From d0532d41edcf653c8ea63f83784495093dd79f17 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:38:42 +0200 Subject: [PATCH 01/59] add new single function playbooks --- deploy_containers_playbook.yml | 21 +++++++++++++++++++++ deploy_loadbalancers_playbook.yml | 3 +++ deploy_mariadb_playbook.yml | 3 +++ deploy_mongo_playbook.yml | 3 +++ deploy_monitoring_playbook.yml | 1 + 5 files changed, 31 insertions(+) create mode 100644 deploy_containers_playbook.yml create mode 100644 deploy_loadbalancers_playbook.yml create mode 100644 deploy_mariadb_playbook.yml create mode 100644 deploy_mongo_playbook.yml create mode 100644 deploy_monitoring_playbook.yml diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml new file mode 100644 index 000000000..efc5b4b44 --- /dev/null +++ b/deploy_containers_playbook.yml @@ -0,0 +1,21 @@ +--- +# Include secrets +- hosts: docker_servers + become: true + tasks: + - name: Read vars from secrets file + include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always + roles: + - { role: docker, tags: ['docker' ] } + +# Separate grouos for all containerized apps +# Dividing apps across the container services should be set in +# the inventory not in the playbook, this way you can easily change +# it for different environments +- hosts: docker_invite + become: true + roles: + - { role: invite, tags: ['invite' ] } \ No newline at end of file diff --git a/deploy_loadbalancers_playbook.yml b/deploy_loadbalancers_playbook.yml new file mode 100644 index 000000000..af57dfc45 --- /dev/null +++ b/deploy_loadbalancers_playbook.yml @@ -0,0 +1,3 @@ +--- +- name: Include some basic roles and read secrets + ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file diff --git a/deploy_mariadb_playbook.yml b/deploy_mariadb_playbook.yml new file mode 100644 index 000000000..af57dfc45 --- /dev/null +++ b/deploy_mariadb_playbook.yml @@ -0,0 +1,3 @@ +--- +- name: Include some basic roles and read secrets + ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file diff --git a/deploy_mongo_playbook.yml b/deploy_mongo_playbook.yml new file mode 100644 index 000000000..af57dfc45 --- /dev/null +++ b/deploy_mongo_playbook.yml @@ -0,0 +1,3 @@ +--- +- name: Include some basic roles and read secrets + ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file diff --git a/deploy_monitoring_playbook.yml b/deploy_monitoring_playbook.yml new file mode 100644 index 000000000..2ccb1e6ec --- /dev/null +++ b/deploy_monitoring_playbook.yml @@ -0,0 +1 @@ +# zie surfconext-deploy-environments/mgnt/README.md \ No newline at end of file From 13e41a0b701fbe7083533c08305816364378b366 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:44:23 +0200 Subject: [PATCH 02/59] remove includes --- deploy_monitoring_playbook.yml | 1 - 1 file changed, 1 deletion(-) delete mode 100644 deploy_monitoring_playbook.yml diff --git a/deploy_monitoring_playbook.yml b/deploy_monitoring_playbook.yml deleted file mode 100644 index 2ccb1e6ec..000000000 --- a/deploy_monitoring_playbook.yml +++ /dev/null @@ -1 +0,0 @@ -# zie surfconext-deploy-environments/mgnt/README.md \ No newline at end of file From f90371b42621858cf698932e3ab5ebacc232b1e1 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:44:49 +0200 Subject: [PATCH 03/59] remove includes --- config_base_playbook.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 config_base_playbook.yml diff --git a/config_base_playbook.yml b/config_base_playbook.yml new file mode 100644 index 000000000..31b84a2b9 --- /dev/null +++ b/config_base_playbook.yml @@ -0,0 +1,26 @@ +--- +- hosts: base + gather_facts: yes + become: true + tasks: + - name: Read vars from secrets file + include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always + roles: + - role: common + tags: ['core', 'base', 'common'] + - role: rsyslog + tags: ['core', 'base', 'rsyslog'] + - role: iptables # TODO: the when should be in the role + when: + - iptables_enable | bool + tags: ['core', 'base', 'iptables'] + # TODO: the role has a lot of when host is in loadbalancer group statements so it makes more sense to move this + # to a load balancer playbook that is ,imited to the loadbalancer group + # at the moment it only is enabled for the vm inventory so maybe it is not necessary at all + - role: selfsigned_certs + when: + - "{{ use_selfsigned_certs | default(false) | bool }}" + tags: ['core', 'base', 'selfsigned_certs'] \ No newline at end of file From 6f3f3ffe72acdfd536a8f21ad479bc84861dbc62 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:45:09 +0200 Subject: [PATCH 04/59] remove includes --- deploy_loadbalancers_playbook.yml | 4 +--- deploy_mariadb_playbook.yml | 4 +--- deploy_mongo_playbook.yml | 4 +--- 3 files changed, 3 insertions(+), 9 deletions(-) diff --git a/deploy_loadbalancers_playbook.yml b/deploy_loadbalancers_playbook.yml index af57dfc45..73b314ff7 100644 --- a/deploy_loadbalancers_playbook.yml +++ b/deploy_loadbalancers_playbook.yml @@ -1,3 +1 @@ ---- -- name: Include some basic roles and read secrets - ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file +--- \ No newline at end of file diff --git a/deploy_mariadb_playbook.yml b/deploy_mariadb_playbook.yml index af57dfc45..73b314ff7 100644 --- a/deploy_mariadb_playbook.yml +++ b/deploy_mariadb_playbook.yml @@ -1,3 +1 @@ ---- -- name: Include some basic roles and read secrets - ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file +--- \ No newline at end of file diff --git a/deploy_mongo_playbook.yml b/deploy_mongo_playbook.yml index af57dfc45..73b314ff7 100644 --- a/deploy_mongo_playbook.yml +++ b/deploy_mongo_playbook.yml @@ -1,3 +1 @@ ---- -- name: Include some basic roles and read secrets - ansible.builtin.import_playbook: base_inc_playbook.yml \ No newline at end of file +--- \ No newline at end of file From 38ed914d1e91c841ca36319129b918de99b3bb9d Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:51:34 +0200 Subject: [PATCH 05/59] add an example --- environments/example/inventory | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 environments/example/inventory diff --git a/environments/example/inventory b/environments/example/inventory new file mode 100644 index 000000000..aadc02798 --- /dev/null +++ b/environments/example/inventory @@ -0,0 +1,9 @@ +[base:children] +docker_servers + +[docker_servers] +docker1.example.com +docker2.example.com + +[docker_invite] +docker2.example.com \ No newline at end of file From 0e688c6e76f3cfc6cfd6b2d0f7e1860c8333b9f5 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 14:57:15 +0200 Subject: [PATCH 06/59] linter --- deploy_containers_playbook.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index efc5b4b44..d001f96e2 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -1,21 +1,23 @@ --- # Include secrets -- hosts: docker_servers +- name: Deploy containerized applications + hosts: docker_servers become: true tasks: - name: Read vars from secrets file - include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" no_log: true tags: - - always + - always roles: - - { role: docker, tags: ['docker' ] } + - { role: docker, tags: ['docker'] } # TODO move to a config docker playbook? # Separate grouos for all containerized apps # Dividing apps across the container services should be set in # the inventory not in the playbook, this way you can easily change # it for different environments -- hosts: docker_invite +- name: Deploy invite app + hosts: docker_invite become: true roles: - - { role: invite, tags: ['invite' ] } \ No newline at end of file + - { role: invite, tags: ['invite'] } From c81aaa6edc4d3729003407aa32f462371c654efb Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 15:00:03 +0200 Subject: [PATCH 07/59] linter --- config_base_playbook.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/config_base_playbook.yml b/config_base_playbook.yml index 31b84a2b9..9087f78eb 100644 --- a/config_base_playbook.yml +++ b/config_base_playbook.yml @@ -1,13 +1,14 @@ --- -- hosts: base - gather_facts: yes +- name: Common configuration + hosts: base + gather_facts: true become: true tasks: - - name: Read vars from secrets file - include_vars: "{{ inventory_dir }}/secrets/secrets.yml" - no_log: true - tags: - - always + - name: Read vars from secrets file + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always roles: - role: common tags: ['core', 'base', 'common'] @@ -22,5 +23,5 @@ # at the moment it only is enabled for the vm inventory so maybe it is not necessary at all - role: selfsigned_certs when: - - "{{ use_selfsigned_certs | default(false) | bool }}" - tags: ['core', 'base', 'selfsigned_certs'] \ No newline at end of file + - "use_selfsigned_certs | default(false) | bool" + tags: ['core', 'base', 'selfsigned_certs'] From 5a614d7830abf8f3330660dca862dfca062e68a9 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 15:18:29 +0200 Subject: [PATCH 08/59] run manage_test_entity register also in check mode --- roles/manage_provision_entities/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/manage_provision_entities/tasks/main.yml b/roles/manage_provision_entities/tasks/main.yml index 684d15877..c0a61424b 100644 --- a/roles/manage_provision_entities/tasks/main.yml +++ b/roles/manage_provision_entities/tasks/main.yml @@ -34,6 +34,7 @@ body: entityid: "{{ manage_provision_client_id }}" run_once: true + check_mode: true # This task does not make changes to the system and can be safely run in check mode register: manage_test_entity until: manage_test_entity is succeeded retries: 15 From f1d5c56202ab9e3aa0c4555ce2849339ba77dfef Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 15:32:02 +0200 Subject: [PATCH 09/59] false not true --- roles/manage_provision_entities/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/manage_provision_entities/tasks/main.yml b/roles/manage_provision_entities/tasks/main.yml index c0a61424b..ae4b37654 100644 --- a/roles/manage_provision_entities/tasks/main.yml +++ b/roles/manage_provision_entities/tasks/main.yml @@ -34,7 +34,7 @@ body: entityid: "{{ manage_provision_client_id }}" run_once: true - check_mode: true # This task does not make changes to the system and can be safely run in check mode + check_mode: false # This task does not make changes to the system and can be safely run in check mode register: manage_test_entity until: manage_test_entity is succeeded retries: 15 From 029fbb04271f2ad8a0815d2aa7fbdb6de7dd3399 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 15:40:22 +0200 Subject: [PATCH 10/59] split docker config and container deployment --- config_docker_playbook.yml | 12 ++++++++++++ deploy_containers_playbook.yml | 3 --- 2 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 config_docker_playbook.yml diff --git a/config_docker_playbook.yml b/config_docker_playbook.yml new file mode 100644 index 000000000..ab32b0481 --- /dev/null +++ b/config_docker_playbook.yml @@ -0,0 +1,12 @@ +--- +- name: Configure docker servers + hosts: docker_servers + become: true + tasks: + - name: Read vars from secrets file + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always + roles: + - { role: docker, tags: ['docker'] } diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index d001f96e2..44fa004d7 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -1,5 +1,4 @@ --- -# Include secrets - name: Deploy containerized applications hosts: docker_servers become: true @@ -9,8 +8,6 @@ no_log: true tags: - always - roles: - - { role: docker, tags: ['docker'] } # TODO move to a config docker playbook? # Separate grouos for all containerized apps # Dividing apps across the container services should be set in From c792ba6ce72f5624c2e8550bee84d8597af41028 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 15:48:15 +0200 Subject: [PATCH 11/59] read secrets in a separte block works, not sure why --- config_docker_playbook.