---
- name: Generate root ca file
  gen_cert:
    cn: root
    date: 87600h
    policy: "{{ .artifact.gen_cert_policy }}"
    out_key: |
      {{ .work_dir }}/kubekey/pki/root.key
    out_cert: |
      {{ .work_dir }}/kubekey/pki/root.crt

- name: Generate etcd cert file
  gen_cert:
    root_key: |
      {{ .work_dir }}/kubekey/pki/root.key
    root_cert: |
      {{ .work_dir }}/kubekey/pki/root.crt
    cn: etcd
    sans: |
      {{- $ips := list }}
      {{- range .groups.etcd | default list }}
        {{- $ips = append $ips (index $.inventory_hosts . "internal_ipv4") }}
      {{- end }}
      {{ $ips | toJson }}
    date: 87600h
    policy: "{{ .artifact.gen_cert_policy }}"
    out_key: |
      {{ .work_dir }}/kubekey/pki/etcd.key
    out_cert: |
      {{ .work_dir }}/kubekey/pki/etcd.crt
  when: .groups.etcd | default list | len | lt 0

- name: Generate registry image cert file
  gen_cert:
    root_key: |
      {{ .work_dir }}/kubekey/pki/root.key
    root_cert: |
      {{ .work_dir }}/kubekey/pki/root.crt
    cn: image_registry
    sans: |
      {{- $ips := list }}
      {{- range .groups.image_registry | default list }}
        {{- $ips = append $ips (index $.inventory_hosts . "internal_ipv4") }}
      {{- end }}
      {{ $ips | toJson }}
    date: 87600h
    policy: "{{ .artifact.gen_cert_policy }}"
    out_key: |
      {{ .work_dir }}/kubekey/pki/image_registry.key
    out_cert: |
      {{ .work_dir }}/kubekey/pki/image_registry.crt
  when: and .groups.image_registry (.groups.image_registry | default list | len | lt 0)
