rekey-host.yml remove-key tag

Author: Alex-Welsh

etc/kayobe/ansible/rekey-hosts.yml

@@ -7,12 +7,15 @@
   hosts: overcloud,seed,seed-hypervisor,infra-vms
   gather_facts: false
   vars:
-    ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+    # The existing key is the key that is currently used to access overcloud hosts
     existing_private_key_path: "{{ ssh_private_key_path }}"
     existing_public_key_path: "{{ ssh_public_key_path }}"
+    # The new key is the key that will be generated by this playbook
     new_private_key_path: "{{ ssh_private_key_path }}"
     new_public_key_path: "{{ ssh_public_key_path }}"
     new_key_type: "{{ ssh_key_type }}"
+    # The existing key will locally be moved to deprecated_key_path once it is replaced
+    deprecated_key_path: ~/old_ssh_key
     rekey_users:
       - stack
       - kolla
@@ -66,12 +69,12 @@
       become: true
 
     - name: Locally deprecate existing key (private)
-      command: "mv {{ existing_private_key_path }} {{ existing_public_key_path }}_old"
+      command: "mv {{ existing_private_key_path }} {{ deprecated_key_path }}"
       delegate_to: localhost
       run_once: true
 
     - name: Locally deprecate existing key (public)
-      command: "mv {{ existing_public_key_path }} {{ existing_public_key_path }}_old"
+      command: "mv {{ existing_public_key_path }} {{ deprecated_key_path }}.pub"
       delegate_to: localhost
       run_once: true
 
@@ -84,14 +87,31 @@
       command: "mv {{ existing_private_key_path }}_new.pub {{ new_public_key_path }}"
       delegate_to: localhost
       run_once: true
+    
+    - block:
+      - name: Stat old key file
+        ansible.builtin.stat:
+          path: "{{ deprecated_key_path }}.pub"
+        register: stat_result
+        delegate_to: localhost
+        run_once: true
 
-    - name: Remove old key from hosts
-      vars:
-        lookup_path: "{{ existing_public_key_path }}_old"
-      ansible.posix.authorized_key:
-        user: "{{ item }}"
-        state: absent
-        key: "{{ lookup('file', lookup_path) }}"
-      loop: "{{ rekey_users }}"
-      become: true
+      - name: Fail when deprecated public key does not exist
+        ansible.builtin.fail:
+          msg: "No deprecated public key file found. Check deprecated_key_path is set correctly."
+        when:
+          - not stat_result.stat.exists
+        delegate_to: localhost
+        run_once: true
+
+      - name: Remove old key from hosts
+        vars:
+          lookup_path: "{{ deprecated_key_path }}.pub"
+        ansible.posix.authorized_key:
+          user: "{{ item }}"
+          state: absent
+          key: "{{ lookup('file', lookup_path) }}"
+        loop: "{{ rekey_users }}"
+        become: true
+      tags: remove-key
       when: rekey_remove_existing_key | bool