Fix vault file owner issues and k8s apiserver cert creation (#2985)

apiserver cert should be created only once

roles/kubernetes/secrets/tasks/gen_certs_vault.yml

@@ -44,6 +44,7 @@
     issue_cert_file_group: "{{ kube_cert_group }}"
     issue_cert_file_owner: kube
     issue_cert_hosts: "{{ groups['kube-master'] }}"
+    issue_cert_run_once: true
     issue_cert_ip_sans: >-
         [
         {%- for host in groups['kube-master']  -%}