login.yml #2

  • //
  • guest/
  • russell_jackson/
  • ansible-sdp/
  • roles/
  • perforce-sdp-install/
  • tasks/
  • install/
  • login.yml
  • View
  • Commits
  • Open Download .zip Download (2 KB)
---
# On replica/edge servers, log the admin and service users into the master so
# replication can authenticate. Included from install.yml only for non-master
# server types. Each login is gated on `p4 login -s` so it only runs (and only
# reports changed) when there is no valid ticket -- keeping the task idempotent.

- name: "Check admin login status against P4MASTERPORT"
  ansible.builtin.command: >-
    /p4/common/bin/p4master_run {{ perforce_id }}
    p4 -p {{ target_server }}:{{ perforce_p4_port }} login -s
  become: true
  become_user: "{{ perforce_user }}"
  register: admin_login_status
  changed_when: false
  failed_when: false

- name: "Log admin user into P4MASTERPORT"
  ansible.builtin.shell: >-
    /p4/common/bin/p4master_run {{ perforce_id }}
    p4 -p {{ target_server }}:{{ perforce_p4_port }} login -a
    < /p4/common/config/.p4passwd.p4_{{ perforce_id }}.admin
  become: true
  become_user: "{{ perforce_user }}"
  when: admin_login_status.rc != 0
  changed_when: true
  failed_when: false

- name: "Check service-user login status against P4MASTERPORT"
  ansible.builtin.shell: >-
    /p4/common/bin/p4master_run {{ perforce_id }}
    p4 -p {{ target_server }}:{{ perforce_p4_port }} -u {{ p4serviceuser }} login -s
  args:
    executable: /bin/bash
  become: true
  become_user: "{{ perforce_user }}"
  register: svc_login_status
  changed_when: false
  failed_when: false

- name: "Log service user into P4MASTERPORT"
  ansible.builtin.shell: >-
    /p4/common/bin/p4master_run {{ perforce_id }}
    p4 -p {{ target_server }}:{{ perforce_p4_port }} login {{ p4serviceuser }}
  args:
    executable: /bin/bash
  become: true
  become_user: "{{ perforce_user }}"
  when: svc_login_status.rc != 0
  changed_when: true
  failed_when: false
# Change User Description Committed
#2 32876 Russell C. Jackson (Rusty) Make both ansible roles idempotent (full converge re-runs cleanly)

Existence gate:
- main.yml: stat /p4/common/bin/p4_vars -> sdp_installed fact; gate the
  destructive cleanup (wipe sdp folder + crontab) on 'not sdp_installed' so a
  re-converge skips wipe/reinstall and only reconciles idempotent config.

Run-once installers gated with creates/checks:
- run_mkdirs.sh: creates /p4/common/bin/p4_vars (drop changed_when:true).
- pyenv: drop changed_when on the creates-guarded bootstrap; add creates for the
  Python build; gate p4python install on 'pip3 show p4python'.
- monitoring prometheus.yml: gate the p4prometheus install script on
  creates /usr/local/bin/p4prometheus.

changed_when:true lies fixed:
- login.yml: gate admin/service logins on 'p4 login -s' (only log in when no
  valid ticket); use command for the no-shell status check.
- network_interface.yml: ifup gated on the interface not already being UP.

touch/cron idempotence:
- authorized_keys touch: modification_time/access_time preserve.
- cron/common.yml: remove 'crontab -r' (cron/cronvar modules manage entries
  idempotently by name; cron.yml is now the authoritative crontab manager).
- install/crontab.yml removed + its include dropped: the SDP-generated p4.crontab
  load was redundant (cron.yml's reset discarded it every run).
- packages.yml: apt update_cache cache_valid_time=3600.

Molecule: configure_new_server gated behind a marker in the install converge and
monitoring prepare; re-added the 'idempotence' step to both scenarios'
test_sequence. ansible-lint production-clean; all playbooks syntax-check.
#1 32842 Russell C. Jackson (Rusty) Reorganize ansible-sdp into per-concern task files; ansible-lint production-clean

- Split install.yml/cron.yml/dependencies.yml and the monitoring role into thin
  orchestrators plus single-purpose phase files; extract shared steps into
  tasks/common/ (fetch_sdp, fetch_binaries, run_mkdirs, copy_ssl,
  configure_broker, sudoers).
- Full best-practices pass: FQCN, true/false, quoted modes, changed_when, loops,
  document-start markers; fill both roles' meta; add .ansible-lint.
- RedHat parity: parameterized EPEL enable, dnf, full upgrade, sysctl/bbr tuning.
- Collapse the 12 journal-rotation cron tasks to one; consolidate duplicate
  download/broker logic; fix broken tests/test.yml role reference.
- Validated ansible-lint clean at the production profile (ansible-core 2.21 /
  python 3.12) and ansible-playbook --syntax-check OK.