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config_docker_playbook.yml b/config_docker_playbook.yml index ab32b0481..eaa54940f 100644 --- a/config_docker_playbook.yml +++ b/config_docker_playbook.yml @@ -1,5 +1,5 @@ --- -- name: Configure docker servers +- name: Read inventory secrets hosts: docker_servers become: true tasks: @@ -8,5 +8,9 @@ no_log: true tags: - always + +- name: Configure docker servers + hosts: docker_servers + become: true roles: - { role: docker, tags: ['docker'] } From a837511a6b208706fd7ed4ee260b9315c5bbf1bd Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 16:24:48 +0200 Subject: [PATCH 12/59] add todo item --- roles/docker/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml index a84f57699..f7e7632cc 100644 --- a/roles/docker/tasks/main.yml +++ b/roles/docker/tasks/main.yml @@ -128,6 +128,7 @@ owner: root mode: "0755" +# TODO only start this when configuration changes - name: Enable and start the new firewall service ansible.builtin.systemd: service: iptablesdocker.service From 4b266c556daf79a38d3232fe458526be511d8b46 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 16:40:37 +0200 Subject: [PATCH 13/59] read secrets in a separte block works, not sure why --- config_base_playbook.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config_base_playbook.yml b/config_base_playbook.yml index 9087f78eb..95f00476a 100644 --- a/config_base_playbook.yml +++ b/config_base_playbook.yml @@ -1,5 +1,5 @@ --- -- name: Common configuration +- name: Read inventory secrets hosts: base gather_facts: true become: true @@ -9,6 +9,10 @@ no_log: true tags: - always + +- name: Common configuration + hosts: base + become: true roles: - role: common tags: ['core', 'base', 'common'] From 89bd2b88417bf601b2a1103688b7110e71a759aa Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 17:06:24 +0200 Subject: [PATCH 14/59] add comment --- config_base_playbook.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config_base_playbook.yml b/config_base_playbook.yml index 95f00476a..77049377b 100644 --- a/config_base_playbook.yml +++ b/config_base_playbook.yml @@ -1,4 +1,6 @@ --- +# This playbook causes a lot of unexpected changes but so does provision.yml +# with the base tag, TODO fix configuration drift or remove some roles - name: Read inventory secrets hosts: base gather_facts: true From 47394372cde3dcba427091ffc91daf1116508e44 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 19:42:03 +0200 Subject: [PATCH 15/59] add dashboard --- deploy_containers_playbook.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index 44fa004d7..e0f8c38ed 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -18,3 +18,10 @@ become: true roles: - { role: invite, tags: ['invite'] } + +- name: Deploy dashboard app + hosts: docker_dashboard + become: true + roles: + - { role: dashboard, tags: ['dashboard'] } + From 1ffca9022933fe2c511e385f8d3ed0c61e6fa469 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 1 May 2025 19:42:55 +0200 Subject: [PATCH 16/59] add dashboard --- deploy_containers_playbook.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index e0f8c38ed..b252c363d 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -24,4 +24,3 @@ become: true roles: - { role: dashboard, tags: ['dashboard'] } - From bea9376c034f734c0aa0e74dfe0bc93151be127f Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 2 May 2025 09:43:59 +0200 Subject: [PATCH 17/59] disable everything for now --- config_base_playbook.yml | 58 ++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/config_base_playbook.yml b/config_base_playbook.yml index 77049377b..f6ece6b48 100644 --- a/config_base_playbook.yml +++ b/config_base_playbook.yml @@ -1,33 +1,33 @@ --- # This playbook causes a lot of unexpected changes but so does provision.yml # with the base tag, TODO fix configuration drift or remove some roles -- name: Read inventory secrets - hosts: base - gather_facts: true - become: true - tasks: - - name: Read vars from secrets file - ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" - no_log: true - tags: - - always +# - name: Read inventory secrets +# hosts: base +# gather_facts: true +# become: true +# tasks: +# - name: Read vars from secrets file +# ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" +# no_log: true +# tags: +# - always -- name: Common configuration - hosts: base - become: true - roles: - - role: common - tags: ['core', 'base', 'common'] - - role: rsyslog - tags: ['core', 'base', 'rsyslog'] - - role: iptables # TODO: the when should be in the role - when: - - iptables_enable | bool - tags: ['core', 'base', 'iptables'] - # TODO: the role has a lot of when host is in loadbalancer group statements so it makes more sense to move this - # to a load balancer playbook that is ,imited to the loadbalancer group - # at the moment it only is enabled for the vm inventory so maybe it is not necessary at all - - role: selfsigned_certs - when: - - "use_selfsigned_certs | default(false) | bool" - tags: ['core', 'base', 'selfsigned_certs'] +# - name: Common configuration +# hosts: base +# become: true +# roles: +# - role: common +# tags: ['core', 'base', 'common'] +# - role: rsyslog +# tags: ['core', 'base', 'rsyslog'] +# - role: iptables # TODO: the when should be in the role +# when: +# - iptables_enable | bool +# tags: ['core', 'base', 'iptables'] +# # TODO: the role has a lot of when host is in loadbalancer group statements so it makes more sense to move this +# # to a load balancer playbook that is ,imited to the loadbalancer group +# # at the moment it only is enabled for the vm inventory so maybe it is not necessary at all +# - role: selfsigned_certs +# when: +# - "use_selfsigned_certs | default(false) | bool" +# tags: ['core', 'base', 'selfsigned_certs'] From 5d66e0f1465f2c2dcf2a9848862a2e084c906615 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 2 May 2025 15:18:55 +0200 Subject: [PATCH 18/59] add all dockerapps1 apps --- deploy_containers_playbook.yml | 90 ++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index b252c363d..e49069531 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -24,3 +24,93 @@ become: true roles: - { role: dashboard, tags: ['dashboard'] } + +- name: Deploy teams app + hosts: docker_teams + become: true + roles: + - { role: teams, tags: ['teams'] } + +- name: Deploy pdp app + hosts: docker_pdp + become: true + roles: + - { role: pdp, tags: ['pdp'] } + +- name: Deploy voot app + hosts: docker_voot + become: true + roles: + - { role: voot, tags: ['voot'] } + +- name: Deploy attribute-aggregation app + hosts: docker_attribute_aggregation + become: true + roles: + - { role: attribute-aggregation, tags: ['aa', 'attribute-aggregation'] } + +- name: Deploy oidc-playground app + hosts: docker_oidc-playground + become: true + roles: + - { role: oidc-playground, tags: ['oidc-playground'] } + +- name: Deploy myconext app + hosts: docker_myconext + become: true + roles: + - { role: myconext, tags: ['myconext'] } + +- name: Deploy manage app + hosts: docker_manage + become: true + roles: + - { role: manage, tags: ['manage'] } + +- name: Deploy oidcng app + hosts: docker_oidcng + become: true + roles: + - { role: oidcng, tags: ['oidcng'] } + +- name: Deploy stats app + hosts: docker_stats + become: true + roles: + - { role: stats, tags: ['stats'] } + +- name: Deploy diyidp app + hosts: docker_diyidp + become: true + roles: + - { role: diyidp, tags: ['diyidp'] } + +- name: Deploy profile app + hosts: docker_profile + become: true + roles: + - { role: profile, tags: ['profile'] } + +- name: Deploy lifecycle app + hosts: docker_lifecycle + become: true + roles: + - { role: lifecycle, tags: ['lifecycle'] } + +- name: Deploy stepuptiqr app + hosts: docker_stepuptiqr + become: true + roles: + - { role: stepuptiqr, tags: ['stepuptiqr', 'stepup'] } + +- name: Deploy mujina-idp app + hosts: docker_mujina_idp + become: true + roles: + - { role: mujina-idp, tags: ['mujina-idp', 'mujina'] } + +- name: Deploy mujina-sp app + hosts: docker_mujina_sp + become: true + roles: + - { role: mujina-sp, tags: ['mujina-sp', 'mujina'] } From 2675b50251fe49595b55e63136b79e88e040dfc7 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 2 May 2025 15:45:48 +0200 Subject: [PATCH 19/59] add all dockerapps2 apps --- deploy_containers_playbook.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index e49069531..87f15824c 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -114,3 +114,15 @@ become: true roles: - { role: mujina-sp, tags: ['mujina-sp', 'mujina'] } + +- name: Deploy engineblock app + hosts: docker_engineblock + become: true + roles: + - { role: engineblock, tags: ['engineblock', 'eb'] } + +- name: Deploy stepupgateway app + hosts: docker_stepupgateway + become: true + roles: + - { role: stepupgateway, tags: ['stepupgateway', 'stepup'] } From 6f864f7c2317095dc209936ccf92aa7e2a563820 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 2 May 2025 16:27:20 +0200 Subject: [PATCH 20/59] add all stepupapp apps --- deploy_containers_playbook.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index 87f15824c..407197a47 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -126,3 +126,33 @@ become: true roles: - { role: stepupgateway, tags: ['stepupgateway', 'stepup'] } + +- name: Deploy stepupwebauthn app + hosts: docker_stepupwebauthn + become: true + roles: + - { role: stepupwebauthn, tags: ['stepupwebauthn', 'stepup'] } + +- name: Deploy stepupazuremfa app + hosts: docker_stepupazuremfa + become: true + roles: + - { role: stepupazuremfa, tags: ['stepupazuremfa', 'stepup'] } + +- name: Deploy stepupmiddleware app + hosts: docker_stepupmiddleware + become: true + roles: + - { role: stepupmiddleware, tags: ['stepupmiddleware', 'stepup'] } + +- name: Deploy stepupselfservice app + hosts: docker_stepupselfservice + become: true + roles: + - { role: stepupselfservice, tags: ['stepupselfservice', 'stepup'] } + +- name: Deploy stepupra app + hosts: docker_stepupra + become: true + roles: + - { role: stepupra, tags: ['stepupra', 'stepup'] } From 910209c265386942b60ec2c103978438a1db8bef Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 10:05:34 +0200 Subject: [PATCH 21/59] add test playbook --- roles/docker/tasks/main.yml | 4 ---- .../manage_provision_entities/tasks/main.yml | 4 ---- test_containers_playbook.yml | 20 +++++++++++++++++++ 3 files changed, 20 insertions(+), 8 deletions(-) create mode 100644 test_containers_playbook.yml diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml index df5957d67..50cbaf0b4 100644 --- a/roles/docker/tasks/main.yml +++ b/roles/docker/tasks/main.yml @@ -128,14 +128,10 @@ owner: root mode: "0755" -<<<<<<< HEAD -# TODO only start this when configuration changes -======= # This is at the moment the best way to get iptables right for # docker and the host (docker tends to destroy the host iptables rules and vice # versa), maybe move this to the iptables role later and make it idempotent # ( do not run when nothing changes ) ->>>>>>> main - name: Enable and start the new firewall service ansible.builtin.systemd: service: iptablesdocker.service diff --git a/roles/manage_provision_entities/tasks/main.yml b/roles/manage_provision_entities/tasks/main.yml index eaadd9d65..f0de4b92b 100644 --- a/roles/manage_provision_entities/tasks/main.yml +++ b/roles/manage_provision_entities/tasks/main.yml @@ -34,11 +34,7 @@ body: entityid: "{{ manage_provision_client_id }}" run_once: true -<<<<<<< HEAD - check_mode: false # This task does not make changes to the system and can be safely run in check mode -======= check_mode: false # This can safely run in check mode because it is not changing anything ->>>>>>> main register: manage_test_entity until: manage_test_entity is succeeded retries: 15 diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml new file mode 100644 index 000000000..9867b5fa6 --- /dev/null +++ b/test_containers_playbook.yml @@ -0,0 +1,20 @@ +--- +- name: Test containerized applications + hosts: docker_servers + become: true + tasks: + - name: Read vars from secrets file + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always + +- name: Test invite app + hosts: docker_invite + become: true + tasks: + - name: Check invite app containers state + ansible.builtin.command: + cmd: docker inspect -f '{{.State.Status}}' "inviteserver" + register: inviteserver_state + failed_when: inviteserver_state != "running" \ No newline at end of file From 359f84f56536f06c20b1589924f9f0e3c1cea90e Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 10:17:44 +0200 Subject: [PATCH 22/59] fix syntax --- test_containers_playbook.