upgrade_content.yml

---
# upgrade_content.yml - Upgrade the content version on a PAN-OS device.
#
# Description
# ===========
#
# Upgrades the content version on a PAN-OS device or HA pair.
#
# This playbook requires connection details for the device to be specified in the variables 'ip_address', 'username',
# and 'password'.  These may be defined as host variables (see `host_vars/firewall.yml` for an example) or
# extra vars.
#
# Usage
# =====
#
# Required Variables:
#
#   target: Target PAN-OS device (or primary member of an HA pair).
#
# Optional Variables:
#
#   sync_to_peer: When the 'target' the primary member of a HA pair, the installed content version will be synced to
#                 the secondary member when set to 'True'.
#
# Upgrade the content on a single PAN-OS device:
#
#   $ ansible-playbook -i inventory upgrade_content.yml --extra-vars "target=firewall"

- hosts: '{{ target | default("firewall") }}'
  connection: local

  vars:
    device:
      ip_address: '{{ ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

    sync_to_peer: false

  tasks:
    - name: Check latest content
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: 'request content upgrade check'
      register: check
      changed_when: false

    - name: Download latest content
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: |
          <request><content><upgrade><download>
          <latest></latest>
          {% if sync_to_peer %}<sync-to-peer>yes</sync-to-peer>{% endif %}
          </download></upgrade></content></request>
        cmd_is_xml: true
      register: download

    - name: Check content download result
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: 'show jobs id {{ (download.stdout | from_json).response.result.job }}'
      register: download_job
      until: download_job is not failed and (download_job.stdout | from_json).response.result.job.status == 'FIN'
      retries: 10
      delay: 60

    - name: Install latest content
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: |
          <request><content><upgrade><install>
          <version>latest</version>
          {% if sync_to_peer %}<sync-to-peer>yes</sync-to-peer>{% endif %}
          </install></upgrade></content></request>
        cmd_is_xml: true
      register: install

    - name: Check content install result
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: 'show jobs id {{ (install.stdout | from_json).response.result.job }}'
      register: install_job
      until: install_job is not failed and (install_job.stdout | from_json).response.result.job.status == 'FIN'
      retries: 10
      delay: 60