---
- block:
    - name: Get an existing kubeadm join token
      shell: |
        kubeadm token list 2>/dev/null \
          | awk '$4 == "authentication,signing" { print $1 }' \
          | head -n1
      register: kubeadm_token_list
      changed_when: False
      check_mode: False
      failed_when: False

    - name: Generate a new kubeadm token
      shell: "kubeadm token create 2>/dev/null || kubeadm token generate"
      register: kubeadm_token_create
      when: kubeadm_token_list.stdout | length == 0

    - set_fact:
        kubeadm_token: |-
          {%- if kubeadm_token_list.stdout | length > 0 -%}
            {{ kubeadm_token_list.stdout }}
          {%- else -%}
            {{ kubeadm_token_create.stdout }}
          {%- endif -%}

  when: kubeadm_token|default('') | length == 0