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 9867b5fa6..c88dcd1e0 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -15,6 +15,7 @@ tasks: - name: Check invite app containers state ansible.builtin.command: - cmd: docker inspect -f '{{.State.Status}}' "inviteserver" + cmd: docker inspect -f '{{ '{{' }} .State.Status{{ '}}' }}' "inviteserver" register: inviteserver_state - failed_when: inviteserver_state != "running" \ No newline at end of file + failed_when: inviteserver_state.stdout != "running" + changed_when: inviteserver_state.rc != 0 From 0367c84e0f66b42fca86c28fdb35a5e20a384c25 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 10:28:21 +0200 Subject: [PATCH 23/59] more items --- test_containers_playbook.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index c88dcd1e0..4cbaf1039 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -15,7 +15,12 @@ tasks: - name: Check invite app containers state ansible.builtin.command: - cmd: docker inspect -f '{{ '{{' }} .State.Status{{ '}}' }}' "inviteserver" - register: inviteserver_state - failed_when: inviteserver_state.stdout != "running" - changed_when: inviteserver_state.rc != 0 + cmd: docker inspect -f '{{ '{{' }} .State.Status{{ '}}' }}' "{{ item }}" + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - inviteserver + - inviteclient + - invitewelcome + From 213713c45e2834f2552f3eecdf9fa664a27ab860 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 12:13:27 +0200 Subject: [PATCH 24/59] more items --- test_containers_playbook.yml | 311 ++++++++++++++++++++++++++++++++++- 1 file changed, 309 insertions(+), 2 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 4cbaf1039..8cdccd732 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -9,13 +9,13 @@ tags: - always -- name: Test invite app +- name: Test invite containers hosts: docker_invite become: true tasks: - name: Check invite app containers state ansible.builtin.command: - cmd: docker inspect -f '{{ '{{' }} .State.Status{{ '}}' }}' "{{ item }}" + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -24,3 +24,310 @@ - inviteclient - invitewelcome +- name: Test dashboard containers + hosts: docker_dashboard + become: true + tasks: + - name: Check dashboard containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - dashboardserver + - dashboardgui + +- name: Test teams containers + hosts: docker_teams + become: true + tasks: + - name: Check teams containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - teamsserver + - teamsgui + +- name: Test pdp pcontainers + hosts: docker_pdp + become: true + tasks: + - name: Check pdp containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - pdpserver + - pdpgui + +- name: Test voot containers + hosts: docker_voot + become: true + tasks: + - name: Check voot containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - vootserver + +- name: Test attribute-aggregation containers + hosts: docker_attribute_aggregation + become: true + tasks: + - name: Check attribite-aggregation containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - aaserver + +- name: Test oidc-playground containers + hosts: docker_oidc-playground + become: true + tasks: + - name: Check playground containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - oidcplaygroundserver + - oidcplaygroundgui + +- name: Test myconext containers + hosts: docker_myconext + become: true + tasks: + - name: Check myconext containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - myconextserver + - myconextgui + - accountgui + - servicedeskgui + +- name: Test manage containers + hosts: docker_manage + become: true + tasks: + - name: Check manage containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - manageserver + - managegui + +- name: Test oidcng containers + hosts: docker_oidcng + become: true + tasks: + - name: Check oidcng containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - oidcngserver + +- name: Test stats containers + hosts: docker_stats + become: true + tasks: + - name: Check stats containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - statsserver + - statsgui + +- name: Test diyidp containers + hosts: docker_diyidp + become: true + tasks: + - name: Check diyidp containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - diyidp + +- name: Test profile containers + hosts: docker_profile + become: true + tasks: + - name: Check profile containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - profile + +- name: Test lifecycle containers + hosts: docker_lifecycle + become: true + tasks: + - name: Check invite app containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - lifecycle + +- name: Test stepuptiqr containers + hosts: docker_stepuptiqr + become: true + tasks: + - name: Check stepuptiqr containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepuptiqr + +- name: Test mujina-idp containers + hosts: docker_mujina_idp + become: true + tasks: + - name: Check mujina-idp containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - mujina-idp + +- name: Test mujina-sp containers + hosts: docker_mujina_sp + become: true + tasks: + - name: Check mujina-sp containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - mujina-sp + +- name: Test engineblock containers + hosts: docker_engineblock + become: true + tasks: + - name: Check engineblock containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - engineblock + +- name: Test stepupgateway containers + hosts: docker_stepupgateway + become: true + tasks: + - name: Check stepupgateway containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepupgateway + +- name: Test stepupwebauthn containers + hosts: docker_stepupwebauthn + become: true + tasks: + - name: Check stepupwebauthn containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepupwebauthn + +- name: Test stepupazuremfa containers + hosts: docker_stepupazuremfa + become: true + tasks: + - name: Check stepupazuremfa containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + stepupazuremfa + +- name: Test stepupmiddleware containers + hosts: docker_stepupmiddleware + become: true + tasks: + - name: Check stepupmiddleware containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepupmiddleware + +- name: Test stepupselfservice containers + hosts: docker_stepupselfservice + become: true + tasks: + - name: Check stepupselfservice containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepupselfservice + +- name: Test stepupra containers + hosts: docker_stepupra + become: true + tasks: + - name: Check stepupra containers state + ansible.builtin.command: + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - stepupra \ No newline at end of file From 48f9c40b3d21463f89256f93bf48308a1e835a4e Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 12:20:24 +0200 Subject: [PATCH 25/59] fix cmd --- test_containers_playbook.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 8cdccd732..41605b632 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -13,9 +13,9 @@ hosts: docker_invite become: true tasks: - - name: Check invite app containers state + - name: Check invite containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false From 7cb94a96afc503b1ef9ef9a19d1908db6c06df9b Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:23:00 +0200 Subject: [PATCH 26/59] fix cmd --- test_containers_playbook.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 41605b632..7391c5270 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -15,7 +15,7 @@ tasks: - name: Check invite containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} "{{ item }}" + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false From 373177bdaa01a15747f4093c42a09537ef8657b5 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:28:09 +0200 Subject: [PATCH 27/59] fix cmd --- test_containers_playbook.yml | 50 ++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 7391c5270..8b93b81d2 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -30,7 +30,7 @@ tasks: - name: Check dashboard containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -44,7 +44,7 @@ tasks: - name: Check teams containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -58,7 +58,7 @@ tasks: - name: Check pdp containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -72,7 +72,7 @@ tasks: - name: Check voot containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -85,7 +85,7 @@ tasks: - name: Check attribite-aggregation containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -98,7 +98,7 @@ tasks: - name: Check playground containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -112,7 +112,7 @@ tasks: - name: Check myconext containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -128,7 +128,7 @@ tasks: - name: Check manage containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -142,7 +142,7 @@ tasks: - name: Check oidcng containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -155,7 +155,7 @@ tasks: - name: Check stats containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -169,7 +169,7 @@ tasks: - name: Check diyidp containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -182,7 +182,7 @@ tasks: - name: Check profile containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -195,7 +195,7 @@ tasks: - name: Check invite app containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -208,7 +208,7 @@ tasks: - name: Check stepuptiqr containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -221,7 +221,7 @@ tasks: - name: Check mujina-idp containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -234,7 +234,7 @@ tasks: - name: Check mujina-sp containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -247,7 +247,7 @@ tasks: - name: Check engineblock containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -260,7 +260,7 @@ tasks: - name: Check stepupgateway containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -273,7 +273,7 @@ tasks: - name: Check stepupwebauthn containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -286,12 +286,12 @@ tasks: - name: Check stepupazuremfa containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - stepupazuremfa + - stepupazuremfa - name: Test stepupmiddleware containers hosts: docker_stepupmiddleware @@ -299,7 +299,7 @@ tasks: - name: Check stepupmiddleware containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -312,7 +312,7 @@ tasks: - name: Check stepupselfservice containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false @@ -325,9 +325,9 @@ tasks: - name: Check stepupra containers state ansible.builtin.command: - cmd: docker inspect -f {{ '{{' }} .State.Status {{ '}}' }} {{ item }} + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - stepupra \ No newline at end of file + - stepupra From 4a1aaadd50f6535ad7d525b239b4d5783ff1bd2a Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:34:25 +0200 Subject: [PATCH 28/59] continue on error --- test_containers_playbook.yml | 38 +++++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 8b93b81d2..6fc48a0d3 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -19,6 +19,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - inviteserver - inviteclient @@ -34,6 +35,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - dashboardserver - dashboardgui @@ -48,6 +50,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - teamsserver - teamsgui @@ -62,6 +65,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - pdpserver - pdpgui @@ -76,6 +80,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - vootserver @@ -89,6 +94,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - aaserver @@ -102,6 +108,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - oidcplaygroundserver - oidcplaygroundgui @@ -116,6 +123,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - myconextserver - myconextgui @@ -132,6 +140,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - manageserver - managegui @@ -146,6 +155,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - oidcngserver @@ -159,6 +169,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - statsserver - statsgui @@ -173,6 +184,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - diyidp @@ -186,6 +198,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - profile @@ -199,6 +212,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - lifecycle @@ -212,8 +226,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepuptiqr + - stepup-tiqr - name: Test mujina-idp containers hosts: docker_mujina_idp @@ -225,6 +240,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - mujina-idp @@ -238,6 +254,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - mujina-sp @@ -251,6 +268,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - engineblock @@ -264,8 +282,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupgateway + - stepup-gateway - name: Test stepupwebauthn containers hosts: docker_stepupwebauthn @@ -277,8 +296,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupwebauthn + - stepup-webauthn - name: Test stepupazuremfa containers hosts: docker_stepupazuremfa @@ -290,8 +310,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupazuremfa + - stepup-azuremfa - name: Test stepupmiddleware containers hosts: docker_stepupmiddleware @@ -303,8 +324,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupmiddleware + - stepup-middleware - name: Test stepupselfservice containers hosts: docker_stepupselfservice @@ -316,8 +338,9 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupselfservice + - stepup-selfservice - name: Test stepupra containers hosts: docker_stepupra @@ -329,5 +352,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false + ignore_errors: yes with_items: - - stepupra + - stepup-ra From 0b69ad75018fa50dd8a19974579069e1e2094ba5 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:37:29 +0200 Subject: [PATCH 29/59] continue on error --- test_containers_playbook.yml | 48 ++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 6fc48a0d3..4da905bf5 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -19,7 +19,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - inviteserver - inviteclient @@ -35,7 +35,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - dashboardserver - dashboardgui @@ -50,7 +50,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - teamsserver - teamsgui @@ -65,7 +65,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - pdpserver - pdpgui @@ -80,7 +80,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - vootserver @@ -94,7 +94,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - aaserver @@ -108,7 +108,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - oidcplaygroundserver - oidcplaygroundgui @@ -123,7 +123,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - myconextserver - myconextgui @@ -140,7 +140,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - manageserver - managegui @@ -155,7 +155,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - oidcngserver @@ -169,7 +169,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - statsserver - statsgui @@ -184,7 +184,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - diyidp @@ -198,7 +198,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - profile @@ -212,7 +212,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - lifecycle @@ -226,7 +226,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-tiqr @@ -240,7 +240,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - mujina-idp @@ -254,7 +254,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - mujina-sp @@ -268,7 +268,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - engineblock @@ -282,7 +282,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-gateway @@ -296,7 +296,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-webauthn @@ -310,7 +310,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-azuremfa @@ -324,7 +324,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-middleware @@ -338,7 +338,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-selfservice @@ -352,6 +352,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: yes + continue_on_error: true with_items: - stepup-ra From 1372ad25c5983d7479da1358f95a76baa7b51939 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:55:46 +0200 Subject: [PATCH 30/59] remove continue_on_error --- test_containers_playbook.yml | 48 ++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 4da905bf5..fa91866c9 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -19,7 +19,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - inviteserver - inviteclient @@ -35,7 +35,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - dashboardserver - dashboardgui @@ -50,7 +50,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - teamsserver - teamsgui @@ -65,7 +65,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - pdpserver - pdpgui @@ -80,7 +80,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - vootserver @@ -94,7 +94,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - aaserver @@ -108,7 +108,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - oidcplaygroundserver - oidcplaygroundgui @@ -123,7 +123,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - myconextserver - myconextgui @@ -140,7 +140,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - manageserver - managegui @@ -155,7 +155,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - oidcngserver @@ -169,7 +169,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - statsserver - statsgui @@ -184,7 +184,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - diyidp @@ -198,7 +198,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - profile @@ -212,7 +212,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - lifecycle @@ -226,7 +226,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-tiqr @@ -240,7 +240,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - mujina-idp @@ -254,7 +254,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - mujina-sp @@ -268,7 +268,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - engineblock @@ -282,7 +282,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-gateway @@ -296,7 +296,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-webauthn @@ -310,7 +310,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-azuremfa @@ -324,7 +324,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-middleware @@ -338,7 +338,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-selfservice @@ -352,6 +352,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - continue_on_error: true + ignore_errors: true with_items: - stepup-ra From 48b0b57d911739d1a480210b43d7aa0ffed6b4de Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 13:59:21 +0200 Subject: [PATCH 31/59] change container names --- test_containers_playbook.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index fa91866c9..41533b7bf 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -228,7 +228,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-tiqr + - tiqr - name: Test mujina-idp containers hosts: docker_mujina_idp @@ -284,7 +284,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-gateway + - gateway - name: Test stepupwebauthn containers hosts: docker_stepupwebauthn @@ -298,7 +298,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-webauthn + - webauthn - name: Test stepupazuremfa containers hosts: docker_stepupazuremfa @@ -312,7 +312,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-azuremfa + - azuremfa - name: Test stepupmiddleware containers hosts: docker_stepupmiddleware @@ -326,7 +326,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-middleware + - middleware - name: Test stepupselfservice containers hosts: docker_stepupselfservice @@ -340,7 +340,7 @@ changed_when: false ignore_errors: true with_items: - - stepup-selfservice + - selfservice - name: Test stepupra containers hosts: docker_stepupra @@ -354,4 +354,4 @@ changed_when: false ignore_errors: true with_items: - - stepup-ra + - ra From 8b86c22ce161fb6e410863279895b7fe96c0f716 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 14:02:31 +0200 Subject: [PATCH 32/59] just stop on an error there should not be errors anyway --- test_containers_playbook.yml | 26 ++------------------------ 1 file changed, 2 insertions(+), 24 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 41533b7bf..a7c0c2906 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -19,7 +19,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - inviteserver - inviteclient @@ -35,7 +34,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - dashboardserver - dashboardgui @@ -50,7 +48,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - teamsserver - teamsgui @@ -65,7 +62,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - pdpserver - pdpgui @@ -80,7 +76,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - vootserver @@ -94,7 +89,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - aaserver @@ -108,7 +102,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - oidcplaygroundserver - oidcplaygroundgui @@ -123,7 +116,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - myconextserver - myconextgui @@ -140,7 +132,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - manageserver - managegui @@ -155,7 +146,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - oidcngserver @@ -169,7 +159,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - statsserver - statsgui @@ -184,7 +173,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - diyidp @@ -198,7 +186,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - profile @@ -212,7 +199,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - lifecycle @@ -226,7 +212,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - tiqr @@ -240,7 +225,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - mujina-idp @@ -254,7 +238,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - mujina-sp @@ -268,7 +251,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - engineblock @@ -282,7 +264,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - gateway @@ -296,7 +277,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true + with_items: - webauthn @@ -310,7 +291,7 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true + with_items: - azuremfa @@ -324,7 +305,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - middleware @@ -338,7 +318,6 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - selfservice @@ -352,6 +331,5 @@ register: container_state failed_when: container_state.stdout != "running" changed_when: false - ignore_errors: true with_items: - ra From 4d9df16b884be95287e6c162fd9c67e3b32fe526 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 14 May 2025 14:07:09 +0200 Subject: [PATCH 33/59] vault is not necessary --- test_containers_playbook.