Active
TMM Created
Intelligent Cert Lifecycle
AI-driven certificate renewal routing
Description
Two certificates expire on production services at the same time. Splunk fires alerts to automation orchestrator. An AI agent analyzes each certificate, discovers available AAP job templates, and selects the correct renewal strategy (PEM for nginx, Java keystore for the API server) without hardcoded routing. An operator reviews the agent's analysis and confidence score, approves, and AAP renews and validates TLS automatically.
Why it matters
- One workflow intelligently handles multiple certificate types instead of maintaining separate automation for each.
- AI provides deployment recommendations and confidence before changes are made, reducing operational risk.
- Validation and notification are built into the process, giving operators confidence that renewal actually succeeded.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Webhook trigger
Starts a workflow when an external system sends an authenticated HTTP POST to a generated endpoint URL, with the request body available as trigger input for downstream steps. Commonly used to integrate CI/CD pipelines, monitoring tools, or Splunk alerts — each workflow gets its own unique URL path.
-
AI & integrations
Task agent
Adds LLM reasoning to a workflow — the step receives a natural-language prompt, can call enabled tools, and returns structured output that downstream steps reference through expressions. Use it for unstructured data (logs, tickets, alerts) to summarize, classify, triage, and recommend remediation actions; pair with an approval step for human oversight.
-
Approval
Approval step
Pauses the branch and creates an approval request; an approver reviews context, approves or rejects, and the workflow continues on the matching path. Place approvals before destructive or production changes, with configurable approver users/groups, a decision window, and fallback behavior if no one responds in time.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
-
Action steps
Script step
Runs Python or Bash to parse, transform, or reshape data between steps — for example, normalizing an API response before a Task agent or AAP job consumes it. Lightweight alternative to launching a playbook; test with mock upstream output in the builder before publishing. Disabled by default until execution-plane capabilities are available in your deployment — intended for demos and early evaluation today. Additional scripting languages may be supported later based on demand.
Interactive Experience
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Splunk Cert Alert", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "Plan Renewal", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/approval-node.png", label: "Approve Renewal", pos: "b", h: 96, constraint: "on" }
C -->|approved| D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run Renewal Job", pos: "b", h: 96, constraint: "on" }
C -->|rejected| E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/script-node.png", label: "Renewal Rejected", pos: "b", h: 96, constraint: "on" }
D --> F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Validate Renewal", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F noBorder
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
renew_certificate.yml
|
Pulls a new PEM certificate from Vault CA, installs it for nginx, and reloads the service. | RHEL node (nginx / PEM) |
renew_keystore_certificate.yml
|
Renews a Java keystore certificate for the API server, updating the keystore and restarting the application. | RHEL node (Java keystore) |
validate_certificate.yml
|
Runs an OpenSSL TLS handshake check and reports certificate subject, issuer, and expiry after renewal. | RHEL node |
notify_mattermost.yml
|
Posts renewal status, agent confidence, and analysis summary to Mattermost after the workflow completes. | localhost (Mattermost API) |