps/efk/kibana/templates/kibana-deployment.yml.j2

@@ -46,7 +46,4 @@ spec:
         - containerPort: 5601
           name: ui
           protocol: TCP
-{% if rbac_enabled %}
       serviceAccountName: efk 
-{% endif %}
-

roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2

@@ -19,9 +19,7 @@ spec:
         app: cephfs-provisioner
         version: {{ cephfs_provisioner_image_tag }}
     spec:
-{% if rbac_enabled %}
       serviceAccount: cephfs-provisioner
-{% endif %}
       containers:
         - name: cephfs-provisioner
           image: {{ cephfs_provisioner_image_repo }}:{{ cephfs_provisioner_image_tag }}

roles/kubernetes-apps/helm/tasks/main.yml

@@ -13,7 +13,7 @@
     - {name: tiller, file: tiller-sa.yml, type: sa}
     - {name: tiller, file: tiller-clusterrolebinding.yml, type: clusterrolebinding}
   register: manifests
-  when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0] and rbac_enabled
+  when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
 
 - name: Helm | Apply Helm Manifests (RBAC)
   kube:
@@ -24,7 +24,7 @@
     filename: "{{kube_config_dir}}/{{item.item.file}}"
     state: "latest"
   with_items: "{{ manifests.results }}"
-  when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0] and rbac_enabled
+  when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
 
 - name: Helm | Install/upgrade helm
   command: >

roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2

@@ -21,9 +21,7 @@ spec:
         prometheus.io/port: '10254'
         prometheus.io/scrape: 'true'
     spec:
-{% if rbac_enabled %}
       serviceAccountName: ingress-nginx
-{% endif %}
 {% if ingress_nginx_host_network %}
       hostNetwork: true
 {% endif %}

roles/kubernetes-apps/policy_controller/calico/defaults/main.yml

@@ -8,8 +8,3 @@ calico_policy_controller_memory_requests: 64M
 # SSL
 calico_cert_dir: "/etc/calico/certs"
 canal_cert_dir: "/etc/canal/certs"
-
-rbac_resources:
-  - sa
-  - clusterrole
-  - clusterrolebinding

roles/kubernetes-apps/policy_controller/calico/tasks/main.yml

@@ -26,8 +26,7 @@
     - {name: calico-kube-controllers, file: calico-kube-cr.yml, type: clusterrole}
     - {name: calico-kube-controllers, file: calico-kube-crb.yml, type: clusterrolebinding}
   register: calico_kube_manifests
-  when:
-    - rbac_enabled or item.type not in rbac_resources
+  when: inventory_hostname == groups['kube-master'][0] and not item|skipped
 
 - name: Start of Calico kube controllers
   kube:

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2

@@ -21,9 +21,7 @@ spec:
         k8s-app: calico-kube-controllers
     spec:
       hostNetwork: true
-{% if rbac_enabled %}
       serviceAccountName: calico-kube-controllers
-{% endif %}
       tolerations:
         - effect: NoSchedule
           operator: Exists