4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
32 lines
1,020 B
YAML
32 lines
1,020 B
YAML
---
|
|
# Fetch the last on-host Goss timer result. Does not run a new check.
|
|
# Usage: ansible-playbook ansible/playbooks/goss-status.yaml
|
|
# make goss-status
|
|
|
|
- hosts: all
|
|
become: true
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Read last Goss timer status
|
|
ansible.builtin.slurp:
|
|
src: /var/lib/railiance/goss/last.status
|
|
register: goss_status
|
|
failed_when: false
|
|
|
|
- name: Show last Goss timer status
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
{{ inventory_hostname }}:
|
|
{{ goss_status.content | default('') | b64decode | trim
|
|
if goss_status.content is defined
|
|
else 'no timer result yet' }}
|
|
|
|
- name: Fail when the last on-host check reported FAILED
|
|
ansible.builtin.stat:
|
|
path: /var/lib/railiance/goss/FAILED
|
|
register: goss_failed
|
|
|
|
- name: Report failed hosts
|
|
ansible.builtin.fail:
|
|
msg: "Goss baseline last run failed on {{ inventory_hostname }}"
|
|
when: goss_failed.stat.exists | default(false)
|