Merge pull request #1953 from abutcher/etcd-certificates

Refactor etcd certificates roles.

19 files changed, 347 insertions, 137 deletions

diff --git a/roles/etcd/meta/main.yml b/roles/etcd/meta/main.yml
index 7156a9fff..cfd72dfbc 100644
--- a/roles/etcd/meta/main.yml
+++ b/roles/etcd/meta/main.yml
@@ -7,7 +7,7 @@ galaxy_info:
   description: etcd management
   company: Red Hat, Inc.
   license: Apache License, Version 2.0
-  min_ansible_version: 1.2
+  min_ansible_version: 2.1
   platforms:
   - name: EL
     versions:
@@ -22,4 +22,4 @@ dependencies:
     port: "{{etcd_client_port}}/tcp"
   - service: etcd peering
     port: "{{ etcd_peer_port }}/tcp"
-- role: etcd_common
+- role: etcd_server_certificates
diff --git a/roles/etcd/templates/etcd.conf.j2 b/roles/etcd/templates/etcd.conf.j2
index cd048ec60..7ccf78212 100644
--- a/roles/etcd/templates/etcd.conf.j2
+++ b/roles/etcd/templates/etcd.conf.j2
@@ -1,5 +1,5 @@
 {% macro initial_cluster() -%}
-{% for host in etcd_peers -%}
+{% for host in etcd_peers | default([]) -%}
 {% if loop.last -%}
 {{ hostvars[host].etcd_hostname }}={{ etcd_peer_url_scheme }}://{{ hostvars[host].etcd_ip }}:{{ etcd_peer_port }}
 {%- else -%}
diff --git a/roles/etcd_ca/meta/main.yml b/roles/etcd_ca/meta/main.yml
index d02456ca3..e3e2f7781 100644
--- a/roles/etcd_ca/meta/main.yml
+++ b/roles/etcd_ca/meta/main.yml
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
   author: Jason DeTiberus
-  description:
+  description: Etcd CA
   company: Red Hat, Inc.
   license: Apache License, Version 2.0
-  min_ansible_version: 1.9
+  min_ansible_version: 2.1
   platforms:
   - name: EL
     versions:
@@ -13,4 +13,4 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: etcd_common }
+- role: etcd_common
diff --git a/roles/etcd_ca/tasks/main.yml b/roles/etcd_ca/tasks/main.yml
index e1bb9baed..865074e41 100644
--- a/roles/etcd_ca/tasks/main.yml
+++ b/roles/etcd_ca/tasks/main.yml
@@ -2,6 +2,8 @@
 - name: Install openssl
   action: "{{ ansible_pkg_mgr }} name=openssl state=present"
   when: not etcd_is_atomic | bool
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - file:
     path: "{{ item }}"
@@ -13,29 +15,41 @@
   - "{{ etcd_ca_new_certs_dir }}"
   - "{{ etcd_ca_crl_dir }}"
   - "{{ etcd_ca_dir }}/fragments"
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - command: cp /etc/pki/tls/openssl.cnf ./
   args:
     chdir: "{{ etcd_ca_dir }}/fragments"
     creates: "{{ etcd_ca_dir }}/fragments/openssl.cnf"
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - template:
     dest: "{{ etcd_ca_dir }}/fragments/openssl_append.cnf"
     src: openssl_append.j2
     backup: true
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - assemble:
     src: "{{ etcd_ca_dir }}/fragments"
     dest: "{{ etcd_openssl_conf }}"
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - command: touch {{ etcd_ca_db }}
   args:
     creates: "{{ etcd_ca_db }}"
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - copy:
     dest: "{{ etcd_ca_serial }}"
     content: "01"
     force: no
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
 
 - command: >
     openssl req -config {{ etcd_openssl_conf }} -newkey rsa:4096
@@ -48,3 +62,5 @@
     creates: "{{ etcd_ca_cert }}"
   environment:
     SAN: 'etcd-signer'
+  delegate_to: "{{ etcd_ca_host }}"
+  run_once: true
diff --git a/roles/etcd_certificates/tasks/client.yml b/roles/etcd_certificates/tasks/client.yml
deleted file mode 100644
index b497a46c0..000000000
--- a/roles/etcd_certificates/tasks/client.yml
+++ /dev/null
@@ -1,42 +0,0 @@
----
-- name: Ensure generated_certs directory present
-  file:
-    path: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    state: directory
-    mode: 0700
-  with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- name: Create the client csr
-  command: >
-    openssl req -new -keyout {{ item.etcd_cert_prefix }}client.key
-    -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}client.csr
-    -reqexts {{ etcd_req_ext }} -batch -nodes
-    -subj /CN={{ item.etcd_hostname }}
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'client.csr' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- name: Sign and create the client crt
-  command: >
-    openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}client.crt
