preflight.yml (2543B)
1 --- 2 - name: Check monitoring bundle files and whole-file Vault encryption 3 ansible.builtin.command: 4 argv: 5 - "{{ ansible_playbook_python }}" 6 - "{{ role_path }}/files/validate-bundle.py" 7 - --files 8 - "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}" 9 delegate_to: localhost 10 become: false 11 register: monitoring_file_check 12 changed_when: false 13 failed_when: false 14 check_mode: false 15 16 - name: Require both monitoring exports with Vault-encrypted secrets 17 ansible.builtin.assert: 18 that: monitoring_file_check.rc == 0 19 fail_msg: "{{ monitoring_file_check.stdout }}" 20 quiet: true 21 22 - name: Load the monitoring exports without logging credentials 23 block: 24 - name: Load public monitoring configuration 25 ansible.builtin.include_vars: 26 file: "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}/monitoring-client.yml" 27 name: monitoring_public_bundle 28 no_log: true 29 30 - name: Decrypt monitoring credentials 31 ansible.builtin.include_vars: 32 file: "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}/monitoring-client-secrets.yml" 33 name: monitoring_secret_bundle 34 no_log: true 35 36 - name: Validate monitoring settings and certificate pairs on the controller 37 ansible.builtin.command: 38 argv: 39 - "{{ ansible_playbook_python }}" 40 - "{{ role_path }}/files/validate-bundle.py" 41 stdin: >- 42 {{ {'public': monitoring_public_bundle, 'secrets': monitoring_secret_bundle} | to_json }} 43 delegate_to: localhost 44 become: false 45 register: monitoring_bundle_check 46 changed_when: false 47 failed_when: false 48 check_mode: false 49 no_log: true 50 51 # The validator prints only fixed diagnostics, never supplied values or PEMs. 52 - name: Require a valid external monitoring bundle 53 ansible.builtin.assert: 54 that: monitoring_bundle_check.rc == 0 55 fail_msg: "{{ monitoring_bundle_check.stdout }}" 56 quiet: true 57 58 rescue: 59 - name: Report an unusable monitoring bundle 60 ansible.builtin.fail: 61 msg: >- 62 Cannot load or validate the monitoring exports. Check the exported YAML, 63 Vault password, certificate identities, purposes, validity and key pairs. 64 65 - name: Require a supported monitoring client platform 66 ansible.builtin.assert: 67 that: 68 - ansible_facts['distribution'] == 'Debian' 69 - ansible_facts['distribution_major_version'] == '13' 70 - ansible_facts['architecture'] in ['x86_64', 'aarch64'] 71 quiet: true