diff --git a/geant/ops_ansible/roles/cic_generic/tasks/fix_template.yaml b/geant/ops_ansible/roles/cic_generic/tasks/fix_template.yaml index bcaf50194957d6a495048715b8889bd9014014c5..bb71812b93e8b53546c8337bbb5cd0ed6be38b60 100644 --- a/geant/ops_ansible/roles/cic_generic/tasks/fix_template.yaml +++ b/geant/ops_ansible/roles/cic_generic/tasks/fix_template.yaml @@ -14,4 +14,5 @@ - name: Show diff of "{{ config_object }}" ansible.builtin.debug: msg: "{{ response }}" - when: verb == "fix" and not (dry_run | ansible.builtin.bool) + when: verb == "fix" and not (dry_run | ansible.builtin.bool) + diff --git a/geant/ops_ansible/roles/cic_generic/tasks/main.yml b/geant/ops_ansible/roles/cic_generic/tasks/main.yml index 3c862bce8c33fd14b2a19954cb2235af947c66d5..e2c27467ba38f79264f99ff8403a774327424144 100644 --- a/geant/ops_ansible/roles/cic_generic/tasks/main.yml +++ b/geant/ops_ansible/roles/cic_generic/tasks/main.yml @@ -9,7 +9,7 @@ when: ((verb is not defined) or (config_object is not defined)) or (verb not in verbs) or (config_object not in config_objects.keys()) - name: Fail if arguments are not correct - ansible.builtin.meta: end_play + meta: end_play when: ((verb is not defined) or (config_object is not defined)) or (verb not in verbs) or (config_object not in config_objects.keys()) - name: Set an ID for this run @@ -21,10 +21,39 @@ ansible.builtin.debug: msg: "{{ opid }}" +- name: Merge system login user vars + merge_vars: + suffix_to_merge: users__to_merge + merged_var_name: system_login_users + expected_type: 'list' + +- name: Merge system login classes vars + merge_vars: + suffix_to_merge: classes__to_merge + merged_var_name: system_login_classes + expected_type: 'list' + +- name: Merge snmp communities vars + merge_vars: + suffix_to_merge: snmp_communities__to_merge + merged_var_name: snmp_communities + expected_type: 'list' + +- name: Merge prefix lists + merge_vars: + suffix_to_merge: prefix_lists__to_merge + merged_var_name: po_prefixlists + expected_type: 'list' + - name: Include compiling the template - ansible.builtin.include_tasks: compile_template.yaml + include_tasks: compile_template.yaml when: (verb in verbs) - name: Include the test tasks if specified - ansible.builtin.include_tasks: test_template.yaml + include_tasks: test_template.yaml when: verb == "test" + +- name: Include the test tasks if specified + include_tasks: fix_template.yaml + when: verb == "fix" + diff --git a/geant/ops_ansible/roles/cic_generic/tasks/test_template.yaml b/geant/ops_ansible/roles/cic_generic/tasks/test_template.yaml index 4125f2bdb47426b725d3535393d0622447c66b3e..0db0e769668250d8238472731d47fe3fd5eed4bf 100644 --- a/geant/ops_ansible/roles/cic_generic/tasks/test_template.yaml +++ b/geant/ops_ansible/roles/cic_generic/tasks/test_template.yaml @@ -1,5 +1,6 @@ --- -- name: Verify "{{ config_object }}" [CHECK ONLY] +### This task will fail if commit-check fails +- name: Test "{{ config_object }}" [CHECK ONLY] juniper_junos_config: load: "{{ config_objects[config_object].strategy }}" src: "/var/tmp/ansible_run_{{ opid }}/{{ config_object }}.conf" @@ -8,20 +9,28 @@ check: true commit: false register: response - when: verb == "test" and (dry_run | ansible.builtin.bool) + when: verb == "test" and dry_run | ansible.builtin.bool +### This task never fails. It only shows differences if ther are any +### but commit-check in the previous task should succeed - name: Show DRY diff of "{{ config_object }}" ansible.builtin.debug: msg: "{{ response }}" - when: verb == "test" and (dry_run | ansible.builtin.bool) and (response.changed | ansible.builtin.bool) + when: verb == "test" and dry_run | ansible.builtin.bool and response.changed == true + +# ### This task will artificially fail if there is config that needs to be added or removed +# - name: Fail if there are diffs +# ansible.builtin.fail: +# msg: "Running configuration is not the same as the intended" +# when: response.changed == true - name: Send an e-mail using Geant SMTP servers - community.general.notification.mail: + mail: host: "{{ cic_alerts_mail_host }}" port: "{{ cic_alerts_smtp_port }}" sender: "{{ cic_alerts_sender }}" to: "{{ cic_alerts_recipient }}" - subject: "Config Integrity Check failed for {{ inventory_hostname }} on {{ config_object }}" + subject: "Config Integrity Check failed for {{ inventory_hostname }} on {{ config_object }}" body: "{{ lookup('ansible.builtin.template', 'mail_body.j2') }}" delegate_to: localhost - when: (response.changed | ansible.builtin.bool) and (send_email | ansible.builtin.bool) + when: response.changed == true and (send_email | ansible.builtin.bool) == true diff --git a/geant/ops_ansible/roles/cic_generic/templates/system_dns.j2 b/geant/ops_ansible/roles/cic_generic/templates/system_dns.j2 new file mode 100644 index 0000000000000000000000000000000000000000..55251f64d76d96a03e52b48ee8991d17f678e5ce --- /dev/null +++ b/geant/ops_ansible/roles/cic_generic/templates/system_dns.j2 @@ -0,0 +1,15 @@ +system { +{% if system_name_servers is defined %} + {% if system_name_servers|length > 1 %} + replace: name-server { + {%- for name_server in system_name_servers %} + {{ name_server }}; + {%- endfor %} + } +{% else %} + {%- for name_server in system_name_servers %} + replace: name-server {{ name_server }}; + {% endfor %} + {% endif %} + {% endif %} +} diff --git a/geant/ops_ansible/roles/cic_generic/templates/system_login.j2 b/geant/ops_ansible/roles/cic_generic/templates/system_login.j2 index e76db0d7795567c97a30056b017647ee11613e78..e7cbade1c5b9633cf36843147d74955eb56ed587 100644 --- a/geant/ops_ansible/roles/cic_generic/templates/system_login.j2 +++ b/geant/ops_ansible/roles/cic_generic/templates/system_login.j2 @@ -70,6 +70,7 @@ replace: login { {% endfor %} } {% endif %} + message "----------------------------------------------------------------\n\n This is {{ inventory_hostname }} a GEANT Router in {{ site_city }}, {{ site_country }}.\n Warning: Unauthorized access to this equipment is strictly forbidden and will lead to prosecution \n\n-------------------------------------------------------------\n"; } } diff --git a/geant/ops_ansible/roles/cic_generic/vars/main.yml b/geant/ops_ansible/roles/cic_generic/vars/main.yml index b6cfa481802d0ac175020c7a3ee2d465077e612d..52d7c1b1a69e31001cf85add531d6ebafe57f536 100644 --- a/geant/ops_ansible/roles/cic_generic/vars/main.yml +++ b/geant/ops_ansible/roles/cic_generic/vars/main.yml @@ -25,4 +25,6 @@ config_objects: system_ntp: strategy: replace system_login: - strategy: merge + strategy: replace + system_dns: + strategy: replace