Can anybody help with a ansible playbook to delete the expired certificates?
#ansible playbook to delete the expired certificates
half kiln
wise valley
`- hosts: all_clusters
collections:
- netapp.ontap
become: false
connection: local
name: ONTAP remove expired certificates
module_defaults:
group/netapp.ontap.netapp_ontap:
hostname: "{{ inventory_hostname }}"
username: "{{ username }}"
password: "{{ password }}"
https: true
validate_certs: true
vars:
username: "{{ lookup('env', 'ANSIBLE_NET_USERNAME') }}"
password: "{{ lookup('env', 'ANSIBLE_NET_PASSWORD') }}"
tasks:
-
name: Get Certificate info
netapp.ontap.na_ontap_rest_info:
gather_subset:
- security/certificates
fields:
- ca
- common_name
- expiry_time
- name
- serial_number
- type
- uuid
use_python_keys: true
parameters:
scope: cluster
type: "server|server-ca|client-ca"
register: certs -
name: Delete expired certificates from ONTAP
netapp.ontap.na_ontap_security_certificates:
state: absent
type: "{{ item.type }}"
name: "{{ item.name }}"
loop: "{{ certs.ontap_info.security_certificates.records }}"
loop_control:
label: "NAME: {{ item.name }} EXPIRY: {{ item.expiry_time }}"
when: item.expiry_time < ansible_date_time.iso8601`
This will look for all server, server-ca and client-ca certificates on the cluster level.
half kiln
thanks a lot @wise valley
half kiln
i am getting this error
wise valley
Please ensure you use a recent version of the netapp.ontap ansible collection. Support for this was added in v21.19
half kiln
had to to 1 simple change -> loop: "{{ certs.ontap_info['security/certificates'].records }}"
wise valley
That's what use_python_keys: true was for