kubespray/roles/kubernetes/master/tasks/users-file.yml

---
- name: Make sure the users directory exits
  file:
    path: "{{ kube_users_dir }}"
    state: directory
    mode: o-rwx
    group: "{{ kube_cert_group }}"

- name: Populate users for basic auth in API
  template:
    src: known_users.csv.j2
    dest: "{{ kube_users_dir }}/known_users.csv"
    backup: yes
  notify: Master | set secret_changed