---
- name: Remove 'signed-by' service annotations to regenerate TLS secrets
  command: >
    {{ openshift_client_binary }} annotate service/{{ item }}
    service.alpha.openshift.io/serving-cert-signed-by-
    --config={{ openshift.common.config_base }}/master/admin.kubeconfig
    -n openshift-template-service-broker
  with_items:
    - apiserver

- name: Delete existing secrets
  oc_secret:
    name: "{{ item }}"
    namespace: openshift-template-service-broker
    state: absent
  with_items:
    - templateservicebroker-client
    - apiserver-serving-cert
