The task importing the client private key referenced `certificate_authority_client_ca_path`, a variable that is declared neither in `defaults/main.yaml` nor in `meta/argument_specs.yaml`. Every run with `certificate_authority_client_create: false` therefore aborted with an undefined variable error before the key was written. Use the actual role variable `certificate_authority_client_path` instead. Co-authored-by: Copilot <copilot@github.com>