c12s-kubespray/roles/kubernetes/secrets/tasks/gen_certs.yml

---
- name: certs | write openssl config
  sudo: False
  local_action: template src="openssl.conf.j2" dest="{{ role_path }}/files/openssl.conf"
  run_once: yes

- name: certs | run cert generation script
  sudo: False
  local_action: shell
    {{ role_path }}/scripts/make-ssl.sh
    -f {{ role_path }}/files/openssl.conf
    -d {{ role_path }}/files/certs/
  run_once: yes

- name: certs | Copy certs on nodes
  copy:
    src: "certs/{{ item }}"
    dest: "{{ kube_cert_dir }}"
  with_items:
    - ca.pem
    - node.pem
    - node-key.pem
  when: inventory_hostname in "{{ groups['k8s-cluster'] }}"

- name: certs | Copy certs on master
  copy:
    src: "certs/{{ item }}"
    dest: "{{ kube_cert_dir }}"
  with_items:
    - ca-key.pem
    - admin.pem
    - admin-key.pem
    - apiserver-key.pem
    - apiserver.pem
  when: inventory_hostname in "{{ groups['kube-master'] }}"

- name: certs | check certificate permissions
  file:
    path={{ kube_cert_dir }}
    group={{ kube_cert_group }}
    owner=kube
    recurse=yes

- shell: ls {{ kube_cert_dir}}/*key.pem
  register: keyfiles

- name: certs | set permissions on keys
  file:
    path: "{{ item }}"
    mode: 0600
  with_items: "{{ keyfiles.stdout_lines }}"