ansible-role-bind/tasks/keys.yml

---
- name: Copy private key
  ansible.builtin.copy:
    dest: "/etc/bind/keys/K{{ item.0 }}.\
      +{{ '00{}'.format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}\
      +{{ bind_dnssec[item.0][item.1].tag }}.private"
    content: '{{ bind_dnssec[item.0][item.1].private_key }}'
    owner: root
    group: bind
    mode: 0640
  no_log: true
  loop: '{{ bind_dnssec | product(file_ext) | list }}'
  vars:
    file_ext:
      - ksk
      - zsk

- name: Copy public key
  ansible.builtin.template:
    src: public.key.j2
    dest: "/etc/bind/keys/K{{ item.0 }}.\
      +{{ '00{}'.format(bind_dnssec[item.0][item.1].algorithm)[-3:] }}\
      +{{ bind_dnssec[item.0][item.1].tag }}.key"
    owner: root
    group: bind
    mode: 0640
  no_log: true
  loop: '{{ bind_dnssec | product(file_ext) | list }}'
  vars:
    file_ext:
      - ksk
      - zsk