Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "Revert "Renaming to platform variables"" #934

Merged
merged 6 commits into from
Oct 16, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .github/files/ansible.cfg
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
[defaults]
collections_paths=/home/runner/collections
collections_path=/home/runner/collections
roles_path=roles/
lookup_plugins=plugins/lookup/
2 changes: 1 addition & 1 deletion .github/workflows/pre-commit.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
with:
collection_namespace: infra
collection_name: controller_configuration
collection_version: 2.10.0
collection_version: 1.0.0
collection_repo: https://github.com/redhat-cop/aap_configuration/
collection_dependencies: awx.awx
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can this take a list?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not without changing it all I believe

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We will need to make that change to fix the workflows

Copy link
Collaborator Author

@Tompage1994 Tompage1994 Oct 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahh, I see what you're referring to now... (not clear in the GH ui). It does take a space separated list

Suggested change
collection_dependencies: awx.awx
collection_dependencies: awx.awx ansible.eda ansible.hub

We would also need ansible.platform but that doesn't seem to be on galaxy so that may not be too helpful

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sean-m-sullivan I think you're involved with the ansible.platform collection... is it going to be on galaxy? (or am I missing it?)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so, we might need to change the workflow stuff but we can work on that later

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not AFAIK, I was involved in the initial push of it, but have not been more recently, but it it is my understanding it will not be public.

...
3 changes: 3 additions & 0 deletions changelogs/fragments/Rewrite.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
---
breaking_changes:
- Major overhaul to all code completed, variables have changed, role names have changed, please see the tranition guide for more details.
3 changes: 0 additions & 3 deletions changelogs/fragments/filetree_node_schedule_survey.yml

This file was deleted.

3 changes: 2 additions & 1 deletion galaxy.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
namespace: infra
name: aap_configuration
version: 3.0.0
version: 1.0.0
Tompage1994 marked this conversation as resolved.
Show resolved Hide resolved
description: A collection of roles to manage Ansible Controller
readme: README.md
authors:
Expand All @@ -18,6 +18,7 @@ build_ignore:
- release.yml
- .github
- '*.tar.gz'
- tests/*
license:
- GPL-3.0-or-later
tags:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Currently:
|`ansible_config_group`|""|no|str|The group the resulting ansible config file or directory should have.|
|`ah_configuration_working_dir`|"/var/tmp"|no|path|Location to render the ansible config file to.|
|`automation_hub_list`|`[]`|no|list|A list of Automation hubs and galaxies to put in the ansible config, see below for details.|
|`ansible_config_list`|`[{"header":"galaxy","keypairs":[{"key":"ignore_certs","value":"{{ not (ah_validate_certs \| bool) }}"}]}]`|no|list|A set of ansible config settings, a default is set, but can be overridden, see below for details.|
|`ansible_config_list`|`[{"header":"galaxy","keypairs":[{"key":"ignore_certs","value":"{{ not (platform_validate_certs \| bool) }}"}]}]`|no|list|A set of ansible config settings, a default is set, but can be overridden, see below for details.|
|`ah_token`|""|no|Tower Admin User's token on the Automation Hub Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook.||
|`ah_path_prefix`|`galaxy`|no|Tower Admin User's token on the Automation Hub Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook.||

Expand All @@ -28,12 +28,12 @@ Currently:
The following Variables compliment each other.
If Both variables are not set, secure logging defaults to false.
The role defaults to False as normally the ansible config task does not by default include sensitive information, we highly recommend the use of ansible vault for passwords and tokens.
ah_configuration_ansible_config_secure_logging defaults to the value of ah_configuration_secure_logging if it is not explicitly called. This allows for secure logging to be toggled for the entire suite of automation hub configuration roles with a single variable, or for the user to selectively use it.
platform_configuration_ansible_config_secure_logging defaults to the value of platform_configuration_secure_logging if it is not explicitly called. This allows for secure logging to be toggled for the entire suite of automation hub configuration roles with a single variable, or for the user to selectively use it.

