cert_rotation.yml

View and edit this Ansible playbook

Playbook Editor

File: playbooks/cert_rotation.yml

Edit the playbook YAML below. Changes are saved to the playbooks/ directory on this server. This playbook will be available for category mapping on the Admin page.

---
- name: Certificate Rotation
  hosts: "{{ region }}_{{ target_group | default('web') }}"
  become: yes
  gather_facts: yes
  
  vars:
    cert_source: "{{ cert_source_path | default('/etc/pki/tls/certs') }}"
    cert_name: "{{ certificate_name | default('server') }}"
    key_vault_name: "{{ azure_key_vault | default('') }}"
    backup_old_cert: "{{ backup_existing | default(true) }}"
    restart_services_after: "{{ restart_services | default(['nginx', 'httpd']) }}"
    
  pre_tasks:
    - name: Display certificate rotation parameters
      debug:
        msg: |
          Certificate Rotation for {{ region }}
          Certificate: {{ cert_name }}
          Source: {{ cert_source }}
          Key Vault: {{ key_vault_name | default('local') }}
          Backup existing: {{ backup_old_cert }}
          
    - name: Check current certificate expiry
      command: >
        openssl x509 -enddate -noout 
        -in {{ cert_source }}/{{ cert_name }}.crt
      register: cert_expiry
      ignore_errors: yes
      
    - name: Display current certificate info
      debug:
        var: cert_expiry.stdout
      when: cert_expiry.rc == 0
      
  tasks:
    - name: Backup existing certificate
      copy:
        src: "{{ cert_source }}/{{ cert_name }}.crt"
        dest: "{{ cert_source }}/{{ cert_name }}.crt.backup-{{ ansible_date_time.epoch }}"
        remote_src: yes
      when: backup_old_cert | bool
      ignore_errors: yes
      
    - name: Download new certificate from Azure Key Vault
      command: >
        az keyvault certificate download
        --vault-name {{ key_vault_name }}
        --name {{ cert_name }}
        --file {{ cert_source }}/{{ cert_name }}.crt
      when: key_vault_name | length > 0
      
    - name: Copy new certificate from local source
      copy:
        src: "certs/{{ cert_name }}.crt"
        dest: "{{ cert_source }}/{{ cert_name }}.crt"
        owner: root
        group: root
        mode: '0644'
      when: key_vault_name | length == 0
      
    - name: Verify new certificate
      command: >
        openssl x509 -noout -text 
        -in {{ cert_source }}/{{ cert_name }}.crt
      register: new_cert_info
      
    - name: Restart affected services
      systemd:
        name: "{{ item }}"
        state: restarted
      loop: "{{ restart_services_after }}"
      
  post_tasks:
    - name: Verify services after certificate rotation
      command: "systemctl is-active {{ item }}"
      loop: "{{ restart_services_after }}"
      register: service_status
      
    - name: Generate rotation report
      debug:
        msg: |
          Certificate rotation completed for {{ inventory_hostname }}
          Old expiry: {{ cert_expiry.stdout | default('unknown') }}
          New certificate installed: yes
          Services restarted: {{ restart_services_after | join(', ') }}

Cancel

Delete this playbook?

Playbook Structure Guide

Standard Variables Available

Variable	Description
`region`	Current execution region (eus2, wus2, etc.)
`target_group`	Host group within region (web, db, mon)
`mop_id`	MOP identifier
`execution_id`	Unique execution run ID
`maintenance_window`	Scheduled maintenance window

Connection Types

Type	Use When
`SSH (default)`	Running commands on remote VMs
`connection: local`	Git operations, file edits on this server
`uri module`	REST API calls to Azure DevOps
`command: terraform`	Terraform CLI operations