kubespray/roles/kubernetes/master/tasks/kubeadm-certificate.yml

---
- name: Backup old certs and keys
  copy:
    src: "{{ kube_cert_dir }}/{{ item.src }}"
    dest: "{{ kube_cert_dir }}/{{ item.dest }}"
    mode: 0640
    remote_src: yes
  with_items:
    - {src: apiserver.crt, dest: apiserver.crt.old}
    - {src: apiserver.key, dest: apiserver.key.old}
    - {src: apiserver-kubelet-client.crt, dest: apiserver-kubelet-client.crt.old}
    - {src: apiserver-kubelet-client.key, dest: apiserver-kubelet-client.key.old}
    - {src: front-proxy-client.crt, dest: front-proxy-client.crt.old}
    - {src: front-proxy-client.key, dest: front-proxy-client.key.old}
  ignore_errors: yes