tripleo-validations/roles/tls_everywhere/tasks/pre-deployment-non-containerized.yaml

---
### join.conf check ###
- name: Verify that join.conf exists
  stat:
    path: /etc/novajoin/join.conf
  register: non_containerized_join_conf_st

- name: Fail if join.conf is not present
  fail:
    msg: join.conf is necessary to continue the validations
  when: not non_containerized_join_conf_st.stat.exists|bool

- name: Set containzerized join.conf location
  set_fact:
    joinconf_location: "/etc/novajoin/join.conf"

- name: Get novajoin keytab path from join.conf
  become: true
  validations_read_ini:
    path: "{{ joinconf_location }}"
    section: DEFAULT
    key: keytab
    ignore_missing_file: true
  register: novajoin_keytab_path
  check_mode: false

- name: Get novajoin server port from join.conf
  become: true
  validations_read_ini:
    path: "{{ joinconf_location }}"
    section: DEFAULT
    key: join_listen_port
    ignore_missing_file: true
  register: novajoin_server_port
  check_mode: false

- name: Get novajoin server host from join.conf
  become: true
  validations_read_ini:
    path: "{{ joinconf_location }}"
    section: DEFAULT
    key: join_listen
    ignore_missing_file: true
  register: novajoin_server_host
  check_mode: false

### verify that the keytab and principal are usable ###
# TODO(alee): We need to move this to a subfile so we can run
#             this against novajoin_server and novajoin_notifier

- name: Verify the novajoin keytab is usable (non-containerized)
  become: true
  block:
    - name: Set fact for novajoin user principal
      set_fact:
        novajoin_principal: "nova/{{ host_entry }}"

    - name: Check for novajoin kerberos host keytab
      stat:
        path: "{{ novajoin_keytab_path.value }}"
      register: non_containerized_novajoin_krb5_keytab_stat

    - name: Test if novajoin principal in novajoin keytab is usable
      command: kinit -kt "{{ novajoin_keytab_path.value }}" -c /tmp/my_novajoin_krb5_ccache "{{ novajoin_principal }}"
      become: true
      register: non_containerized_novajoin_principal_usable_result
      ignore_errors: true
      when: non_containerized_novajoin_krb5_keytab_stat.stat.exists

    - name: Set facts for novajoin principal is usable skipped
      set_fact:
        principal_usable_status: "{{ helper_status_skipped }}"
        principal_usable_reason: "skipped checking if the novajoin principal is usable for host {{ ansible_host }} because there is no keytab file"
        principal_usable_recommendations: null
      when: not non_containerized_novajoin_krb5_keytab_stat.stat.exists

    - name: Set facts for novajoin principal is usable success
      set_fact:
        principal_usable_status: "{{ helper_status_ok }}"
        principal_usable_reason: "The principal {{ novajoin_principal }} is able to obtain a kerberos ticket"
        principal_usable_recommendations: null
        temp_krb_caches: "{{ novajoin_temp_krb_caches + [ '/tmp/my_novajoin_krb5_ccache' ] }}"
      changed_when: true
      when:
        - non_containerized_novajoin_krb5_keytab_stat.stat.exists
        - non_containerized_novajoin_principal_usable_result is succeeded
      notify:  # (hrybacki): novajoin server running on the undercloud -- it's okay to use this handler
        - clean_up_temp_krb_caches

    - name: Set facts for principal is usable failure
      set_fact:
        principal_usable_status: "{{ helper_status_error }}"
        principal_usable_reason: "Tho principal {{ novajoin_principal }} is unable to obtain a kerberos ticket"
        principal_usable_recommendations: null
      when:
        - non_containerized_novajoin_krb5_keytab_stat.stat.exists
        - non_containerized_novajoin_principal_usable_result is failed

    - name: Report on Kerberos principal in novajoin keytab is usable check
      reportentry:
        report_status: "{{ principal_usable_status }}"
        report_reason: "{{ principal_usable_reason }}"
        report_recommendations: "{{ principal_usable_recommendations }}"

### verify servers are running ###

- name: Verify that novajoin-server is running (non-containerized)
  block:
    - name: Check if novajoin-server is running
      command: systemctl status novajoin-server
      register: novajoin_server_status_result
      ignore_errors: true

    - name: Set facts for novajoin-server is running success
      set_fact:
        service_running_status: "{{ helper_status_ok }}"
        service_running_reason: "The novajoin-server service is running"
        service_running_recommendations: null
      when: novajoin_server_status_result is success

    - name: Set facts for novajoin-server is running failure
      set_fact:
        service_running_status: "{{ helper_status_error }}"
        service_running_reason: "The novajoin-server service is not running"
        service_running_recommendations:
          - "Start the novajoin-server service with systemctl start novajoin-server"
      when: novajoin_server_status_result is failed

    - name: Report on is novajoin-server running check
      reportentry:
        report_status: "{{ service_running_status }}"
        report_reason: "{{ service_running_reason }}"
        report_recommendations: "{{ service_running_recommendations }}"

- name: Verify that novajoin-server is reachable (non-containerized)
  when: novajoin_server_status_result is success
  block:
    - name: Check if novajoin-server port is reachable
      wait_for:
        port: "{{ novajoin_server_port.value }}"
        host: "{{ novajoin_server_host.value }}"
        timeout: 20
      register: novajoin_server_port_status
      ignore_errors: true

    - name: Set facts for novajoin-server port status success
      set_fact:
        port_reachable_status: "{{ helper_status_ok }}"
        port_reachable_reason: "The novajoin-server service is reachable on {{ novajoin_server_port.value }}"
        port_reachable_recommendations: null
      when: novajoin_server_port_status is success

    - name: Set facts for novajoin-server port status failure
      set_fact:
        port_reachable_status: "{{ helper_status_error }}"
        port_reachable_reason: "The novajoin-server service is started, but not reachable locally on {{ novajoin_server_port.value }}"
        port_reachable_recommendations:
          - "iCheck the novajoin-server logs and journal entry"
      when: novajoin_server_port_status is failed

    - name: Report on is novajoin-server port reachable check
      reportentry:
        report_status: "{{ port_reachable_status }}"
        report_reason: "{{ port_reachable_reason }}"
        report_recommendations: "{{ port_reachable_recommendations }}"

- name: Verify that novajoin-notify is running (non-containerized)
  block:
    - name: Check if novajoin-notify is running
      command: systemctl status novajoin-notify
      register: novajoin_notify_status_result
      ignore_errors: true

    - name: Set facts for novajoin-notify is running success
      set_fact:
        service_running_status: "{{ helper_status_ok }}"
        service_running_reason: "The novajoin-notify service is running"
        service_running_recommendations: null
      when: novajoin_notify_status_result is success

    - name: Set facts for novajoin-notify is running failure
      set_fact:
        service_running_status: "{{ helper_status_error }}"
        service_running_reason: "The novajoin-notify service is not running"
        service_running_recommendations:
          - "Start the novajoin-notify service with systemctl start novajoin-notify"
      when: novajoin_notify_status_result is failed

    - name: Report on is novajoin-notify running check
      reportentry:
        report_status: "{{ service_running_status }}"
        report_reason: "{{ service_running_reason }}"
        report_recommendations: "{{ service_running_recommendations }}"