consul/tasks/ssl/ca.yaml

- name: Create CA
  when: inventory_hostname in groups[consul_cacert_ca_host_group]
  block:
    - name: CA and certs | Install cryptography library
      package:
        name: python3-cryptography
        state: present

    - name: CA and certs | Check if ssl gen dir exist
      file:
        name: "{{ consul_ssl_path }}"
        state: directory

    - name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
      community.crypto.openssl_privatekey:
        path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
      register: consul_cacert_ca_key_gen

    - name: Generate an OpenSSL Certificate Signing Request
      community.crypto.openssl_csr:
        path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.csr"
        privatekey_path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
        use_common_name_for_san: false
        basic_constraints:
          - 'CA:TRUE'
        basic_constraints_critical: yes
        key_usage:
          - keyCertSign
        key_usage_critical: true
        common_name: "CA-{{ consul_self_signed_cert_name }}"
      register: consul_cacert_ca_csr

    - name: Generate a Self Signed OpenSSL CA certificate
      community.crypto.x509_certificate:
        path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.crt"
        csr_path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.csr"
        privatekey_path: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
        provider: selfsigned
      register: consul_cacert_ca_cert_gen

    - name: Get CA cert content
      slurp:
        src: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.crt"
      register: consul_cacert_ca_cert_b64

    - name: Get CA csr content
      slurp:
        src: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.csr"
      register: consul_cacert_ca_csr_b64

    - name: Get CA key content
      slurp:
        src: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
      register: consul_cacert_ca_key_b64

    - name: Set facts about key and cert
      set_fact:
        consul_cacert_ca_key: "{{ consul_cacert_ca_key_b64.content | b64decode }}"
        consul_cacert_ca_csr: "{{ consul_cacert_ca_csr_b64.content | b64decode }}"
        consul_cacert_ca_cert: "{{ consul_cacert_ca_cert_b64.content | b64decode }}"
      delegate_to: "{{ fact_item }}"
      delegate_facts: true
      with_items: 
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: fact_item

- name: Distribute CA certificates
  become: true
  block:
    - name: CA and cert | Check if dest dir exist on remote host
      file:
        name: "{{ consul_ssl_path }}"
        state: directory
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item

    - name: Put CA key
      copy:
        content: "{{ consul_cacert_ca_key }}"
        dest: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.key"
        mode: 0600
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item

    - name: Put CA csr
      copy:
        content: "{{ consul_cacert_ca_csr }}"
        dest: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.csr"
        mode: 0644
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item

    - name: Put CA cert
      copy:
        content: "{{ consul_cacert_ca_cert }}"
        dest: "{{ consul_ssl_path }}/CA-{{ consul_self_signed_cert_name }}.crt"
        mode: 0644
        owner: "{{ consul_user }}"
        group: "{{ consul_group }}"
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item

    - name: Put CA OpenSSL cert to PKI
      copy:
        content: "{{ consul_cacert_ca_cert }}"
        dest: "{{ consul_cacert_ca_trust_dir }}/CA-{{ consul_self_signed_cert_name }}.crt"
        mode: 0644
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item
      register: consul_ca_trust_anchors

    - name: Update CA trust
      shell: "{{ consul_cacert_update_ca_trust_command }}"
      loop:
        - "{{ groups[consul_cacert_ca_host_group] | default([]) }}"
        - "{{ groups[consul_cacert_clients_group] | default([]) }}"
      loop_control:
        loop_var: host_item
      when:
        - consul_ca_trust_anchors.changed 
        - consul_cacert_ca_trust_anchors_update