-    -in {{ item.etcd_cert_prefix }}client.csr
-    -batch
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'client.crt' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_client_certs | default([]) }}"
-
-- file:
-    src: "{{ etcd_ca_cert }}"
-    dest: "{{ etcd_generated_certs_dir}}/{{ item.etcd_cert_subdir }}/{{ item.etcd_cert_prefix }}ca.crt"
-    state: hard
-  with_items: "{{ etcd_needing_client_certs | default([]) }}"
diff --git a/roles/etcd_certificates/tasks/main.yml b/roles/etcd_certificates/tasks/main.yml
deleted file mode 100644
index 17092ca58..000000000
--- a/roles/etcd_certificates/tasks/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-- include: client.yml
-  when: etcd_needing_client_certs | default([]) | length > 0
-
-- include: server.yml
-  when: etcd_needing_server_certs | default([]) | length > 0
diff --git a/roles/etcd_certificates/tasks/server.yml b/roles/etcd_certificates/tasks/server.yml
deleted file mode 100644
index 934b8b805..000000000
--- a/roles/etcd_certificates/tasks/server.yml
+++ /dev/null
@@ -1,71 +0,0 @@
----
-- name: Ensure generated_certs directory present
-  file:
-    path: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    state: directory
-    mode: 0700
-  with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Create the server csr
-  command: >
-    openssl req -new -keyout {{ item.etcd_cert_prefix }}server.key
-    -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}server.csr
-    -reqexts {{ etcd_req_ext }} -batch -nodes
-    -subj /CN={{ item.etcd_hostname }}
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'server.csr' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_server_certs  | default([]) }}"
-
-- name: Sign and create the server crt
-  command: >
-    openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}server.crt
-    -in {{ item.etcd_cert_prefix }}server.csr
-    -extensions {{ etcd_ca_exts_server }} -batch
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'server.crt' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_server_certs  | default([]) }}"
-
-- name: Create the peer csr
-  command: >
-    openssl req -new -keyout {{ item.etcd_cert_prefix }}peer.key
-    -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}peer.csr
-    -reqexts {{ etcd_req_ext }} -batch -nodes
-    -subj /CN={{ item.etcd_hostname }}
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'peer.csr' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- name: Sign and create the peer crt
-  command: >
-    openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
-    -out {{ item.etcd_cert_prefix }}peer.crt
-    -in {{ item.etcd_cert_prefix }}peer.csr
-    -extensions {{ etcd_ca_exts_peer }} -batch
-  args:
-    chdir: "{{ etcd_generated_certs_dir }}/{{ item.etcd_cert_subdir }}"
-    creates: "{{ etcd_generated_certs_dir ~ '/' ~  item.etcd_cert_subdir ~ '/'
-                 ~ item.etcd_cert_prefix ~ 'peer.crt' }}"
-  environment:
-    SAN: "IP:{{ item.etcd_ip }}"
-  with_items: "{{ etcd_needing_server_certs | default([]) }}"
-
-- file:
-    src: "{{ etcd_ca_cert }}"
-    dest: "{{ etcd_generated_certs_dir}}/{{ item.etcd_cert_subdir }}/{{ item.etcd_cert_prefix }}ca.crt"
-    state: hard
-  with_items: "{{ etcd_needing_server_certs | default([]) }}"
diff --git a/roles/etcd_certificates/README.md b/roles/etcd_client_certificates/README.md
index 95f8f8aab..269d5296d 100644
--- a/roles/etcd_certificates/README.md
+++ b/roles/etcd_client_certificates/README.md
@@ -1,5 +1,5 @@
-OpenShift etcd certificates
-========================
+OpenShift Etcd Certificates
+===========================
 
 TODO
 
diff --git a/roles/etcd_client_certificates/library b/roles/etcd_client_certificates/library
new file mode 120000
index 000000000..494d3c39e
--- /dev/null
+++ b/roles/etcd_client_certificates/library
@@ -0,0 +1 @@
+../../library
\ No newline at end of file
diff --git a/roles/etcd_certificates/meta/main.yml b/roles/etcd_client_certificates/meta/main.yml
index 41370fab4..713c78c70 100644
--- a/roles/etcd_certificates/meta/main.yml
+++ b/roles/etcd_client_certificates/meta/main.yml
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
   author: Jason DeTiberus
-  description:
+  description: Etcd Client Certificates
   company: Red Hat, Inc.
