pavel/ansible-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1720

Browse Source
This commit is contained in:
pavel
2025-10-22 17:20:02 +03:00
parent 6d883ce59c
commit 235187b5f6
1 changed files with 118 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files

240
files/ansible-playbooks/update-indoor.yml
View File

@@ -1,6 +1,6 @@
---
# update-secondline.yml
- name: Second-line upgrade tunneled noninvasive engine
- name: Second-line indoor upgrade via DEV1 → tunnel → DEV2 (non-invasive control path)
hosts: all
gather_facts: no
@@ -29,7 +29,7 @@
# SSH options used from controller
ssh_opts_common: "-o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o NumberOfPasswordPrompts=1 -o ConnectTimeout=15"
# Image to stage on DEV2 noninvasive we do not run update -w here
# Image to stage on DEV2 (we validate first; the actual write happens later)
image_filename: "fox200-2.2.1-r6801.bin"
image_md5: "56b7211709de617e058b98d4204e2562"
# Optional SHA256; leave empty to skip SHA256 checks
@@ -52,21 +52,21 @@
pre_tasks:
# ------------------------------- Hostname sanity DEV1 -------------------------------
- name: Read DEV1 hostname from env busybox safe
- name: Read DEV1 hostname (busybox-safe)
ansible.builtin.raw: >
{{ pathprefix }}
(cat /proc/sys/kernel/hostname 2>/dev/null || echo "")
register: dev1_host_read
changed_when: false
- name: Stop if DEV1 connected hostname differs from inventory
- name: Stop early if connected DEV1 hostname != inventory
ansible.builtin.meta: end_host
when: (dev1_host_read.stdout | trim | length > 0) and
((dev1_host_read.stdout | trim) != (inventory_hostname | string))
tasks:
# ---------------------------- Idempotent temp IP on DEV1 ----------------------------
- name: Add temporary IP on DEV1 idempotent treat File exists as OK
- name: Add temporary IP on DEV1 (tolerate 'File exists')
ansible.builtin.raw: >
{{ pathprefix }}
ip a add {{ dev2_side_ip }} dev {{ dev1_iface }}
@@ -77,7 +77,7 @@
and ('File exists' not in (add_ip.stdout | default('')))
and ('File exists' not in (add_ip.stderr | default('')))
- name: Debug add ip results
- name: Debug: result of adding temp IP to DEV1
ansible.builtin.debug:
msg:
- "add_ip.rc={{ add_ip.rc | default('') }}"
@@ -85,19 +85,19 @@
- "add_ip.stderr={{ (add_ip.stderr | default('')) | trim }}"
# ---------------------------- Discover MAC via bridge FDB and add static ARP on DEV1 ----------------------------
- name: Read dynamic MAC on eth0 behind {{ dev1_iface }} via bridge fdb
- name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort)
ansible.builtin.raw: >
{{ pathprefix }}
bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1
register: dev2_mac_scan
changed_when: false
- name: Set dev2_mac from fdb scan (if any)
- name: Capture discovered DEV2 MAC (if any)
ansible.builtin.set_fact:
dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
changed_when: false
- name: Remove current ARP entry for DEV2 on DEV1 (best-effort)
- name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
ansible.builtin.raw: >
{{ pathprefix }}
ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true
@@ -105,7 +105,7 @@
changed_when: false
failed_when: false
- name: Add static ARP for DEV2 on DEV1
- name: Add static ARP entry on DEV1 (locks DEV2 IP → discovered MAC)
ansible.builtin.raw: >
{{ pathprefix }}
ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent
@@ -116,7 +116,7 @@
and ('File exists' not in (dev2_arp_add.stdout | default('')))
and ('File exists' not in (dev2_arp_add.stderr | default('')))
- name: Debug static ARP result
- name: Debug: ARP action summary on DEV1
ansible.builtin.debug:
msg:
- "dev2_mac={{ dev2_mac | default('UNSET') }}"
@@ -124,13 +124,13 @@
- "arp_add.out={{ (dev2_arp_add.stdout | default('')) | trim }}"
- "arp_add.err={{ (dev2_arp_add.stderr | default('')) | trim }}"
- name: Skip ARP add because MAC not found
- name: Note: skipping static ARP add (no MAC discovered)
when: dev2_mac is not defined or dev2_mac | length == 0
ansible.builtin.debug:
msg: "No suitable dynamic MAC found via bridge fdb; skipping static ARP add on DEV1"
# ---------------------------- Local tunnel preparation ----------------------------
- name: Pick a free local port for the tunnel controller
- name: Pick a free local TCP port for the tunnel (controller side)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -153,22 +153,22 @@
register: pick_port
changed_when: false
- name: Stop if no free local port
