Update Kubernetes PKI certificate file permissions

Signed-off-by: bmelbourne <[email protected]>

roles/kubernetes/kubeadm/tasks/main.yml

@@ -194,12 +194,26 @@
  tags:
  - kube-proxy
 
+- name: Set Kubernetes PKI certificate file permissions
+ file:
+ path: "{{ kube_cert_dir }}/{{ item }}"
+ owner: root
+ group: root
+ mode: 0600
+ with_items:
+ - apiserver-kubelet-client.crt
+ - apiserver.crt
+ - front-proxy-ca.crt
+ - front-proxy-client.crt
+ when:
+ - inventory_hostname in groups['kube_control_plane']
+
 - name: Set ca.crt file permission
  file:
  path: "{{ kube_cert_dir }}/ca.crt"
  owner: root
  group: root
- mode: "0644"
+ mode: 0600
 
 - name: Restart all kube-proxy pods to ensure that they load the new configmap
  command: "{{ kubectl }} delete pod -n kube-system -l k8s-app=kube-proxy --force --grace-period=0"