generate secrets on first master

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -1,31 +1,29 @@
 ---
 - name: certs | write openssl config
-  become: False
-  local_action: template src="openssl.conf.j2" dest="{{ role_path }}/files/openssl.conf"
+  template:
+    src: "openssl.conf.j2"
+    dest: "{{ kube_config_dir }}/openssl.conf"
   run_once: yes
-  when: gen_certs|default(false)
+  when: inventory_hostname == groups['kube-master'][0] and gen_certs|default(false)
+
+- name: certs | copy certs generation script
+  copy:
+    src: "make-ssl.sh"
+    dest: "{{ kube_script_dir }}/make-ssl.sh"
+    mode: 0700
+  run_once: yes
+  when: inventory_hostname == groups['kube-master'][0] and gen_certs|default(false)
 
 - name: certs | run cert generation script
-  become: False
-  local_action: shell
-    {{ role_path }}/scripts/make-ssl.sh
-    -f {{ role_path }}/files/openssl.conf
-    -d {{ role_path }}/files/certs/
+  command: "{{ kube_script_dir }}/make-ssl.sh -f {{ kube_config_dir }}/openssl.conf -d {{ kube_cert_dir }}"
   run_once: yes
-  when: gen_certs|default(false)
+  when: inventory_hostname == groups['kube-master'][0] and gen_certs|default(false)
   notify: set secret_changed
 
 - set_fact:
     master_certs: ['ca-key.pem', 'admin.pem', 'admin-key.pem', 'apiserver-key.pem', 'apiserver.pem']
     node_certs: ['ca.pem', 'node.pem', 'node-key.pem']
 
-- name: certs | Copy certs on first master
-  copy:
-    src: "certs/{{ item }}"
-    dest: "{{ kube_cert_dir }}"
-  with_items: '{{ master_certs + node_certs }}'
-  when: inventory_hostname == "{{ groups['kube-master'][0] }}" and gen_certs|default(false)
-
 - name: certs | Get the certs from first master
   slurp:
     src: "{{ kube_cert_dir }}/{{ item }}"