   license: Apache License, Version 2.0
-  min_ansible_version: 1.8
+  min_ansible_version: 2.1
   platforms:
   - name: EL
     versions:
@@ -13,4 +13,4 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: etcd_ca }
+- role: etcd_ca
diff --git a/roles/etcd_client_certificates/tasks/main.yml b/roles/etcd_client_certificates/tasks/main.yml
new file mode 100644
index 000000000..b86afb81c
--- /dev/null
+++ b/roles/etcd_client_certificates/tasks/main.yml
@@ -0,0 +1,119 @@
+---
+- name: Check status of external etcd certificatees
+  stat:
+    path: "{{ etcd_cert_config_dir }}/{{ item }}"
+  with_items:
+  - "{{ etcd_cert_prefix }}client.crt"
+  - "{{ etcd_cert_prefix }}client.key"
+  - "{{ etcd_cert_prefix }}ca.crt"
+  register: g_external_etcd_cert_stat_result
+
+- set_fact:
+    etcd_client_certs_missing: "{{ False in (g_external_etcd_cert_stat_result.results
+                                   | oo_collect(attribute='stat.exists')
+                                   | list) }}"
+
+- name: Ensure generated_certs directory present
+  file:
+    path: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    state: directory
+    mode: 0700
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the client csr
+  command: >
+    openssl req -new -keyout {{ etcd_cert_prefix }}client.key
+    -config {{ etcd_openssl_conf }}
+    -out {{ etcd_cert_prefix }}client.csr
+    -reqexts {{ etcd_req_ext }} -batch -nodes
+    -subj /CN={{ etcd_hostname }}
+  args:
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'client.csr' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+# Certificates must be signed serially in order to avoid competing
+# for the serial file.
+- name: Sign and create the client crt
+  delegated_serial_command:
+    command: >
+      openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+      -out {{ etcd_cert_prefix }}client.crt
+      -in {{ etcd_cert_prefix }}client.csr
+      -batch
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'client.crt' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- file:
+    src: "{{ etcd_ca_cert }}"
+    dest: "{{ etcd_generated_certs_dir}}/{{ etcd_cert_subdir }}/{{ etcd_cert_prefix }}ca.crt"
+    state: hard
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create local temp directory for syncing certs
+  local_action: command mktemp -d /tmp/etcd_certificates-XXXXXXX
+  register: g_etcd_client_mktemp
+  changed_when: False
+  when: etcd_client_certs_missing | bool
+  delegate_to: localhost
+  become: no
+
+- name: Create a tarball of the etcd certs
+  command: >
+    tar -czvf {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz
+      -C {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }} .
+  args:
+    creates: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Retrieve the etcd cert tarballs
+  fetch:
+    src: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+    dest: "{{ g_etcd_client_mktemp.stdout }}/"
+    flat: yes
+    fail_on_missing: yes
+    validate_checksum: yes
+  when: etcd_client_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Ensure certificate directory exists
+  file:
+    path: "{{ etcd_cert_config_dir }}"
+    state: directory
+  when: etcd_client_certs_missing | bool
+
+- name: Unarchive etcd cert tarballs
+  unarchive:
+    src: "{{ g_etcd_client_mktemp.stdout }}/{{ etcd_cert_subdir }}.tgz"
+    dest: "{{ etcd_cert_config_dir }}"
+  when: etcd_client_certs_missing | bool
+
+- file:
+    path: "{{ etcd_cert_config_dir }}/{{ item }}"
+    owner: root
+    group: root
+    mode: 0600
+  with_items:
+  - "{{ etcd_cert_prefix }}client.crt"
+  - "{{ etcd_cert_prefix }}client.key"
+  - "{{ etcd_cert_prefix }}ca.crt"
+  when: etcd_client_certs_missing | bool
+
+- name: Delete temporary directory
+  file: name={{ g_etcd_client_mktemp.stdout }} state=absent
+  changed_when: False
+  when: etcd_client_certs_missing | bool
+  delegate_to: localhost
+  become: no
diff --git a/roles/etcd_server_certificates/README.md b/roles/etcd_server_certificates/README.md
new file mode 100644
index 000000000..269d5296d
--- /dev/null
+++ b/roles/etcd_server_certificates/README.md
@@ -0,0 +1,34 @@
+OpenShift Etcd Certificates
+===========================
+
+TODO
+
+Requirements
+------------
+
+TODO
+
+Role Variables
+--------------
+
+TODO
+
+Dependencies
+------------
+
+TODO
+
+Example Playbook
+----------------
