mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
cd1225d2d9
The repo's async convention is fire and forget: ASYNC_POLL is 0 whenever ASYNC_ENABLED is true, and the swarm test lane forces it true through extra vars. A task dispatched that way returns a stub, so a changed_when or failed_when reading its own register evaluates against nothing and can never report changed and never fail. Several tasks carried a "not ASYNC_ENABLED and" prefix in front of those conditions, added to avoid touching undefined rc and stdout, which turned the guard off entirely rather than adapting it. That is how the nextcloud plugin configuration stayed broken unseen: the batch reported ok after 0.8s while its delegated commands kept running, the next task read the half written configuration, and no failure in any of them could surface. Every async in the repo was decided individually rather than swept. Where nothing consumes the result, the async stays and a one line rationale now records what does not read it. Where a later task, a handler or a browser does consume it, either the async goes or the result is collected. Collecting is what the new reaper does. It waits for a whole batch, then reports every broken job at once instead of aborting on the first, so one run shows whether a single item or the whole set is broken. Deciding what counts as broken lives in a filter plugin, because the distinction is subtle enough to deserve tests: a module reports failure in msg, a command in rc and stdout, an idempotent API answers "already exists" and means success, and a job that cannot be read at all comes back marked finished with no outcome, which would otherwise read as green. Timing cost is roughly one to two minutes on a deploy measured in hours. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
---
|
|
- name: "🔄 Update Client settings"
|
|
vars:
|
|
kc_object_kind: "client"
|
|
kc_lookup_value: "{{ KEYCLOAK_CLIENT_ID }}"
|
|
kc_desired: >-
|
|
{{
|
|
KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId','equalto', KEYCLOAK_CLIENT_ID)
|
|
| list | first
|
|
}}
|
|
kc_force_attrs:
|
|
publicClient: >-
|
|
{{
|
|
(KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId','equalto', KEYCLOAK_CLIENT_ID)
|
|
| map(attribute='publicClient')
|
|
| first)
|
|
}}
|
|
serviceAccountsEnabled: >-
|
|
{{
|
|
(KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId','equalto', KEYCLOAK_CLIENT_ID)
|
|
| map(attribute='serviceAccountsEnabled')
|
|
| first )
|
|
}}
|
|
frontchannelLogout: >-
|
|
{{
|
|
(KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId','equalto', KEYCLOAK_CLIENT_ID)
|
|
| map(attribute='frontchannelLogout')
|
|
| first)
|
|
}}
|
|
attributes: >-
|
|
{{
|
|
( (KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId','equalto', KEYCLOAK_CLIENT_ID)
|
|
| list | first | default({}) ).attributes | default({}) )
|
|
| combine({'frontchannel.logout.url': KEYCLOAK_FRONTCHANNEL_LOGOUT_URL}, recursive=True)
|
|
}}
|
|
keycloak_kcadm_update:
|
|
object_kind: "{{ kc_object_kind }}"
|
|
lookup_value: "{{ kc_lookup_value }}"
|
|
desired: "{{ kc_desired }}"
|
|
force_attrs: "{{ kc_force_attrs }}"
|
|
kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
|
|
realm: "{{ KEYCLOAK_REALM }}"
|
|
assert_mode: "{{ MODE_ASSERT }}"
|
|
cid_resolve_cmd: "{{ KEYCLOAK_CID_RESOLVE_CMD if DEPLOYMENT_MODE == 'swarm' else omit }}"
|
|
current_cid: "{{ KEYCLOAK_LOCAL_CID if DEPLOYMENT_MODE == 'swarm' else omit }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
register: kc_client_update
|
|
changed_when: false
|
|
# rationale: async; reaped in update_routines.yml before 04_rbac reads the client back
|
|
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
|
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|