define protected envs in common vars, improve lock_unlock_instances

Author: bertiethorpe

ansible/adhoc/lock_unlock_instances.yml

@@ -1,11 +1,11 @@
 ---
 
-- hosts: "{{ target_hosts | default('all') }}"
+- hosts: cluster
   gather_facts: no
   become: no
   tasks:
     - name: Lock/Unlock instances
       openstack.cloud.server_action:
-        action: "{{ server_action | default('lock') }}"
+        action: "{{ appliances_server_action | default('lock') }}"
         server: "{{ inventory_hostname }}"
       delegate_to: localhost

ansible/adhoc/rebuild-via-slurm.yml

@@ -10,9 +10,8 @@
 
 - name: Unlock compute instances for rebuild
   vars:
-    server_action: unlock
-    target_hosts: compute
-  ansible.builtin.import_playbook: lock_unlock_instances.yml
+    appliances_server_action: unlock
+  ansible.builtin.command: ansible-playbook --limit compute adhoc/lock_unlock_instances.yml
 
 - hosts: login
   run_once: true

ansible/safe-env.yml

@@ -2,9 +2,6 @@
 - hosts: localhost
   gather_facts: no
   become: no
-  vars:
-    protected_environments:
-      - prd
   tasks:
     - name: Confirm continuing if using production environment
       ansible.builtin.pause:
@@ -17,6 +14,6 @@
           Do you really want to continue (yes/no)?
       register: env_confirm_safe
       when:
-        - appliances_environment_name in protected_environments
-        - not (prd_continue | default(false) | bool)
+        - appliances_environment_name in appliances_protected_environments
+        - not (appliances_protected_environment_autoapprove | default(false) | bool)
       failed_when: not (env_confirm_safe.user_input | bool)

ansible/site.yml

@@ -2,11 +2,8 @@
 
 - ansible.builtin.import_playbook: safe-env.yml
 
-- name: Lock all instances
-  vars:
-    server_action: lock
-    target_hosts: all
-  ansible.builtin.import_playbook: adhoc/lock_unlock_instances.yml
+- name: Lock cluster instances
+  ansible.builtin.command: ansible-playbook adhoc/lock_unlock_instances.yml
 
 - name: Run pre.yml hook
   vars:

environments/common/inventory/group_vars/all/defaults.yml

@@ -4,6 +4,8 @@ ansible_user: rocky
 appliances_repository_root: "{{ lookup('env', 'APPLIANCES_REPO_ROOT') }}"
 appliances_environment_root: "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}"
 appliances_environment_name: "{{ appliances_environment_root | basename | regex_replace('\\W+', '') }}" # [a-zA-Z0-9_] only
+appliances_protected_environments:
+  - prd
 appliances_cockpit_state: absent # RHEL cockpit installed but not enabled in genericcloud images; appliance defaults to removing it
 # appliances_state_dir: # define an absolute path here to use for persistent state: NB: This is defined as /var/lib/state in inventory by the default Terraform
 appliances_mode: configure