feat(ansible): Add addon support (#836)

template/tasks/ansible/main.yaml

@@ -1,15 +1,8 @@
 ---
-- name: Get absolute path to this Git repository # noqa: command-instead-of-module
-  ansible.builtin.command: git rev-parse --show-toplevel
-  changed_when: false
-  check_mode: false
-  register: repository_path
-  failed_when: repository_path.rc != 0
-
 - name: Template Ansible configuration
   ansible.builtin.template:
     src: "{{ item.src }}"
-    dest: "{{ repository_path.stdout }}/{{ item.dest }}"
+    dest: "{{ repository_path }}/{{ item.dest }}"
     mode: "0755"
   loop:
     - src: templates/ansible/supplemental.yaml.j2
@@ -18,34 +11,43 @@
       dest: ./ansible/inventory/hosts.yaml
 
 # https://github.com/ansible-collections/community.sops/issues/153
-- name: Backup sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml"
-    dest: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    mode: "0755"
-- name: Remove sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml"
-    state: absent
-
-- name: Template out node secrets
-  community.sops.sops_encrypt:
-    path: "{{ repository_path.stdout }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
-    age: ["{{ bootstrap_age_public_key }}"]
-    content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
-    mode: "0755"
-    force: true
-  loop: "{{ bootstrap_hosts.master + bootstrap_hosts.worker | default([]) }}"
-  loop_control:
-    label: "{{ item.address }}"
-
-# https://github.com/ansible-collections/community.sops/issues/153
-- name: Restore sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    dest: "{{ repository_path.stdout }}/.sops.yaml"
-    mode: "0755"
-- name: Remove backup sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path.stdout }}/.sops.yaml.orig"
-    state: absent
+- name: Template Ansible encrypted files
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted node secrets
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/ansible/inventory/host_vars/{{ item.name }}.sops.yaml"
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', 'templates/ansible/node.sops.yaml.j2', template_vars=dict(password=item.password)) | from_yaml }}"
+        mode: "0755"
+        force: true
+      loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
+      loop_control:
+        label: "{{ item.address }}"
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent