Active
AI Generated
Expiry Threshold Routing
Rule-based cert countdown switch
Expiry isn't pass/fail — it's a countdown.
Description
Rule-based certificate expiry handling — distinct from Intelligent Cert Lifecycle which uses an AI agent to pick renewal templates. This demo switches on cert_status from days remaining with no LLM required.
Why it matters
- Days-remaining tiers match how operations teams actually plan cert work — healthy, plan, renew, emergency.
- No AI dependency — deterministic switch routing anyone can audit and reproduce.
- Clear escalation from skip to emergency renew without custom Controller decision trees.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Manual trigger
Starts a workflow when a user clicks Run in the UI or calls the workflow execution API — the simplest entry point for on-demand runs like demos, break-glass remediation, or operator-initiated changes. No extra configuration is required, and runs appear in history with the triggering user as the source.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
Interactive Experience
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Manual or Schedule", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Check Cert Expiry", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "cert_status", pos: "b", h: 96, constraint: "on" }
C -->|healthy| D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Skip Healthy", pos: "b", h: 96, constraint: "on" }
C -->|plan| E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Open Change Request", pos: "b", h: 96, constraint: "on" }
C -->|renew| F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Renew Certificate", pos: "b", h: 96, constraint: "on" }
C -->|emergency| G@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Emergency Renew", pos: "b", h: 96, constraint: "on" }
F --> H@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Validate TLS", pos: "b", h: 96, constraint: "on" }
G --> H
D --> I@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Notify Chatroom", pos: "b", h: 96, constraint: "on" }
E --> I
H --> I
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F,G,H,I noBorder
Switch routing
| cert_status | Days remaining | Action |
|---|---|---|
healthy |
> 60 | Skip — no action |
plan |
30–60 | Open change request |
renew |
7–30 | Run renewal playbook |
emergency |
< 7 | Renew + alert + verify chain |
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
check_cert_expiry.yml
|
Checks certificate expiry via openssl, classifies into cert_status (healthy, plan, renew, emergency). | RHEL node |
skip_healthy.yml
|
Logs OK for healthy certificates with more than 60 days remaining. | RHEL node |
open_change_request.yml
|
Creates a change request marker for certificates in the 30-60 day planning window. | RHEL node |
renew_cert.yml
|
Renews a certificate using community.crypto modules for the 7-30 day window. | RHEL node |
emergency_renew.yml
|
Emergency certificate renewal for less than 7 days remaining with urgency flag. | RHEL node |
validate_tls.yml
|
Validates TLS handshake and certificate expiry after renewal. | RHEL node |
notify_chatroom.yml
|
Posts cert expiry routing results to Mattermost. | localhost (Mattermost API) |
AI Generated
This demo's playbooks and workflow were generated by AI to illustrate the pattern. They have not been fully tested in a live environment. Review and adapt before using in production.