mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
---
|
|
- name: Delete k3s nodes and remove cluster token from vault
|
|
hosts: k3s_hosts
|
|
become: true
|
|
tasks:
|
|
- name: Remove existing k3s installation and data
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: cleanup
|
|
|
|
- name: Remove k3s token from Ansible vault
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
vars:
|
|
vault_k3s_path: "{{ playbook_dir }}/../inventory/group_vars/all/vault_k3s.yml"
|
|
k3s_vault_password_file: "{{ lookup('env', 'ANSIBLE_VAULT_PASSWORD_FILE') | default('', true) }}"
|
|
tasks:
|
|
- name: Require vault password file for token deletion
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_vault_password_file is defined
|
|
- k3s_vault_password_file | length > 0
|
|
fail_msg: "Set k3s_vault_password_file to a vault password file path."
|
|
|
|
- name: Ensure vault file exists
|
|
ansible.builtin.stat:
|
|
path: "{{ vault_k3s_path }}"
|
|
register: vault_k3s_file
|
|
|
|
- name: Fail when vault file is missing
|
|
ansible.builtin.fail:
|
|
msg: "Vault file not found at {{ vault_k3s_path }}"
|
|
when: not vault_k3s_file.stat.exists
|
|
|
|
- name: Read vault_k3s.yml header
|
|
ansible.builtin.command: "head -n 1 {{ vault_k3s_path }}"
|
|
register: vault_k3s_header
|
|
changed_when: false
|
|
|
|
- name: Mark vault_k3s.yml encryption state
|
|
ansible.builtin.set_fact:
|
|
vault_k3s_encrypted: "{{ vault_k3s_header.stdout is search('^\\$ANSIBLE_VAULT') }}"
|
|
|
|
- name: Decrypt vault_k3s.yml
|
|
ansible.builtin.command: >-
|
|
ansible-vault decrypt {{ vault_k3s_path }}
|
|
--vault-password-file {{ k3s_vault_password_file }}
|
|
changed_when: true
|
|
when: vault_k3s_encrypted | bool
|
|
|
|
- name: Remove vault_k3s_token entry
|
|
ansible.builtin.lineinfile:
|
|
path: "{{ vault_k3s_path }}"
|
|
regexp: '^vault_k3s_token:'
|
|
state: absent
|
|
|
|
- name: Encrypt vault_k3s.yml
|
|
ansible.builtin.command: >-
|
|
ansible-vault encrypt {{ vault_k3s_path }}
|
|
--vault-password-file {{ k3s_vault_password_file }}
|
|
changed_when: true
|
|
when: vault_k3s_encrypted | bool
|