tls-ansible

tlsconfig.yaml

---
- name: get parameters
  set_fact:
    cert_path: {get_param: DeployedSSLCertificatePath}
    cert_content: {get_param: SSLCertificate}
    chain_content: {get_param: SSLIntermediateCertificate}
    key_content: {get_param: SSLKey}
  no_log: true

- name: get DeployedSSLCertificatePath attributes
  register: attr_cert_path
  stat:
    path: "{{cert_path}}"

- name: remove DeployedSSLCertificatePath if is dir
  when: attr_cert_path.stat.isdir is defined and attr_cert_path.stat.isdir
  file:
    path: "{{cert_path}}"
    state: absent

- name: push certificate content
  no_log: true
  copy:
    dest: "{{cert_path}}"
    group: haproxy
    mode: 0440
    owner: root
    content: |
      {{cert_content}}
      {{chain_content}}
      {{key_content}}

- name: get md5sum from certificate content
  register: checksum
  stat:
    path: "{{cert_path}}"
    checksum_algorithm: "md5"
    get_checksum: true

- name: check haproxy status
  register: haproxy_state
  systemd:
    name: haproxy

- name: reload haproxy if enabled
  when: haproxy_state.status.ActiveState == 'active'
  service:
    name: haproxy
    state: reloaded

- name: check pacemaker status
  register: pacemaker_state
  systemd:
    name: pacemaker

- name: Assign bootstrap node
  when: pacemaker_state.status.ActiveState == 'active'
  set_fact:
    bootstrap_node: "{{ groups.pacemaker[0] }}"

- name: restart pacemaker resource for haproxy
  when:
    - ansible_hostname == bootstrap_node
    - pacemaker_state.status.ActiveState == 'active'
    - attr_cert_path.stat.exists
    - attr_cert_path.stat.isdir
  shell: |
    HAPROXY_RESOURCE_NAME=$(pcs status | grep -E "container.+haproxy" | sed 's/^.*container.*: \(.*\) .*/\1/')
    if [[ -n "$HAPROXY_RESOURCE_NAME" ]]; then
      pcs resource restart "$HAPROXY_RESOURCE_NAME"
    fi

- name: get container_id
  when:
    - attr_cert_path.stat.exists
    - attr_cert_path.stat.isdir == False
  shell: |
    HAPROXY_CONTAINER_ID=$(docker ps -f name=haproxy |awk '{print $1}')
  register: container_id

- name: ensure content and rigts
  when:
    - pacemaker_state.stattus.ActiveState == 'active'
    - attr_cert_path.stat.exists
    - attr_cert_path.stat.isdir == False
  shell: |
    docker exec {{container_id.stdout}} cp /var/lib/kolla/config_files/src-tls{{cert_path}} {{cert_path}}

- name: update service via container
  when:
    - attr_cert_path.stat.exists
    - attr_cert_path.stat.isdir == False
  shell: |
    docker kill --signal=HUP {{container_id.stdout}}