---
- name: Backup and remove master cerftificates
  hosts: oo_masters_to_config
  any_errors_fatal: true

  roles:
  - openshift_facts

  tasks:
  - name: Check for generated-configs directory
    stat:
      path: "{{ openshift.common.config_base }}/generated-configs"
      get_checksum: false
      get_attributes: false
      get_mime: false
    register: openshift_generated_configs_dir_stat
    delegate_to: "{{ openshift_ca_host }}"
    run_once: true

  - name: Backup generated-configs directory
    command: >
      tar -czvf /etc/origin/generated-configs-backup-{{ ansible_date_time.epoch }}.tgz
      {{ openshift.common.config_base }}/generated-configs
    when: openshift_generated_configs_dir_stat.stat.exists
    delegate_to: "{{ openshift_ca_host }}"
    run_once: true

  - name: Remove generated-configs directory
    file:
      path: "{{ item }}"
      state: absent
    with_items:
    - "{{ openshift.common.config_base }}/generated-configs"
    delegate_to: "{{ openshift_ca_host }}"
    run_once: true

  - name: Backup master certificates and config
    command: >
      tar -czvf /etc/origin/master-cert-config-backup-{{ ansible_date_time.epoch }}.tgz
      {{ openshift.common.config_base }}/master

  - name: Remove master certificates and config
    file:
      path: "{{ openshift.common.config_base }}/master/{{ item }}"
      state: absent
    with_items:
    - admin.crt
    - admin.key
    - admin.kubeconfig
    - aggregator-front-proxy.crt
    - aggregator-front-proxy.key
    - aggregator-front-proxy.kubeconfig
    - front-proxy-ca.crt
    - front-proxy-ca.key
    - master.kubelet-client.crt
    - master.kubelet-client.key
    - master.proxy-client.crt
    - master.proxy-client.key
    - etcd.server.crt
    - etcd.server.key
    - master.server.crt
    - master.server.key
    - openshift-master.crt
    - openshift-master.key
    - openshift-master.kubeconfig

  - name: Remove service signer certificates
    file:
      path: "{{ openshift.common.config_base }}/master/{{ item }}"
      state: absent
    with_items:
    - service-signer.crt
    - service-signer.key
    when: (openshift_redeploy_openshift_ca | default(false) | bool) and (openshift_redeploy_service_signer | default(true) | bool)
