refactor: copy external files to role, copy containers to quay.io linux-system-roles#12
Merged
richm merged 1 commit intoApr 13, 2026
Conversation
Reviewer's GuideRefactors the trustee_server role to vendor quadlet and config assets into the role instead of cloning them from an external Git repo, adjusts secret registration server task notifications and restart logic, and adds static config/quadlet files plus minor vars cleanup. Sequence diagram for secret registration server deployment and restart logicsequenceDiagram
actor AnsibleUser
participant AnsibleController
participant TaskDeployScript
participant TaskDeployService
participant TaskSetFact
participant HandlerRestartServices
participant Systemd
AnsibleUser->>AnsibleController: run trustee_server role
AnsibleController->>TaskDeployScript: template secret_registration_server.py
TaskDeployScript-->>AnsibleController: result __trustee_server_secret_reg_script (changed or not)
alt script changed
AnsibleController->>HandlerRestartServices: notify restart_trustee_services
end
AnsibleController->>TaskDeployService: template secret_registration_server.service
TaskDeployService-->>AnsibleController: result __trustee_server_secret_reg_service (changed or not)
alt service unit changed
AnsibleController->>HandlerRestartServices: notify restart_trustee_services
end
AnsibleController->>TaskSetFact: update __trustee_server_services list
alt secret_registration_server not in __trustee_server_services
TaskSetFact-->>AnsibleController: __trustee_server_services += secret_registration_server
else already present
TaskSetFact-->>AnsibleController: no change to __trustee_server_services
end
AnsibleController->>HandlerRestartServices: run handler if notified
HandlerRestartServices->>Systemd: restart all services in __trustee_server_services
Systemd-->>HandlerRestartServices: services restarted
HandlerRestartServices-->>AnsibleController: handler completed
AnsibleController-->>AnsibleUser: role completed
Flow diagram for quadlet and config deployment from vendored filesflowchart TD
A_start["Start trustee_quadlet tasks"] --> B_dir["Ensure quadlet install directory exists (__trustee_server_quadlet_install_dir)"]
B_dir --> C_copy_quadlet["Copy files from files/quadlet/ to __trustee_server_quadlet_install_dir"]
C_copy_quadlet --> D_cfg_dir["Ensure config directory exists (__trustee_server_config_dir)"]
D_cfg_dir --> E_loop_as["Copy files/configs/as to __trustee_server_config_dir"]
D_cfg_dir --> F_loop_kbs["Copy files/configs/kbs to __trustee_server_config_dir"]
D_cfg_dir --> G_loop_rvps["Copy files/configs/rvps to __trustee_server_config_dir"]
E_loop_as --> H_done["Quadlet and config deployment complete"]
F_loop_kbs --> H_done
G_loop_rvps --> H_done
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- In the
trustee_quadlet.ymlcopy tasks,srcpaths likefiles/quadlet/andfiles/configs/{{ item }}are likely incorrect for a role (they are resolved relative to the role'sfiles/directory), and should probably be updated toquadlet/andconfigs/{{ item }}respectively to avoid looking underfiles/files/.... - The
whencondition"'secret_registration_server' not in __trustee_server_services"insecret_registration_server.ymlwill fail if__trustee_server_servicesis undefined; consider using(__trustee_server_services | default([]))in the condition as well to match theset_factexpression.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the `trustee_quadlet.yml` copy tasks, `src` paths like `files/quadlet/` and `files/configs/{{ item }}` are likely incorrect for a role (they are resolved relative to the role's `files/` directory), and should probably be updated to `quadlet/` and `configs/{{ item }}` respectively to avoid looking under `files/files/...`.
- The `when` condition `"'secret_registration_server' not in __trustee_server_services"` in `secret_registration_server.yml` will fail if `__trustee_server_services` is undefined; consider using `(__trustee_server_services | default([]))` in the condition as well to match the `set_fact` expression.