+
+TODO
+
+License
+-------
+
+Apache License Version 2.0
+
+Author Information
+------------------
+
+Scott Dodson (sdodson@redhat.com)
diff --git a/roles/etcd_server_certificates/library b/roles/etcd_server_certificates/library
new file mode 120000
index 000000000..494d3c39e
--- /dev/null
+++ b/roles/etcd_server_certificates/library
@@ -0,0 +1 @@
+../../library
\ No newline at end of file
diff --git a/roles/etcd_server_certificates/meta/main.yml b/roles/etcd_server_certificates/meta/main.yml
new file mode 100644
index 000000000..b453f2bd8
--- /dev/null
+++ b/roles/etcd_server_certificates/meta/main.yml
@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  author: Jason DeTiberus
+  description: Etcd Server Certificates
+  company: Red Hat, Inc.
+  license: Apache License, Version 2.0
+  min_ansible_version: 2.1
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+  - system
+dependencies:
+- role: etcd_ca
diff --git a/roles/etcd_server_certificates/tasks/main.yml b/roles/etcd_server_certificates/tasks/main.yml
new file mode 100644
index 000000000..edcf51092
--- /dev/null
+++ b/roles/etcd_server_certificates/tasks/main.yml
@@ -0,0 +1,136 @@
+---
+- name: Check status of etcd certificates
+  stat:
+    path: "{{ etcd_cert_config_dir }}/{{ item }}"
+  with_items:
+  - "{{ etcd_cert_prefix }}server.crt"
+  - "{{ etcd_cert_prefix }}peer.crt"
+  - "{{ etcd_cert_prefix }}ca.crt"
+  register: g_etcd_server_cert_stat_result
+
+- set_fact:
+    etcd_server_certs_missing: "{{ False in (g_etcd_server_cert_stat_result.results
+                                   | oo_collect(attribute='stat.exists')
+                                   | list) }}"
+
+- name: Ensure generated_certs directory present
+  file:
+    path: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    state: directory
+    mode: 0700
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the server csr
+  command: >
+    openssl req -new -keyout {{ etcd_cert_prefix }}server.key
+    -config {{ etcd_openssl_conf }}
+    -out {{ etcd_cert_prefix }}server.csr
+    -reqexts {{ etcd_req_ext }} -batch -nodes
+    -subj /CN={{ etcd_hostname }}
+  args:
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'server.csr' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+# Certificates must be signed serially in order to avoid competing
+# for the serial file.
+- name: Sign and create the server crt
+  delegated_serial_command:
+    command: >
+      openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+      -out {{ etcd_cert_prefix }}server.crt
+      -in {{ etcd_cert_prefix }}server.csr
+      -extensions {{ etcd_ca_exts_server }} -batch
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'server.crt' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create the peer csr
+  command: >
+    openssl req -new -keyout {{ etcd_cert_prefix }}peer.key
+    -config {{ etcd_openssl_conf }}
+    -out {{ etcd_cert_prefix }}peer.csr
+    -reqexts {{ etcd_req_ext }} -batch -nodes
+    -subj /CN={{ etcd_hostname }}
+  args:
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'peer.csr' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Sign and create the peer crt
+  delegated_serial_command:
+    command: >
+      openssl ca -name {{ etcd_ca_name }} -config {{ etcd_openssl_conf }}
+      -out {{ etcd_cert_prefix }}peer.crt
+      -in {{ etcd_cert_prefix }}peer.csr
+      -extensions {{ etcd_ca_exts_peer }} -batch
+    chdir: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}"
+    creates: "{{ etcd_generated_certs_dir ~ '/' ~  etcd_cert_subdir ~ '/'
+                 ~ etcd_cert_prefix ~ 'peer.crt' }}"
+  environment:
+    SAN: "IP:{{ etcd_ip }}"
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- file:
+    src: "{{ etcd_ca_cert }}"
+    dest: "{{ etcd_generated_certs_dir}}/{{ etcd_cert_subdir }}/{{ etcd_cert_prefix }}ca.crt"
+    state: hard
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Create local temp directory for syncing certs
+  local_action: command mktemp -d /tmp/etcd_certificates-XXXXXXX
+  register: g_etcd_server_mktemp
+  changed_when: False
+  when: etcd_server_certs_missing | bool
+  delegate_to: localhost
+
+- name: Create a tarball of the etcd certs
+  command: >
+    tar -czvf {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz
+      -C {{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }} .
