gen_certs_script.yml

---
- name: "Gen_certs | Create kubernetes config directory (on {{groups['kube-master'][0]}})"
  file:
    path: "{{ kube_config_dir }}"
    state: directory
    owner: kube
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_certs|default(false)
  tags:
    - kubelet
    - k8s-secrets
    - kube-controller-manager
    - kube-apiserver
    - bootstrap-os
    - apps
    - network
    - master
    - node

- name: "Gen_certs | Create kubernetes script directory (on {{groups['kube-master'][0]}})"
  file:
    path: "{{ kube_script_dir }}"
    state: directory
    owner: kube
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_certs|default(false)
  tags:
    - k8s-secrets
    - bootstrap-os

- name: Gen_certs | write openssl config
  template:
    src: "openssl.conf.j2"
    dest: "{{ kube_config_dir }}/openssl.conf"
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_certs|default(false)

- name: Gen_certs | copy certs generation script
  copy:
    src: "make-ssl.sh"
    dest: "{{ kube_script_dir }}/make-ssl.sh"
    mode: 0700
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_certs|default(false)

- name: Gen_certs | run cert generation script
  command: "{{ kube_script_dir }}/make-ssl.sh -f {{ kube_config_dir }}/openssl.conf -d {{ kube_cert_dir }}"
  environment:
    - MASTERS: "{% for m in groups['kube-master'] %}
                  {% if gen_master_certs|default(false) %}
                    {{ m }}
                  {% endif %}
                {% endfor %}"
    - HOSTS: "{% for h in groups['k8s-cluster'] %}
                {% if gen_node_certs[h]|default(true) %}
                    {{ h }}
                {% endif %}
              {% endfor %}"
  run_once: yes
  delegate_to: "{{groups['kube-master'][0]}}"
  when: gen_certs|default(false)
  notify: set secret_changed

- set_fact:
    all_master_certs: "['ca-key.pem',
                       'apiserver.pem',