okd/playbooks/common/openshift-etcd/certificates.yml

---
- name: Create etcd server certificates for etcd hosts
  hosts: oo_etcd_to_config
  any_errors_fatal: true
  roles:
    - role: openshift_etcd_facts
  post_tasks:
    - include_role:
        name: etcd
        tasks_from: server_certificates
      vars:
        etcd_ca_host: "{{ groups.oo_etcd_to_config.0 }}"
        etcd_peers: "{{ groups.oo_etcd_to_config | default([], true) }}"
        etcd_certificates_etcd_hosts: "{{ groups.oo_etcd_to_config | default([], true) }}"
        r_etcd_common_etcd_runtime: "{{ openshift.common.etcd_runtime }}"

- name: Create etcd client certificates for master hosts
  hosts: oo_masters_to_config
  any_errors_fatal: true
  roles:
    - role: openshift_etcd_facts
    - role: openshift_etcd_client_certificates
      etcd_ca_host: "{{ groups.oo_etcd_to_config.0 }}"
      etcd_cert_subdir: "openshift-master-{{ openshift.common.hostname }}"
      etcd_cert_config_dir: "{{ openshift.common.config_base }}/master"
      etcd_cert_prefix: "master.etcd-"
      openshift_ca_host: "{{ groups.oo_first_master.0 }}"
      r_etcd_common_etcd_runtime: "{{ openshift.common.etcd_runtime }}"
      when: groups.oo_etcd_to_config is defined and groups.oo_etcd_to_config