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index a7c0c2906..30f999527 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -1,14 +1,4 @@ --- -- name: Test containerized applications - hosts: docker_servers - become: true - tasks: - - name: Read vars from secrets file - ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" - no_log: true - tags: - - always - - name: Test invite containers hosts: docker_invite become: true From 9788de541782d527c84a46ac553fcd6c66986461 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 16 May 2025 14:12:32 +0200 Subject: [PATCH 34/59] use existing example environment template --- environments/example/inventory | 9 --------- environments/template/inventory | 11 +++++++++++ 2 files changed, 11 insertions(+), 9 deletions(-) delete mode 100644 environments/example/inventory diff --git a/environments/example/inventory b/environments/example/inventory deleted file mode 100644 index aadc02798..000000000 --- a/environments/example/inventory +++ /dev/null @@ -1,9 +0,0 @@ -[base:children] -docker_servers - -[docker_servers] -docker1.example.com -docker2.example.com - -[docker_invite] -docker2.example.com \ No newline at end of file diff --git a/environments/template/inventory b/environments/template/inventory index 435ecc3a5..c6264bd12 100644 --- a/environments/template/inventory +++ b/environments/template/inventory @@ -53,3 +53,14 @@ dbcluster_nodes [local] localhost ansible_connection=local + +# for refactored playbooks +[base:children] +docker_servers + +[docker_servers] +docker1.example.com +docker2.example.com + +[docker_invite] +docker2.example.com \ No newline at end of file From 49e6de549016ee0d482b63e28fe9569b5ecc1795 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 21 May 2025 10:24:27 +0200 Subject: [PATCH 35/59] alphabetize test playbook --- config_base_playbook.yml | 3 + deploy_containers_playbook.yml | 133 +++++++++++++++++---------------- 2 files changed, 70 insertions(+), 66 deletions(-) diff --git a/config_base_playbook.yml b/config_base_playbook.yml index f6ece6b48..6ee46c561 100644 --- a/config_base_playbook.yml +++ b/config_base_playbook.yml @@ -1,6 +1,9 @@ --- # This playbook causes a lot of unexpected changes but so does provision.yml # with the base tag, TODO fix configuration drift or remove some roles +# common can be removed +# self signed can be removed + # - name: Read inventory secrets # hosts: base # gather_facts: true diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml index 407197a47..51ab9dc69 100644 --- a/deploy_containers_playbook.yml +++ b/deploy_containers_playbook.yml @@ -13,11 +13,12 @@ # Dividing apps across the container services should be set in # the inventory not in the playbook, this way you can easily change # it for different environments -- name: Deploy invite app - hosts: docker_invite + +- name: Deploy attribute-aggregation app + hosts: docker_attribute_aggregation become: true roles: - - { role: invite, tags: ['invite'] } + - { role: attribute-aggregation, tags: ['aa', 'attribute-aggregation'] } - name: Deploy dashboard app hosts: docker_dashboard @@ -25,47 +26,53 @@ roles: - { role: dashboard, tags: ['dashboard'] } -- name: Deploy teams app - hosts: docker_teams +- name: Deploy diyidp app + hosts: docker_diyidp become: true roles: - - { role: teams, tags: ['teams'] } + - { role: diyidp, tags: ['diyidp'] } -- name: Deploy pdp app - hosts: docker_pdp +- name: Deploy engineblock app + hosts: docker_engineblock become: true roles: - - { role: pdp, tags: ['pdp'] } + - { role: engineblock, tags: ['engineblock', 'eb'] } -- name: Deploy voot app - hosts: docker_voot +- name: Deploy invite app + hosts: docker_invite become: true roles: - - { role: voot, tags: ['voot'] } + - { role: invite, tags: ['invite'] } -- name: Deploy attribute-aggregation app - hosts: docker_attribute_aggregation +- name: Deploy lifecycle app + hosts: docker_lifecycle become: true roles: - - { role: attribute-aggregation, tags: ['aa', 'attribute-aggregation'] } + - { role: lifecycle, tags: ['lifecycle'] } -- name: Deploy oidc-playground app - hosts: docker_oidc-playground +- name: Deploy manage app + hosts: docker_manage become: true roles: - - { role: oidc-playground, tags: ['oidc-playground'] } + - { role: manage, tags: ['manage'] } -- name: Deploy myconext app - hosts: docker_myconext +- name: Deploy mujina-idp app + hosts: docker_mujina_idp become: true roles: - - { role: myconext, tags: ['myconext'] } + - { role: mujina-idp, tags: ['mujina-idp', 'mujina'] } -- name: Deploy manage app - hosts: docker_manage +- name: Deploy mujina-sp app + hosts: docker_mujina_sp become: true roles: - - { role: manage, tags: ['manage'] } + - { role: mujina-sp, tags: ['mujina-sp', 'mujina'] } + +- name: Deploy myconext app + hosts: docker_myconext + become: true + roles: + - { role: myconext, tags: ['myconext'] } - name: Deploy oidcng app hosts: docker_oidcng @@ -73,17 +80,17 @@ roles: - { role: oidcng, tags: ['oidcng'] } -- name: Deploy stats app - hosts: docker_stats +- name: Deploy oidc-playground app + hosts: docker_oidc-playground become: true roles: - - { role: stats, tags: ['stats'] } + - { role: oidc-playground, tags: ['oidc-playground'] } -- name: Deploy diyidp app - hosts: docker_diyidp +- name: Deploy pdp app + hosts: docker_pdp become: true roles: - - { role: diyidp, tags: ['diyidp'] } + - { role: pdp, tags: ['pdp'] } - name: Deploy profile app hosts: docker_profile @@ -91,68 +98,62 @@ roles: - { role: profile, tags: ['profile'] } -- name: Deploy lifecycle app - hosts: docker_lifecycle - become: true - roles: - - { role: lifecycle, tags: ['lifecycle'] } - -- name: Deploy stepuptiqr app - hosts: docker_stepuptiqr +- name: Deploy stats app + hosts: docker_stats become: true roles: - - { role: stepuptiqr, tags: ['stepuptiqr', 'stepup'] } + - { role: stats, tags: ['stats'] } -- name: Deploy mujina-idp app - hosts: docker_mujina_idp +- name: Deploy stepupazuremfa app + hosts: docker_stepupazuremfa become: true roles: - - { role: mujina-idp, tags: ['mujina-idp', 'mujina'] } + - { role: stepupazuremfa, tags: ['stepupazuremfa', 'stepup'] } -- name: Deploy mujina-sp app - hosts: docker_mujina_sp +- name: Deploy stepupgateway app + hosts: docker_stepupgateway become: true roles: - - { role: mujina-sp, tags: ['mujina-sp', 'mujina'] } + - { role: stepupgateway, tags: ['stepupgateway', 'stepup'] } -- name: Deploy engineblock app - hosts: docker_engineblock +- name: Deploy stepupmiddleware app + hosts: docker_stepupmiddleware become: true roles: - - { role: engineblock, tags: ['engineblock', 'eb'] } + - { role: stepupmiddleware, tags: ['stepupmiddleware', 'stepup'] } -- name: Deploy stepupgateway app - hosts: docker_stepupgateway +- name: Deploy stepupra app + hosts: docker_stepupra become: true roles: - - { role: stepupgateway, tags: ['stepupgateway', 'stepup'] } + - { role: stepupra, tags: ['stepupra', 'stepup'] } -- name: Deploy stepupwebauthn app - hosts: docker_stepupwebauthn +- name: Deploy stepupselfservice app + hosts: docker_stepupselfservice become: true roles: - - { role: stepupwebauthn, tags: ['stepupwebauthn', 'stepup'] } + - { role: stepupselfservice, tags: ['stepupselfservice', 'stepup'] } -- name: Deploy stepupazuremfa app - hosts: docker_stepupazuremfa +- name: Deploy stepuptiqr app + hosts: docker_stepuptiqr become: true roles: - - { role: stepupazuremfa, tags: ['stepupazuremfa', 'stepup'] } + - { role: stepuptiqr, tags: ['stepuptiqr', 'stepup'] } -- name: Deploy stepupmiddleware app - hosts: docker_stepupmiddleware +- name: Deploy stepupwebauthn app + hosts: docker_stepupwebauthn become: true roles: - - { role: stepupmiddleware, tags: ['stepupmiddleware', 'stepup'] } + - { role: stepupwebauthn, tags: ['stepupwebauthn', 'stepup'] } -- name: Deploy stepupselfservice app - hosts: docker_stepupselfservice +- name: Deploy teams app + hosts: docker_teams become: true roles: - - { role: stepupselfservice, tags: ['stepupselfservice', 'stepup'] } + - { role: teams, tags: ['teams'] } -- name: Deploy stepupra app - hosts: docker_stepupra +- name: Deploy voot app + hosts: docker_voot become: true roles: - - { role: stepupra, tags: ['stepupra', 'stepup'] } + - { role: voot, tags: ['voot'] } From 0a50928a3c8088a41d604076c4eba4882a8cbf24 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 21 May 2025 12:11:13 +0200 Subject: [PATCH 36/59] alphabetize deploy playbook --- test_containers_playbook.yml | 206 +++++++++++++++++------------------ 1 file changed, 102 insertions(+), 104 deletions(-) diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml index 30f999527..7e8644cbf 100644 --- a/test_containers_playbook.yml +++ b/test_containers_playbook.yml @@ -1,18 +1,16 @@ --- -- name: Test invite containers - hosts: docker_invite +- name: Test attribute-aggregation containers + hosts: docker_attribute_aggregation become: true tasks: - - name: Check invite containers state + - name: Check attribite-aggregation containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - inviteserver - - inviteclient - - invitewelcome + - aaserver - name: Test dashboard containers hosts: docker_dashboard @@ -28,298 +26,298 @@ - dashboardserver - dashboardgui -- name: Test teams containers - hosts: docker_teams +- name: Test diyidp containers + hosts: docker_diyidp become: true tasks: - - name: Check teams containers state + - name: Check diyidp containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - teamsserver - - teamsgui + - diyidp -- name: Test pdp pcontainers - hosts: docker_pdp +- name: Test engineblock containers + hosts: docker_engineblock become: true tasks: - - name: Check pdp containers state + - name: Check engineblock containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - pdpserver - - pdpgui + - engineblock -- name: Test voot containers - hosts: docker_voot +- name: Test invite containers + hosts: docker_invite become: true tasks: - - name: Check voot containers state + - name: Check invite containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - vootserver + - inviteserver + - inviteclient + - invitewelcome -- name: Test attribute-aggregation containers - hosts: docker_attribute_aggregation +- name: Test lifecycle containers + hosts: docker_lifecycle become: true tasks: - - name: Check attribite-aggregation containers state + - name: Check invite app containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - aaserver + - lifecycle -- name: Test oidc-playground containers - hosts: docker_oidc-playground +- name: Test manage containers + hosts: docker_manage become: true tasks: - - name: Check playground containers state + - name: Check manage containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - oidcplaygroundserver - - oidcplaygroundgui + - manageserver + - managegui -- name: Test myconext containers - hosts: docker_myconext +- name: Test mujina-idp containers + hosts: docker_mujina_idp become: true tasks: - - name: Check myconext containers state + - name: Check mujina-idp containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - myconextserver - - myconextgui - - accountgui - - servicedeskgui + - mujina-idp -- name: Test manage containers - hosts: docker_manage +- name: Test mujina-sp containers + hosts: docker_mujina_sp become: true tasks: - - name: Check manage containers state + - name: Check mujina-sp containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - manageserver - - managegui + - mujina-sp -- name: Test oidcng containers - hosts: docker_oidcng +- name: Test myconext containers + hosts: docker_myconext become: true tasks: - - name: Check oidcng containers state + - name: Check myconext containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - oidcngserver + - myconextserver + - myconextgui + - accountgui + - servicedeskgui -- name: Test stats containers - hosts: docker_stats +- name: Test oidcng containers + hosts: docker_oidcng become: true tasks: - - name: Check stats containers state + - name: Check oidcng containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - statsserver - - statsgui + - oidcngserver -- name: Test diyidp containers - hosts: docker_diyidp +- name: Test oidc-playground containers + hosts: docker_oidc-playground become: true tasks: - - name: Check diyidp containers state + - name: Check playground containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - diyidp + - oidcplaygroundserver + - oidcplaygroundgui -- name: Test profile containers - hosts: docker_profile +- name: Test pdp pcontainers + hosts: docker_pdp become: true tasks: - - name: Check profile containers state + - name: Check pdp containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - profile + - pdpserver + - pdpgui -- name: Test lifecycle containers - hosts: docker_lifecycle +- name: Test profile containers + hosts: docker_profile become: true tasks: - - name: Check invite app containers state + - name: Check profile containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - lifecycle + - profile -- name: Test stepuptiqr containers - hosts: docker_stepuptiqr +- name: Test stats containers + hosts: docker_stats become: true tasks: - - name: Check stepuptiqr containers state + - name: Check stats containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - tiqr + - statsserver + - statsgui -- name: Test mujina-idp containers - hosts: docker_mujina_idp +- name: Test stepupazuremfa containers + hosts: docker_stepupazuremfa become: true tasks: - - name: Check mujina-idp containers state + - name: Check stepupazuremfa containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - mujina-idp + - azuremfa -- name: Test mujina-sp containers - hosts: docker_mujina_sp +- name: Test stepupgateway containers + hosts: docker_stepupgateway become: true tasks: - - name: Check mujina-sp containers state + - name: Check stepupgateway containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - mujina-sp + - gateway -- name: Test engineblock containers - hosts: docker_engineblock +- name: Test stepupmiddleware containers + hosts: docker_stepupmiddleware become: true tasks: - - name: Check engineblock containers state + - name: Check stepupmiddleware containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - engineblock + - middleware -- name: Test stepupgateway containers - hosts: docker_stepupgateway +- name: Test stepupra containers + hosts: docker_stepupra become: true tasks: - - name: Check stepupgateway containers state + - name: Check stepupra containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - gateway + - ra -- name: Test stepupwebauthn containers - hosts: docker_stepupwebauthn +- name: Test stepupselfservice containers + hosts: docker_stepupselfservice become: true tasks: - - name: Check stepupwebauthn containers state + - name: Check stepupselfservice containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false - with_items: - - webauthn + - selfservice -- name: Test stepupazuremfa containers - hosts: docker_stepupazuremfa +- name: Test stepuptiqr containers + hosts: docker_stepuptiqr become: true tasks: - - name: Check stepupazuremfa containers state + - name: Check stepuptiqr containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false - with_items: - - azuremfa + - tiqr -- name: Test stepupmiddleware containers - hosts: docker_stepupmiddleware +- name: Test stepupwebauthn containers + hosts: docker_stepupwebauthn become: true tasks: - - name: Check stepupmiddleware containers state + - name: Check stepupwebauthn containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - middleware + - webauthn -- name: Test stepupselfservice containers - hosts: docker_stepupselfservice +- name: Test teams containers + hosts: docker_teams become: true tasks: - - name: Check stepupselfservice containers state + - name: Check teams containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - selfservice + - teamsserver + - teamsgui -- name: Test stepupra containers - hosts: docker_stepupra +- name: Test voot containers + hosts: docker_voot become: true tasks: - - name: Check stepupra containers state + - name: Check voot containers state ansible.builtin.command: cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" register: container_state failed_when: container_state.stdout != "running" changed_when: false with_items: - - ra + - vootserver From 2d06c0d368e452093dea09412004fb3ae58e8835 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 21 May 2025 14:07:43 +0200 Subject: [PATCH 37/59] add laodbalancer plays --- deploy_loadbalancers_playbook.yml | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/deploy_loadbalancers_playbook.yml b/deploy_loadbalancers_playbook.yml index 73b314ff7..5ac92329c 100644 --- a/deploy_loadbalancers_playbook.yml +++ b/deploy_loadbalancers_playbook.yml @@ -1 +1,28 @@ ---- \ No newline at end of file +--- +- name: Read secrets + hosts: loadbalancers + become: true + tasks: + - name: Read vars from secrets file + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always + +- name: Deploy haproxy + hosts: loadbalancer + gather_facts: true + become: true + roles: + - role: haproxy + tags: ['core', 'loadbalancer', 'lb'] + +- name: Deploy keepalived and bind for clustered loadbalancers + hosts: loadbalancer_ha + gather_facts: true + become: true + roles: + - role: keepalived + tags: ['core', 'loadbalancer_ha', 'keepalived'] + - role: bind + tags: ['core', 'loadbalancer_ha', 'bind'] From ebba09effefc7bd6769aedc2d0cdb76d8f976447 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 21 May 2025 14:32:00 +0200 Subject: [PATCH 38/59] fix typo --- deploy_loadbalancers_playbook.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy_loadbalancers_playbook.yml b/deploy_loadbalancers_playbook.yml index 5ac92329c..12daca264 100644 --- a/deploy_loadbalancers_playbook.yml +++ b/deploy_loadbalancers_playbook.yml @@ -1,6 +1,6 @@ --- - name: Read secrets - hosts: loadbalancers + hosts: loadbalancer become: true tasks: - name: Read vars from secrets file From d09707a6b913c9fe14845a77e3483c65bb8ebb66 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Wed, 21 May 2025 14:49:57 +0200 Subject: [PATCH 39/59] fix false positive --- roles/haproxy/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml index a4a9227d2..55f38f8f1 100644 --- a/roles/haproxy/tasks/main.yml +++ b/roles/haproxy/tasks/main.yml @@ -4,6 +4,7 @@ url: "https://haproxy.debian.net/bernat.debian.org.gpg" dest: "/etc/apt/trusted.gpg.d/haproxy.asc" mode: '0644' + when: not ansible_check_mode # task reports change in check mode when there is none - name: Add HAProxy repository to sources list ansible.builtin.copy: From d50f9dca073aea957cd31893f0748d19054aa62b Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 09:19:46 +0200 Subject: [PATCH 40/59] testje --- test_loadbalancers_playbook.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 test_loadbalancers_playbook.yml diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml new file mode 100644 index 000000000..a0b03b037 --- /dev/null +++ b/test_loadbalancers_playbook.yml @@ -0,0 +1,26 @@ +--- +- name: Test loadbalancer + hosts: loadbalancer + become: true + tasks: + - name: Check attribite-aggregation containers state + ansible.builtin.command: + cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" + register: container_state + failed_when: container_state.stdout != "running" + changed_when: false + with_items: + - aaserver + + - name: Wait for the webserver to return a 200 + uri: + url: "https://145.100.191.138:443/" + method: GET + status_code: 200 + return_content: no + headers: + host: "invite.acc.surfconext.nl" + register: result + until: result.status == 200 + retries: 3 + delay: 1 \ No newline at end of file From 37fad76c17f285916b80073458a034b91559644e Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 09:24:29 +0200 Subject: [PATCH 41/59] debug --- test_loadbalancers_playbook.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index a0b03b037..f4957d523 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -23,4 +23,9 @@ register: result until: result.status == 200 retries: 3 - delay: 1 \ No newline at end of file + delay: 1 + continue_on_error: true + + - name: debug + debug: + msg: "{{ result }}" From c93853ae25c6335950f428edace88790455779b4 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 09:25:34 +0200 Subject: [PATCH 42/59] debug --- test_loadbalancers_playbook.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index f4957d523..32c7970a1 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -24,7 +24,7 @@ until: result.status == 200 retries: 3 delay: 1 - continue_on_error: true + ignore_errors: true - name: debug debug: From 9b00aa2f223dcb28cbbed211f434052130b6a89e Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 10:07:21 +0200 Subject: [PATCH 43/59] working for one url --- test_loadbalancers_playbook.yml | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 32c7970a1..0e9835905 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -1,31 +1,21 @@ --- - name: Test loadbalancer hosts: loadbalancer - become: true + become: false + gather_facts: false tasks: - - name: Check attribite-aggregation containers state - ansible.builtin.command: - cmd: docker inspect -f '{{ '{{' }} .State.Status {{ '}}' }}' "{{ item }}" - register: container_state - failed_when: container_state.stdout != "running" - changed_when: false - with_items: - - aaserver - name: Wait for the webserver to return a 200 - uri: - url: "https://145.100.191.138:443/" + ansible.legacy.uri: + url: "https://145.100.191.139:443/" method: GET status_code: 200 return_content: no + validate_certs: false headers: host: "invite.acc.surfconext.nl" register: result until: result.status == 200 retries: 3 delay: 1 - ignore_errors: true - - - name: debug - debug: - msg: "{{ result }}" + delegate_to: 127.0.0.1 From acdb6c269aed23564f178223ffe2a6e02f1dd732 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 13:35:10 +0200 Subject: [PATCH 44/59] This results in some readable output --- inc_test_loadbalancer_tasklist.yml | 26 ++++++++++++++++++++++++++ test_loadbalancers_playbook.yml | 25 +++++++++---------------- 2 files changed, 35 insertions(+), 16 deletions(-) create mode 100644 inc_test_loadbalancer_tasklist.yml diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml new file mode 100644 index 000000000..3fa7ea8b2 --- /dev/null +++ b/inc_test_loadbalancer_tasklist.yml @@ -0,0 +1,26 @@ +--- +- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 + when: item.restricted is defined and item.restricted and 'amsterdam' in group_names + ansible.builtin.uri: + url: "https://{{ haproxy_sni_ip_restricted_ipv4 }}:443" + method: GET + status_code: [200, 302] + return_content: no + validate_certs: false + headers: + host: "{{ item.vhost_name }}" + register: result + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 1 + delegate_to: 127.0.0.1 + ignore_errors: true + +- name: Create a variable to append to the results + when: result.status is defined + ansible.builtin.set_fact: + resultstring: "{{ ansible_hostname }}: vhost {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 returns status code {{ result.status }}" + +- name: Append variable to list + ansible.builtin.set_fact: + results: "{{ results + [ resultstring ] }}" \ No newline at end of file diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 0e9835905..64b91cd3f 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -1,21 +1,14 @@ --- - name: Test loadbalancer - hosts: loadbalancer + hosts: loadbalancer:&amsterdam become: false - gather_facts: false + vars: + results: [] tasks: - - name: Wait for the webserver to return a 200 - ansible.legacy.uri: - url: "https://145.100.191.139:443/" - method: GET - status_code: 200 - return_content: no - validate_certs: false - headers: - host: "invite.acc.surfconext.nl" - register: result - until: result.status == 200 - retries: 3 - delay: 1 - delegate_to: 127.0.0.1 + - name: Include task list in play + ansible.builtin.include_tasks: + file: inc_test_loadbalancer_tasklist.yml + with_items: "{{ haproxy_applications }}" + + - debug: var=results \ No newline at end of file From 5e98f6b38643093485194f043dedc35eae9707d1 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 13:43:40 +0200 Subject: [PATCH 45/59] use internal health --- inc_test_loadbalancer_tasklist.