fix add nodes to the cluster

roles/kubernetes/secrets/tasks/gen_certs.yml

@@ -3,6 +3,7 @@
   become: False
   local_action: template src="openssl.conf.j2" dest="{{ role_path }}/files/openssl.conf"
   run_once: yes
+  when: gen_certs|default(false)
 
 - name: certs | run cert generation script
   become: False
@@ -11,28 +12,47 @@
     -f {{ role_path }}/files/openssl.conf
     -d {{ role_path }}/files/certs/
   run_once: yes
+  when: gen_certs|default(false)
+  notify: set secret_changed
+
+- set_fact:
+    master_certs: ['ca-key.pem', 'admin.pem', 'admin-key.pem', 'apiserver-key.pem', 'apiserver.pem']
+    node_certs: ['ca.pem', 'node.pem', 'node-key.pem']
+
+- name: certs | Copy certs on first master
+  copy:
+    src: "certs/{{ item }}"
+    dest: "{{ kube_cert_dir }}"
+  with_items: '{{ master_certs + node_certs }}'
+  when: inventory_hostname == "{{ groups['kube-master'][0] }}" and gen_certs|default(false)
+
+- name: certs | Get the certs from first master
+  slurp:
+    src: "{{ kube_cert_dir }}/{{ item }}"
+  delegate_to: "{{groups['kube-master'][0]}}"
+  register: slurp_certs
+  with_items: '{{ master_certs + node_certs }}'
+  when: sync_certs|default(false)
+  run_once: true
+  notify: set secret_changed
+
+- name: certs | Copy certs on masters
+  copy:
+    content: "{{ item.content|b64decode }}"
+    dest: "{{ item.source }}"
+  with_items: '{{slurp_certs.results}}'
+  when: item.item in master_certs and
+        inventory_hostname in groups['kube-master'] and sync_certs|default(false) and
+        inventory_hostname != groups['kube-master'][0]
 
 - name: certs | Copy certs on nodes
   copy:
-    src: "certs/{{ item }}"
-    dest: "{{ kube_cert_dir }}"
-  with_items:
-    - ca.pem
-    - node.pem
-    - node-key.pem
-  when: inventory_hostname in "{{ groups['k8s-cluster'] }}"
-
-- name: certs | Copy certs on master
-  copy:
-    src: "certs/{{ item }}"
-    dest: "{{ kube_cert_dir }}"
-  with_items:
-    - ca-key.pem
-    - admin.pem
-    - admin-key.pem
-    - apiserver-key.pem
-    - apiserver.pem
-  when: inventory_hostname in "{{ groups['kube-master'] }}"
+    content: "{{ item.content|b64decode }}"
+    dest: "{{ item.source }}"
+  with_items: '{{slurp_certs.results}}'
+  when: item.item in node_certs and
+        inventory_hostname in groups['kube-node'] and sync_certs|default(false) and
+        inventory_hostname != groups['kube-master'][0]
 
 - name: certs | check certificate permissions
   file:
@@ -43,6 +63,7 @@
 
 - shell: ls {{ kube_cert_dir}}/*key.pem
   register: keyfiles
+  changed_when: false
 
 - name: certs | set permissions on keys
   file: