ansible-role-bind/tasks/keys.yml

---
- name: copy private key
  copy:
    dest: "/etc/bind/keys/K{{ item.0 }}.\
      +{{ '00{}'.format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}\
      +{{ bind_dnssec[item.0][item.1].tag }}.private"
    content: '{{ bind_dnssec[item.0][item.1].private_key }}'
    owner: root
    group: bind
    mode: 0640
  no_log: true
  loop: '{{ bind_dnssec|product(file_ext)|list }}'
  vars:
    file_ext:
      - ksk
      - zsk

- name: copy public key
  template:
    src: public.key.j2
    dest: "/etc/bind/keys/K{{ item.0 }}.\
      +{{ '00{}'.format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}\
      +{{ bind_dnssec[item.0][item.1].tag }}.key"
    owner: root
    group: bind
    mode: 0640
  no_log: true
  loop: '{{ bind_dnssec|product(file_ext)|list }}'
  vars:
    file_ext:
      - ksk
      - zsk