configuration_push.yml

---

- name: "RUN DATA DRIVEN PALO ALTO TERRAFORM AND ANSIBLE SOLUTION"
  hosts: "localhost"
  gather_facts: "no"
  connection: "local"

  vars_files:
    - "{{ playbook_dir }}/provider.yml"

  vars:
    provider_dir: "{{ playbook_dir }}"
    output_file: "{{ provider_dir }}/main.tf"
    module_dir: "./modules/{{ cloud_provider |lower }}"
    temp_key_dir: "{{ lookup('env', 'HOME')}}/paloalto/creds"
    temp_key: "{{ temp_key_dir }}/tempkey"

  tasks:

    - name: "SETUP CREDENTIALS & ENV FOR {{ cloud_provider| upper }}"
      include_role:
        name: "env_setup"
      tags:
        - 'always'
        - 'tf'

    - name: "RUN ROLE TO MANAGE VARS AND SCHEMA VALIDATION"
      include_role:
        name: "var_management"
      tags:
        - 'always'
        - 'tf'

    - name: "CREATING {{ cloud_provider }} TEMPLATE"
      template:
        src: "{{ cloud_provider }}-main.tf.j2"
        dest: "{{ output_file }}"
      tags:
        - 'always'
        - 'tf'

    - name: "RUN FMT FOR {{ cloud_provider }}"
      command: 'terraform fmt {{ output_file }}'
      tags:
        - 'tf'

    - name: "EXECUTE TERRAFORM PLAN"
      include_role:
        name: "terraform"
      tags:
        - 'always'
        - 'tf'

    - name: "GET CREATED FIREWALLS FROM TERRAFORM OUTPUT"
      command: 'terraform output -json firewalls_created'
      register: firewalls_created

    - name: "USE TERRAFORM OUTPUT STORE TEMP VALUES"
      set_fact:
        firewalls: "{{ firewalls_created.stdout |from_json }}"

#    - name: "ANSIBLE IMPORT TFSTATE FOR DICTIONARY CREATION"
#      set_fact:
#        tfstate: "{{ lookup('file','{{ playbook_dir }}/terraform.tfstate') | from_json }}"
#
#    - name: "USE TERRAFORM OUTPUT STORE AWS TUNNEL INFO"
#      set_fact:
#        simplified_tfstate_info: "{{ tfstate | my_magic_filter }}"
#    - debug: var=simplified_tfstate_info
#      when: cloud_provider == 'aws'

    - name: "ADD HOSTS FROM TF OUTPUT TO FIREWALL GROUP"
      add_host:
        hostname: "{{ item.key }}"
        ansible_host: "{{ item.value }}"
        ansible_ssh_private_key: "{{ temp_key }}"
        groups: "firewalls"
      with_dict: "{{ firewalls['value'] }}"
      tags:
        - 'tf'

  #  - name:  "USE TERRAFORM OUTPUT STORE AZURE TEMP VALUES"
  #    set_fact:
  #      private_address: "{{ private_address.stdout |from_json }}"
  #    when: cloud_provider == 'azure'


- name: "DEPLOY CONFIGURATIONS AND VALIDATE"
  hosts: "firewalls"
  connection: "local"
  gather_facts: "no"

  vars_files:
    - "{{ playbook_dir }}/provider.yml"

  vars:
    temp_key_dir: "{{ lookup('env', 'HOME') }}/paloalto/creds"
    temp_key: "{{ temp_key_dir }}/tempkey"

  tasks:

    - name: "WAIT FOR HTTPS ACCESS"
      wait_for:
        host: "{{ ansible_host }}"
        port: 443
        timeout: 450

    - name: "WAIT FOR MGMT AVAILABILITY"
      pause:
        seconds: "{{ cloud_unique[cloud_provider | lower]['timeout'] }}"

    - name: "CONFIGURE MGMT ACCESS"
      panos_admpwd:
        ip_address: "{{ ansible_host }}"
        key_filename: "{{ lookup('env', 'HOME') }}/paloalto/creds/tempkey"
        username: "{{ username }}"
        newpassword: "{{ password }}"
      when: cloud_provider == 'aws'


- name: "IMPORT IRON SKILLET WITH ROLE PALOALTONETWORKS AND ADD AGAIN ADMIN"
  hosts: "firewalls"
  connection: "local"
  gather_facts: "no"

  vars_files:
    - "{{ playbook_dir }}/provider.yml"

  roles:
    - role: "PaloAltoNetworks.paloaltonetworks"

  tasks:
# Import and load config file from URL
  - name: Import IRON SKILLET
    include_role:
      name: 'iron_skillet'
      tasks_from: '{{ cloud_provider }}.yml'

