diff --git a/installer/pkg/config-generator/BUILD.bazel b/installer/pkg/config-generator/BUILD.bazel
index 8bd8d998f49..7c758e6a4b7 100644
--- a/installer/pkg/config-generator/BUILD.bazel
+++ b/installer/pkg/config-generator/BUILD.bazel
@@ -6,12 +6,12 @@ go_library(
         "generator.go",
         "ignition.go",
         "tls.go",
-        "utils.go",
     ],
     importpath = "github.com/openshift/installer/installer/pkg/config-generator",
     visibility = ["//visibility:public"],
     deps = [
         "//installer/pkg/config:go_default_library",
+        "//installer/pkg/copy:go_default_library",
         "//installer/pkg/tls:go_default_library",
         "//vendor/github.com/apparentlymart/go-cidr/cidr:go_default_library",
         "//vendor/github.com/coreos/ignition/config/v2_2:go_default_library",
diff --git a/installer/pkg/config-generator/tls.go b/installer/pkg/config-generator/tls.go
index 8e1dd829373..03e0cee245a 100644
--- a/installer/pkg/config-generator/tls.go
+++ b/installer/pkg/config-generator/tls.go
@@ -12,6 +12,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/openshift/installer/installer/pkg/copy"
 	"github.com/openshift/installer/installer/pkg/tls"
 )
 
@@ -123,7 +124,7 @@ func (c *ConfigGenerator) GenerateTLSConfig(clusterDir string) error {
 	}
 
 	// Ingress certs
-	if copyFile(kubeCACertPath, ingressCACertPath); err != nil {
+	if copy.Copy(kubeCACertPath, ingressCACertPath); err != nil {
 		return fmt.Errorf("failed to import kube CA cert into ingress-ca.crt: %v", err)
 	}
 
@@ -274,12 +275,12 @@ func generateRootCert(clusterDir string) (cert *x509.Certificate, key *rsa.Priva
 // getCertFiles copies the given cert/key files into the generated folder and returns their contents
 func getCertFiles(clusterDir string, certPath string, keyPath string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	keyDst := filepath.Join(clusterDir, rootCAKeyPath)
-	if err := copyFile(keyPath, keyDst); err != nil {
+	if err := copy.Copy(keyPath, keyDst); err != nil {
 		return nil, nil, fmt.Errorf("failed to write file: %v", err)
 	}
 