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 3fa7ea8b2..56773d660 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -2,7 +2,7 @@ - name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 when: item.restricted is defined and item.restricted and 'amsterdam' in group_names ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricted_ipv4 }}:443" + url: "https://{{ haproxy_sni_ip_restricted_ipv4 }}:443/internal/health" method: GET status_code: [200, 302] return_content: no @@ -23,4 +23,4 @@ - name: Append variable to list ansible.builtin.set_fact: - results: "{{ results + [ resultstring ] }}" \ No newline at end of file + results: "{{ results + [ resultstring ] }}" From 4eafc4a0a61aee02140ce17280d695681b0f5ab3 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 14:15:27 +0200 Subject: [PATCH 46/59] add utrecht and unrestricted --- inc_test_loadbalancer_tasklist.yml | 34 +++++++++++++++++++++++++++--- test_loadbalancers_playbook.yml | 18 +++++++++++++++- 2 files changed, 48 insertions(+), 4 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 56773d660..1a082ec71 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -1,6 +1,6 @@ --- - name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 - when: item.restricted is defined and item.restricted and 'amsterdam' in group_names + when: item.restricted is defined and item.restricted and location in group_names ansible.builtin.uri: url: "https://{{ haproxy_sni_ip_restricted_ipv4 }}:443/internal/health" method: GET @@ -16,11 +16,39 @@ delegate_to: 127.0.0.1 ignore_errors: true -- name: Create a variable to append to the results +- name: Create a variable for {{ item.vhost_name }} to append to the results when: result.status is defined ansible.builtin.set_fact: resultstring: "{{ ansible_hostname }}: vhost {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 returns status code {{ result.status }}" -- name: Append variable to list +- name: Append {{ item.vhost_name }} variable to list + when: resultstring is defined + ansible.builtin.set_fact: + results: "{{ results + [ resultstring ] }}" + +- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_ipv4 }}:443 + when: item.restricted is undefined and location in group_names + ansible.builtin.uri: + url: "https://{{ haproxy_sni_ip_ipv4 }}:443/internal/health" + method: GET + status_code: [200, 302] + return_content: no + validate_certs: false + headers: + host: "{{ item.vhost_name }}" + register: result + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 1 + delegate_to: 127.0.0.1 + ignore_errors: true + +- name: Create a variable for {{ item.vhost_name }} to append to the results + when: result.status is defined + ansible.builtin.set_fact: + resultstring: "{{ ansible_hostname }}: vhost {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 returns status code {{ result.status }}" + +- name: Append {{ item.vhost_name }} variable to list + when: resultstring is defined ansible.builtin.set_fact: results: "{{ results + [ resultstring ] }}" diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 64b91cd3f..2a1358107 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -3,6 +3,7 @@ hosts: loadbalancer:&amsterdam become: false vars: + location: "amsterdam" results: [] tasks: @@ -11,4 +12,19 @@ file: inc_test_loadbalancer_tasklist.yml with_items: "{{ haproxy_applications }}" - - debug: var=results \ No newline at end of file + - debug: var=results + +- name: Test loadbalancer + hosts: loadbalancer:&utrecht + become: false + vars: + location: "utrecht" + results: [] + tasks: + + - name: Include task list in play + ansible.builtin.include_tasks: + file: inc_test_loadbalancer_tasklist.yml + with_items: "{{ haproxy_applications }}" + + - debug: var=results From f5b8a36e8404e3a9218c27ce25bed99c4362b36d Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 14:28:34 +0200 Subject: [PATCH 47/59] add utrecht and unrestricted --- test_loadbalancers_playbook.yml | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 2a1358107..92e05dd61 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -1,24 +1,11 @@ --- - name: Test loadbalancer - hosts: loadbalancer:&amsterdam + hosts: loadbalancer become: false vars: - location: "amsterdam" - results: [] - tasks: - - - name: Include task list in play - ansible.builtin.include_tasks: - file: inc_test_loadbalancer_tasklist.yml - with_items: "{{ haproxy_applications }}" - - - debug: var=results - -- name: Test loadbalancer - hosts: loadbalancer:&utrecht - become: false - vars: - location: "utrecht" + locations: + - amsterdam + - utrecht results: [] tasks: From e62efa1a83157243d9a34e78b92c201243a58ce6 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Thu, 22 May 2025 16:32:50 +0200 Subject: [PATCH 48/59] commit working for amsterdam version --- test_loadbalancers_playbook.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 92e05dd61..314362464 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -3,9 +3,7 @@ hosts: loadbalancer become: false vars: - locations: - - amsterdam - - utrecht + location: amsterdam results: [] tasks: From 56b90733db9b3a1fe7d362bd0c10b7d676ffb466 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 23 May 2025 12:55:32 +0200 Subject: [PATCH 49/59] fix sni variable issue and do not summarize results but fix health urls later --- environments/template/group_vars/template.yml | 2 + environments/template/inventory | 13 ++++ inc_test_loadbalancer_tasklist.yml | 76 ++++++++++++------- test_loadbalancers_playbook.yml | 18 +++-- 4 files changed, 73 insertions(+), 36 deletions(-) diff --git a/environments/template/group_vars/template.yml b/environments/template/group_vars/template.yml index ab3beb374..3c347d1dd 100644 --- a/environments/template/group_vars/template.yml +++ b/environments/template/group_vars/template.yml @@ -1,4 +1,6 @@ --- + +locations: ['amsterdam'] # add at least one location, for example the city where your datacentre is located env: "%env%" mariadb_host: localhost rsyslog_host: localhost diff --git a/environments/template/inventory b/environments/template/inventory index c6264bd12..89e35169f 100644 --- a/environments/template/inventory +++ b/environments/template/inventory @@ -55,6 +55,19 @@ dbcluster_nodes localhost ansible_connection=local # for refactored playbooks + +[%location%:children] # create one or more groups here for your chosen location(s) +storage +mongo_servers +sysloghost +loadbalancer_ha +loadbalancer +lifecycle +dbcluster +dbcluster_nodes +stats +docker_servers + [base:children] docker_servers diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 1a082ec71..c4b320598 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -1,54 +1,74 @@ --- -- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 - when: item.restricted is defined and item.restricted and location in group_names +# Try to reach applications via loadbalancer with restricted ip v4 +- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.0.restricted is defined and item.0.restricted and item.1 in group_names ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricted_ipv4 }}:443/internal/health" + url: "https://{{ haproxy_sni_ip_restricte.ipv4 }}:443/internal/health" method: GET status_code: [200, 302] - return_content: no + return_content: false validate_certs: false headers: - host: "{{ item.vhost_name }}" + host: "{{ item.0.vhost_name }}" register: result until: result.status == 200 or result.status == 302 retries: 3 delay: 1 delegate_to: 127.0.0.1 - ignore_errors: true + ignore_errors: true # remove this when all apps have internal/health endpoint -- name: Create a variable for {{ item.vhost_name }} to append to the results - when: result.status is defined - ansible.builtin.set_fact: - resultstring: "{{ ansible_hostname }}: vhost {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 returns status code {{ result.status }}" +# Try to reach applications via loadbalancer without restricted ip v4 +- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.0.restricted is undefined and item.1 in group_names + ansible.builtin.uri: + url: "https://{{ haproxy_sni_ip.ipv4 }}:443/internal/health" + method: GET + status_code: [200, 302] + return_content: false + validate_certs: false + headers: + host: "{{ item.0.vhost_name }}" + register: result + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 1 + delegate_to: 127.0.0.1 + ignore_errors: true # remove this when all apps have internal/health endpoint -- name: Append {{ item.vhost_name }} variable to list - when: resultstring is defined - ansible.builtin.set_fact: - results: "{{ results + [ resultstring ] }}" -- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_ipv4 }}:443 - when: item.restricted is undefined and location in group_names +# Try to reach applications via loadbalancer with restricted ip v6 +- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv6 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.0.restricted is defined and item.0.restricted and item.1 in group_names ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_ipv4 }}:443/internal/health" + url: "https://{{ haproxy_sni_ip_restricted.ipv6 }}:443/internal/health" method: GET status_code: [200, 302] - return_content: no + return_content: false validate_certs: false headers: - host: "{{ item.vhost_name }}" + host: "{{ item.0.vhost_name }}" register: result until: result.status == 200 or result.status == 302 retries: 3 delay: 1 delegate_to: 127.0.0.1 - ignore_errors: true + ignore_errors: true # remove this when all apps have internal/health endpoint -- name: Create a variable for {{ item.vhost_name }} to append to the results - when: result.status is defined - ansible.builtin.set_fact: - resultstring: "{{ ansible_hostname }}: vhost {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted_ipv4 }}:443 returns status code {{ result.status }}" -- name: Append {{ item.vhost_name }} variable to list - when: resultstring is defined - ansible.builtin.set_fact: - results: "{{ results + [ resultstring ] }}" +# Try to reach applications via loadbalancer without restricted ip v6 +- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv6 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.0.restricted is undefined and item.1 in group_names + ansible.builtin.uri: + url: "https://{{ haproxy_sni_ip.ipv6 }}:443/internal/health" + method: GET + status_code: [200, 302] + return_content: false + validate_certs: false + headers: + host: "{{ item.0.vhost_name }}" + register: result + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 1 + delegate_to: 127.0.0.1 + ignore_errors: true # remove this when all apps have internal/health endpoint diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index 314362464..e282c0ec6 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -1,15 +1,17 @@ --- - name: Test loadbalancer hosts: loadbalancer + gather_facts: false become: false - vars: - location: amsterdam - results: [] tasks: - - name: Include task list in play - ansible.builtin.include_tasks: - file: inc_test_loadbalancer_tasklist.yml - with_items: "{{ haproxy_applications }}" + - name: Read vars from secrets file + ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" + no_log: true + tags: + - always - - debug: var=results + - name: Include task list in play + ansible.builtin.include_tasks: + file: inc_test_loadbalancer_tasklist.yml + loop: "{{ haproxy_applications | product(locations) }}" # add locations to the array From 1ef021c50e308f838f1546a859f68eca3e803f30 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 23 May 2025 15:39:31 +0200 Subject: [PATCH 50/59] fix typo --- inc_test_loadbalancer_tasklist.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index c4b320598..792c7dfe6 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -3,7 +3,7 @@ - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging when: item.0.restricted is defined and item.0.restricted and item.1 in group_names ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricte.ipv4 }}:443/internal/health" + url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/internal/health" method: GET status_code: [200, 302] return_content: false From baa6bff368783a6cc5b7a608d886f8fe4727b948 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 23 May 2025 15:51:16 +0200 Subject: [PATCH 51/59] ipv6 generates error 99, fix it later --- inc_test_loadbalancer_tasklist.yml | 42 ++---------------------------- 1 file changed, 2 insertions(+), 40 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 792c7dfe6..515f8019f 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -13,7 +13,7 @@ register: result until: result.status == 200 or result.status == 302 retries: 3 - delay: 1 + delay: 2 delegate_to: 127.0.0.1 ignore_errors: true # remove this when all apps have internal/health endpoint @@ -31,44 +31,6 @@ register: result until: result.status == 200 or result.status == 302 retries: 3 - delay: 1 - delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint - - -# Try to reach applications via loadbalancer with restricted ip v6 -- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv6 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is defined and item.0.restricted and item.1 in group_names - ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricted.ipv6 }}:443/internal/health" - method: GET - status_code: [200, 302] - return_content: false - validate_certs: false - headers: - host: "{{ item.0.vhost_name }}" - register: result - until: result.status == 200 or result.status == 302 - retries: 3 - delay: 1 - delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint - - -# Try to reach applications via loadbalancer without restricted ip v6 -- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv6 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is undefined and item.1 in group_names - ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip.ipv6 }}:443/internal/health" - method: GET - status_code: [200, 302] - return_content: false - validate_certs: false - headers: - host: "{{ item.0.vhost_name }}" - register: result - until: result.status == 200 or result.status == 302 - retries: 3 - delay: 1 + delay: 2 delegate_to: 127.0.0.1 ignore_errors: true # remove this when all apps have internal/health endpoint From 9f6e1db443b8555b6f6756a0133b9b904078d7d4 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 15:45:35 +0200 Subject: [PATCH 52/59] add health url from env settings --- inc_test_loadbalancer_tasklist.