Fix #4237: update kube cert path (#4354)

roles/kubernetes/client/defaults/main.yml

@@ -4,4 +4,5 @@ kubectl_localhost: false
 artifacts_dir: "{{ inventory_dir }}/artifacts"
 
 kube_config_dir: "/etc/kubernetes"
+kube_cert_dir: "{{ kube_config_dir }}/pki"
 kube_apiserver_port: "6443"

roles/kubernetes/client/tasks/main.yml

@@ -49,7 +49,7 @@
     kubeconfig user
     --client-name kubernetes-admin
     --org system:masters
-    --cert-dir {{ kube_config_dir }}/ssl
+    --cert-dir {{ kube_cert_dir }}
     --apiserver-advertise-address {{ external_apiserver_address }}
     --apiserver-bind-port {{ external_apiserver_port }}
   run_once: yes

roles/kubernetes/master/tasks/kubeadm-setup.yml

@@ -71,7 +71,7 @@
   tags: facts
 
 - name: kubeadm | Copy etcd cert dir under k8s cert dir
-  command: "cp -TR {{ etcd_cert_dir }} {{ kube_config_dir }}/ssl/etcd"
+  command: "cp -TR {{ etcd_cert_dir }} {{ kube_cert_dir }}/etcd"
   changed_when: false
 
 - name: Create audit-policy directory

roles/kubernetes/preinstall/defaults/main.yml

@@ -25,6 +25,7 @@ disable_ipv6_dns: false
 
 kube_cert_group: kube-cert
 kube_config_dir: /etc/kubernetes
+kube_cert_dir: "{{ kube_config_dir }}/pki"
 
 # Container Linux by CoreOS cloud init config file to define /etc/resolv.conf content
 # for hostnet pods and infra needs

roles/kubespray-defaults/defaults/main.yaml

@@ -93,7 +93,7 @@ kube_script_dir: "{{ bin_dir }}/kubernetes-scripts"
 kube_manifest_dir: "{{ kube_config_dir }}/manifests"
 
 # This is where all the cert scripts and certs will be located
-kube_cert_dir: "{{ kube_config_dir }}/ssl"
+kube_cert_dir: "{{ kube_config_dir }}/pki"
 
 # This is where all of the bearer tokens will be stored
 kube_token_dir: "{{ kube_config_dir }}/tokens"