503f4df2ae
- Updated `bf-wireguard-restart.yml` to include dynamic host targeting based on `operation_wave`. - Added pre-tasks to assert that the operation wave is approved and confirmed, ensuring proper execution context. - Modified the service restart task to use a more structured command format. - Adjusted `operations.py` and `ui_gui.py` to reflect changes in operation scope from "simple" to "wave" for relevant operations. - Improved UI handling in `ui_gui.py` and `ui_surfaces.py` for better output management and user interaction. - Updated log rotation configuration to target specific log files. - Enhanced systemd service configurations for WireGuard to improve restart behavior. - Refined firstboot scripts to ensure proper handling of dealer ID and state management. - Improved error handling and rollback mechanisms in identity and installation scripts.
49 lines
No EOL
2 KiB
YAML
49 lines
No EOL
2 KiB
YAML
---
|
|
# Controlled reboots require an approved wave and explicit confirmation.
|
|
- name: Controlled fleet reboot
|
|
hosts: blueforce
|
|
gather_facts: false
|
|
become: true
|
|
serial: 2
|
|
max_fail_percentage: 0
|
|
any_errors_fatal: true
|
|
vars:
|
|
release_wave: ""
|
|
reboot_confirmed: false
|
|
allow_production_reboot: false
|
|
reboot_delay_seconds: "{{ reboot_grace_seconds | default(300) }}"
|
|
pre_tasks:
|
|
- name: Require an approved non-production release wave
|
|
ansible.builtin.assert:
|
|
that:
|
|
- release_wave in ['lab', 'pilot_1', 'pilot_2', 'wave_1', 'wave_2', 'production']
|
|
- reboot_confirmed | bool
|
|
- release_wave != 'production' or allow_production_reboot | bool
|
|
fail_msg: "Set approved release_wave and reboot_confirmed=true. Production additionally requires allow_production_reboot=true."
|
|
|
|
- name: Refuse full-fleet scope without explicit production override
|
|
ansible.builtin.assert:
|
|
that:
|
|
- release_wave == 'production' or ansible_limit | default('') | regex_search('(^|[:,])' ~ release_wave ~ '($|[:,])')
|
|
fail_msg: "Limit this reboot to the approved release_wave group; full fleet is refused."
|
|
- name: Require exact or subset host selection for release wave
|
|
ansible.builtin.assert:
|
|
that:
|
|
- release_wave in groups
|
|
- groups[release_wave] | length > 0
|
|
- ansible_play_hosts_all | length > 0
|
|
- ansible_play_hosts_all | difference(groups[release_wave]) | length == 0
|
|
fail_msg: "Selected hosts must equal or be a subset of groups[release_wave]; broader fleet scope is refused."
|
|
run_once: true
|
|
tasks:
|
|
- name: Reboot host with grace period
|
|
ansible.builtin.reboot:
|
|
reboot_timeout: 600
|
|
pre_reboot_delay: "{{ reboot_delay_seconds }}"
|
|
msg: Blueforce scheduled reboot via Ansible
|
|
|
|
- name: Verify host health after reboot batch
|
|
ansible.builtin.command: /usr/local/bin/bf-status --check
|
|
register: reboot_health
|
|
changed_when: false
|
|
failed_when: reboot_health.rc != 0 |