Ansible facts discovery returns some values as empty

Question

I have a very simple script in /etc/ansible/facts.d which is used to discover the local SSL certs on a host. This is the code:

#!/bin/sh

echo "{
  \"testkey\": \"testvalue\",
  \"crt\": \"$(/usr/bin/base64 -w 0 /etc/kubernetes/pki/apiserver.crt)\",
  \"key\": \"$(/usr/bin/base64 -w 0 /etc/kubernetes/pki/apiserver.key)\"
}"

When I run it myself with $> /etc/ansible/facts.d/apiserver_ssl_facts.fact it outputs all the values as expected. But when Ansible runs it only the testkey has a value, while the others are an empty string "":

ansible@bastion-1:~/ansible$ ansible -m setup <host> -a "filter=ansible_local"
<host> | SUCCESS => {
    "ansible_facts": {
        "ansible_local": {
            "apiserver_ssl_facts": {
                "crt": "", 
                "key": "", 
                "testkey": "testvalue"
            }
        }
    }, 
    "changed": false
}

Running Ansible in very verbose with -vvvv does not show any errors.

Answer 1

Answer from the comments: there is a permission issue, so the ansible user can't access cert files.