mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
kevinveenbirkenbachandClaude Opus 5.5
285ce910d2
The Keycloak stage on echoserver ran ten minutes before sys-svc-dns stopped
it with "API.cloudflare.api_token must be set": the inventory still kept the
token under the flat name CLOUDFLARE_API_TOKEN, which nothing reads any
more. The validator that runs before every deploy now catches that class.
- api.py reports a host that selects DNS_PROVIDER: cloudflare without
API.cloudflare.api_token, with group_vars/all merged under the host_vars
- variables.py reports every top-level key of host_vars and group_vars that
core does not read: not declared in group_vars or a role's defaults or
vars, not tested with "is defined" or "| default(", not read by name in a
plugin, and not a SYSTEM_EMAIL_<KEY> the email lookup builds; a flat
credential name such as CLOUDFLARE_API_TOKEN names its API.<provider>.<key>
path; ansible_* keys are exempt
A key that is read in a way the scan cannot see takes
"# nocheck: inventory-variable", documented in suppression.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
41 lines
1.3 KiB
Python
41 lines
1.3 KiB
Python
"""Public API of the inventory validator.
|
|
|
|
Split by concern (DRY/SPOT/KISS):
|
|
- ``keys``: dotted-path key extraction
|
|
- ``loaders``: YAML parsing + inventory directory scans
|
|
- ``applications``: applications-vs-defaults+variants validation
|
|
- ``users``: user-vs-defaults validation
|
|
- ``hosts``: ``all.children`` host-group validation
|
|
- ``api``: API credential validation
|
|
- ``variables``: top-level inventory variables core never reads
|
|
- ``__main__``: argparse + orchestration
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
PROJECT_ROOT: Path = Path(__file__).resolve().parents[4]
|
|
|
|
from .__main__ import main # noqa: E402
|
|
from .api import validate_api_keys # noqa: E402
|
|
from .applications import compare_application_keys # noqa: E402
|
|
from .hosts import validate_host_keys # noqa: E402
|
|
from .keys import recursive_keys # noqa: E402
|
|
from .loaders import load_inventory_files, load_yaml_file # noqa: E402
|
|
from .users import compare_user_keys # noqa: E402
|
|
from .variables import validate_inventory_variables # noqa: E402
|
|
|
|
__all__ = [
|
|
"PROJECT_ROOT",
|
|
"compare_application_keys",
|
|
"compare_user_keys",
|
|
"load_inventory_files",
|
|
"load_yaml_file",
|
|
"main",
|
|
"recursive_keys",
|
|
"validate_api_keys",
|
|
"validate_host_keys",
|
|
"validate_inventory_variables",
|
|
]
|