chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 14:04:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ansible: opt read-only kubectl/samba-tool tasks into --check mode

Browse Source 
Ansible --check mode auto-skips command/shell tasks unless they
explicitly opt in via check_mode:false. The two cluster-state lookups
(svc/auth ClusterIP and knoe-kdc-secrets/trust_shared_password) were
silently skipped during dry-run, leaving trust_kdc_ip empty and tripping
the assertion immediately.

Add check_mode:false to the five read-only tasks so a --check run can
still resolve cluster state and report what would change:
  - Resolve trust_kdc_ip from cluster
  - Resolve trust_shared_password from knoe-kdc-secrets
  - samba-tool domain trust list  (idempotency probe)
  - samba-tool domain trust validate
  - samba-tool domain trust show  (smoke print)

The mutating create step (samba-tool domain trust create) keeps the
default behavior - skipped in check mode. validate/show gain a guarded
failed_when so a check-mode dry-run on a host where the trust does not
yet exist does not fail (the create was skipped, so a non-zero rc is
expected). Real runs still fail hard on rc!=0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-05-10 01:51:30 -07:00
parent 5cece408bd
commit 227f49042c
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
infrastructure/playbooks/kerberos_trust_setup.yml
View File

@ -76,6 +76,7 @@
register: _kdc_clusterip register: _kdc_clusterip
when: trust_kdc_ip == "" when: trust_kdc_ip == ""
changed_when: false changed_when: false
check_mode: false
- name: Set trust_kdc_ip fact from cluster lookup - name: Set trust_kdc_ip fact from cluster lookup
ansible.builtin.set_fact: ansible.builtin.set_fact:
@ -106,6 +107,7 @@
register: _trust_pw register: _trust_pw
when: trust_shared_password == "" when: trust_shared_password == ""
changed_when: false changed_when: false
check_mode: false
no_log: true no_log: true
- name: Set trust_shared_password fact from cluster Secret - name: Set trust_shared_password fact from cluster Secret
@ -140,6 +142,7 @@
register: _trust_list register: _trust_list
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: false
- name: Set fact — trust already present - name: Set fact — trust already present
ansible.builtin.set_fact: ansible.builtin.set_fact:
@ -202,7 +205,13 @@
no_log: true no_log: true
register: _trust_validate register: _trust_validate
changed_when: false changed_when: false
failed_when: _trust_validate.rc != 0 check_mode: false
# In --check mode the create step is skipped, so a missing trust
# is expected and shouldn't fail the dry run. In a real run we
# always want a non-zero rc to fail.
failed_when:
- _trust_validate.rc != 0
- not (ansible_check_mode and not _trust_exists)
- name: Print trust validation result - name: Print trust validation result
ansible.builtin.debug: ansible.builtin.debug:
@ -219,7 +228,10 @@
no_log: true no_log: true
register: _trust_show register: _trust_show
changed_when: false changed_when: false
failed_when: _trust_show.rc != 0 check_mode: false
failed_when:
- _trust_show.rc != 0
- not (ansible_check_mode and not _trust_exists)
- name: Print trust show output - name: Print trust show output
ansible.builtin.debug: ansible.builtin.debug: