upgrade_ha.yml

---
# upgrade_ha.yml - PAN-OS HA pair upgrade playbook.
#
# Description
# ===========
#
# Upgrades a PAN-OS HA pair to the specified version.  Upgrade must be a single step (i.e. 8.1.7 to 8.1.12).  For major
# version upgrades requiring a base image to be downloaded to the device prior to performing the upgrade, see the
# 'download_panos_image.yml' playbook.
#
# This playbook requires connection details for the two members of the HA pair to be specified in the variables
# 'primary_ip_address', 'secondary_ip_address', 'username', and 'password'.  These may be defined as host variables
# (see `host_vars/ha_pair.yml` for an example) or extra vars.
#
# Usage
# =====
#
# Required variables:
#
#   target: Target HA pair.  See `host_vars/ha_pair.yml` for sample definition of host variables.
#
#   version: Version to install.
#
# See the VARS section of the playbook for additional customization options.
#
# Default run:
#
#  $ ansible-playbook -i inventory upgrade_ha.yml --extra-vars "target=ha_pair version=9.0.3-h3"
#
# Notes
# =====
#
# HA pairs with preemption enabled are not supported by this playbook.

- hosts: '{{ target | default("ha_pair") }}'
  connection: local

  vars:
    primary:
      ip_address: '{{ primary_ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

    secondary:
      ip_address: '{{ secondary_ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

    # backup_config - Create a backup of the currently running config before upgrading on both devices.
    backup_config: true

    # backup_filename - Filename for running config backup.
    backup_filename: 'ansible-backup-{{ ansible_date_time.date }}.xml'

    # pause_mid_upgrade - Optionally pause for additional verification during upgrade.  This playbook will perform
    #                     basic checks for HA status and session sync, but this will wait for manual verification before
    #                     upgrading the secondary firewall.
    pause_mid_upgrade: false

  tasks:
    - name: Backup device config (primary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ primary }}'
        cmd: 'save config to {{ backup_filename }}'
      when: backup_config|bool

    - name: Backup device config (secondary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ secondary }}'
        cmd: 'save config to {{ backup_filename }}'
      when: backup_config|bool

    - name: Download target PAN-OS version
      paloaltonetworks.panos.panos_software:
        provider: '{{ primary }}'
        version: '{{ version }}'
        download: true
        sync_to_peer: true
        install: false

    - name: Suspend primary device
      paloaltonetworks.panos.panos_op:
        provider: '{{ primary }}'
        cmd: 'request high-availability state suspend'

    - name: Check that secondary is now active
      paloaltonetworks.panos.panos_op:
        provider: '{{ secondary }}'
        cmd: 'show high-availability state'
      register: secondary_active
      retries: 10
      delay: 30
      until: ( secondary_active.stdout | from_json).response.result.group["local-info"].state == 'active' and
             ( secondary_active.stdout | from_json).response.result.group["peer-info"].state == 'suspended' and
             ( secondary_active.stdout | from_json).response.result.group["peer-info"]["state-reason"] == 'User requested' # yamllint disable-line

    - name: Install target PAN-OS version and restart (primary)
      paloaltonetworks.panos.panos_software:
        provider: '{{ primary }}'
        version: '{{ version }}'
        download: false
        restart: true

    - name: Pause for restart
      ansible.builtin.pause:
        seconds: 30

    - name: Chassis ready (primary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ primary }}'
        cmd: 'show chassis-ready'
      changed_when: false
      register: result
      until: result is not failed and (result.stdout | from_json).response.result == 'yes'
      retries: 30
      delay: 60

    - name: State sync check (primary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ primary }}'
        cmd: 'show high-availability state'
      register: primary_state_sync
      retries: 10
      delay: 30
      until: '"state" in ( primary_state_sync.stdout | from_json).response.result.group["local-info"] and
             ( primary_state_sync.stdout | from_json).response.result.group["local-info"].state == "passive" and
             ( primary_state_sync.stdout | from_json).response.result.group["local-info"]["state-sync"] == "Complete"'

    - name: Pause for verification
      ansible.builtin.pause:
        prompt: 'Primary upgrade complete.  Pausing for verification.'
      when: pause_mid_upgrade

    - name: Suspend secondary device
      paloaltonetworks.panos.panos_op:
        provider: '{{ secondary }}'
        cmd: 'request high-availability state suspend'

    - name: Check that primary is now active
      paloaltonetworks.panos.panos_op:
        provider: '{{ primary }}'
        cmd: 'show high-availability state'
      register: primary_active
      retries: 10
      delay: 30
      until: ( primary_active.stdout | from_json).response.result.group["local-info"].state == 'active' and
             ( primary_active.stdout | from_json).response.result.group["peer-info"].state == 'suspended' and
             ( primary_active.stdout | from_json).response.result.group["peer-info"]["state-reason"] == 'User requested'

    - name: Install target PAN-OS version and restart (secondary)
      paloaltonetworks.panos.panos_software:
        provider: '{{ secondary }}'
        version: '{{ version }}'
        download: false
        restart: true

    - name: Pause for restart
      ansible.builtin.pause:
        seconds: 30

    - name: Chassis ready (secondary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ secondary }}'
        cmd: 'show chassis-ready'
      changed_when: false
      register: result
      until: result is not failed and (result.stdout | from_json).response.result == 'yes'
      retries: 30
      delay: 60

    - name: State sync check (secondary)
      paloaltonetworks.panos.panos_op:
        provider: '{{ secondary }}'
        cmd: 'show high-availability state'
      register: secondary_state_sync
      retries: 10
      delay: 30
      until: '"state" in ( secondary_state_sync.stdout | from_json).response.result.group["local-info"] and
             ( secondary_state_sync.stdout | from_json).response.result.group["local-info"].state == "passive" and
             ( secondary_state_sync.stdout | from_json).response.result.group["local-info"]["state-sync"] == "Complete"'