- name: Stop if no free local port was found
ansible.builtin.meta: end_host
when: (pick_port.stdout | trim | length) == 0
- name: Record chosen local port and control directory
- name: Record chosen local port and create control dir for SSH ControlMaster
delegate_to: localhost
ansible.builtin.set_fact:
_local_port: "{{ pick_port.stdout | trim }}"
_ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
- name: Build tunnel control socket path
- name: Build path for SSH ControlMaster socket
delegate_to: localhost
ansible.builtin.set_fact:
_ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl"
- name: Debug chosen tunnel params
- name: Debug: tunnel parameters (controller side)
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -176,11 +176,11 @@
- "ctrl_dir={{ _ctrl_dir }}"
- "ctrl_sock={{ _ctrl_sock }}"
- name: issue arping with own IP
- name: Refresh ARP on DEV1’s LAN (send unsolicited ARP from temporary IP)
ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3
# ---------------------------- Start SSH local forward via DEV1 ----------------------------
- name: Start SSH tunnel via DEV1 background ControlMaster
- name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -195,13 +195,13 @@
register: start_tunnel
changed_when: true
- name: Small delay for tunnel to settle
- name: Wait a moment for tunnel to settle
delegate_to: localhost
ansible.builtin.wait_for:
timeout: 1
changed_when: false
- name: Verify tunnel master running proper O check with destination
- name: Verify ControlMaster is running (ssh -O check)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -210,7 +210,7 @@
register: tun_check
changed_when: false
- name: Debug tunnel check
- name: Debug: ControlMaster status
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -218,7 +218,7 @@
- "tunnel_check.out={{ (tun_check.stdout | default('')) | trim }}"
# ---------------------------- Controller-side sanity for DEV2 auth ----------------------------
- name: Sanity confirm tunnel TCP reachability to DEV2
- name: Probe TCP reachability to DEV2 through the tunnel (nc)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -227,7 +227,7 @@
changed_when: false
ignore_errors: true
- name: Debug reachability result
- name: Debug: tunnel reachability result
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -235,11 +235,11 @@
- "nc.stdout={{ (nc_probe.stdout | default('')) | trim }}"
- "nc.stderr={{ (nc_probe.stderr | default('')) | trim }}"
- name: Stop if tunnel TCP check failed
- name: Stop if tunnel TCP probe failed
ansible.builtin.meta: end_host
when: nc_probe.rc != 0
- name: Sanity show presence and permissions of passfiles on controller
- name: Show passfiles available on controller (ls)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -247,15 +247,15 @@
register: dev2_ls
changed_when: false
- name: Debug passfiles listing
- name: Debug: passfiles presence
delegate_to: localhost
ansible.builtin.debug:
msg:
- "{{ (dev2_ls.stdout | default('')) | trim }}"
- "{{ (dev2_ls.stderr | default('')) | trim }}"
# ---------------------------- Pick DEV2 password root only ----------------------------
- name: Try DEV2 login with basicpass root
# ---------------------------- Pick DEV2 password for root ----------------------------
- name: Try DEV2 login with 'basicpass' (root)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -270,14 +270,14 @@
changed_when: false
ignore_errors: true
- name: Select basicpass as working passfile
- name: Select 'basicpass' if previous login succeeded
when: dev2_try_basicpass.rc == 0
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used: "basicpass"
changed_when: false
- name: Try DEV2 login with basicpass2 root only if first failed
- name: Try DEV2 login with 'basicpass2' (only if first failed)
when: dev2_passfile_used is not defined
delegate_to: localhost
ansible.builtin.shell: |
@@ -293,21 +293,21 @@
changed_when: false
ignore_errors: true
- name: Select basicpass2 as working passfile
- name: Select 'basicpass2' if second login succeeded
when: dev2_passfile_used is not defined and dev2_try_basicpass2.rc == 0
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used: "basicpass2"
changed_when: false
- name: Set dev2_passfile_used to NONE if neither worked
- name: Mark DEV2 auth as NONE if both attempts failed
when: dev2_passfile_used is not defined
delegate_to: localhost
ansible.builtin.set_fact:
dev2_passfile_used: "NONE"
changed_when: false