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 515f8019f..a70fa8ee6 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -1,9 +1,9 @@ --- # Try to reach applications via loadbalancer with restricted ip v4 - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is defined and item.0.restricted and item.1 in group_names + when: item.0.restricted is defined and item.0.restricted and item.1 in group_names # item.1 is the location ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/internal/health" + url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/{{ item.0.ha_url }}" method: GET status_code: [200, 302] return_content: false @@ -15,13 +15,13 @@ retries: 3 delay: 2 delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint + #ignore_errors: true # remove this when all apps have internal/health endpoint # Try to reach applications via loadbalancer without restricted ip v4 - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is undefined and item.1 in group_names + when: item.0.restricted is undefined and item.1 in group_names # item.1 is the location ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip.ipv4 }}:443/internal/health" + url: "https://{{ haproxy_sni_ip.ipv4 }}:443/{{ item.0.ha_url }}" method: GET status_code: [200, 302] return_content: false @@ -33,4 +33,4 @@ retries: 3 delay: 2 delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint + #ignore_errors: true # remove this when all apps have internal/health endpoint From 8a32b75b68dafac6f2e77e6e117ffba47b9acb97 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 15:52:14 +0200 Subject: [PATCH 53/59] debug --- inc_test_loadbalancer_tasklist.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index a70fa8ee6..0f0955cd5 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -15,7 +15,11 @@ retries: 3 delay: 2 delegate_to: 127.0.0.1 - #ignore_errors: true # remove this when all apps have internal/health endpoint + ignore_errors: true # remove this when all apps have internal/health endpoint + +- name: debugging + debug: + msg: {{ result }} # Try to reach applications via loadbalancer without restricted ip v4 - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging @@ -33,4 +37,8 @@ retries: 3 delay: 2 delegate_to: 127.0.0.1 - #ignore_errors: true # remove this when all apps have internal/health endpoint + ignore_errors: true # remove this when all apps have internal/health endpoint + +- name: debugging + debug: + msg: {{ result }} \ No newline at end of file From c2da4195d0c3fb0becd3bbb5dd9e84fe9b99725a Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 15:53:41 +0200 Subject: [PATCH 54/59] debug --- inc_test_loadbalancer_tasklist.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 0f0955cd5..0bd2a8e4f 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -19,7 +19,7 @@ - name: debugging debug: - msg: {{ result }} + msg: "{{ result }}" # Try to reach applications via loadbalancer without restricted ip v4 - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging @@ -41,4 +41,4 @@ - name: debugging debug: - msg: {{ result }} \ No newline at end of file + msg: "{{ result }}" \ No newline at end of file From 0765853aa0b13969ae77112d1d186339372fe5ab Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 15:55:59 +0200 Subject: [PATCH 55/59] debug --- inc_test_loadbalancer_tasklist.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 0bd2a8e4f..20d292a81 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -11,9 +11,9 @@ headers: host: "{{ item.0.vhost_name }}" register: result - until: result.status == 200 or result.status == 302 - retries: 3 - delay: 2 + #until: result.status == 200 or result.status == 302 + #retries: 3 + #delay: 2 delegate_to: 127.0.0.1 ignore_errors: true # remove this when all apps have internal/health endpoint @@ -33,9 +33,9 @@ headers: host: "{{ item.0.vhost_name }}" register: result - until: result.status == 200 or result.status == 302 - retries: 3 - delay: 2 + #until: result.status == 200 or result.status == 302 + #retries: 3 + #delay: 2 delegate_to: 127.0.0.1 ignore_errors: true # remove this when all apps have internal/health endpoint From 4d853b578fbb6396de2ae1858d29fbf1f7209907 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 15:57:19 +0200 Subject: [PATCH 56/59] debug --- inc_test_loadbalancer_tasklist.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 20d292a81..eebf90956 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -11,11 +11,11 @@ headers: host: "{{ item.0.vhost_name }}" register: result - #until: result.status == 200 or result.status == 302 - #retries: 3 - #delay: 2 + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 2 delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint + #ignore_errors: true # remove this when all apps have internal/health endpoint - name: debugging debug: @@ -33,11 +33,11 @@ headers: host: "{{ item.0.vhost_name }}" register: result - #until: result.status == 200 or result.status == 302 - #retries: 3 - #delay: 2 + until: result.status == 200 or result.status == 302 + retries: 3 + delay: 2 delegate_to: 127.0.0.1 - ignore_errors: true # remove this when all apps have internal/health endpoint + #ignore_errors: true # remove this when all apps have internal/health endpoint - name: debugging debug: From cb1fe838a1eb5bb70212cf15ce92d2c08e51e429 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Fri, 27 Jun 2025 17:09:57 +0200 Subject: [PATCH 57/59] adding comment --- inc_test_loadbalancer_tasklist.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index eebf90956..59f38dbd1 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -1,4 +1,13 @@ --- +# playbook loops over: +# locations (item.1) +# haproxy_applications (item.0) +# +# for example: +# item.1 is amsterdam: +# when item.1 in group_names +# haproxy_sni_ip_(restricted) + # Try to reach applications via loadbalancer with restricted ip v4 - name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging when: item.0.restricted is defined and item.0.restricted and item.1 in group_names # item.1 is the location From bcc3cdd413b8303ee289702ffc53a258e4cf80f8 Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Mon, 30 Jun 2025 14:03:25 +0200 Subject: [PATCH 58/59] simplify script --- config_base_playbook.yml | 36 ----------------- ...playbook.yml => deploy_docker_playbook.yml | 0 inc_test_loadbalancer_tasklist.yml | 40 ++++++------------- test_loadbalancers_playbook.yml | 2 +- 4 files changed, 14 insertions(+), 64 deletions(-) delete mode 100644 config_base_playbook.yml rename config_docker_playbook.yml => deploy_docker_playbook.yml (100%) diff --git a/config_base_playbook.yml b/config_base_playbook.yml deleted file mode 100644 index 6ee46c561..000000000 --- a/config_base_playbook.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -# This playbook causes a lot of unexpected changes but so does provision.yml -# with the base tag, TODO fix configuration drift or remove some roles -# common can be removed -# self signed can be removed - -# - name: Read inventory secrets -# hosts: base -# gather_facts: true -# become: true -# tasks: -# - name: Read vars from secrets file -# ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml" -# no_log: true -# tags: -# - always - -# - name: Common configuration -# hosts: base -# become: true -# roles: -# - role: common -# tags: ['core', 'base', 'common'] -# - role: rsyslog -# tags: ['core', 'base', 'rsyslog'] -# - role: iptables # TODO: the when should be in the role -# when: -# - iptables_enable | bool -# tags: ['core', 'base', 'iptables'] -# # TODO: the role has a lot of when host is in loadbalancer group statements so it makes more sense to move this -# # to a load balancer playbook that is ,imited to the loadbalancer group -# # at the moment it only is enabled for the vm inventory so maybe it is not necessary at all -# - role: selfsigned_certs -# when: -# - "use_selfsigned_certs | default(false) | bool" -# tags: ['core', 'base', 'selfsigned_certs'] diff --git a/config_docker_playbook.yml b/deploy_docker_playbook.yml similarity index 100% rename from config_docker_playbook.yml rename to deploy_docker_playbook.yml diff --git a/inc_test_loadbalancer_tasklist.yml b/inc_test_loadbalancer_tasklist.yml index 59f38dbd1..9a697cf87 100644 --- a/inc_test_loadbalancer_tasklist.yml +++ b/inc_test_loadbalancer_tasklist.yml @@ -1,53 +1,39 @@ --- # playbook loops over: -# locations (item.1) -# haproxy_applications (item.0) +# loadbalancers +# haproxy_applications (item) # -# for example: -# item.1 is amsterdam: -# when item.1 in group_names -# haproxy_sni_ip_(restricted) +# and does an url request on lodbalancer ip with vhostname as the host header -# Try to reach applications via loadbalancer with restricted ip v4 -- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is defined and item.0.restricted and item.1 in group_names # item.1 is the location +- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.restricted is defined and item.restricted ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/{{ item.0.ha_url }}" + url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/{{ item.ha_url }}" method: GET status_code: [200, 302] return_content: false validate_certs: false headers: - host: "{{ item.0.vhost_name }}" + host: "{{ item.vhost_name }}" register: result until: result.status == 200 or result.status == 302 retries: 3 delay: 2 - delegate_to: 127.0.0.1 - #ignore_errors: true # remove this when all apps have internal/health endpoint - -- name: debugging - debug: - msg: "{{ result }}" + delegate_to: 127.0.0.1 # run check from deploy host # Try to reach applications via loadbalancer without restricted ip v4 -- name: Try to reach {{ item.0.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging - when: item.0.restricted is undefined and item.1 in group_names # item.1 is the location +- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging + when: item.restricted is undefined ansible.builtin.uri: - url: "https://{{ haproxy_sni_ip.ipv4 }}:443/{{ item.0.ha_url }}" + url: "https://{{ haproxy_sni_ip.ipv4 }}:443/{{ item.ha_url }}" method: GET status_code: [200, 302] return_content: false validate_certs: false headers: - host: "{{ item.0.vhost_name }}" + host: "{{ item.vhost_name }}" register: result until: result.status == 200 or result.status == 302 retries: 3 delay: 2 - delegate_to: 127.0.0.1 - #ignore_errors: true # remove this when all apps have internal/health endpoint - -- name: debugging - debug: - msg: "{{ result }}" \ No newline at end of file + delegate_to: 127.0.0.1 #run check from deploy host diff --git a/test_loadbalancers_playbook.yml b/test_loadbalancers_playbook.yml index e282c0ec6..aedd9166f 100644 --- a/test_loadbalancers_playbook.yml +++ b/test_loadbalancers_playbook.yml @@ -14,4 +14,4 @@ - name: Include task list in play ansible.builtin.include_tasks: file: inc_test_loadbalancer_tasklist.yml - loop: "{{ haproxy_applications | product(locations) }}" # add locations to the array + with_items: "{{ haproxy_applications }}" From 3521d532a1e08125cbdd839d2629bcd5dd7913ed Mon Sep 17 00:00:00 2001 From: Chantal Rosmuller Date: Mon, 30 Jun 2025 14:08:51 +0200 Subject: [PATCH 59/59] simplify script --- environments/template/group_vars/template.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/environments/template/group_vars/template.yml b/environments/template/group_vars/template.yml index 3c347d1dd..d85f4bbcb 100644 --- a/environments/template/group_vars/template.yml +++ b/environments/template/group_vars/template.yml @@ -1,6 +1,5 @@ --- -locations: ['amsterdam'] # add at least one location, for example the city where your datacentre is located env: "%env%" mariadb_host: localhost rsyslog_host: localhost