rolling restart when certs changed

tasks/setup_cluster.yml

@@ -36,6 +36,7 @@
   with_dict: "{{ mariadb_tls_files }}"
   become: true
   no_log: true
+  register: _mariadb_galera_cluster_newcerts
   when:
     - mariadb_tls_files is defined
     - mariadb_tls_files | length == 3
@@ -93,7 +94,8 @@
   with_items: "{{ galera_mysql_first_node }}"
   when: >
     galera_cluster_configured.stat.exists and
-    _mariadb_galera_cluster_reconfigured.changed
+    (_mariadb_galera_cluster_reconfigured.changed or
+    _mariadb_galera_cluster_newcerts.changed)
 
 - name: setup_cluster | cluster rolling restart - apply config changes (other nodes)
   ansible.builtin.include_tasks: manage_node_state.yml
@@ -102,7 +104,8 @@
   with_items: "{{ ansible_play_hosts | difference(galera_mysql_first_node) }}"
   when: >
     galera_cluster_configured.stat.exists and
-    _mariadb_galera_cluster_reconfigured.changed
+    (_mariadb_galera_cluster_reconfigured.changed or
+    _mariadb_galera_cluster_newcerts.changed)
 
 # Offline (re)configuration of glaera cluster settings - cluster bootstrap
 - name: setup_cluster | cluster bootstrap - stopping mysql to (re)configure cluster (other nodes)
@@ -122,7 +125,7 @@
     not galera_cluster_configured.stat.exists
 
 - name: setup_cluster | custer bootstrap - killing lingering mysql processes to ensure mysql is stopped
-  ansible.builtin.command: "pkill {{ mariadb_systemd_service_name }}"  # noqa ignore-errors
+  ansible.builtin.command: "pkill {{ mariadb_systemd_service_name }}" # noqa ignore-errors
   become: true
   ignore_errors: true
   when: not galera_cluster_configured.stat.exists