Fix cinder & external_openstack cacert deployment (#6745) (#6832)

The CA cert was only deployed on master nodes

roles/kubernetes-apps/csi_driver/cinder/tasks/cinder-write-cacert.yml

@@ -0,0 +1,12 @@
+---
+# include to workaround mitogen issue
+# https://github.com/dw/mitogen/issues/663
+
+- name: Cinder CSI Driver | Write cacert file
+  copy:
+    src: "{{ cinder_cacert }}"
+    dest: "{{ kube_config_dir }}/cinder-cacert.pem"
+    group: "{{ kube_cert_group }}"
+    mode: 0640
+  tags: cinder-csi-driver
+  delegate_to: "{{ delegate_host_to_write_cacert }}"

roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml

@@ -3,11 +3,11 @@
   tags: cinder-csi-driver
 
 - name: Cinder CSI Driver | Write cacert file
-  copy:
+  include_tasks: cinder-write-cacert.yml
-    src: "{{ cinder_cacert }}"
+  run_once: true
-    dest: "{{ kube_config_dir }}/cinder-cacert.pem"
+  loop: "{{ groups['k8s-cluster'] }}"
-    group: "{{ kube_cert_group }}"
+  loop_control:
-    mode: 0640
+    loop_var: delegate_host_to_write_cacert
   when:
     - inventory_hostname in groups['k8s-cluster']
     - cinder_cacert is defined

roles/kubernetes-apps/external_cloud_controller/openstack/tasks/main.yml

@@ -3,11 +3,11 @@
   tags: external-openstack
 
 - name: External OpenStack Cloud Controller | Write cacert file
-  copy:
+  include_tasks: openstack-write-cacert.yml
-    src: "{{ external_openstack_cacert }}"
+  run_once: true
-    dest: "{{ kube_config_dir }}/external-openstack-cacert.pem"
+  loop: "{{ groups['k8s-cluster'] }}"
-    group: "{{ kube_cert_group }}"
+  loop_control:
-    mode: 0640
+    loop_var: delegate_host_to_write_cacert
   when:
     - inventory_hostname in groups['k8s-cluster']
     - external_openstack_cacert is defined

roles/kubernetes-apps/external_cloud_controller/openstack/tasks/openstack-write-cacert.yml

@@ -0,0 +1,12 @@
+---
+# include to workaround mitogen issue
+# https://github.com/dw/mitogen/issues/663
+
+- name: External OpenStack Cloud Controller | Write cacert file
+  copy:
+    src: "{{ external_openstack_cacert }}"
+    dest: "{{ kube_config_dir }}/external-openstack-cacert.pem"
+    group: "{{ kube_cert_group }}"
+    mode: 0640
+  tags: external-openstack
+  delegate_to: "{{ delegate_host_to_write_cacert }}"