I do not want a second run of the TLS role to count as a change, and I do not want --diff to print the private key. Both of those are in roles/configure_harbor_tls/tasks/is_present.yml. This is not a comparison with Terraform. The kit does not ship one.
When harbor_tls_mode is ipa, the request is ipa-getcert request with -f the cert, -k the key, -K the principal, -N CN= the Harbor hostname, and -D the same hostname. Mode on the key is 0600. The task has creates: {{ harbor_tls_key }}. If the key is already there, certmonger is not asked again.
The wait is ipa-getcert status -f the cert, changed_when: false, retried until stdout contains MONITORING. A status check that reports changed will dirty every run while IdM is still issuing. I have watched that. The retries belong on the status, not on a sleep in the play.
When the mode is staged, the role stats the cert, the key, and the CA if harbor_tls_staged_ca is set. The stat is delegated to localhost when artifact_staged_on is controller, otherwise it runs on the registry host. If any stat is missing, the assert names the missing path and which host it expected. I would rather fail there than copy an empty file into harbor_tls_key.
The key copy sets mode: 0600 and diff: false. The comment in the task says never print the private key, even with --diff. The cert copy is 0644. The CA copy notifies Update the CA trust, and only when the CA path is non-empty. A notify on a copy that did not change does not fire. A notify on a key copy would be the wrong handler anyway. The key is not a trust anchor.
remote_src is true when the files are already on the target. When they are on the controller, the copy pulls them. I mixed those up once and the role looked for the staged cert on the registry host, where I had not put it.
github.com/noahfarshad/harbor-airgap-kit, roles/configure_harbor_tls/tasks/is_present.yml.