- name: Debug selected DEV2 passfile or NONE
- name: Debug: selected DEV2 passfile
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -333,13 +333,13 @@
register: dev2_host_read
changed_when: false
- name: Normalize hostnames for strict compare
- name: Normalize hostnames for strict compare (inventory/DEV1/DEV2)
ansible.builtin.set_fact:
_inv_hn: "{{ (inventory_hostname | string) | trim | regex_replace('\\r+$','') | lower }}"
_dev1_hn: "{{ (dev1_host_read.stdout | default('')) | trim | regex_replace('\\r+$','') | lower }}"
_dev2_hn: "{{ (dev2_host_read.stdout | default('')) | trim | regex_replace('\\r+$','') | lower }}"
- name: Debug hostname bytes (hex)
- name: Debug: normalized hostnames (JSON-escaped)
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -348,7 +348,7 @@
- "dev2={{ _dev2_hn | tojson }}"
# ---------------- Hostname equality guard (soft-journal and stop) ----------------
- name: Enforce DEV2 hostname equals inventory and DEV1
- name: Guard: DEV2 hostname must equal inventory AND DEV1 (prevents IP churn mistakes)
block:
- name: Fail if DEV2 hostname differs from inventory/DEV1
ansible.builtin.fail:
@@ -365,12 +365,12 @@
_prep_blocked: false
delegate_to: localhost
- name: Append hostname mismatch to journal
- name: Append hostname mismatch info to journal
ansible.builtin.set_fact:
_journal: "{{ _journal + [ 'Hostname mismatch: DEV2=' ~ _dev2_hn ~ ', inventory=' ~ _inv_hn ~ ', DEV1=' ~ _dev1_hn ] }}"
delegate_to: localhost
- name: Build control queue payload for indoor aborted journal (hostname)
- name: Build control queue payload for indoor aborted journal (hostname check)
ansible.builtin.set_fact:
journal_indoor_aborted:
inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
@@ -379,7 +379,7 @@
indoor: update aborted with following reason(s): {{ (_journal | default([])) | join('; ') }}
delegate_to: localhost
- name: Publish indoor aborted journal to control queue (hostname)
- name: Publish indoor aborted journal (hostname mismatch)
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
@@ -408,17 +408,17 @@
ansible.builtin.meta: end_host
# ---------------------------- SOFT-FAIL JOURNAL INIT + PREP MARKER CHECK ----------------------------
- name: Initialize journal and flags
- name: Init soft-fail journal flags
ansible.builtin.set_fact:
_journal: []
_prep_blocked: false
_blocked: false
- name: Build specific marker filename (no .bin)
- name: Build specific image marker path on DEV2 (/tmp/prepared_for_<image>)
ansible.builtin.set_fact:
_marker_specific: "/tmp/prepared_for_{{ image_filename | regex_replace('\\.bin$','') }}"
- name: Check for any preparation markers on DEV2 (wildcard count)
- name: Count existing preparation markers on DEV2 (best-effort)
when: dev2_passfile_used != "NONE"
delegate_to: localhost
ansible.builtin.shell: |
@@ -437,7 +437,7 @@
changed_when: false
ignore_errors: true
- name: Soft-block if any prep markers already present
- name: Soft-block if preparation markers already present on DEV2
when: dev2_prep_count is defined and (dev2_prep_count.stdout is defined) and ((dev2_prep_count.stdout | trim | int) > 0)
ansible.builtin.set_fact:
_prep_blocked: true
@@ -445,7 +445,7 @@
_journal: "{{ _journal + [ 'Preparation markers already present on DEV2 (count=' ~ (dev2_prep_count.stdout | trim) ~ '). Skipping staging/write' ] }}"
# ---------------------------- DEV2 version firmux primary check ----------------------------
- name: Read DEV2 firmux release
- name: Read DEV2 /usr/lib/release/firmux (if present)
when: dev2_passfile_used != "NONE"
delegate_to: localhost
ansible.builtin.shell: |
@@ -464,14 +464,14 @@
changed_when: false
ignore_errors: true
- name: Debug firmux content DEV2
- name: Debug: DEV2 firmux banner (if any)
when: dev2_firmux is defined
delegate_to: localhost
ansible.builtin.debug:
msg: "DEV2 firmux={{ (dev2_firmux.stdout | default('')) | trim }}"
# ---------------------------- Normalize rebootin early (HOURS) ----------------------------
- name: "Normalize rebootin (phase 1: raw/is_now/is_int/HOURS)"
- name: Normalize 'rebootin' (detect 'now' or integer HOURS)
delegate_to: localhost
ansible.builtin.set_fact:
_reboot_raw: "{{ rebootin | default('') | string | trim | lower }}"
@@ -483,15 +483,10 @@
else (rebootin | int if ((rebootin | default('') | string | trim) is match('^\\d+$') ) else -1)
}}
- name: "Normalize rebootin (phase 2: requested flag)"
- name: Compute reboot flags (requested? seconds? minutes?)
