- hosts: bridge.openstack.org:!disabled
  name: "Bridge: boostrap the bastion host"
  become: true
  roles:
    - pip3
    # Note for production use we expect to take the defaults; unit
    # test jobs override this to test with latest upstream ansible.
    # For example, if there is a fix on the ansible stable branch we
    # need that is unreleased, you could do the following:
    #
    #  install_ansible_name: '{{ bridge_ansible_name | default("git+https://github.com/ansible/ansible.git@stable-2.7") }}'
    #  install_ansible_version: '{{ bridge_ansible_version | default(None) }}'
    - role: install-ansible
      install_ansible_name: '{{ bridge_ansible_name | default("ansible") }}'
      # NOTE(mordred): Do not upgrade this to 2.10 without figuring out an install for the
      # debug callback plugin which moved out of tree in 2.10. It might be in Ansible Community
      # Distro - but needs to be verified before we do it.
      install_ansible_version: '{{ bridge_ansible_version | default("2.9.8") }}'
      install_ansible_openstacksdk_name: '{{ bridge_openstacksdk_name | default("openstacksdk") }}'
      install_ansible_openstacksdk_version: '{{ bridge_openstacksdk_verison | default("latest") }}'
      # NOTE(ianw): At 2018-12, ARA is only enabled during gate
      # testing jobs as we decide if or how to store data on
      # production bridge.o.o
      install_ansible_ara_name: '{{ bridge_ara_name | default("ara") }}'
      install_ansible_ara_version: '{{ bridge_ara_version | default("0.16.4") }}'
    - root-keys