|Variable Name|Default Value|Required|Description|
|:---:|:---:|:---:|:---:|
|`ah_configuration_ansible_config_secure_logging`|`False`|no|Whether or not to include the sensitive ansible config role tasks in the log. Set this value to `True` if you will be providing your sensitive values from elsewhere.|
|`ah_configuration_secure_logging`|`False`|no|This variable enables secure logging as well, but is shared across multiple roles, see above.|
|`platform_configuration_ansible_config_secure_logging`|`False`|no|Whether or not to include the sensitive ansible config role tasks in the log. Set this value to `True` if you will be providing your sensitive values from elsewhere.|
|`platform_configuration_secure_logging`|`False`|no|This variable enables secure logging as well, but is shared across multiple roles, see above.|

## Data Structures

Expand Down Expand Up @@ -70,7 +70,7 @@ ansible_config_list:
- header: galaxy
keypairs:
- key: ignore_certs
value: "{{ not (ah_validate_certs | bool) }}"
value: "{{ not (platform_validate_certs | bool) }}"
- key: server_list
value: "{{ automation_hub_list | map(attribute='name') | join(',') }}"

Expand All @@ -92,7 +92,7 @@ automation_hub_list:
connection: local
gather_facts: false
vars:
ah_validate_certs: false
platform_validate_certs: false
# Define following vars here, or in ah_configs/ah_auth.yml
# ah_host: ansible-ah-web-svc-test-project.example.com
# ah_token: changeme
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# You shouldn't need to define them again and again but they should be defined
# ah_hostname: "{{ inventory_hostname }}"
# ah_oauthtoken: ""
# ah_validate_certs: false
# platform_validate_certs: false

# These are the default variables specific to the ansible config role
# ansible_config_owner: # optional
Expand All @@ -27,9 +27,9 @@ ansible_config_list:
- header: galaxy
keypairs:
- key: ignore_certs
value: "{{ not (ah_validate_certs | default(true) | bool) }}"
value: "{{ not (platform_validate_certs | default(true) | bool) }}"
# - key: server_list
# value: "{{ automation_hub_list | map(attribute="name") | join(",") }}"

ah_configuration_ansible_config_secure_logging: "{{ ah_configuration_secure_logging | default(false) }}"
platform_configuration_ansible_config_secure_logging: "{{ platform_configuration_secure_logging | default(false) }}"
...
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ argument_specs:
- header: galaxy
keypairs:
- key: ignore_certs
value: "{{ not (ah_validate_certs | default(true) | bool) }}"
value: "{{ not (platform_validate_certs | default(true) | bool) }}"
required: false
type: list
description: A set of ansible config settings, a default is set, but can be overridden.
Expand All @@ -86,12 +86,12 @@ argument_specs:
description: Value for entry for the corresponding key.

# No_log variables
ah_configuration_ansible_config_secure_logging:
default: "{{ ah_configuration_secure_logging | default(false) }}"
platform_configuration_ansible_config_secure_logging:
default: "{{ platform_configuration_secure_logging | default(false) }}"
required: false
type: bool
description: Whether or not to include the sensitive role tasks in the log. Set this value to `true` if you will be providing your sensitive values from elsewhere.
ah_configuration_secure_logging:
platform_configuration_secure_logging:
default: false
required: false
type: bool
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
galaxy_info:
role_name: "namespace"
role_name: "ansible_config"
author: "Sean Sullivan"
description: "An Ansible Role to create namespace in Automation Hub."
company: "Red Hat"
Expand Down Expand Up @@ -33,8 +33,8 @@ galaxy_info:
- "automationhub"
- "galaxy"
- "configuration"
- "namespace"
- "namespaces"
- "ansible"
- "config"

dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@
owner: "{{ ansible_config_owner | default(omit) }}"
group: "{{ ansible_config_group | default(omit) }}"
mode: "{{ ansible_config_mode }}"
no_log: "{{ ah_configuration_ansible_config_secure_logging }}"
no_log: "{{ platform_configuration_ansible_config_secure_logging }}"
...
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
---
- name: Add namespace to Automation Hub
- name: Create ansible config to Automation Platform
hosts: localhost
connection: local
gather_facts: false
vars:
ah_validate_certs: false
platform_validate_certs: false
# Define following vars here, or in ah_configs/ah_auth.yml
# ah_host: ansible-ah-web-svc-test-project.example.com
# ah_token: changeme
Expand All @@ -16,5 +16,5 @@
tags:
- always
roles:
- ../../namespace
- ../../ansible_config
...
24 changes: 12 additions & 12 deletions roles/controller_ad_hoc_command/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,26 +16,26 @@ Currently:

