fix/ansible 2.19: ssl_ca_dirs: don't rely on final evaluation (#13477)

roles/kubespray_defaults/defaults/main/main.yml

@@ -639,18 +639,7 @@ local_volume_provisioner_base_dir: /mnt/disks
 local_volume_provisioner_mount_dir: /mnt/disks
 local_volume_provisioner_storage_classes: "{{ local_volume_provisioner_storage_classes_default | items2dict }}"
 
-ssl_ca_dirs: |-
-  [
-  {% if ansible_facts['os_family'] in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] -%}
-  '/usr/share/ca-certificates',
-  {% elif ansible_facts['os_family'] == 'RedHat' -%}
-  '/etc/pki/tls',
-  '/etc/pki/ca-trust',
-  {% elif ansible_facts['os_family'] == 'Debian' -%}
-  '/usr/share/ca-certificates',
-  {% endif -%}
-  ]
-
+ssl_ca_dirs: "{{ ssl_ca_dirs_per_os_family[ansible_facts['os_family']] | d([]) }}"
 # used for delegating tasks on a working control plane node
 first_kube_control_plane: "{{ groups['kube_control_plane'] | first }}"
 # Vars for pointing to kubernetes api endpoints

roles/kubespray_defaults/vars/main/main.yml

@@ -52,3 +52,12 @@ local_volume_provisioner_storage_classes_default:
       mount_dir: "{{ local_volume_provisioner_mount_dir }}"
       volume_mode: Filesystem
       fs_type: ext4
+
+ssl_ca_dirs_per_os_family:
+  Debian: &usr_share
+    - /usr/share/ca-certificates
+  Flatcar: *usr_share
+  'Flatcar Container Linux by Kinvolk': *usr_share
+  RedHat:
+    - /etc/pki/tls
+    - /etc/pki/ca-trust