delegate_to: localhost
ansible.builtin.set_fact:
_reboot_requested: "{{ _reboot_is_now or _reboot_is_int }}"
# Compute effective seconds from HOURS (0h → ~20 seconds grace); clamp non-negative
- name: "Normalize rebootin (phase 3: compute seconds from HOURS)"
delegate_to: localhost
ansible.builtin.set_fact:
_reboot_seconds: >-
{{
20
@@ -501,28 +496,31 @@
if (_reboot_requested | default(false))
else 0
}}
# Derive minutes from seconds (non-negative), for tasks/summary that expect minutes
- name: "Normalize rebootin (phase 4: derive minutes)"
delegate_to: localhost
ansible.builtin.set_fact:
_reboot_minutes: "{{ ((_reboot_seconds | int) // 60) if (_reboot_seconds | int) > 0 else 0 }}"
# ---------------------------- Journal: indoor start (after we know we can proceed) ----------------------------
- name: Build control queue payload for indoor start journal
- name: Debug: reboot plan summary
delegate_to: localhost
ansible.builtin.debug:
msg:
- "reboot_requested={{ _reboot_requested | default(false) }}"
- "reboot_seconds={{ _reboot_seconds | default(0) }}"
- "reboot_minutes={{ _reboot_minutes | default(0) }}"
# ---------------------------- Journal: indoor start (we can proceed) ----------------------------
- name: Build control queue payload for 'indoor start' journal
ansible.builtin.set_fact:
journal_indoor_start:
inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
task_name: "journal_add"
task_result: >-
Indoor: Dev2 is reachable, starting with update.
Indoor: Dev2 is reachable, starting update.
image={{ image_filename }}, md5={{ image_md5 }},
firmux={{ (dev2_firmux.stdout | default('unknown')) | trim }},
reboot={{ 'in ' ~ (_reboot_seconds | int) ~ ' seconds' if (_reboot_is_now and (_reboot_minutes | int) == 0) else (rebootin | default('') | trim) }}
when: dev2_passfile_used != "NONE"
delegate_to: localhost
- name: Publish indoor start journal to control queue
- name: Publish 'indoor start' journal to control queue
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
@@ -548,20 +546,20 @@
when: journal_indoor_start is defined
delegate_to: localhost
# ---------------------------- Stage image on DEV2 no write ----------------------------
- name: Check local presence of image file
# ---------------------------- Stage image on DEV2 (no write yet) ----------------------------
- name: Check local presence of image file on controller
delegate_to: localhost
ansible.builtin.stat:
path: "{{ image_filename }}"
register: local_img
- name: Soft-block if image missing locally
- name: Soft-block if local image is missing
when: not local_img.stat.exists
ansible.builtin.set_fact:
_blocked: true
_journal: "{{ _journal + [ 'Local image missing on controller: ' ~ image_filename ] }}"
- name: Compute local md5 of the image
- name: Compute local md5 of the image (controller)
when: local_img.stat.exists
delegate_to: localhost
ansible.builtin.shell: |
@@ -590,7 +588,7 @@
changed_when: false
ignore_errors: true
- name: Soft-block if local sha256 mismatch or unavailable
- name: Soft-block if local sha256 mismatch/unavailable
when: local_img.stat.exists and (image_sha256 | default('') | length) > 0 and (local_sha256 is not defined or (local_sha256.stdout | trim) != (image_sha256 | trim))
ansible.builtin.set_fact:
_prep_blocked: true
@@ -598,7 +596,7 @@
_journal: "{{ _journal + [ 'Local sha256 mismatch/unavailable: have=' ~ ((local_sha256.stdout | default('NA')) | trim) ~ ' expected=' ~ (image_sha256 | trim) ] }}"
# fw_printenv health before upload (soft-fail)
- name: Read fw_printenv size (line count) on DEV2
- name: Read fw_printenv size (line count) on DEV2 (soft health)
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.shell: |
@@ -616,14 +614,14 @@
changed_when: false
ignore_errors: true
- name: Soft-block if fw_printenv too small
- name: Soft-block if fw_printenv too small (<30 lines)
when: dev2_fwenv_wc is defined and (dev2_fwenv_wc.stdout is defined) and ((dev2_fwenv_wc.stdout | trim | int) < 30)
ansible.builtin.set_fact:
