No option to update profile? Ansible bigip_profile_client_ssl module - ssl

Question

I am attempting to create an Ansible play in which SSL Certificates that were previously downloaded are then distributed to our F5's. I've updated to the latest version our license will allow, 12.1.4. I am able to place key and certificate files on the F5. I can manually configure these certs and everything works fine...but I need this process to be automated via Ansible.
Our F5's are currently being used as fail-overs for a service called WaveForm which monitors audio feeds. I am trying to use bigip_profile_client_ssl to update the client profile for WaveForm to point to the new SSL Certs that have been uploaded in earlier steps. The problem is that I can't figure out how to update the existing profile, bigip_profile_client_ssl only seems to create a new profile with the same name. I've searched the docs, google, etc and can't find an answer to how to perform, specifically, an update of a client SSL profile.
So, naturally, I was thinking perhaps I could delete the old entry and create a new entry. Simple, right? But I run into problems there as well: I can't seem to figure out how to set the Application or Partition/Path with the bigip_profile_client_ssl module. The Application setting specifically, I think, is what will bind the SSL configuration to the actual network resource.
See Ansible docs: https://docs.ansible.com/ansible/latest/modules/bigip_profile_client_ssl_module.html
Note this is all run on an internal network and is not accessible from the outside world.
Here is the module that I'm having trouble with:
# fullpath from facts: "/Common/wf.site.com.app/wf.site.com_client-ssl"
- name: Update Client SSL Profile for WaveForm
bigip_profile_client_ssl:
provider:
server: "{{ server }}"
server_port: "{{ server_port }}"
user: "{{ f5_ad_user }}"
password: "{{ f5_ad_password }}"
transport: rest
validate_certs: no # temporary ignore SSL validation
state: present # as opposed to absent
name: "wf.site.com_client-ssl"
parent: "/Common/clientssl"
cert_key_chain:
- cert: "/Common/default.crt" #test-cert-fullchain.crt"
key: "/Common/default.key" #test-key.key"
# chain:
delegate_to: localhost
After running this I end up with 2 entries for wf.site.com_client-ssl. The one is new and contains the correct certificates but is not configured to be used via Application setting, the other entry that is being actively used remains unchanged.
The correct entry looks something like this on the Local Traffic›Profiles:SSL:Client page:
Name | Application | Parent Profile | Partition/Path
wf.site.com_client-ssl | wf.site.com | clientssl | Common/wf.site.com.app
Where as the NEW entry looks something like this:
Name | Application | Parent Profile | Partition/Path
wf.site.com_client-ssl | (blank) | clientssl | Common
What are my options here? Shell commands?

Answer 1

I found that running my Ansible playbook multiple times did not result in multiple new client SSL profiles. So as a work around I disregard the existing configured Client SSL Profile, I used my Ansible playbook to create a new Client SSL Profile, modified the Application settings to point to this new Client SSL Profile, and the SSL to waveform still seems to be in-tact. I can update with Common/default.crt and default.key and see that wave forms SSL fails, and can run the ansible script again with the correct key and full chain certificate and see waveform operate as expected over valid HTTPS. The Application configuration doesn't seem to be doing anything else...just changed the configured Client SSL Profile and all seems to be working as desired.
I hope this helps someone else who might be running into similar issues.