Streamline path to certs dir (#3836)

* Streamline path to certs dir

* More fixes

* Set path to etcd certs in kubernetes defaults instead

roles/kubernetes/kubeadm/tasks/main.yml

@@ -16,7 +16,7 @@
   register: kubelet_conf
 
 - name: Calculate kubeadm CA cert hash
-  shell: openssl x509 -pubkey -in {{ kube_config_dir }}/ssl/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
+  shell: openssl x509 -pubkey -in {{ kube_cert_dir }}/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
   register: kubeadm_ca_hash
   delegate_to: "{{ groups['kube-master'][0] }}"
   run_once: true

roles/kubernetes/master/defaults/main.yml

@@ -14,10 +14,6 @@ kube_apiserver_bind_address: 0.0.0.0
 # Inclusive at both ends of the range.
 kube_apiserver_node_port_range: "30000-32767"
 
-# ETCD cert dir for connecting apiserver to etcd
-etcd_config_dir: /etc/ssl/etcd
-etcd_cert_dir: "{{ etcd_config_dir }}/ssl"
-
 # ETCD backend for k8s data
 kube_apiserver_storage_backend: etcd3
 

roles/kubernetes/master/tasks/encrypt-at-rest.yml

@@ -2,7 +2,7 @@
 - name: Write secrets for encrypting secret data at rest
   template:
     src: secrets_encryption.yaml.j2
-    dest: "{{ kube_config_dir }}/ssl/secrets_encryption.yaml"
+    dest: "{{ kube_cert_dir }}/secrets_encryption.yaml"
     owner: root
     group: "{{ kube_cert_group }}"
     mode: 0640

roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2

@@ -102,7 +102,7 @@ apiServerExtraArgs:
 {%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
-  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
+  experimental-encryption-provider-config: {{ kube_cert_dir }}/secrets_encryption.yaml
 {% endif %}
   storage-backend: {{ kube_apiserver_storage_backend }}
 {% if kube_api_runtime_config is defined %}

roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2

@@ -87,7 +87,7 @@ apiServerExtraArgs:
 {%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
-  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
+  experimental-encryption-provider-config: {{ kube_cert_dir }}/secrets_encryption.yaml
 {% endif %}
   storage-backend: {{ kube_apiserver_storage_backend }}
 {% if kube_api_runtime_config is defined %}

roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2

@@ -97,7 +97,7 @@ apiServerExtraArgs:
 {%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
-  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
+  experimental-encryption-provider-config: {{ kube_cert_dir }}/secrets_encryption.yaml
 {% endif %}
   storage-backend: {{ kube_apiserver_storage_backend }}
 {% if kube_api_runtime_config is defined %}

roles/kubernetes/master/templates/kubeadm-config.v1beta1.yaml.j2

@@ -95,7 +95,7 @@ apiServer:
 {%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
-    encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
+    encryption-provider-config: {{ kube_cert_dir }}/secrets_encryption.yaml
 {% endif %}
     storage-backend: {{ kube_apiserver_storage_backend }}
 {% if kube_api_runtime_config is defined %}

roles/kubernetes/node/defaults/main.yml

@@ -67,8 +67,6 @@ nginx_image_repo: nginx
 nginx_image_tag: 1.13
 nginx_config_dir: "/etc/nginx"
 
-etcd_config_dir: /etc/ssl/etcd
-
 kubelet_flexvolumes_plugins_dir: /var/lib/kubelet/volume-plugins
 
 # A port range to reserve for services with NodePort visibility.

roles/kubernetes/preinstall/tasks/0050-create_directories.yml

@@ -19,7 +19,7 @@
   with_items:
     - "{{bin_dir}}"
     - "{{ kube_config_dir }}"
-    - "{{ kube_config_dir }}/ssl"
+    - "{{ kube_cert_dir }}"
     - "{{ kube_manifest_dir }}"
     - "{{ kube_script_dir }}"