_prep_blocked: true
_blocked: true
_journal: "{{ _journal + [ 'fw_printenv too small on DEV2: ' ~ (dev2_fwenv_wc.stdout | trim) ~ ' lines (<30). Skipping image staging' ] }}"
- name: Check existing image md5 on DEV2 NOFILE if absent
- name: Check existing DEV2 image md5 (NOFILE if missing)
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.shell: |
@@ -640,7 +638,7 @@
register: dev2_md5_before
changed_when: false
- name: Copy image to DEV2 via tunnel only if missing or md5 mismatch
- name: Copy image to DEV2 if missing or md5 mismatch
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false)) and ((dev2_md5_before.stdout | trim) != image_md5)
delegate_to: localhost
ansible.builtin.shell: |
@@ -655,7 +653,7 @@
register: scp_push
changed_when: true
- name: Compute md5 of image on DEV2 after copy or if exists
- name: Compute md5 of image on DEV2 after copy (or if already present)
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.shell: |
@@ -672,7 +670,7 @@
register: dev2_md5_after
changed_when: false
- name: Verify DEV2 md5 matches expected (soft-fail journal)
- name: Soft-block if DEV2 md5 != expected
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false)) and ((dev2_md5_after.stdout | trim) != image_md5)
ansible.builtin.set_fact:
_prep_blocked: true
@@ -705,7 +703,7 @@
_blocked: true
_journal: "{{ _journal + [ 'Remote sha256 mismatch/unavailable on DEV2: have=' ~ ((dev2_sha256_after.stdout | default('NA')) | trim) ~ ' expected=' ~ (image_sha256 | trim) ] }}"
- name: Run noninvasive update check on DEV2 update c
- name: Pre-validate image on DEV2 with 'update -c' (non-invasive)
when: local_img.stat.exists and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.shell: |
@@ -723,13 +721,13 @@
register: dev2_update_check
changed_when: false
- name: Debug update c output DEV2
- name: Debug: output from 'update -c'
when: dev2_update_check is defined
delegate_to: localhost
ansible.builtin.debug:
msg: "{{ (dev2_update_check.stdout | default('')) | trim }}"
- name: Soft-block if update -c did not say valid
- name: Soft-block if 'update -c' did not return 'valid'
when: dev2_update_check is defined and not ((dev2_update_check.stdout | default('') | lower) is search('valid'))
ansible.builtin.set_fact:
_prep_blocked: true
@@ -737,7 +735,7 @@
_journal: "{{ _journal + [ 'update -c did not return valid on DEV2; output=' ~ ((dev2_update_check.stdout | default('')) | trim) ] }}"
# ---------------------------- Journal: indoor aborted (if any blockers) ----------------------------
- name: Build control queue payload for indoor aborted journal
- name: Build control queue payload for 'indoor aborted' journal
ansible.builtin.set_fact:
journal_indoor_aborted:
inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
@@ -747,7 +745,7 @@
when: (_blocked | default(false))
delegate_to: localhost
- name: Publish indoor aborted journal to control queue
- name: Publish 'indoor aborted' journal to control queue
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
@@ -774,10 +772,10 @@
delegate_to: localhost
# ============================ ACTUAL UPGRADE WRITE + BANK FLIP (only if not blocked) ============================
- name: Upgrade write and flip block
- name: Upgrade write and bank flip on DEV2 (guarded by soft-block)
when: not (_blocked | default(false))
block:
- name: Write image on DEV2 (this will take a while)
- name: Write image to inactive bank on DEV2 (update -w)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -795,7 +793,7 @@
changed_when: true
failed_when: dev2_up_write.stdout is not search('update is complete')
- name: Read current active partition on DEV2
- name: Read current active partition on DEV2 (before flip)
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -813,12 +811,12 @@
changed_when: false
failed_when: (dev2_active_before.stdout | trim) not in ['1','2']
- name: Determine new active value for DEV2
- name: Determine new active value for DEV2 (flip 1↔2)
