upgrade_panos_v10.yml

- hosts: all
  connection: local
  gather_facts: false

  vars:
    auth_code: 'your valid VM Auth-Code if unlicensed'

    provider:
      ip_address: '{{ ip_address }}'
      username: '{{ username }}'
      password: '{{ password }}'

  collections:
    - paloaltonetworks.panos

  tasks:
    - name: Ensure deps are avabilable
      # Ensure we have all the right requirements installed in this environment
      pip:
        name:
          - pan-python
          - pandevice
          - xmltodict
          - requests
          - requests_toolbelt

    - name: Show System Info
      # Grab the system info to determine current sw-version
      # this will also wait for the device to come on-line
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show system info'
      register: system_info
      until: system_info is not failed
      retries: 30
      delay: 60

    - set_fact: system_info_json="{{ system_info.stdout | from_json }}"

    - name: Show Version
      debug: msg="Current Version is {{ system_info_json.response.result.system['sw-version'] }} "

    - name: Activate my authcode
      # This firewall must be licensed to pull dynamic content and software updates
      panos_lic:
        provider: '{{ provider }}'
        auth_code: '{{ auth_code }}'
      register: activate_authcode

    - name: Pause for Service Restart
      pause:
        seconds: 180
      when: activate_authcode.changed

    - name: Wait for Reboot if necessary
      # Installing a license will cause pan software to restart, again wait for a positive API call
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show system info'
      register: system_info
      until: system_info is not failed
      retries: 30
      delay: 60

    - set_fact: system_info_json="{{ system_info.stdout | from_json }}"

    - debug:
        msg: "Serial number is {{ system_info_json.response.result.system['serial'] }}"

    - debug:
        msg: "Software version is {{ system_info_json.response.result.system['sw-version'] }}"

    - name: Check latest content
      # Get an updated dynamic content list
      panos_op:
        provider: '{{ provider }}'
        cmd: 'request content upgrade check'
      register: check

    - name: Download latest content
      # Download the latest version
      panos_op:
        provider: '{{ provider }}'
        cmd: |
          <request><content><upgrade><download>
          <latest></latest>
          </download></upgrade></content></request>
        cmd_is_xml: true
      register: download

    - name: Check content download result
      # wait for this job to finish
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show jobs id {{ (download.stdout | from_json).response.result.job }}'
      register: download_job
      until: download_job is not failed and (download_job.stdout | from_json).response.result.job.status == 'FIN'
      retries: 10
      delay: 60

    - name: Install latest content
      # Content is downloaded and ready, now install it
      panos_op:
        provider: '{{ provider }}'
        cmd: |
          <request><content><upgrade><install>
          <version>latest</version>
          </install></upgrade></content></request>
        cmd_is_xml: true
      register: install

    - name: Check content install result
      # again, wait for job to complete
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show jobs id {{ (install.stdout | from_json).response.result.job }}'
      register: install_job
      until: install_job is not failed and (install_job.stdout | from_json).response.result.job.status == 'FIN'
      retries: 10
      delay: 60

    - name: Download PAN-OS 9.0.0 base image only
      # If current version is less than 9.0, download 9.0 base image
      panos_software:
        provider: '{{ provider }}'
        version: '9.0.0'
        install: false
        restart: false
      when: |
        system_info_json.response.result.system['sw-version'] is version('9.0.0', '<')

    - name: Install PAN-OS 9.0.8
      # if current version is less than 9.0.8, then do an upgrade, with no restart
      panos_software:
        provider: '{{ provider }}'
        version: '9.0.8'
        install: true
        restart: false # fixme - we may need a reboot and wait cycle here as well
      when: |
        system_info_json.response.result.system['sw-version'] is version('9.0.8', '<')

    - name: Download PAN-OS 9.1.0 base image only
      # if current version is less than 9.1.0, download 9.1 base image
      panos_software:
        provider: '{{ provider }}'
        version: '9.1.0'
        install: false
        restart: false
      when: |
        system_info_json.response.result.system['sw-version'] is version('9.1.0', '<')

    - name: Install PAN-OS 9.1.3-h1
      # if current version is less than 9.1.2-h1
      panos_software:
        provider: '{{ provider }}'
        version: '9.1.3-h1'
        install: true
        restart: true
      when: |
        system_info_json.response.result.system['sw-version'] is version('9.1.3', '<')

    - name: Wait for Reboot if necessary
      # wait for device to come back online
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show system info'
      register: system_info
      until: system_info is not failed
      retries: 30
      delay: 60

    - set_fact: system_info_json="{{ system_info.stdout | from_json }}"

    - name: Install PAN-OS 10.0.0
      # if current version is less than 10.0.0
      panos_software:
        provider: '{{ provider }}'
        version: '10.0.0'
        install: true
        restart: true
      when: |
        system_info_json.response.result.system['sw-version'] is version('10.0.0', '<')

    - name: Pause for restart
      pause:
        seconds: 30

    - name: Final Reboot Cycle
      panos_op:
        provider: '{{ provider }}'
        cmd: 'show system info'
      register: system_info
      until: system_info is not failed
      retries: 30
      delay: 60

    - name: Display new software rev
      debug: msg="Softare is now {{ (system_info.stdout | from_json).response.result.system['sw-version'] }}"