rekey-host.yml remove-key tag

Author: Alex-Welsh

etc/kayobe/ansible/rekey-hosts.yml

@@ -7,12 +7,15 @@
   hosts: overcloud,seed,seed-hypervisor,infra-vms
   gather_facts: false
   vars:
-    ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+    # The existing key is the key that is currently used to access overcloud hosts
     existing_private_key_path: "{{ ssh_private_key_path }}"
     existing_public_key_path: "{{ ssh_public_key_path }}"
+    # The new key is the key that will be generated by this playbook
     new_private_key_path: "{{ ssh_private_key_path }}"
     new_public_key_path: "{{ ssh_public_key_path }}"
     new_key_type: "{{ ssh_key_type }}"
+    # The existing key will locally be moved to deprecated_key_path once it is replaced
+    deprecated_key_path: ~/old_ssh_key
     rekey_users:
       - stack
       - kolla
@@ -66,12 +69,12 @@
       become: true
 
     - name: Locally deprecate existing key (private)
-      command: "mv {{ existing_private_key_path }} {{ existing_public_key_path }}_old"
+      command: "mv {{ existing_private_key_path }} {{ deprecated_key_path }}"
       delegate_to: localhost
       run_once: true
 
     - name: Locally deprecate existing key (public)
-      command: "mv {{ existing_public_key_path }} {{ existing_public_key_path }}_old"
+      command: "mv {{ existing_public_key_path }} {{ deprecated_key_path }}.pub"
       delegate_to: localhost
       run_once: true
 
@@ -85,13 +88,30 @@
       delegate_to: localhost
       run_once: true
 
-    - name: Remove old key from hosts
-      vars:
-        lookup_path: "{{ existing_public_key_path }}_old"
-      ansible.posix.authorized_key:
-        user: "{{ item }}"
-        state: absent
-        key: "{{ lookup('file', lookup_path) }}"
-      loop: "{{ rekey_users }}"
-      become: true
+    - block:
+        - name: Stat old key file
+          ansible.builtin.stat:
+            path: "{{ deprecated_key_path }}.pub"
+          register: stat_result
+          delegate_to: localhost
+          run_once: true
+
+        - name: Fail when deprecated public key does not exist
+          ansible.builtin.fail:
+            msg: "No deprecated public key file found. Check deprecated_key_path is set correctly."
+          when:
+            - not stat_result.stat.exists
+          delegate_to: localhost
+          run_once: true
+
+        - name: Remove old key from hosts
+          vars:
+            lookup_path: "{{ deprecated_key_path }}.pub"
+          ansible.posix.authorized_key:
+            user: "{{ item }}"
+            state: absent
+            key: "{{ lookup('file', lookup_path) }}"
+          loop: "{{ rekey_users }}"
+          become: true
+      tags: remove-key
       when: rekey_remove_existing_key | bool