kubespray/roles/kubernetes/control-plane/tasks/kubeadm-backup.yml

---
- name: Backup old certs and keys
  copy:
    src: "{{ kube_cert_dir }}/{{ item }}"
    dest: "{{ kube_cert_dir }}/{{ item }}.old"
    mode: preserve
    remote_src: yes
  with_items:
    - apiserver.crt
    - apiserver.key
    - apiserver-kubelet-client.crt
    - apiserver-kubelet-client.key
    - front-proxy-client.crt
    - front-proxy-client.key
  ignore_errors: yes

- name: Backup old confs
  copy:
    src: "{{ kube_config_dir }}/{{ item }}"
    dest: "{{ kube_config_dir }}/{{ item }}.old"
    mode: preserve
    remote_src: yes
  with_items:
    - admin.conf
    - controller-manager.conf
    - kubelet.conf
    - scheduler.conf
  ignore_errors: yes