mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
30 lines
1.3 KiB
YAML
30 lines
1.3 KiB
YAML
---
|
|
# Realm import only runs for a MISSING realm; this kcadm create-or-update brings
|
|
# application-declared clients to existing realms too. Desired state is the
|
|
# import's own client object, so the realm template stays the one SPOT.
|
|
- name: "✅ Ensure the '{{ kc_declared_client_id }}' client"
|
|
vars:
|
|
kc_desired: >-
|
|
{{
|
|
KEYCLOAK_DICTIONARY_REALM.clients
|
|
| selectattr('clientId', 'equalto', kc_declared_client_id)
|
|
| list | first
|
|
}}
|
|
keycloak_kcadm_update:
|
|
object_kind: "client"
|
|
lookup_value: "{{ kc_declared_client_id }}"
|
|
desired: "{{ kc_desired }}"
|
|
kcadm_exec: "{{ KEYCLOAK_EXEC_KCADM }}"
|
|
realm: "{{ KEYCLOAK_REALM }}"
|
|
assert_mode: "{{ MODE_ASSERT }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
register: kc_declared_client
|
|
# rationale: async; nothing reads the client back in this chain, reaped at the end of update_routines.yml
|
|
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
|
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|
|
|
|
# rationale: looped include — each iteration overwrites the register, so the job handle is banked here for the reap.
|
|
- name: "🧾 Queue the '{{ kc_declared_client_id }}' client job for the reap"
|
|
ansible.builtin.set_fact:
|
|
kc_declared_client_jobs: "{{ (kc_declared_client_jobs | default([])) + [kc_declared_client] }}"
|