70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
---
|
|
- name: Render DAG .yaml.j2 templates safely
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
|
|
vars:
|
|
# Hardcoded fallback for DAGs path
|
|
dags_path: "{{ playbook_dir ~ '/../app-configs/rinoa/dagu/dags' }}"
|
|
vault_addr: "{{ lookup('env', 'VAULT_ADDR') }}"
|
|
vault_token: "{{ lookup('env', 'VAULT_TOKEN') }}"
|
|
|
|
tasks:
|
|
- name: Build list of DAG template files
|
|
ansible.builtin.set_fact:
|
|
dag_templates: >-
|
|
{{
|
|
lookup('ansible.builtin.fileglob', dags_path ~ '/*.yaml.j2', wantlist=True)
|
|
| default([])
|
|
}}
|
|
|
|
- name: Pre-check Vault secrets in templates
|
|
when: dag_templates | length > 0
|
|
block:
|
|
- name: Read each DAG template safely
|
|
ansible.builtin.slurp:
|
|
src: "{{ item }}"
|
|
loop: "{{ dag_templates }}"
|
|
register: slurped_templates
|
|
|
|
- name: Extract Vault keys from DAG templates
|
|
ansible.builtin.set_fact:
|
|
vault_keys: >-
|
|
{{
|
|
slurped_templates.results
|
|
| map(attribute='content')
|
|
| map('b64decode')
|
|
| map('regex_findall',
|
|
"lookup\\('community.hashi_vault.vault_kv2_get',\\s*'[^']+',\\s*engine_mount_point='[^']+',\\s*url=[^,]+,\\s*token=[^\\)]+\\)\\['secret'\\]\\['([^']+)'\\]")
|
|
| sum(start=[])
|
|
}}
|
|
|
|
- name: Warn if any Vault keys might be missing
|
|
loop: "{{ vault_keys }}"
|
|
ansible.builtin.debug:
|
|
msg: "Vault key '{{ item }}' will be required by templates"
|
|
|
|
|
|
- name: Warn if any Vault keys might be missing
|
|
loop: "{{ vault_keys }}"
|
|
ansible.builtin.debug:
|
|
msg: "Vault key '{{ item }}' will be required by templates"
|
|
|
|
- name: Render DAG templates in-place (guarded)
|
|
when: dag_templates | length > 0
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "{{ item | regex_replace('\\.j2$', '') }}"
|
|
mode: '0644'
|
|
loop: "{{ dag_templates }}"
|
|
vars:
|
|
ansible_jinja2_native: true
|
|
ignore_errors: false
|
|
|
|
- name: Log rendered files
|
|
when: dag_templates | length > 0
|
|
loop: "{{ dag_templates }}"
|
|
ansible.builtin.debug:
|
|
msg: "Rendered {{ item }} -> {{ item | regex_replace('\\.j2$', '') }}"
|