Ansible Integration

Ansible Integration with TigerTrust

TigerTrust provides an Ansible collection for automating certificate lifecycle management across your infrastructure. Deploy, rotate, and manage certificates using familiar Ansible patterns.

Collection Installation

Install the TigerTrust collection:

bash
1# Install from Ansible Galaxy
2ansible-galaxy collection install tigertrust.certificates
3
4# Or install from source
5ansible-galaxy collection install git+https://github.com/tigertrust/ansible-collection.git

Configuration

Configure TigerTrust credentials:

yaml
1# group_vars/all.yml
2tigertrust_api_url: https://api.tigertrust.io
3tigertrust_api_key: "{{ vault_tigertrust_api_key }}"
4tigertrust_org_id: "{{ vault_tigertrust_org_id }}"

Certificate Modules

Use TigerTrust modules in playbooks:

yaml
1---
2- name: Manage certificates
3  hosts: webservers
4  become: yes
5
6  tasks:
7    - name: Request certificate from TigerTrust
8      tigertrust.certificates.certificate:
9        common_name: "{{ inventory_hostname }}"
10        san_names:
11          - "{{ inventory_hostname }}"
12          - "{{ ansible_fqdn }}"
13        issuer: enterprise-ca
14        validity_days: 365
15        state: present
16      register: cert_result
17
18    - name: Deploy certificate to server
19      tigertrust.certificates.deploy:
20        certificate_id: "{{ cert_result.certificate_id }}"
21        cert_path: /etc/ssl/certs/server.crt
22        key_path: /etc/ssl/private/server.key
23        chain_path: /etc/ssl/certs/chain.crt
24        owner: root
25        group: ssl-cert
26        mode: '0640'
27      notify: Restart nginx
28
29    - name: Verify certificate
30      tigertrust.certificates.verify:
31        cert_path: /etc/ssl/certs/server.crt
32        check_expiry: yes
33        check_chain: yes
34      register: verify_result
35
36  handlers:
37    - name: Restart nginx
38      service:
39        name: nginx
40        state: restarted

Certificate Rotation

Automate certificate rotation:

yaml
1---
2- name: Rotate expiring certificates
3  hosts: all
4  become: yes
5
6  tasks:
7    - name: Check certificate expiration
8      tigertrust.certificates.info:
9        cert_path: /etc/ssl/certs/server.crt
10      register: cert_info
11
12    - name: Renew if expiring within 30 days
13      when: cert_info.days_until_expiry < 30
14      block:
15        - name: Request renewal
16          tigertrust.certificates.renew:
17            certificate_id: "{{ cert_info.certificate_id }}"
18          register: renewal
19
20        - name: Deploy renewed certificate
21          tigertrust.certificates.deploy:
22            certificate_id: "{{ renewal.new_certificate_id }}"
23            cert_path: /etc/ssl/certs/server.crt
24            key_path: /etc/ssl/private/server.key
25            backup: yes
26          notify: Restart services

Roles

Use pre-built roles:

yaml
1# requirements.yml
2roles:
3  - name: tigertrust.certificates.webserver
4    version: "1.0.0"
5  - name: tigertrust.certificates.kubernetes
6    version: "1.0.0"
7
8# playbook.yml
9---
10- name: Configure web servers
11  hosts: webservers
12
13  roles:
14    - role: tigertrust.certificates.webserver
15      vars:
16        tigertrust_domains:
17          - "{{ inventory_hostname }}"
18        tigertrust_webserver: nginx
19        tigertrust_auto_renew: yes

Inventory Integration

Dynamic inventory based on certificates:

yaml
1# tigertrust_inventory.yml
2plugin: tigertrust.certificates.inventory
3api_url: https://api.tigertrust.io
4api_key: "{{ lookup('env', 'TIGERTRUST_API_KEY') }}"
5
6filters:
7  environment: production
8  expiring_within_days: 30
9
10groups:
11  expiring_soon: "days_until_expiry < 14"
12  critical: "days_until_expiry < 7"
13
14compose:
15  ansible_host: "common_name"

AWX/Tower Integration

Configure AWX credentials:

yaml
1# Custom credential type
2name: TigerTrust
3kind: cloud
4inputs:
5  fields:
6    - id: api_url
7      type: string
8      label: API URL
9    - id: api_key
10      type: string
11      label: API Key
12      secret: true
13    - id: org_id
14      type: string
15      label: Organization ID
16
17injectors:
18  env:
19    TIGERTRUST_API_URL: '{{ api_url }}'
20    TIGERTRUST_API_KEY: '{{ api_key }}'
21    TIGERTRUST_ORG_ID: '{{ org_id }}'

Vault Integration

Secure credentials with Ansible Vault:

yaml
1# vault.yml (encrypted)
2vault_tigertrust_api_key: your-api-key-here
3vault_tigertrust_org_id: your-org-id
4
5# Usage
6ansible-playbook certificates.yml --ask-vault-pass

Fact Gathering

Gather certificate facts:

yaml
1- name: Gather certificate facts
2  tigertrust.certificates.facts:
3    paths:
4      - /etc/ssl/certs
5      - /etc/pki/tls/certs
6  register: cert_facts
7
8- name: Show certificates
9  debug:
10    msg: "Certificate {{ item.common_name }} expires in {{ item.days_until_expiry }} days"
11  loop: "{{ cert_facts.certificates }}"

Automate your certificate infrastructure with TigerTrust and Ansible.