Tags and Variables
Azure IRE only, for now
These variables apply to the Azure IRE's perimeter auth proxy, the only place
this role is deployed today. azure_keyvault is the only implemented
certificate_sync_source; aws_secretsmanager is reserved for a future AWS
implementation.
Tags
None — the role is single-purpose and declarative, so tasks/main.yml runs everything on any converge (no intent tag required, unlike the tag-gated roles).
Variables
The role's meta/argument_specs.yml is the authoritative, machine-checked reference (ansible-doc -t role certificate_sync); required variables have no default and fail at role entry. This page adds context.
Source
| Variable | Required | Default | Description |
|---|---|---|---|
certificate_sync_source |
no | azure_keyvault |
Secret store to fetch from. azure_keyvault is the only implemented source; aws_secretsmanager is planned with the same PKCS#12 contract. |
certificate_sync_vault_name |
for azure_keyvault |
"" |
Key Vault name (data plane https://<name>.vault.azure.net). |
certificate_sync_secret_name |
yes | Secret name of the certificate in the store. A Key Vault certificate exposes its PKCS#12 bundle as a secret of the same name; the versionless fetch always returns the latest version. | |
certificate_sync_identity_resource_id |
no | "" |
ARM resource id of the user-assigned managed identity to fetch with (IMDS mi_res_id). Preferred over the client id: it names the identity, so it stays correct when the identity is recreated. |
certificate_sync_client_id |
no | "" |
Client id of the user-assigned managed identity to fetch with. An alternative to the resource id; set at most one. Neither set uses the machine's system-assigned identity. |
Destination and validation
| Variable | Required | Default | Description |
|---|---|---|---|
certificate_sync_certificate_path |
yes | Destination PEM for the leaf + intermediates (written mode 0644, root). A bundled self-signed root is deliberately not written — clients bring their own trust store. |
|
certificate_sync_key_path |
yes | Destination PEM for the private key (written mode 0600, root). |
|
certificate_sync_expected_names |
no | [] |
Hostnames a fetched certificate must cover (SANs; single-label wildcards counted) before it is installed. Empty skips the check — set it: this is what stops a mis-issued certificate from going live. |
Cadence
| Variable | Required | Default | Description |
|---|---|---|---|
certificate_sync_interval |
no | 30min |
systemd OnUnitActiveSec between syncs. |
certificate_sync_randomized_delay |
no | 5min |
systemd RandomizedDelaySec jitter, so a fleet doesn't hit the store in lock-step. |
Consumer reload
After a swap the consumer is reloaded and the reload verified — some daemons (nginx among them) log the failure and keep serving the old state while systemd reports success. On any failure the previous certificate and key are restored from their .bak copies and the consumer reloaded again.
| Variable | Required | Default | Description |
|---|---|---|---|
certificate_sync_reload_unit |
no | "" |
systemd unit to reload after a swap (e.g. nginx). Empty installs the files without reloading; an inactive unit is left alone either way (which is what makes running this role before the consumer's first deploy safe). |
certificate_sync_validate_command |
no | "" |
Shell command run before the reload (e.g. nginx -t); non-zero rolls the swap back without touching the running service. |
certificate_sync_error_log |
no | "" |
Log file scanned after the reload for new certificate_sync_error_pattern lines. Empty skips the scan. |
certificate_sync_error_pattern |
no | [emerg] |
Substring marking a failed reload in the error log. |
Worked example
group_vars/ire_copier_azure_app_nginx/vars.yml wires the perimeter auth proxy:
certificate_sync_vault_name: sph-ire-PAuth-cus-kv # shared with the App Gateway
certificate_sync_secret_name: pauth-public
certificate_sync_identity_resource_id: /subscriptions/<sub>/resourceGroups/ire-dmz-centralus-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ire-pauth_cert-centralus-uai
certificate_sync_certificate_path: "{{ perimeter_auth_ssl_certificate }}"
certificate_sync_key_path: "{{ perimeter_auth_ssl_certificate_key }}"
certificate_sync_reload_unit: nginx
certificate_sync_validate_command: nginx -t
certificate_sync_error_log: /var/log/nginx/error.log
certificate_sync_expected_names is deliberately left at its default there, so
that consumer does not check a fetched certificate's SANs.