 	certDst := filepath.Join(clusterDir, rootCACertPath)
-	if err := copyFile(certPath, certDst); err != nil {
+	if err := copy.Copy(certPath, certDst); err != nil {
 		return nil, nil, fmt.Errorf("failed to write file: %v", err)
 	}
 	// content validation occurs in pkg/config/validate.go
diff --git a/installer/pkg/config-generator/utils.go b/installer/pkg/config-generator/utils.go
deleted file mode 100644
index 272b4bea341..00000000000
--- a/installer/pkg/config-generator/utils.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package configgenerator
-
-import (
-	"io"
-	"os"
-)
-
-func copyFile(fromFilePath, toFilePath string) error {
-	from, err := os.Open(fromFilePath)
-	if err != nil {
-		return err
-	}
-	defer from.Close()
-	to, err := os.OpenFile(toFilePath, os.O_RDWR|os.O_CREATE, 0666)
-	if err != nil {
-		return err
-	}
-	defer to.Close()
-	_, err = io.Copy(to, from)
-	return err
-}
diff --git a/installer/pkg/copy/BUILD.bazel b/installer/pkg/copy/BUILD.bazel
new file mode 100644
index 00000000000..c5aef073f73
--- /dev/null
+++ b/installer/pkg/copy/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "copy.go",
+    ],
+    importpath = "github.com/openshift/installer/installer/pkg/copy",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "go_default_test",
+    size = "small",
+    srcs = [
+        "copy_test.go",
+    ],
+    embed = [":go_default_library"],
+)
diff --git a/installer/pkg/copy/copy.go b/installer/pkg/copy/copy.go
new file mode 100644
index 00000000000..9036adf9580
--- /dev/null
+++ b/installer/pkg/copy/copy.go
@@ -0,0 +1,26 @@
+// Package copy supports copying a file to another path.
+package copy
+
+import (
+	"io"
+	"os"
+)
+
+// Copy creates a new file at toFilePath with with mode 0666 (before
+// umask) and the same content as fromFilePath.
+func Copy(fromFilePath, toFilePath string) error {
+	from, err := os.Open(fromFilePath)
+	if err != nil {
+		return err
+	}
+	defer from.Close()
+
+	to, err := os.OpenFile(toFilePath, os.O_WRONLY|os.O_CREATE, 0666)
+	if err != nil {
+		return err
+	}
+	defer to.Close()
+
+	_, err = io.Copy(to, from)
+	return err
+}
diff --git a/installer/pkg/copy/copy_test.go b/installer/pkg/copy/copy_test.go
new file mode 100644
index 00000000000..72b570f7063
--- /dev/null
+++ b/installer/pkg/copy/copy_test.go
@@ -0,0 +1,38 @@
+package copy
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCopyFile(t *testing.T) {
+	dir, err := ioutil.TempDir("", "workflow-test-")
+	if err != nil {
+		t.Error(err)
+	}
+	defer os.RemoveAll(dir)
+
+	sourcePath := filepath.Join(dir, "source")
+	sourceContent := []byte("Hello, World!\n")
+	err = ioutil.WriteFile(sourcePath, sourceContent, 0600)
+	if err != nil {
+		t.Error(err)
+	}
+
+	targetPath := filepath.Join(dir, "target")
+	err = Copy(sourcePath, targetPath)
+	if err != nil {
+		t.Error(err)
+	}
+
+	targetContent, err := ioutil.ReadFile(targetPath)
+	if err != nil {
+		t.Error(err)
+	}
+
+	if string(targetContent) != string(sourceContent) {
+		t.Errorf("target %q != source %q", string(targetContent), string(sourceContent))
+	}
+}
diff --git a/installer/pkg/workflow/BUILD.bazel b/installer/pkg/workflow/BUILD.bazel
index 69b874238ed..b86c13789f1 100644
--- a/installer/pkg/workflow/BUILD.bazel
+++ b/installer/pkg/workflow/BUILD.bazel
@@ -17,6 +17,7 @@ go_library(
     deps = [
         "//installer/pkg/config:go_default_library",
         "//installer/pkg/config-generator:go_default_library",
+        "//installer/pkg/copy:go_default_library",
         "//vendor/gopkg.in/yaml.v2:go_default_library",
     ],
 )
diff --git a/installer/pkg/workflow/init.go b/installer/pkg/workflow/init.go
index 4d35f8970ad..35603f2f3a2 100644
--- a/installer/pkg/workflow/init.go
+++ b/installer/pkg/workflow/init.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/openshift/installer/installer/pkg/config"
 	configgenerator "github.com/openshift/installer/installer/pkg/config-generator"
+	"github.com/openshift/installer/installer/pkg/copy"
 )
 
 const (
@@ -104,7 +105,7 @@ func prepareWorspaceStep(m *metadata) error {
 
 	// put config file under the clusterDir folder
 	configFilePath := filepath.Join(clusterDir, configFileName)
-	if err := copyFile(m.configFilePath, configFilePath); err != nil {
+	if err := copy.Copy(m.configFilePath, configFilePath); err != nil {
 		return fmt.Errorf("failed to create cluster config at %q: %v", clusterDir, err)
 	}
 
diff --git a/installer/pkg/workflow/utils.go b/installer/pkg/workflow/utils.go
index c2a899d5351..c628e8fb58a 100644
--- a/installer/pkg/workflow/utils.go
+++ b/installer/pkg/workflow/utils.go
@@ -3,7 +3,6 @@ package workflow
 import (
 	"errors"
 	"fmt"
-	"io"
 	"io/ioutil"
 	"os"
 	"path"
@@ -30,23 +29,6 @@ const (
 	topologyStep     = "topology"
 )
 
-func copyFile(fromFilePath, toFilePath string) error {
-	from, err := os.Open(fromFilePath)
-	if err != nil {
-		return err
-	}
-	defer from.Close()
-
-	to, err := os.OpenFile(toFilePath, os.O_RDWR|os.O_CREATE, 0666)
-	if err != nil {
-		return err
-	}
-	defer to.Close()
-
-	_, err = io.Copy(to, from)
-	return err
-}
-
 // returns the directory containing templates for a given step. If platform is
 // specified, it looks for a subdirectory with platform first, falling back if
 // there are no platform-specific templates for that step