fail to copy certs of kube-node from etcd[0] to other kube-node

[davidstack]

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
BUG
when use script to generate certs in kubernetst cluster. it will fail to copy certs of kube-node from etcd[0] to other kube-node which does not install etcd.
after i add this code at the last of file roles/etcd/tasks/gen_certs_script.yml
`

• name: Gen_certs | Copy etcd node certs
  synchronize:
  src: "{{item}}"
  dest: "{{etcd_cert_dir }}"
  with_items:
  • "{{ etcd_cert_dir }}/ca.pem"
  • "{{ etcd_cert_dir }}/ca-key.pem"
  • "[{% for node in groups['etcd'] %}
    '{{ etcd_cert_dir }}/admin-{{ node }}.pem',
    '{{ etcd_cert_dir }}/admin-{{ node }}-key.pem',
    '{{ etcd_cert_dir }}/member-{{ node }}.pem',
    '{{ etcd_cert_dir }}/member-{{ node }}-key.pem',
    {% endfor %}]"
  • "[{% for node in (groups['k8s-cluster'] + groups['calico-rr']|default([]))|unique %}
    '{{ etcd_cert_dir }}/node-{{ node }}.pem',
    '{{ etcd_cert_dir }}/node-{{ node }}-key.pem',
    {% endfor %}]"
    delegate_to: "{{groups['etcd'][0]}}"
    when: (('calico-rr' in groups and inventory_hostname in groups['calico-rr']) or
    inventory_hostname in groups['k8s-cluster']) and
    sync_certs|default(false) and inventory_hostname not in groups['etcd']
    `
    i don't know whether this is a bug ,or i miss some configure for script cert manger. thanks
    kubespray version:
    2.7

[LuckySB]

what is ansible version ?

Ansible v2.7.0 is failing and/or produce unexpected results due to ansible/ansible/issues/46600

[davidstack]

@LuckySB i have tried change ansible version, but it did't work

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.