Fix etcd idempotency

roles/etcd/tasks/check_certs.yml

@@ -61,7 +61,7 @@
       {% if gen_node_certs[inventory_hostname] or 
         (not etcdcert_node.results[0].stat.exists|default(False)) or
           (not etcdcert_node.results[1].stat.exists|default(False)) or
-            (etcdcert_node.results[1].stat.checksum|default('') != etcdcert_master.files|selectattr("path", "equalto", etcdcert_node.results[1].stat.path)|first|map(attribute="checksum")|default('')) -%}
+            (etcdcert_node.results[1].stat.checksum|default('') != etcdcert_master.files|selectattr("path", "equalto", etcdcert_node.results[1].stat.path)|map(attribute="checksum")|first|default('')) -%}
               {%- set _ = certs.update({'sync': True}) -%}
       {% endif %}
       {{ certs.sync }}

roles/etcd/tasks/gen_certs_script.yml

@@ -4,7 +4,8 @@
     path: "{{ etcd_cert_dir }}"
     group: "{{ etcd_cert_group }}"
     state: directory
-    owner: root
+    owner: kube
+    mode: 0700
     recurse: yes
 
 - name: "Gen_certs | create etcd script dir (on {{groups['etcd'][0]}})"
@@ -12,6 +13,7 @@
     path: "{{ etcd_script_dir }}"
     state: directory
     owner: root
+    mode: 0700
   run_once: yes
   delegate_to: "{{groups['etcd'][0]}}"
 
@@ -20,8 +22,9 @@
     path: "{{ etcd_cert_dir }}"
     group: "{{ etcd_cert_group }}"
     state: directory
-    owner: root
+    owner: kube
     recurse: yes
+    mode: 0700
   run_once: yes
   delegate_to: "{{groups['etcd'][0]}}"
 
@@ -42,6 +45,7 @@
   delegate_to: "{{groups['etcd'][0]}}"
   when: gen_certs|default(false)
 
+
 - name: Gen_certs | run cert generation script
   command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
   environment:
@@ -114,7 +118,9 @@
 - name: Gen_certs | Prepare tempfile for unpacking certs                        
   shell: mktemp /tmp/certsXXXXX.tar.gz                                          
   register: cert_tempfile                                                       
-                                                                                
+  when: inventory_hostname in groups['etcd'] and sync_certs|default(false) and
+        inventory_hostname != groups['etcd'][0]                          
+
 - name: Gen_certs | Write master certs to tempfile                              
   copy:                                                                         
     content: "{{etcd_master_cert_data.stdout}}"                                      
@@ -154,13 +160,9 @@
     group: "{{ etcd_cert_group }}"
     state: directory
     owner: kube
+    mode: "u=rwX,g-rwx,o-rwx"
     recurse: yes
 
-- name: Gen_certs | set permissions on keys
-  shell: chmod 0600 {{ etcd_cert_dir}}/*key.pem
-  when: inventory_hostname in groups['etcd']
-  changed_when: false
-
 - name: Gen_certs | target ca-certificate store file
   set_fact:
     ca_cert_path: |-