preflight.yml (3366B)
1 --- 2 - name: Check monitoring bundle files and whole-file Vault encryption 3 ansible.builtin.command: 4 argv: 5 - "{{ ansible_playbook_python }}" 6 - "{{ role_path }}/files/validate-bundle.py" 7 - --files 8 - "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}" 9 delegate_to: localhost 10 become: false 11 register: monitoring_file_check 12 changed_when: false 13 failed_when: false 14 check_mode: false 15 16 - name: Require both monitoring exports with Vault-encrypted secrets 17 ansible.builtin.assert: 18 that: monitoring_file_check.rc == 0 19 fail_msg: "{{ monitoring_file_check.stdout }}" 20 quiet: true 21 22 - name: Load the monitoring exports without logging credentials 23 block: 24 - name: Load public monitoring configuration 25 ansible.builtin.include_vars: 26 file: "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}/monitoring-client.yml" 27 name: monitoring_public_bundle 28 no_log: true 29 30 - name: Decrypt monitoring credentials 31 ansible.builtin.include_vars: 32 file: "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}/monitoring-client-secrets.yml" 33 name: monitoring_secret_bundle 34 no_log: true 35 36 - name: Validate monitoring settings and certificate pairs on the controller 37 ansible.builtin.command: 38 argv: 39 - "{{ ansible_playbook_python }}" 40 - "{{ role_path }}/files/validate-bundle.py" 41 stdin: >- 42 {{ {'public': monitoring_public_bundle, 'secrets': monitoring_secret_bundle} | to_json }} 43 delegate_to: localhost 44 become: false 45 register: monitoring_bundle_check 46 changed_when: false 47 failed_when: false 48 check_mode: false 49 no_log: true 50 51 # The validator prints only fixed diagnostics, never supplied values or PEMs. 52 - name: Require a valid external monitoring bundle 53 ansible.builtin.assert: 54 that: monitoring_bundle_check.rc == 0 55 fail_msg: "{{ monitoring_bundle_check.stdout }}" 56 quiet: true 57 58 rescue: 59 - name: Report an unusable monitoring bundle 60 ansible.builtin.fail: 61 msg: >- 62 Cannot load or validate the monitoring exports. Check the exported YAML, 63 Vault password, certificate identities, purposes, validity and key pairs. 64 65 - name: Require a supported monitoring client platform 66 ansible.builtin.assert: 67 that: 68 - ansible_facts['distribution'] == 'Debian' 69 - ansible_facts['distribution_major_version'] == '13' 70 - ansible_facts['architecture'] in ['x86_64', 'aarch64'] 71 quiet: true 72 73 - name: Read the optional nginx latency capability 74 ansible.builtin.set_fact: 75 monitoring_nginx_latency_enabled: >- 76 {{ monitoring_public_bundle.monitoring_client.get('nginx_latency', {}).get('enabled', false) }} 77 78 - name: Load the exchange latency route allowlist 79 ansible.builtin.set_fact: 80 monitoring_nginx_latency_routes: >- 81 {{ lookup('ansible.builtin.file', role_path ~ '/files/exchange-latency-routes.json') | from_json }} 82 when: monitoring_nginx_latency_enabled 83 84 - name: Require a safe exchange timing log name 85 ansible.builtin.assert: 86 that: 87 - exchange_domain is defined 88 - exchange_domain is match('^[A-Za-z0-9][A-Za-z0-9.-]*$') 89 fail_msg: Nginx latency collection needs the exchange domain to identify its timing log. 90 quiet: true 91 when: monitoring_nginx_latency_enabled