Skip to content

Add repo connectivty checks to verify (preflight) playbooks - #367

Merged
kvelarde-itential merged 7 commits into
itential:devfrom
kvelarde-itential:feature/verify_repo_access
Aug 13, 2026
Merged

Add repo connectivty checks to verify (preflight) playbooks#367
kvelarde-itential merged 7 commits into
itential:devfrom
kvelarde-itential:feature/verify_repo_access

Conversation

@kvelarde-itential

Copy link
Copy Markdown
Collaborator

Made verify.yml continue past a single component's failure instead of aborting the whole run.
Root cause: Ansible aborts the entire ansible-playbook run — not just the current play — the moment a play ends with 100% of its hosts failed, even for later, unrelated plays. Since verify.yml chains verify_redis/verify_mongodb/verify_platform/verify_gateway via import_playbook, one bad host in Redis could prevent MongoDB/Platform/Gateway from ever being checked.

  • Made the OS/architecture asserts in verify-host.yml non-fatal (ignore_errors + register: os_validation/arch_validation), matching the existing CPU/RAM/disk pattern.
  • Made the final combined assert in verify-results.yml non-fatal, with every registered result wrapped in | default({'failed': false}) so a component that skips a check (e.g. verify-sentinel.yml never calls verify-connectivity.yml) doesn't crash the assert on an undefined variable.
  • Added one real, un-ignored final play to verify.yml ("Report Overall Verification Result", hosts: all) that asserts on a per-host verification_passed fact — since nothing runs after it, failing there is safe, and it's what gives the whole run a genuine non-zero exit code while still letting every component's checks run against every host.

Fixed a cross-component overwrite bug. verification_passed (and later validation_errors) were single shared per-host facts that got clobbered by whichever component ran last. On a host belonging to more than one component group (e.g. an all-in-one host), a later component passing cleanly erased an earlier component's failure on the same host. Fixed both to accumulate (logical AND / dict merge via combine()) instead of overwrite.

Added per-component failure reporting. The final report play now shows a component_validation_errors dict keyed by component ({"Redis": [...], "Platform": [...]}) instead of just a pass/fail flag, so it's immediately clear which component failed which specific check on a given host.

Removed the Vault connectivity pre-check. The standalone Vault-installing role was dropped from this collection in v4 — Platform now only configures a client connection to an externally managed Vault, so checking access to Vault's install RPM repo (rpm.releases.hashicorp.com) pre-install was stale. Removed from common_required_repositories, verify-platform.yml, and the README repository table. Also renamed the copy-pasted "Verify Platform host requirements" task name in each component's results-reporting step to match the actual component (Redis/MongoDB/Platform/Redis Sentinel).

Fixed a Redis Sentinel connectivity bug. verify-sentinel.yml's connectivity check used component_name: "Redis Sentinel", which matched no entries in the repository list — it silently verified nothing. Fixed to check Redis's own repositories, since Sentinel-only hosts still install the full Redis package/source (same repos are needed).

Moved required-repository lists out of common and into each component role. common_required_repositories was a single shared list in roles/common/vars/main.yml, filtered by component_name at verify time. Split into redis_required_repositories, mongodb_required_repositories, platform_required_repositories, and gateway_required_repositories, each now owned by its own role's vars/main.yml (created one for Gateway, which didn't have one). verify-connectivity.yml's interface changed accordingly — it now takes the list directly via required_repositories instead of filtering a shared list by name. roles/common/vars/ no longer exists.

Added Gateway hardware-spec verification (built on top of the gateway_hw_specs var and common:verify-host wiring). Found and fixed a bug where the new CPU/RAM/disk/OS/arch checks were being collected into validation_errors but never actually gated in the final assert (which only checked connectivity_validation) — a Gateway host failing hardware requirements would still report success. Switched Gateway to the same verify-host → verify-connectivity → verify-results sequence used by Redis/MongoDB/Platform, so it's now consistent and hw-spec failures actually fail the check.

Docs: updated roles/common/CLAUDE.md, roles/redis/CLAUDE.md, roles/mongodb/CLAUDE.md, roles/platform/CLAUDE.md, roles/gateway/CLAUDE.md, top-level CLAUDE.md, and README.md throughout to match.

Comment thread roles/gateway/vars/main.yml
Comment thread roles/platform/vars/main.yml
@kvelarde-itential
kvelarde-itential merged commit 8601aac into itential:dev Aug 13, 2026
2 checks passed
@kvelarde-itential
kvelarde-itential deleted the feature/verify_repo_access branch August 13, 2026 19:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants