add support for output of tokens to a known location so kubectl can be configured

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -65,3 +65,11 @@
   shell: chmod 0600 {{ kube_cert_dir}}/*key.pem
   when: inventory_hostname in groups['kube-master']
   changed_when: false
+
+- name: Gen_certs | download certs for remote kubectl
+  fetch: src="{{ kube_cert_dir }}/{{ item }}" dest="output/tokens/{{ item }}" flat=yes
+  delegate_to: "{{ groups['kube-master'][0] }}"
+  with_items:
+    - "ca.pem"
+    - "admin.pem"
+    - "admin-key.pem"