Add repo connectivty checks to verify (preflight) playbooks - #367
Merged
kvelarde-itential merged 7 commits intoAug 13, 2026
Merged
Conversation
kvelarde-itential
requested review from
Amunagala-itential,
Madias2222,
Nick-Andreano and
steven-schattenberg-itential
August 13, 2026 16:28
steven-schattenberg-itential
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Made verify.yml continue past a single component's failure instead of aborting the whole run.
Root cause: Ansible aborts the entire ansible-playbook run — not just the current play — the moment a play ends with 100% of its hosts failed, even for later, unrelated plays. Since verify.yml chains verify_redis/verify_mongodb/verify_platform/verify_gateway via import_playbook, one bad host in Redis could prevent MongoDB/Platform/Gateway from ever being checked.
Fixed a cross-component overwrite bug. verification_passed (and later validation_errors) were single shared per-host facts that got clobbered by whichever component ran last. On a host belonging to more than one component group (e.g. an all-in-one host), a later component passing cleanly erased an earlier component's failure on the same host. Fixed both to accumulate (logical AND / dict merge via combine()) instead of overwrite.
Added per-component failure reporting. The final report play now shows a component_validation_errors dict keyed by component ({"Redis": [...], "Platform": [...]}) instead of just a pass/fail flag, so it's immediately clear which component failed which specific check on a given host.
Removed the Vault connectivity pre-check. The standalone Vault-installing role was dropped from this collection in v4 — Platform now only configures a client connection to an externally managed Vault, so checking access to Vault's install RPM repo (rpm.releases.hashicorp.com) pre-install was stale. Removed from common_required_repositories, verify-platform.yml, and the README repository table. Also renamed the copy-pasted "Verify Platform host requirements" task name in each component's results-reporting step to match the actual component (Redis/MongoDB/Platform/Redis Sentinel).
Fixed a Redis Sentinel connectivity bug. verify-sentinel.yml's connectivity check used component_name: "Redis Sentinel", which matched no entries in the repository list — it silently verified nothing. Fixed to check Redis's own repositories, since Sentinel-only hosts still install the full Redis package/source (same repos are needed).
Moved required-repository lists out of common and into each component role. common_required_repositories was a single shared list in roles/common/vars/main.yml, filtered by component_name at verify time. Split into redis_required_repositories, mongodb_required_repositories, platform_required_repositories, and gateway_required_repositories, each now owned by its own role's vars/main.yml (created one for Gateway, which didn't have one). verify-connectivity.yml's interface changed accordingly — it now takes the list directly via required_repositories instead of filtering a shared list by name. roles/common/vars/ no longer exists.
Added Gateway hardware-spec verification (built on top of the gateway_hw_specs var and common:verify-host wiring). Found and fixed a bug where the new CPU/RAM/disk/OS/arch checks were being collected into validation_errors but never actually gated in the final assert (which only checked connectivity_validation) — a Gateway host failing hardware requirements would still report success. Switched Gateway to the same verify-host → verify-connectivity → verify-results sequence used by Redis/MongoDB/Platform, so it's now consistent and hw-spec failures actually fail the check.
Docs: updated roles/common/CLAUDE.md, roles/redis/CLAUDE.md, roles/mongodb/CLAUDE.md, roles/platform/CLAUDE.md, roles/gateway/CLAUDE.md, top-level CLAUDE.md, and README.md throughout to match.