150 lines
8.1 KiB
YAML
150 lines
8.1 KiB
YAML
---
|
||
# =============================================================================
|
||
# CONVERGE - Сборка и запуск тестовых сценариев
|
||
# =============================================================================
|
||
- hosts: localhost
|
||
gather_facts: false
|
||
vars:
|
||
# Получаем preset из переменной окружения или используем default
|
||
preset_name: "{{ lookup('env', 'MOLECULE_PRESET') | default('default') }}"
|
||
preset_file: "/workspace/molecule/presets/{{ preset_name }}.yml"
|
||
|
||
# перечисли файлы/глобы, которые нужно временно расшифровать
|
||
vault_targets:
|
||
- /workspace/vault/secrets.yml
|
||
- /workspace/vault/secret.yml
|
||
- /workspace/files/playbooks/group_vars/*/vault.yml
|
||
- /workspace/files/playbooks/host_vars/*/vault.yml
|
||
- /workspace/roles/**/vars/vault.yml
|
||
|
||
tasks:
|
||
# =============================================================================
|
||
# НАСТРОЙКА - Загрузка конфигурации и подготовка
|
||
# =============================================================================
|
||
- name: Configuration setup
|
||
debug:
|
||
msg: |
|
||
================================================================================
|
||
НАСТРОЙКА - Загрузка конфигурации и подготовка
|
||
================================================================================
|
||
Preset: {{ preset_name }}
|
||
================================================================================
|
||
|
||
- name: Load preset configuration
|
||
include_vars: "{{ preset_file }}"
|
||
when: preset_file is file
|
||
ignore_errors: true
|
||
|
||
# - name: Install collections
|
||
# community.docker.docker_container_exec:
|
||
# container: ansible-controller
|
||
# command: bash -lc "ansible-galaxy collection install -r /workspace/requirements.yml --force --no-deps --upgrade >/dev/null 2>&1 || true"
|
||
|
||
# =============================================================================
|
||
# VAULT - Работа с зашифрованными файлами
|
||
# =============================================================================
|
||
- name: Vault operations
|
||
debug:
|
||
msg: |
|
||
================================================================================
|
||
VAULT - Работа с зашифрованными файлами
|
||
================================================================================
|
||
Files: {{ vault_targets | length }} targets
|
||
================================================================================
|
||
|
||
- name: Check if vault file is encrypted
|
||
community.docker.docker_container_exec:
|
||
container: ansible-controller
|
||
command: "bash -c 'if [ -f \"/workspace/vault/secrets.yml\" ]; then grep -q \"ANSIBLE_VAULT\" /workspace/vault/secrets.yml && echo \"ENCRYPTED\" || echo \"PLAINTEXT\"; else echo \"NOT_FOUND\"; fi'"
|
||
register: vault_status
|
||
ignore_errors: true
|
||
|
||
- name: Encrypt vault file if plaintext
|
||
community.docker.docker_container_exec:
|
||
container: ansible-controller
|
||
command: "bash -c 'VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"/workspace/vault/secrets.yml\" ] && [ \"{{ vault_status.stdout }}\" = \"PLAINTEXT\" ]; then ansible-vault encrypt --encrypt-vault-id default --vault-password-file \"$VAULT_PASSWORD_FILE\" /workspace/vault/secrets.yml; fi'"
|
||
when: vault_status.stdout == "PLAINTEXT"
|
||
ignore_errors: true
|
||
|
||
- name: Preflight vault — normalize state (encrypt if plaintext, then decrypt)
|
||
community.docker.docker_container_exec:
|
||
container: ansible-controller
|
||
command: "bash -c 'VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"/workspace/vault/secrets.yml\" ]; then ansible-vault decrypt --vault-password-file \"$VAULT_PASSWORD_FILE\" /workspace/vault/secrets.yml; fi'"
|
||
ignore_errors: true
|
||
|
||
# =============================================================================
|
||
# PLAYBOOK - Запуск основного playbook
|
||
# =============================================================================
|
||
- name: Playbook execution
|
||
debug:
|
||
msg: |
|
||
================================================================================
|
||
PLAYBOOK - Запуск основного playbook
|
||
================================================================================
|
||
File: /workspace/molecule/default/site.yml
|
||
================================================================================
|
||
|
||
- name: Debug - Check files in container
|
||
community.docker.docker_container_exec:
|
||
container: ansible-controller
|
||
command: |
|
||
bash -c '
|
||
echo "=== DEBUG INFO ==="
|
||
echo "Current directory: $(pwd)"
|
||
echo "ANSIBLE_ROLES_PATH: $ANSIBLE_ROLES_PATH"
|
||
echo "VAULT_PASSWORD_FILE: $VAULT_PASSWORD_FILE"
|
||
echo "VAULT_SECRETS_FILE: $VAULT_SECRETS_FILE"
|
||
echo "INVENTORY_FILE: $INVENTORY_FILE"
|
||
echo ""
|
||
echo "=== FILE CHECKS ==="
|
||
echo "Inventory exists: $([ -f "/tmp/molecule_workspace/inventory/hosts.ini" ] && echo "YES" || echo "NO")"
|
||
echo "Vault password exists: $([ -f "/workspace/vault/.vault" ] && echo "YES" || echo "NO")"
|
||
echo "Vault secrets exists: $([ -f "/workspace/vault/secrets.yml" ] && echo "YES" || echo "NO")"
|
||
echo "Site.yml exists: $([ -f "/workspace/molecule/default/site.yml" ] && echo "YES" || echo "NO")"
|
||
echo ""
|
||
echo "=== DIRECTORY LISTING ==="
|
||
ls -la /tmp/molecule_workspace/ || echo "No molecule_workspace dir"
|
||
ls -la /workspace/vault/ || echo "No vault dir"
|
||
echo ""
|
||
echo "=== INVENTORY CONTENT ==="
|
||
cat /tmp/molecule_workspace/inventory/hosts.ini || echo "Cannot read inventory"
|
||
'
|
||
|
||
# - name: Run lab playbook
|
||
# community.docker.docker_container_exec:
|
||
# container: ansible-controller
|
||
# command: |
|
||
# bash -c '
|
||
# set -e
|
||
# export ANSIBLE_ROLES_PATH=/workspace/roles
|
||
# export VAULT_PASSWORD_FILE="/workspace/vault/.vault"
|
||
# export VAULT_SECRETS_FILE="/workspace/vault/secrets.yml"
|
||
# export INVENTORY_FILE="/tmp/molecule_workspace/inventory/hosts.ini"
|
||
# echo "Starting playbook execution..."
|
||
# if [ -f "$VAULT_PASSWORD_FILE" ] && [ -f "$VAULT_SECRETS_FILE" ]; then
|
||
# echo "Running with vault..."
|
||
# ansible-playbook -i "$INVENTORY_FILE" /workspace/molecule/default/site.yml --vault-password-file "$VAULT_PASSWORD_FILE" -e "vault_file_path=$VAULT_SECRETS_FILE" -v
|
||
# else
|
||
# echo "Running without vault..."
|
||
# ansible-playbook -i "$INVENTORY_FILE" /workspace/molecule/default/site.yml -v
|
||
# fi
|
||
# echo "Playbook completed successfully"
|
||
# '
|
||
|
||
# =============================================================================
|
||
# CLEANUP - Перешифровка файлов после выполнения
|
||
# =============================================================================
|
||
- name: Cleanup operations
|
||
debug:
|
||
msg: |
|
||
================================================================================
|
||
CLEANUP - Перешифровка файлов после выполнения
|
||
================================================================================
|
||
Re-encrypting vault files
|
||
================================================================================
|
||
|
||
- name: Post-run — re-encrypt secrets
|
||
community.docker.docker_container_exec:
|
||
container: ansible-controller
|
||
command: "bash -c 'VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"/workspace/vault/secrets.yml\" ]; then ansible-vault encrypt --encrypt-vault-id default --vault-password-file \"$VAULT_PASSWORD_FILE\" /workspace/vault/secrets.yml; fi'"
|
||
ignore_errors: true |