Description of problem:
Specify custom ca cert in ansible inventory, trigger an installation.
openshift_master_ca_certificate={"certfile": "/path/to/ca.crt", "keyfile": "/path/to/ca.key"}

The custom ca cert were overwritten by newly generated ca when creating the master certificates.


Version-Release number of selected component (if applicable):
openshift-ansible-3.4.26-1.git.0.882474b.el7.noarch.rpm

How reproducible:
Always

Steps to Reproduce:
1.Prepare a self-signed ca cert, set openshift_master_ca_certificate option in inventory file, run the install playbook
openshift_master_ca_certificate={"certfile": "/path/to/ca.crt", "keyfile": "/path/to/ca.key"}
[root@ip-172-18-11-122 ~]# openssl x509 -in /path/to/ca.crt -text |grep Subject:
        Subject: C=CN, ST=beijing, L=beijing, O=redhat, OU=openshift, CN=qe-test


2.The ca certs files were copied to /etc/origin/master/ dir, but were replaced by new ca cert when creating the master certificates with commnd:
oc adm create-master-certs --hostnames=kubernetes.default,kubernetes.default.svc.cluster.local,kubernetes,openshift.default,x.com,ip-172-18-11-122.ec2.internal,openshift.default.svc,172.30.0.1,54.164.64.179,172.18.11.122,openshift.default.svc.cluster.local,kubernetes.default.svc,openshift -master=https://ip-172-18-11-122.ec2.internal:8443 --public-master=https://x.com:8443 --cert-dir=/etc/origin/master --overwrite=false


Actual results:
After installation, check the CN of /etc/origin/master/ca.crt
[root@ip-172-18-11-122 master]# openssl x509 -in ca.crt -text |grep Subject
        Subject: CN=openshift-signer@1479886468

ca-bundle.crt has the same content as ca.crt


Expected results:
Custom ca cert should be used

Additional info:
Related ansible installer logs:
TASK [openshift_ca : Deploy master ca certificate] *****************************
Wednesday 23 November 2016  03:16:46 +0000 (0:00:00.193)       0:06:53.160 **** 
changed: [x.com -> x.com] => (item={u'dest': u'ca.crt', u'src': u'/path/to/ca.crt'}) => {"changed": true, "checksum": "aa036a66bdd7e5d6e336a6848ee3659e36982024", "dest": "/etc/origin/master/ca.crt", "gid": 0, "group": "root", "item": {"dest": "ca.crt", "src": "/path/to/ca.crt"}, "md5sum": "b47bee28be185efc25e022fda45a35f0", "mode": "0644", "owner": "root", "secontext": "system_u:object_r:etc_t:s0", "size": 1322, "src": "/root/.ansible/tmp/ansible-tmp-1479871008.02-181141957834103/source", "state": "file", "uid": 0}
changed: [x.com -> x.com] => (item={u'dest': u'ca.key', u'src': u'/path/to/ca.key'}) => {"changed": true, "checksum": "8d0aa1f9e9273fefd2ab9070cf5712f84bb066dc", "dest": "/etc/origin/master/ca.key", "gid": 0, "group": "root", "item": {"dest": "ca.key", "src": "/path/to/ca.key"}, "md5sum": "7b753021411c457ceaf2d694797d3c35", "mode": "0644", "owner": "root", "secontext": "system_u:object_r:etc_t:s0", "size": 1834, "src": "/root/.ansible/tmp/ansible-tmp-1479871012.0-266515015458432/source", "state": "file", "uid": 0}

TASK [openshift_ca : Create ca serial] *****************************************
Wednesday 23 November 2016  03:16:54 +0000 (0:00:08.139)       0:07:01.300 **** 
changed: [x.com -> x.com] => {"changed": true, "checksum": "356a192b7913b04c54574d18c28d46e6395428ab", "dest": "/etc/origin/master/ca.serial.txt", "gid": 0, "group": "root", "md5sum": "c4ca4238a0b923820dcc509a6f75849b", "mode": "0644", "owner": "root", "secontext": "system_u:object_r:etc_t:s0", "size": 1, "src": "/root/.ansible/tmp/ansible-tmp-1479871016.16-31779106527266/source", "state": "file", "uid": 0}

TASK [openshift_ca : Create the master certificates if they do not already exist] ***
Wednesday 23 November 2016  03:16:58 +0000 (0:00:04.138)       0:07:05.439 **** 
changed: [x.com -> ] => {"changed": true, "cmd": ["oc", "adm", "create-master-certs", "--hostnames=kubernetes.default,kubernetes.default.svc.cluster.local,kubernetes,openshift.default,x.com,ip-172-18-11-122.ec2.internal,openshift.default.svc,172.30.0.1,54.164.64.179,172.18.11.122,openshift.default.svc.cluster.local,kubernetes.default.svc,openshift", "--master=https://ip-172-18-11-122.ec2.internal:8443", "--public-master=https://x.com:8443", "--cert-dir=/etc/origin/master", "--overwrite=false"], "delta": "0:00:06.914696", "end": "2016-11-22 22:17:07.301075", "rc": 0, "start": "2016-11-22 22:17:00.386379", "stderr": "Command \"create-master-certs\" is deprecated, Use 'oc adm ca' instead.", "stdout": "Generated new key pair as /etc/origin/master/serviceaccounts.public.key and /etc/origin/master/serviceaccounts.private.key", "stdout_lines": ["Generated new key pair as /etc/origin/master/serviceaccounts.public.key and /etc/origin/master/serviceaccounts.private.key"], "warnings": []}