when: dev2_active_before is defined and (dev2_active_before.stdout is defined) and ((dev2_active_before.stdout | trim) in ['1','2'])
ansible.builtin.set_fact:
dev2_new_active: "{{ '1' if (dev2_active_before.stdout | trim) == '2' else '2' }}"
- name: Switch active partition to {{ dev2_new_active }}
- name: Set fw_setenv active={{ dev2_new_active }} on DEV2
when: dev2_new_active is defined
delegate_to: localhost
ansible.builtin.shell: |
@@ -836,7 +834,7 @@
register: dev2_setenv_out
changed_when: true
- name: Verify active partition flipped on DEV2
- name: Verify active partition flipped on DEV2 (read back)
when: dev2_new_active is defined
delegate_to: localhost
ansible.builtin.shell: |
@@ -855,7 +853,7 @@
changed_when: false
failed_when: (dev2_active_after.stdout | trim) != (dev2_new_active | string)
- name: Create specific prep marker on DEV2 (no generic)
- name: Create specific prep marker on DEV2 for this image
delegate_to: localhost
ansible.builtin.shell: |
set -e
@@ -874,7 +872,7 @@
ignore_errors: true
# ---------------------------- Reboot scheduling (normalized) ----------------------------
- name: Schedule delayed reboot on DEV2 minutes
- name: Schedule DEV2 reboot after computed delay (seconds)
when: _reboot_requested and (_reboot_minutes | int) >= 0 and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.shell: |
@@ -894,7 +892,7 @@
changed_when: true
ignore_errors: true
- name: Build control queue payload for indoor-restart-scheduled tag
- name: Build 'indoor-restart-scheduled' tag payload
ansible.builtin.set_fact:
tag_restart_sched_payload:
inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
@@ -903,7 +901,7 @@
when: _reboot_requested and (_reboot_minutes | int) >= 0 and dev2_passfile_used != "NONE" and not (_blocked | default(false))
delegate_to: localhost
- name: Publish indoor-restart-scheduled tag to control queue via RabbitMQ HTTP API
- name: Publish 'indoor-restart-scheduled' tag to control queue
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
@@ -929,19 +927,28 @@
when: tag_restart_sched_payload is defined
delegate_to: localhost
- name: Note reboot request bad format
- name: Note: reboot was requested but value is invalid (format warning)
when: (rebootin | default('') | string | trim | length) > 0 and not _reboot_requested
ansible.builtin.debug:
msg: "Reboot requested but value '{{ rebootin | string | trim }}' is invalid; not applied"
# ---------------------------- Journal: indoor updated and reboot schedule ----------------------------
- name: Build control queue payload for indoor updated journal
- name: Compute write success flag (_write_success)
ansible.builtin.set_fact:
_write_success: "{{ (dev2_up_write.stdout | default('')) is search('update is complete') if (dev2_up_write is defined) else false }}"
when: not (_blocked | default(false))
delegate_to: localhost
- name: Build indoor updated journal payload text
- name: Debug: write result and active banks (quick summary)
when: not (_blocked | default(false))
delegate_to: localhost
ansible.builtin.debug:
msg:
- "write_success={{ _write_success | default(false) }}"
- "active_before={{ (dev2_active_before.stdout | default('NA')) | trim }}"
- "active_after={{ (dev2_active_after.stdout | default('NA')) | trim }}"
- name: Build 'indoor updated' journal payload text
ansible.builtin.set_fact:
journal_indoor_updated:
inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
@@ -958,7 +965,7 @@
when: not (_blocked | default(false)) and (_write_success | bool)
delegate_to: localhost
- name: Publish indoor updated journal to control queue
- name: Publish 'indoor updated' journal to control queue
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
method: POST
@@ -984,9 +991,8 @@
when: journal_indoor_updated is defined
delegate_to: localhost
# ──────────────────────────────── NEW: derive expected version for the checker ────────────────────────────────
# Schedule window (we only send after-upgrade if write succeeded & not blocked)
- name: Init after-upgrade scheduling vars (attempt 1 + delay from reboot + 6m)