# # Create Firewall admin
# # Doesn't commit the candidate config
#   - name: Create Firewall Admin
#     panos_administrator:
#       ip_address: "{{ ansible_host }}"
#       username: "{{ username }}"
#       password: "{{ password }}"
#       admin_username: "{{ username }}"
#       admin_password: "{{ password }}"
#       state: "present"
#       superuser: true
#       commit: false

- name: "DEPLOY CONFIGURATIONS AND VALIDATE"
  hosts: "firewalls"
  connection: "local"
  gather_facts: "no"

  vars_files:
    - "{{ playbook_dir }}/provider.yml"

  vars:
    temp_key_dir: "{{ lookup('env', 'HOME') }}/paloalto/creds"
    temp_key: "{{ temp_key_dir }}/tempkey"

  tasks:

    - name: "DEPLOY ADMIN TASKS"
      include_role:
        name: "pa_admin"
      tags:
        - 'ansible'

#    - name: "CONFIGURE MGMT ACCESS"
#      panos_admpwd:
#        ip_address: "{{ ansible_host }}"
#        key_filename: "{{ lookup('env', 'HOME') }}/paloalto/creds/tempkey"
#        username: "{{ username }}"
#        newpassword: "{{ password }}"
#      when: cloud_provider == 'aws'

    - name: "DEPLOY ADMIN TASKS"
      include_role:
        name: "pa_admin"
      tags:
        - 'ansible'

    - name: "PUSH ANY ZONE OR NETWORK CONFIGURATIONS"
      include_role:
        name: "pa_network"
      tags:
        - 'ansible'

    - name: "PUSH ANY OBJECTS"
      include_role:
        name: "pa_object"
      tags:
        - 'ansible'

    - name: "PUSH SECURITY RULES"
      include_role:
        name: "pa_srule"
      tags:
        - 'ansible'

    - name: "PERFORM OPERATIONAL VALIDATION"
      include_role:
       name: "pa_validate"

    - name: "Create Static routes"
      include_role:
        name: "pa_staticroute"
      tags:
        - 'ansible'

    - name: "ANSIBLE IMPORT TFSTATE FOR DICTIONARY CREATION"
      set_fact:
        tfstate: "{{ lookup('file','{{ playbook_dir }}/terraform.tfstate') | from_json }}"

    - name: "USE TERRAFORM OUTPUT STORE AWS TUNNEL INFO"
      set_fact:
        simplified_tfstate_info: "{{ tfstate | my_magic_filter }}"
      when: cloud_provider == 'aws'

    - name: "Create IPSEC Tunnels"
      include_role:
        name: "pa_ipsec"
      vars:
        tfstate: "{{ simplified_tfstate_info }}"
      tags:
        - 'ansible'
      when: cloud_provider == 'aws'

    - name: "COMMIT THE CHANGES"
      panos_commit:
        ip_address: '{{ ansible_host }}'
        username: '{{ username }}'
        password: '{{ password }}'
      tags:
        - 'ansible'


- name: "Update and License Firewall"
  hosts: "firewalls"
  connection: "local"
  gather_facts: "no"

  vars_files:
    - "{{ playbook_dir }}/provider.yml"

  roles:
    - role: "PaloAltoNetworks.paloaltonetworks"

  tasks:
    # - name: "COMMIT THE CHANGES"
    #   panos_commit:
    #     ip_address: '{{ ansible_host }}'
    #     username: '{{ username }}'
    #     password: '{{ password }}'
    #   tags:
    #     - 'ansible'

    - name: "Update PANOS Software"
      panos_software:
        ip_address: '{{ ansible_host }}'
        username: '{{ username }}'
        password: '{{ password }}'
        version: "{{ item.value.version}}"
        restart: "{{ item.value.restart }}"
      with_dict: "{{ cm_panos_software }}"
      when: "cm_panos_software is defined"
      tags:
        - 'ansible'

    - name: "License the Firewall with Auth_Code"
      panos_lic:
        ip_address: '{{ ansible_host }}'
        username: '{{ username }}'
        password: '{{ password }}'
        auth_code: "{{ item.value.auth_code}}"
      with_dict: "{{ cm_panos_lic }}"
      when: "cm_panos_lic is defined"
      tags:
        - 'ansible'