+  args:
+    creates: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Retrieve etcd cert tarball
+  fetch:
+    src: "{{ etcd_generated_certs_dir }}/{{ etcd_cert_subdir }}.tgz"
+    dest: "{{ g_etcd_server_mktemp.stdout }}/"
+    flat: yes
+    fail_on_missing: yes
+    validate_checksum: yes
+  when: etcd_server_certs_missing | bool
+  delegate_to: "{{ etcd_ca_host }}"
+
+- name: Ensure certificate directory exists
+  file:
+    path: "{{ etcd_cert_config_dir }}"
+    state: directory
+  when: etcd_server_certs_missing | bool
+
+- name: Unarchive cert tarball
+  unarchive:
+    src: "{{ g_etcd_server_mktemp.stdout }}/{{ etcd_cert_subdir }}.tgz"
+    dest: "{{ etcd_cert_config_dir }}"
+  when: etcd_server_certs_missing | bool
+
+- name: Delete temporary directory
+  file: name={{ g_etcd_server_mktemp.stdout }} state=absent
+  changed_when: False
+  when: etcd_server_certs_missing | bool
+  delegate_to: localhost
diff --git a/roles/flannel/meta/main.yml b/roles/flannel/meta/main.yml
index 909bdbfa4..616ae61d2 100644
--- a/roles/flannel/meta/main.yml
+++ b/roles/flannel/meta/main.yml
@@ -4,7 +4,7 @@ galaxy_info:
   description: flannel management
   company: Red Hat, Inc.
   license: Apache License, Version 2.0
-  min_ansible_version: 1.2
+  min_ansible_version: 2.1
   platforms:
   - name: EL
     versions:
@@ -13,4 +13,6 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: openshift_facts }
+- role: openshift_facts
+- role: openshift_etcd_client_certificates
+  etcd_cert_prefix: flannel.etcd-
diff --git a/roles/openshift_etcd_certificates/meta/main.yml b/roles/openshift_etcd_client_certificates/meta/main.yml
index 2725fdb51..3268c390f 100644
--- a/roles/openshift_etcd_certificates/meta/main.yml
+++ b/roles/openshift_etcd_client_certificates/meta/main.yml
@@ -1,10 +1,10 @@
 ---
 galaxy_info:
-  author: Andrew Butcher
-  description: OpenShift etcd Certificates
+  author: Jason DeTiberus
+  description: OpenShift Etcd Client Certificates
   company: Red Hat, Inc.
   license: Apache License, Version 2.0
-  min_ansible_version: 1.9
+  min_ansible_version: 2.1
   platforms:
   - name: EL
     versions:
@@ -13,4 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_etcd_facts
-- role: etcd_certificates
+- role: etcd_client_certificates
diff --git a/roles/openshift_etcd_facts/vars/main.yml b/roles/openshift_etcd_facts/vars/main.yml
index 6f3894565..cae15d61a 100644
--- a/roles/openshift_etcd_facts/vars/main.yml
+++ b/roles/openshift_etcd_facts/vars/main.yml
@@ -3,3 +3,8 @@ etcd_is_containerized: "{{ openshift.common.is_containerized }}"
 etcd_is_atomic: "{{ openshift.common.is_atomic }}"
 etcd_hostname: "{{ openshift.common.hostname }}"
 etcd_ip: "{{ openshift.common.ip }}"
+etcd_cert_subdir: "etcd-{{ openshift.common.hostname }}"
+etcd_cert_prefix:
+etcd_cert_config_dir: /etc/etcd
+etcd_peer_url_scheme: https
+etcd_url_scheme: https
diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml
index e391acfaa..a2f665702 100644
--- a/roles/openshift_master/meta/main.yml
+++ b/roles/openshift_master/meta/main.yml
@@ -12,4 +12,3 @@ galaxy_info:
   categories:
   - cloud
 dependencies: []
-