# ──────────────────────────────── Derive expected version for the checker (strict) ────────────────────────────────
- name: Init after-upgrade scheduling vars (attempt=1, delay=reboot + 6m)
ansible.builtin.set_fact:
au_attempt: 1
au_max_attempts: 3
@@ -994,15 +1000,14 @@
when: not (_blocked | default(false)) and (_write_success | bool)
delegate_to: localhost
- name: Generate correlation ID and original emitted timestamp
- name: Generate correlation ID and UTC timestamp (for after-upgrade tracking)
ansible.builtin.set_fact:
au_correlation_id: "{{ lookup('pipe', 'date +%s%N | sha1sum | cut -c1-12') }}"
au_original_emitted_at: "{{ lookup('pipe', 'date -u +%FT%TZ') }}"
when: au_delay_sec is defined
delegate_to: localhost
# Strict, single-source expected version: "X.Y.Z-rNNNN" from image_filename
- name: Compute expected firmware core "X.Y.Z-rNNNN" from image filename (strict)
- name: Derive expected target_version from image filename (strict: X.Y.Z-rNNNN)
delegate_to: localhost
ansible.builtin.set_fact:
expected_fw_core: >-
@@ -1012,19 +1017,7 @@
}}
when: au_delay_sec is defined
- name: Ensure expected_fw_core is set (strict parse from filename)
delegate_to: localhost
ansible.builtin.set_fact:
expected_fw_core: >-
{{
expected_fw_core | default(
image_filename
| regex_replace('.*?([0-9]+\\.[0-9]+\\.[0-9]+)-r([0-9]+).*','\\1-r\\2')
)
}}
when: au_delay_sec is defined
- name: Debug derived target version
- name: Debug: derived expected target_version for checker
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -1047,13 +1040,16 @@
when: au_delay_sec is defined
delegate_to: localhost
- name: Debug x-delay about to be sent (ms)
- name: Debug: after-upgrade plan (routing + delay + version)
ansible.builtin.debug:
msg: "x-delay(ms) = {{ (au_delay_sec | int) * 1000 }}"
msg:
- "routing_key={{ afterupgrade_routing_key }}"
- "x-delay(ms)={{ (au_delay_sec | int) * 1000 }}"
- "target_version={{ afterupgrade_payload.target_version | default('NA') }}"
when: afterupgrade_payload is defined
delegate_to: localhost
- name: Publish delayed after-upgrade check to holding exchange
- name: Publish delayed after-upgrade check (headers.x-delay) to holding exchange
ansible.builtin.uri:
url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ 'deviceconfig.delayed' | urlencode }}/publish"
method: POST
@@ -1080,8 +1076,8 @@
when: afterupgrade_payload is defined
delegate_to: localhost
# ---------------------------- summary ----------------------------
- name: Summary show key results
# ---------------------------- Final operator summary (concise) ----------------------------
- name: Summary: key outcomes (one-liners)
delegate_to: localhost
ansible.builtin.debug:
msg:
@@ -1104,28 +1100,28 @@
- "journal={{ (_journal | default([])) | join(' || ') }}"
post_tasks:
- name: Cleanup always
- name: Cleanup (always)
block:
- ansible.builtin.debug:
msg: "entering cleanup block"
msg: "Entering cleanup block"
changed_when: false
delegate_to: localhost
always:
- name: Close tunnel best effort
- name: Close SSH ControlMaster (best-effort)
delegate_to: localhost
ansible.builtin.shell: |
ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
changed_when: false
ignore_errors: true
- name: Remove control dir best effort
- name: Remove tunnel control dir (best-effort)
delegate_to: localhost
ansible.builtin.file:
path: "{{ _ctrl_dir | default('/tmp/none') }}"
state: absent
ignore_errors: true
- name: Remove temporary IP on DEV1 idempotent Cannot assign requested address OK
- name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
ansible.builtin.raw: >
{{ pathprefix }}
ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
@@ -1136,7 +1132,7 @@
and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
and ('Cannot assign requested address' not in (del_ip.stderr | default('')))
- name: Debug del ip results
- name: Debug: temp IP removal result
ansible.builtin.debug:
msg:
- "del_ip.rc={{ del_ip.rc | default('') }}"