## Individual Comments
### Comment 1
<location path="tasks/trustee_quadlet.yml" line_range="16-19" />
<code_context>
- msg: "No quadlet files found in {{ __trustee_server_quadlet_repo_url }}/{{ __trustee_server_quadlet_repo_path }}"
- when: quadlet_files_found.files | length == 0
-
- name: Copy Trustee Server quadlet files to install directory
ansible.builtin.copy:
- src: "{{ item.path }}"
- dest: "{{ __trustee_server_quadlet_install_dir }}/{{ item.path | basename }}"
+ src: files/quadlet/
+ dest: "{{ __trustee_server_quadlet_install_dir }}/"
mode: "0644"
- remote_src: true
</code_context>
<issue_to_address>
**issue (bug_risk):** Role-relative `src` path for quadlet files is likely incorrect (`files/...` will be resolved twice).
In roles, `copy.src` is already relative to the role’s `files/` directory, so `src: files/quadlet/` will be resolved as `roles/<role_name>/files/files/quadlet/`. Update this to `src: quadlet/` so Ansible correctly uses `roles/<role_name>/files/quadlet/`.
</issue_to_address>
### Comment 2
<location path="tasks/trustee_quadlet.yml" line_range="28-34" />
<code_context>
+ state: directory
+ mode: "0755"
- name: Copy Trustee Server config files to config directory
ansible.builtin.copy:
- src: "{{ __trustee_server_quadlet_repo_dir.path }}/configs/"
- dest: "{{ __trustee_server_config_dir }}/"
+ src: "files/configs/{{ item }}"
+ dest: "{{ __trustee_server_config_dir }}"
mode: "0644"
- remote_src: true
- force: true
- when: __repo_configs_dir.stat.exists
+ directory_mode: "0755"
+ loop: [as, kbs, rvps]
- name: Generate certificates for all components
</code_context>
<issue_to_address>
**issue (bug_risk):** Config copy task probably needs role-relative `src` without the `files/` prefix.
Using `src: "files/configs/{{ item }}"` will resolve to `.../files/files/configs/<item>`, which likely doesn’t exist. For role-relative lookup, use `src: "configs/{{ item }}"` so Ansible maps it to `roles/<role_name>/files/configs/<item>` correctly.
</issue_to_address>
### Comment 3
<location path="files/configs/kbs/config.toml" line_range="15-18" />
<code_context>
+insecure_api = false
+auth_public_key = "/etc/kbs/auth.pub"
+
+[attestation_token]
+insecure_key = false
+attestataion_token_type = "CoCo"
+trusted_certs_paths = ["/etc/kbs/trusted_certs/token0.crt"]
+
+[attestation_service]
</code_context>
<issue_to_address>
**issue (bug_risk):** The `attestataion_token_type` key appears to be misspelled and may not be recognized by KBS.
`attestataion_token_type = "CoCo"` should likely be `attestation_token_type`. If KBS relies on this exact key, the typo could cause the setting to be ignored or misparsed, potentially resulting in runtime errors or unintended (possibly insecure) defaults.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
richm
force-pushed
the
refactor-copy-external-files-into-role
branch
from
ee92d29 to
e65f960
Compare
Contributor
Author
|
[citest] |
…ux-system-roles Copy quadlet files and configs into the role Copy container images to quay.io/linux-system-roles Add cleanup to tests Fix spelling error with "attestation_token_type" config parameter Signed-off-by: Rich Megginson <rmeggins@redhat.com>
richm
force-pushed
the
refactor-copy-external-files-into-role
branch
from
e65f960 to
7fe047e
Compare
Contributor
Author
|
[citest] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copy quadlet files and configs into the role
Copy container images to quay.io/linux-system-roles
Signed-off-by: Rich Megginson rmeggins@redhat.com
Summary by Sourcery
Inline quadlet and configuration assets into the trustee_server role and adjust service management behavior.
New Features:
Enhancements:
Chores: