test-connection: accept Infisical creds via env OR ansible var + add diagnostic
This commit is contained in:
parent
831d6c0a17
commit
261edceb8c
@ -1,79 +1,72 @@
|
||||
---
|
||||
# ============================================================================
|
||||
# test-connection.yml — diagnostic playbook (makes NO changes to any host)
|
||||
# ============================================================================
|
||||
# Confirms the Semaphore pipeline works end to end:
|
||||
# 1. Repo pulled OK over SSH -> list files in the checked-out repo
|
||||
# 2. Infisical reachable + auth works -> login + read secret KEYS (not values)
|
||||
#
|
||||
# Runs entirely on the Semaphore runner (localhost). No target hosts touched.
|
||||
#
|
||||
# Requires (Semaphore Variable Group 'infisical-dev' as env vars):
|
||||
# INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID
|
||||
# INFISICAL_URL (default http://192.168.122.41:8080), INFISICAL_ENV_SLUG (default dev)
|
||||
#
|
||||
# Usage: Task Template -> playbook playbooks/test-connection.yml, env infisical-dev
|
||||
# test-connection.yml — diagnostic (no host changes). Confirms repo pull +
|
||||
# Infisical auth. Reads Infisical creds from EITHER env vars OR ansible vars,
|
||||
# so it works regardless of which Semaphore Variable-Group section they're in.
|
||||
# ============================================================================
|
||||
|
||||
- name: "Semaphore diagnostics — repo + Infisical"
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
vars:
|
||||
infisical_url: "{{ lookup('env','INFISICAL_URL') | default('http://192.168.122.41:8080', true) }}"
|
||||
infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('dev', true) }}"
|
||||
# Accept creds from env var OR extra/ansible var (whichever Semaphore provides)
|
||||
infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(INFISICAL_CLIENT_ID | default(''), true) }}"
|
||||
infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(INFISICAL_CLIENT_SECRET | default(''), true) }}"
|
||||
infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(INFISICAL_PROJECT_ID | default(''), true) }}"
|
||||
infisical_url: "{{ lookup('env','INFISICAL_URL') | default(INFISICAL_URL | default('http://192.168.122.41:8080'), true) }}"
|
||||
infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(INFISICAL_ENV_SLUG | default('dev'), true) }}"
|
||||
|
||||
tasks:
|
||||
# ---------- 1. REPO CHECK (proves SSH clone worked) ----------
|
||||
- name: "[repo] Where is the checked-out repo?"
|
||||
ansible.builtin.set_fact:
|
||||
repo_dir: "{{ playbook_dir | dirname }}"
|
||||
|
||||
- name: "[repo] List files in the repository"
|
||||
- name: "[repo] Locate + list repo files"
|
||||
ansible.builtin.find:
|
||||
paths: "{{ repo_dir }}"
|
||||
recurse: true
|
||||
paths: "{{ playbook_dir | dirname }}"
|
||||
excludes: ".git"
|
||||
recurse: false
|
||||
register: repo_files
|
||||
|
||||
- name: "[repo] Repo contents"
|
||||
- name: "[repo] Repo pulled OK"
|
||||
ansible.builtin.debug:
|
||||
msg: >-
|
||||
Repo pulled OK at {{ repo_dir }} —
|
||||
{{ repo_files.files | map(attribute='path') | map('regex_replace', '^'+repo_dir+'/', '') | list }}
|
||||
msg: "Repo at {{ playbook_dir | dirname }} — files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
|
||||
|
||||
# ---------- 2. INFISICAL CHECK (proves auth + read works) ----------
|
||||
- name: "[infisical] Auth vars present?"
|
||||
# DIAGNOSTIC: show what channels actually carried the value (lengths only, no secrets)
|
||||
- name: "[diag] Which channel carried INFISICAL_CLIENT_ID?"
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
|
||||
- "ansible var defined: {{ INFISICAL_CLIENT_ID is defined }}"
|
||||
- "resolved id length: {{ infisical_client_id | length }}"
|
||||
|
||||
- name: "[infisical] Auth vars present (via env or var)?"
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- lookup('env','INFISICAL_CLIENT_ID') | length > 0
|
||||
- lookup('env','INFISICAL_CLIENT_SECRET') | length > 0
|
||||
- lookup('env','INFISICAL_PROJECT_ID') | length > 0
|
||||
fail_msg: "Missing INFISICAL_CLIENT_ID / _SECRET / _PROJECT_ID (set them in the Variable Group)."
|
||||
success_msg: "Infisical auth vars present."
|
||||
- infisical_client_id | length > 0
|
||||
- infisical_client_secret | length > 0
|
||||
- infisical_project_id | length > 0
|
||||
fail_msg: >-
|
||||
Infisical creds not reaching the playbook via EITHER env vars or ansible vars.
|
||||
Check the Variable Group values are non-empty and the group is attached.
|
||||
|
||||
- name: "[infisical] Log in (universal auth)"
|
||||
- name: "[infisical] Log in"
|
||||
infisical.vault.login:
|
||||
url: "{{ infisical_url }}"
|
||||
auth_method: universal_auth
|
||||
universal_auth_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
|
||||
universal_auth_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
|
||||
universal_auth_client_id: "{{ infisical_client_id }}"
|
||||
universal_auth_client_secret: "{{ infisical_client_secret }}"
|
||||
register: infisical_login
|
||||
|
||||
- name: "[infisical] Read secrets from project/env"
|
||||
- name: "[infisical] Read secrets"
|
||||
infisical.vault.read_secrets:
|
||||
login_data: "{{ infisical_login.login_data }}"
|
||||
project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
|
||||
project_id: "{{ infisical_project_id }}"
|
||||
env_slug: "{{ infisical_env_slug }}"
|
||||
path: "/"
|
||||
as_dict: true
|
||||
register: infisical_secrets
|
||||
|
||||
- name: "[infisical] Show which secret KEYS are visible (values hidden)"
|
||||
- name: "[infisical] Secret keys visible (values hidden)"
|
||||
ansible.builtin.debug:
|
||||
msg: >-
|
||||
Infisical OK ({{ infisical_url }}, env={{ infisical_env_slug }}) —
|
||||
secret keys available: {{ infisical_secrets.secrets.keys() | list }}
|
||||
msg: "Infisical OK (env={{ infisical_env_slug }}) — keys: {{ infisical_secrets.secrets.keys() | list }}"
|
||||
|
||||
- name: "[result] ALL CHECKS PASSED"
|
||||
ansible.builtin.debug:
|
||||
msg: "SSH repo pull ✓ | Infisical auth + read ✓ — pipeline is ready."
|
||||
msg: "SSH repo pull ✓ | Infisical auth + read ✓ — pipeline ready."
|
||||
|
||||
Loading…
Reference in New Issue
Block a user