170 lines
6.3 KiB
YAML
170 lines
6.3 KiB
YAML
---
|
|
- name: entrypoint
|
|
hosts: all
|
|
user: ansible
|
|
become: yes
|
|
gather_facts: true
|
|
vars:
|
|
test_run_roles:
|
|
# - network
|
|
# - repos
|
|
# - yum
|
|
# - ssh
|
|
# - users
|
|
# - systemd
|
|
# - rsyslog
|
|
# - audittrail
|
|
# - nhc
|
|
# - prometheus
|
|
# - sysctl
|
|
# - limits
|
|
# START
|
|
# - ntp
|
|
# - os_packages
|
|
- hypervisor_prep
|
|
# - vxlan
|
|
# - firewalld
|
|
|
|
tasks:
|
|
|
|
######## load core group_vars
|
|
#
|
|
# load the following core environment files under vars['steel']
|
|
# - inventory/group_vars/cluster.yml
|
|
# - inventory/group_vars/roles.yml
|
|
# - inventory/group_vars/networks.yml
|
|
|
|
- name: load core environment configuration
|
|
block:
|
|
|
|
- name: set env import variables
|
|
ansible.builtin.set_fact:
|
|
env_files:
|
|
- 'cluster.yml'
|
|
- 'roles.yml'
|
|
- 'networks.yml'
|
|
env_dir: "{{ ansible_inventory_sources[0] | dirname }}/group_vars"
|
|
config_namespace: "steel"
|
|
|
|
- name: include vars from core config files
|
|
ansible.builtin.include_vars:
|
|
file: "{{ env_path }}"
|
|
name: "env_import_{{ env_namespace }}"
|
|
loop: "{{ env_files }}"
|
|
loop_control:
|
|
loop_var: entry
|
|
vars:
|
|
env_path: "{{ env_dir }}/{{ entry }}"
|
|
env_namespace: "{{ entry.split('.yml')[0] }}"
|
|
|
|
- name: append env vars to temp dict
|
|
ansible.builtin.set_fact:
|
|
env_dict: "{{ env_dict | default({}) | combine (env_import, recursive=True) }}"
|
|
loop: "{{ lookup('ansible.builtin.varnames', 'env_import_').split(',') }}"
|
|
loop_control:
|
|
loop_var: entry
|
|
vars:
|
|
env_import: "{{ vars[entry] }}"
|
|
|
|
- name: copy dict of env vars under top level namespace
|
|
set_fact:
|
|
{ "{{ config_namespace }}": "{{ env_dict }}" }
|
|
|
|
######## generate list of roles to run against host
|
|
|
|
- name: list all hostvars groups where the host is a member
|
|
ansible.builtin.set_fact:
|
|
_hostvars_groups: "{{ hostvars[ansible_hostname]['group_names'] | default([]) + (['all']) }}"
|
|
|
|
- name: intersect hostvars groups with role groups, uses role groups to dictate role runtime order
|
|
ansible.builtin.set_fact:
|
|
active_role_groups: "{{ role_groups | intersect(group) }}"
|
|
loop:
|
|
- "{{ _hostvars_groups }}"
|
|
loop_control:
|
|
loop_var: entry
|
|
vars:
|
|
group: "{{ entry }}"
|
|
role_groups: "{{ vars[config_namespace]['roles'] | list }}"
|
|
|
|
- name: list roles to run against "{{ ansible_hostname }}"
|
|
ansible.builtin.set_fact:
|
|
_run_roles: "{{ _run_roles | default([]) + vars[config_namespace]['roles'][entry] }}"
|
|
loop: "{{ active_role_groups }}"
|
|
loop_control:
|
|
loop_var: entry
|
|
|
|
# this is required for roles to be dual purpose (client/server)
|
|
# - roles.yml may have role 'ntp' under groups 'all' and again under 'ntpd'
|
|
# - the 'ntp' role will be run only once for the 'all' group but will select a client/server setup based on ansible inventory membership in the 'ntpd' group
|
|
- name: select only unique roles, preserve runtime order
|
|
ansible.builtin.set_fact:
|
|
_run_roles: "{{ _run_roles | unique }}"
|
|
|
|
- name: roles to run on "{{ ansible_hostname }}"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- run roles "{{ _run_roles }}"
|
|
|
|
# global variables we can use for evaluations, we use these to determine role/task execution:
|
|
# - "{{ active_role_groups }}" # role groups that <this> host is a member of, whitelisted/intersected from vars[config_namespace]['roles'] / group_vars/roles.yml
|
|
# - "{{ _run_roles }}" # all roles to run on <this> host, role runtime execution is ordered from vars[config_namespace]['role'] / group_vars/roles.yml
|
|
#
|
|
# example usage of active_role_groups:
|
|
#
|
|
# - a task can check if <this> host is in the monitoring group
|
|
# when: "'monitoring' in active_role_groups" # this method includes all groups <this> host is a member and also the 'all' group, crucially it only includes groups whitelisted in vars[config_namespace]['role']
|
|
# when: "'monitoring' in hostvars[ansible_hostname]['group_names']" # this is a ansible native test but excludes the 'all' group
|
|
# when: inventory_hostname in groups['monitoring'] # this is a ansible native method, probably the easiest ansible native method, notice inventory_hostname usage where external dns or hosts file entries are not available
|
|
#
|
|
# - ansible.builtin.debug:
|
|
# msg:
|
|
# - "{{ groups['all'] }}"
|
|
# - "{{ hostvars[ansible_hostname]['group_names'] }}"
|
|
# - "{{ active_role_groups }}"
|
|
# - "{{ _run_roles }}"
|
|
|
|
######## load vars from each target role
|
|
|
|
# try to code around this method to make code more modular/portable:
|
|
# - strategies such as pull other host facts with delegate_facts where possible, chain roles where applicable - run roles on all hosts with skip tasks where unavoidable
|
|
#
|
|
# if this task is truely necessary extend its use further to fit future design patterns:
|
|
#
|
|
# info.yml should load variables into config_namespace and also contain merge OR overwrite functions to source from group_vars/<role name>.yml
|
|
# each role main.yml would run the info.yml as the first task also, to be a catch_all function for any future portability (it could always check if vars[config_namespace] was already populated)
|
|
# role tasks should all source variables from vars[config_namespace]
|
|
|
|
# - name: "Load variables {{ ansible_hostname }}"
|
|
# ansible.builtin.include_role:
|
|
# name: "{{ role_var }}"
|
|
# public: true
|
|
# tasks_from: info.yml
|
|
# loop: "{{ _run_roles }}"
|
|
# loop_control:
|
|
# loop_var: role_var
|
|
# label: Setup {{ role_var }} variables on {{ ansible_hostname }}
|
|
|
|
# - name: Output vars structure
|
|
# ansible.builtin.debug:
|
|
# msg: "{{ vars[role_var] }}"
|
|
# when: vars[role_var] is defined
|
|
# loop: "{{ _run_roles }}"
|
|
# loop_control:
|
|
# loop_var: role_var
|
|
# tags: never
|
|
|
|
######## run roles against hosts
|
|
|
|
- name: override run_roles for testing
|
|
set_fact:
|
|
_run_roles: "{{ test_run_roles }}"
|
|
when: test_run_roles is defined
|
|
|
|
- name: run roles on "{{ ansible_hostname }}"
|
|
ansible.builtin.include_role:
|
|
name: "{{ entry }}"
|
|
loop: "{{ _run_roles }}"
|
|
loop_control:
|
|
loop_var: entry
|
|
label: run {{ entry }} role on {{ ansible_hostname }} |