Change fails to asserts

Author: Martin Jackson

playbooks/process_secrets.yml

@@ -42,13 +42,14 @@
         secrets_phase: "{{ secrets_phase }}"
       register: secrets_results
 
-    - name: Fail when bootstrap secret loading requires values-secret v2
-      ansible.builtin.fail:
-        msg: >-
+    - name: Assert values-secret v2 when loading bootstrap (early) secrets
+      ansible.builtin.assert:
+        that:
+          - (secrets_yaml.version | default('1.0')) is version('2.0', '>=')
+        fail_msg: >-
           Bootstrap secret loading (secrets_phase=early) requires values-secret format version 2.0 or newer.
-      when:
-        - secrets_phase | default('late') == 'early'
-        - (secrets_yaml.version | default('1.0')) is version('2.0', '<')
+        success_msg: values-secret version is 2.0 or newer; bootstrap (early) loading is allowed.
+      when: secrets_phase | default('late') == 'early'
 
     - name: Select Kubernetes secrets loader for bootstrap (early) phase
       ansible.builtin.set_fact:

roles/load_secrets/tasks/main.yml

@@ -17,14 +17,14 @@
     - cluster_pre_check
     - find_vp_secrets
 
-- name: Fail if values_secrets_data is missing
-  ansible.builtin.shell: |
-    printf "ERROR\n"
-    printf "    values_secrets_data was not found.\n"
-    printf "    The find_vp_secrets role should set it.\n"
-    printf "    Ensure your values/secret files are present and readable.\n"
-    exit 1
-  when: values_secrets_data is not defined
+- name: Assert values_secrets_data is present after find_vp_secrets
+  ansible.builtin.assert:
+    that:
+      - values_secrets_data is defined
+    fail_msg: >-
+      values_secrets_data was not found. The find_vp_secrets role should set it.
+      Ensure your values/secret files are present and readable.
+    success_msg: values_secrets_data is defined; continuing with secret loading.
 
 - name: Determine how to load secrets
   ansible.builtin.set_fact:
@@ -46,13 +46,14 @@
     secrets_phase: "{{ secrets_phase }}"
   register: secrets_results
 
-- name: Fail when bootstrap secret loading requires values-secret v2
-  ansible.builtin.fail:
-    msg: >-
+- name: Assert values-secret v2 when loading bootstrap (early) secrets
+  ansible.builtin.assert:
+    that:
+      - (secrets_yaml.version | default('1.0')) is version('2.0', '>=')
+    fail_msg: >-
       Bootstrap secret loading (secrets_phase=early) requires values-secret format version 2.0 or newer.
-  when:
-    - secrets_phase | default('late') == 'early'
-    - (secrets_yaml.version | default('1.0')) is version('2.0', '<')
+    success_msg: values-secret version is 2.0 or newer; bootstrap (early) loading is allowed.
+  when: secrets_phase | default('late') == 'early'
 
 - name: Select Kubernetes secrets loader for bootstrap (early) phase
   ansible.builtin.set_fact: