panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
70 lines
2.9 KiB
YAML
70 lines
2.9 KiB
YAML
---
|
|
# Apply the desired VyOS configuration. `vyos_config` compares the rendered
|
|
# `set` lines against the running config and issues only the differences, so
|
|
# re-runs are no-ops. Supports --check and --diff.
|
|
|
|
- name: Render the desired configuration
|
|
ansible.builtin.set_fact:
|
|
_vyos_lines: >-
|
|
{{ lookup('template', 'vyos.conf.j2').splitlines()
|
|
| map('trim') | reject('equalto', '') | list }}
|
|
|
|
- name: Apply configuration
|
|
vyos.vyos.vyos_config:
|
|
lines: "{{ _vyos_lines }}"
|
|
# Persist to config.boot; without this the config is lost on reboot.
|
|
save: true
|
|
# Pull the PRE-change running config back to the control host. VyOS also
|
|
# keeps its own commit revisions (`show system commit`, `rollback N`), but
|
|
# those are only reachable if the box is still reachable -- which is exactly
|
|
# what a bad change takes away.
|
|
backup: true
|
|
backup_options:
|
|
dir_path: "{{ playbook_dir }}/../vyos/backups"
|
|
filename: "config.boot"
|
|
comment: "ansible {{ lookup('pipe', 'date -u +%Y-%m-%dT%H:%M:%SZ') }}"
|
|
register: _vyos_cfg
|
|
# `backup: true` fetches the running config every run, which the module counts
|
|
# as a change. Report changed ONLY when commands were actually issued,
|
|
# otherwise real drift is indistinguishable from a routine backup.
|
|
changed_when: (_vyos_cfg.commands | default([]) | length) > 0
|
|
|
|
- name: Show what changed
|
|
ansible.builtin.debug:
|
|
msg: "{{ _vyos_cfg.commands | default(['(no changes)']) }}"
|
|
|
|
# ── post-deploy verification ──────────────────────────────────────────────
|
|
# Proving the config was WRITTEN is not the same as proving the network still
|
|
# WORKS. These assert operational state, which is the part a bad change breaks.
|
|
- name: Collect operational state
|
|
vyos.vyos.vyos_command:
|
|
commands:
|
|
- show ip ospf neighbor
|
|
- show interfaces
|
|
register: _vyos_state
|
|
changed_when: false
|
|
|
|
- name: Assert OSPF adjacency with the upstream router is Full
|
|
ansible.builtin.assert:
|
|
that: "'Full' in _vyos_state.stdout[0] and vyos_lan_gateway in _vyos_state.stdout[0]"
|
|
fail_msg: >-
|
|
No Full OSPF adjacency with {{ vyos_lan_gateway }}. The SDN subnets are
|
|
NOT being advertised, so nothing can reach them.
|
|
Neighbors seen:\n{{ _vyos_state.stdout[0] }}
|
|
success_msg: "OSPF adjacency with {{ vyos_lan_gateway }} is Full"
|
|
|
|
- name: Assert each SDN gateway address is actually live
|
|
ansible.builtin.assert:
|
|
that: "item.address in _vyos_state.stdout[1]"
|
|
fail_msg: >-
|
|
{{ item.iface }} ({{ item.description }}) is missing {{ item.address }} --
|
|
guests on that VNet have no gateway.
|
|
quiet: true
|
|
loop: "{{ vyos_sdn_interfaces }}"
|
|
loop_control:
|
|
label: "{{ item.iface }} {{ item.address }}"
|
|
|
|
- name: Report
|
|
ansible.builtin.debug:
|
|
msg: "{{ _vyos_state.stdout[0].splitlines() | select('search', 'Full') | list }}"
|