|Variable Name|Default Value|Required|Description|Example|
|:---|:---:|:---:|:---|:---|
|`controller_state`|"present"|no|The state all objects will take unless overridden by object default|'absent'|
|`controller_hostname`|""|yes|URL to the Ansible Controller Server.|127.0.0.1|
|`controller_validate_certs`|`True`|no|Whether or not to validate the Ansible Controller Server's SSL certificate.||
|`controller_username`|""|no|Admin User on the Ansible Controller Server. Either username / password or oauthtoken need to be specified.||
|`controller_password`|""|no|Controller Admin User's password on the Ansible Controller Server. This should be stored in an Ansible Vault at vars/controller-secrets.yml or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.||
|`controller_oauthtoken`|""|no|Controller Admin User's token on the Ansible Controller Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.||
|`controller_request_timeout`|`10`|no|Specify the timeout in seconds Ansible should use in requests to the controller host.||
|`platform_state`|"present"|no|The state all objects will take unless overridden by object default|'absent'|
|`platform_hostname`|""|yes|URL to the Ansible Automation Platform Server.|127.0.0.1|
|`platform_validate_certs`|`True`|no|Whether or not to validate the Ansible Automation Platform Server's SSL certificate.||
|`platform_username`|""|no|Admin User on the Ansible Automation Platform Server. Either username / password or oauthtoken need to be specified.||
|`platform_password`|""|no|Platform Admin User's password on the Server. This should be stored in an Ansible Vault at vars/platform-secrets.yml or elsewhere and called from a parent playbook.||
|`platform_token`|""|no|Controller Admin User's token on the Ansible Automation Platform Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.||
|`platform_request_timeout`|`10`|no|Specify the timeout in seconds Ansible should use in requests to the controller host.||
|`controller_ad_hoc_commands`|`see below`|yes|Data structure describing your ad hoc commands to run Described below.||

### Secure Logging Variables

The following Variables compliment each other.
If Both variables are not set, secure logging defaults to false.
The role defaults to False as normally the add ad hoc commands task does not include sensitive information.
controller_configuration_ad_hoc_command_secure_logging defaults to the value of controller_configuration_secure_logging if it is not explicitly called. This allows for secure logging to be toggled for the entire suite of controller configuration roles with a single variable, or for the user to selectively use it.
controller_configuration_ad_hoc_command_secure_logging defaults to the value of platform_configuration_secure_logging if it is not explicitly called. This allows for secure logging to be toggled for the entire suite of controller configuration roles with a single variable, or for the user to selectively use it.

|Variable Name|Default Value|Required|Description|
|:---:|:---:|:---:|:---:|
|`controller_configuration_ad_hoc_command_secure_logging`|`False`|no|Whether or not to include the sensitive ad_hoc_command role tasks in the log. Set this value to `True` if you will be providing your sensitive values from elsewhere.|
|`controller_configuration_secure_logging`|`False`|no|This variable enables secure logging as well, but is shared across multiple roles, see above.|
|`platform_configuration_secure_logging`|`False`|no|This variable enables secure logging as well, but is shared across multiple roles, see above.|

## Data Structure

Expand Down Expand Up @@ -83,12 +83,12 @@ controller_ad_hoc_commands:
- name: Playbook to configure ansible controller post installation
hosts: localhost
connection: local
# Define following vars here, or in controller_configs/controller_auth.yml
# Define following vars here, or in platform_configs/controller_auth.yml
# controller_hostname: ansible-controller-web-svc-test-project.example.com
# controller_username: admin
# platform_username: admin
# controller_password: changeme
pre_tasks:
- name: Include vars from controller_configs directory
- name: Include vars from platform_configs directory
ansible.builtin.include_vars:
dir: ./yaml
ignore_files: [controller_config.yml.template]
Expand Down
2 changes: 1 addition & 1 deletion roles/controller_ad_hoc_command/defaults/main.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
---
# These are the default variables specific to the ad_hoc_command role
controller_configuration_ad_hoc_command_secure_logging: "{{ controller_configuration_secure_logging | default('false') }}"
controller_configuration_ad_hoc_command_secure_logging: "{{ platform_configuration_secure_logging | default('false') }}"
...
26 changes: 13 additions & 13 deletions roles/controller_ad_hoc_command/meta/argument_specs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -76,45 +76,45 @@ argument_specs:

