Refactor copy certificates task

Refactor service configuration to use the copy certificates task. This
reduces code duplication and simplifies implementing encrypting backend
HAProxy traffic for individual services.

Change-Id: I0474324b60a5f792ef5210ab336639edf7a8cd9e

ansible/roles/aodh/tasks/config.yml

@@ -45,19 +45,9 @@
   notify:
     - "Restart {{ item.key }} container"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ aodh_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/aodh/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ aodh_services }}"

ansible/roles/barbican/tasks/config.yml

@@ -47,19 +47,9 @@
   when:
     - barbican_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ barbican_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/barbican/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ barbican_services }}"

ansible/roles/blazar/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - blazar_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ blazar_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/blazar/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ blazar_services }}"

ansible/roles/ceilometer/tasks/config.yml

@@ -136,19 +136,9 @@
   when:
     - ceilometer_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ ceilometer_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/ceilometer/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ ceilometer_services }}"

ansible/roles/cinder/tasks/config.yml

@@ -37,19 +37,9 @@
   when:
     - cinder_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ cinder_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/cinder/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ cinder_services }}"

ansible/roles/cloudkitty/tasks/config.yml

@@ -55,19 +55,9 @@
   set_fact:
     cloudkitty_custom_metrics_used: "{{ cloudkitty_custom_metrics_file.stat.exists }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ cloudkitty_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/cloudkitty/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ cloudkitty_services }}"

ansible/roles/common/tasks/config.yml

@@ -52,18 +52,9 @@
     fluentd_binary: "{{ fluentd_labels.images.0.ContainerConfig.Labels.fluentd_binary }}"
   when: enable_fluentd | bool
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ common_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/common/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ common_services }}"

ansible/roles/congress/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - congress_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ congress_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/congress/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ congress_services }}"

ansible/roles/cyborg/tasks/config.yml

@@ -45,19 +45,9 @@
   notify:
     - Restart {{ item.key }} container
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ cyborg_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/cyborg/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ cyborg_services }}"

ansible/roles/designate/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - designate_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ designate_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/designate/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ designate_services }}"

ansible/roles/elasticsearch/tasks/config.yml

@@ -12,18 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ elasticsearch_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ elasticsearch_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/elasticsearch/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ elasticsearch_services }}"

ansible/roles/freezer/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - freezer_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ freezer_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/freezer/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ freezer_services }}"

ansible/roles/glance/tasks/config.yml

@@ -35,19 +35,9 @@
   when:
     - glance_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ glance_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/glance/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ glance_services }}"

ansible/roles/gnocchi/tasks/config.yml

@@ -35,19 +35,9 @@
   when:
     - gnocchi_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ gnocchi_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/gnocchi/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ gnocchi_services }}"

ansible/roles/grafana/tasks/config.yml

@@ -20,18 +20,9 @@
   run_once: True
   register: check_extra_conf_grafana
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ grafana_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files
   template:

ansible/roles/grafana/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ grafana_services }}"

ansible/roles/haproxy/tasks/config.yml

@@ -125,19 +125,9 @@
   notify:
     - Restart haproxy container
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  vars:
-    service: "{{ haproxy_services['haproxy'] }}"
-  become: true
-  copy:
-    src: "{{ kolla_certificates_dir }}/ca/"
-    dest: "{{ node_config_directory }}/haproxy/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[service.group]
     - kolla_copy_ca_into_containers | bool
-  notify:
-    - Restart haproxy container
 
 - name: Copying over haproxy start script
   vars:

ansible/roles/haproxy/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ haproxy_services }}"

ansible/roles/heat/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - heat_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ heat_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   become: true

ansible/roles/heat/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ heat_services }}"

ansible/roles/horizon/tasks/config.yml

@@ -133,19 +133,9 @@
   notify:
     - Restart horizon container
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - inventory_hostname in groups[item.value.group]
-    - item.value.enabled | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ horizon_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - include_tasks: check-containers.yml
   when: kolla_action != "config"

ansible/roles/horizon/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ horizon_services }}"

ansible/roles/ironic/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - ironic_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ ironic_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/ironic/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ ironic_services }}"

ansible/roles/karbor/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ karbor_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ karbor_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/karbor/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ karbor_services }}"

ansible/roles/kibana/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ kibana_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ kibana_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/kibana/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ kibana_services }}"

ansible/roles/kuryr/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - kuryr_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ kuryr_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/kuryr/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ kuryr_services }}"

ansible/roles/magnum/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - magnum_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ magnum_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/magnum/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ magnum_services }}"

ansible/roles/manila/tasks/config.yml

@@ -36,19 +36,9 @@
   when:
     - manila_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ manila_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/manila/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ manila_services }}"

ansible/roles/mistral/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - mistral_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ mistral_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/mistral/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ mistral_services }}"

ansible/roles/monasca/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ monasca_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ monasca_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/monasca/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ monasca_services }}"

ansible/roles/murano/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - murano_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ murano_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/murano/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ murano_services }}"

ansible/roles/neutron/tasks/config.yml

@@ -20,19 +20,9 @@
   changed_when: False
   register: check_extra_ml2_plugins
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - item.value.host_in_groups | bool
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ neutron_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   become: true

ansible/roles/neutron/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ neutron_services }}"

ansible/roles/nova-cell/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ nova_cell_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ nova_cell_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - include_tasks: external_ceph.yml
   when:

ansible/roles/nova-cell/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ nova_cell_services }}"

ansible/roles/nova-hyperv/tasks/config.yml

@@ -34,13 +34,6 @@
     - "wsgate.ini.j2"
   notify: Restart FreeRDP-WebConnect
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_custom_config  }}/nova-hyperv/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool

ansible/roles/nova-hyperv/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ nova_hyperv_services }}"

ansible/roles/nova/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - nova_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ nova_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   become: true

ansible/roles/nova/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ nova_services }}"

ansible/roles/octavia/tasks/config.yml

@@ -45,19 +45,9 @@
   notify:
     - "Restart {{ item.key }} container"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ octavia_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/octavia/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ octavia_services }}"

ansible/roles/panko/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - panko_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ panko_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/panko/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ panko_services }}"

ansible/roles/placement/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - placement_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ placement_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   become: true

ansible/roles/placement/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ placement_services }}"

ansible/roles/prometheus/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ prometheus_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ prometheus_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files
   become: true

ansible/roles/prometheus/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ prometheus_services }}"

ansible/roles/qinling/tasks/config.yml

@@ -36,19 +36,9 @@
   when:
     - qinling_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ qinling_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/qinling/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ qinling_services }}"

ansible/roles/rally/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - rally_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ rally_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/rally/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ rally_services }}"

ansible/roles/sahara/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - sahara_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ sahara_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/sahara/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ sahara_services }}"

ansible/roles/searchlight/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - searchlight_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ searchlight_config_jsons }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/searchlight/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ searchlight_services }}"

ansible/roles/senlin/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - senlin_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ senlin_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/senlin/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ senlin_services }}"

ansible/roles/skydive/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ skydive_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ skydive_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over default config.json files
   template:

ansible/roles/skydive/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ skydive_services }}"

ansible/roles/solum/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ solum_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ solum_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/solum/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ solum_services }}"

ansible/roles/swift/tasks/config.yml

@@ -28,19 +28,9 @@
     - "swift-proxy-server"
     - "swift-rsyncd"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ swift_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/swift/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ swift_services }}"

ansible/roles/tacker/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - tacker_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ tacker_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/tacker/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ tacker_services }}"

ansible/roles/telegraf/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ telegraf_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ telegraf_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over default config.json files
   template:

ansible/roles/telegraf/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ telegraf_services }}"

ansible/roles/tempest/tasks/config.yml

@@ -12,19 +12,9 @@
     - item.value.enabled | bool
   with_dict: "{{ tempest_services }}"
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ tempest_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/tempest/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ tempest_services }}"

ansible/roles/trove/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - trove_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ trove_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/trove/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ trove_services }}"

ansible/roles/vitrage/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - vitrage_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ vitrage_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/vitrage/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ vitrage_services }}"

ansible/roles/watcher/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - watcher_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ watcher_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/watcher/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ watcher_services }}"

ansible/roles/zun/tasks/config.yml

@@ -31,19 +31,9 @@
   when:
     - zun_policy.results
 
-- name: Copying over extra CA certificates
+- include_tasks: copy-certs.yml
-  become: true
-  copy:
-    src: "{{ node_config }}/certificates/ca/"
-    dest: "{{ node_config_directory }}/{{ item.key }}/ca-certificates"
-    mode: "0644"
   when:
-    - item.value.enabled | bool
-    - inventory_hostname in groups[item.value.group]
     - kolla_copy_ca_into_containers | bool
-  with_dict: "{{ zun_services }}"
-  notify:
-    - "Restart {{ item.key }} container"
 
 - name: Copying over config.json files for services
   template:

ansible/roles/zun/tasks/copy-certs.yml

@@ -0,0 +1,6 @@
+---
+- name: "Copy certificates and keys for {{ project_name }}"
+  import_role:
+    role: service-cert-copy
+  vars:
+    project_services: "{{ zun_services }}"