Bug 1684484

Description of problem:
The master api certificate (set in openshift_master_named_certificates) on master, gets overwritten when openshift_hosted_registry_routecertificates is set with the same certificate name (cert.pem).

Inventory vars:
openshift_master_named_certificates=[{"certfile": "/path-to-named-cert/cert.pem", "keyfile": "/path-to-named-cert/privkey.pem", "cafile": "/path-to-named-cert/chain.pem"}]
openshift_hosted_router_certificate=[{"certfile": "/path-to-router-cert/cert.pem", "keyfile": "/path-to-router-cert/privkey.pem", "cafile": "/path-to-router-cert/chain.pem"}]
openshift_hosted_registry_routecertificates=[{"certfile": "/path-to-registry-cert/cert.pem", "keyfile": "/path-to-registry-cert/privkey.pem", "cafile": "/path-to-registry-cert/chain.pem"}]

In openshift-ansible/roles/openshift_hosted/tasks/secure/passthrough.yml 
the certs for the hosted registry are created.

--
# Retrieve user supplied certificate files if they are provided
- when:
  - "'certfile' in openshift_hosted_registry_routecertificates"
  - "'keyfile' in openshift_hosted_registry_routecertificates"
  block:
  - name: Configure provided certificate file paths
    set_fact:
      docker_registry_cert_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['certfile'] | basename }}"
      docker_registry_key_path: "/etc/origin/master/named_certificates/{{ openshift_hosted_registry_routecertificates['keyfile'] | basename }}"
docker_registry_self_signed: false
---

This task creates cert.pem

But there is already a cert.pem is the designated folder. Because that's the master cert by setting this var:
openshift_master_named_certificates: [{"certfile": "/path-to-named-cert/cert.pem", "keyfile": "/path-to-named-cert/privkey.pem", "cafile": "/path-to-named-cert/chain.pem"}]

The role is creating certifcates with the name: cert.pem. So these are the same.


Version-Release number of the following components:
ansible-2.4.2.0-2.el7

How reproducible:

Steps to Reproduce:
1. Set inventory vars as:
openshift_master_named_certificates=[{"certfile": "/path-to-named-cert/cert.pem", "keyfile": "/path-to-named-cert/privkey.pem", "cafile": "/path-to-named-cert/chain.pem"}]
openshift_hosted_router_certificate=[{"certfile": "/path-to-router-cert/cert.pem", "keyfile": "/path-to-router-cert/privkey.pem", "cafile": "/path-to-router-cert/chain.pem"}]
openshift_hosted_registry_routecertificates=[{"certfile": "/path-to-registry-cert/cert.pem", "keyfile": "/path-to-registry-cert/privkey.pem", "cafile": "/path-to-registry-cert/chain.pem"}]
2. Deploy the cluster


Actual results:

master 1
-rw-r--r--. 1 root root 1996 Feb 26 14:35 cert.pem
-rw-r--r--. 1 root root 1984 Feb 26 14:23 cert.pem.20591.2019-02-26@14:35:57~
-rw-------. 1 root root 1647 Feb 26 14:23 chain.pem
-rw-r--r--. 1 root root 3643 Feb 26 14:36 docker-registry.pem
-rw-------. 1 root root 1704 Feb 26 14:35 privkey.pem
-rw-------. 1 root root 1708 Feb 26 14:23 privkey.pem.20720.2019-02-26@14:35:59~

master 3
-rw-r--r--. 1 root root 1984 Feb 26 14:23 cert.pem
-rw-------. 1 root root 1647 Feb 26 14:23 chain.pem
-rw-------. 1 root root 1708 Feb 26 14:23 privkey.pem 

You can see that at 14.23 the first set op certs is created, these are the openshift_master_named_certificates
 
at 14.36 the hosted registry is being created, this is done in the installer after the creation of the master certs. Ansible creates a backup at 14.35 a minute before the docker-registry.pem.


Expected results:
cert.pem should no be overwritten in master 1