# No_log variables
controller_configuration_ad_hoc_command_secure_logging:
default: "{{ controller_configuration_secure_logging | default(false) }}"
default: "{{ platform_configuration_secure_logging | default(false) }}"
required: false
type: bool
description: Whether or not to include the sensitive ad_hoc_command role tasks in the log. Set this value to `true` if you will be providing your sensitive values from elsewhere.
controller_configuration_secure_logging:
platform_configuration_secure_logging:
Tompage1994 marked this conversation as resolved.
Show resolved Hide resolved
default: false
required: false
type: bool
description: This variable enables secure logging across all roles as a default.

# Generic across all roles
controller_state:
platform_state:
default: present
required: false
description: The state all objects will take unless overridden by object default
type: str
controller_hostname:
platform_hostname:
default: None
required: false
description: URL to the Ansible Controller Server.
description: URL to the Ansible Automation Platform Server.
type: str
controller_validate_certs:
platform_validate_certs:
default: true
required: false
description: Whether or not to validate the Ansible Controller Server's SSL certificate.
description: Whether or not to validate the Ansible Automation Platform Server's SSL certificate.
type: str
controller_username:
platform_username:
default: None
required: false
description: Admin User on the Ansible Controller Server. Either username / password or oauthtoken need to be specified.
description: Admin User on the Ansible Automation Platform Server. Either username / password or oauthtoken need to be specified.
type: str
controller_password:
platform_password:
default: None
required: false
description: Controller Admin User's password on the Ansible Controller Server. This should be stored in an Ansible Vault at vars/controller-secrets.yml or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.
description: Platform Admin User's password on the Server. This should be stored in an Ansible Vault at vars/platform-secrets.yml or elsewhere and called from a parent playbook.
type: str
controller_oauthtoken:
platform_token:
default: None
required: false
description: Controller Admin User's token on the Ansible Controller Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.
description: Controller Admin User's token on the Ansible Automation Platform Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.
type: str
...
13 changes: 6 additions & 7 deletions roles/controller_ad_hoc_command/tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,12 @@
timeout: "{{ __ad_hoc_command_item.timeout | default(omit, true) }}"

# Role Standard Options
controller_username: "{{ controller_username | default(omit, true) }}"
controller_password: "{{ controller_password | default(omit, true) }}"
controller_oauthtoken: "{{ controller_oauthtoken | default(omit, true) }}"
request_timeout: "{{ controller_request_timeout | default(omit, true) }}"
controller_host: "{{ controller_hostname | default(omit, true) }}"
controller_config_file: "{{ controller_config_file | default(omit, true) }}"
validate_certs: "{{ controller_validate_certs | default(omit) }}"
controller_username: "{{ platform_username | default(omit, true) }}"
controller_password: "{{ platform_password | default(omit, true) }}"
controller_oauthtoken: "{{ platform_token | default(omit, true) }}"
request_timeout: "{{ platform_request_timeout | default(omit, true) }}"
controller_host: "{{ platform_hostname | default(omit, true) }}"
validate_certs: "{{ platform_validate_certs | default(omit) }}"
loop: "{{ controller_ad_hoc_commands }}"
loop_control:
loop_var: "__ad_hoc_command_item"
Expand Down
4 changes: 2 additions & 2 deletions roles/controller_ad_hoc_command/tests/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@
vars:
controller_validate_certs: false
controller_hostname: controller.example.com
controller_username: admin
platform_username: admin
controller_password: changeme

collections:
- awx.awx

pre_tasks:
- name: Include vars from controller_configs directory
- name: Include vars from platform_configs directory
ansible.builtin.include_vars:
dir: ./configs
extensions: ["yml"]
Expand Down
Loading
Loading