home-cluster/bootstrap/tasks/validation/net.yaml

---
- name: Check if master node count is odd
  ansible.builtin.assert:
    that:
      - bootstrap_nodes.master | length > 0
      - bootstrap_nodes.master | length is odd
    success_msg: Master node count {{ bootstrap_nodes.master | length }} is correct.
    fail_msg: Master node count {{ bootstrap_nodes.master | length }} is not greater than 0 or is not odd.

- name: Check if node CIDR is ipv4
  ansible.builtin.assert:
    that: bootstrap_node_cidr is ansible.utils.ipv4
    success_msg: Node CIDR {{ bootstrap_node_cidr }} is valid.
    fail_msg: Node CIDR {{ bootstrap_node_cidr }} is invalid.

- name: Check if cluster CIDR is ipv4 OR ipv6
  when: not bootstrap_ipv6_enabled | default(false)
  ansible.builtin.assert:
    that: bootstrap_cluster_cidr is ansible.utils.ipv4 or bootstrap_cluster_cidr is ansible.utils.ipv6
    success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
    fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.

- name: Check if service CIDR is ipv4 OR ipv6
  when: not bootstrap_ipv6_enabled | default(false)
  ansible.builtin.assert:
    that: bootstrap_service_cidr is ansible.utils.ipv4 or bootstrap_service_cidr is ansible.utils.ipv6
    success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
    fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.

- name: Check if cluster CIDR is ipv4 AND ipv6
  when: bootstrap_ipv6_enabled | default(false)
  ansible.builtin.assert:
    that: >
      (
        bootstrap_cluster_cidr.split(',')[0] is ansible.utils.ipv4 or
          bootstrap_cluster_cidr.split(',')[1] is ansible.utils.ipv4
      ) and (
        bootstrap_cluster_cidr.split(',')[1] is ansible.utils.ipv6 or
          bootstrap_cluster_cidr.split(',')[0] is ansible.utils.ipv6
      )
    success_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is valid.
    fail_msg: Cluster CIDR {{ bootstrap_cluster_cidr }} is invalid.

- name: Check if service CIDR is ipv4 AND ipv6
  when: bootstrap_ipv6_enabled | default(false)
  ansible.builtin.assert:
    that: >
      (
        bootstrap_service_cidr.split(',')[0] is ansible.utils.ipv4 or
          bootstrap_service_cidr.split(',')[1] is ansible.utils.ipv4
      ) and (
        bootstrap_service_cidr.split(',')[1] is ansible.utils.ipv6 or
          bootstrap_service_cidr.split(',')[0] is ansible.utils.ipv6
      )
    success_msg: Service CIDR {{ bootstrap_service_cidr }} is valid.
    fail_msg: Service CIDR {{ bootstrap_service_cidr }} is invalid.

- name: Check if k8s_gateway is ipv4
  ansible.builtin.assert:
    that: bootstrap_k8s_gateway_addr is ansible.utils.ipv4
    success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is valid.
    fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is invalid.

- name: Check if k8s_gateway is in node CIDR
  ansible.builtin.assert:
    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_k8s_gateway_addr)
    success_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is within {{ bootstrap_node_cidr }}.
    fail_msg: k8s_gateway address {{ bootstrap_k8s_gateway_addr }} is not within {{ bootstrap_node_cidr }}.

- name: Check if internal ingress is ipv4
  ansible.builtin.assert:
    that: bootstrap_internal_ingress_addr is ansible.utils.ipv4
    success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is valid.
    fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is invalid.

- name: Check if internal ingress is in node CIDR
  ansible.builtin.assert:
    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_internal_ingress_addr)
    success_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is within {{ bootstrap_node_cidr }}.
    fail_msg: internal ingress address {{ bootstrap_internal_ingress_addr }} is not within {{ bootstrap_node_cidr }}.

- name: Check if external ingress is ipv4
  ansible.builtin.assert:
    that: bootstrap_external_ingress_addr is ansible.utils.ipv4
    success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is valid.
    fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is invalid.

- name: Check external ingress is in node CIDR
  ansible.builtin.assert:
    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_external_ingress_addr)
    success_msg: external ingress address {{ bootstrap_external_ingress_addr }} is within {{ bootstrap_node_cidr }}.
    fail_msg: external ingress address {{ bootstrap_external_ingress_addr }} is not within {{ bootstrap_node_cidr }}.

- name: Check if Kube API address is ipv4
  ansible.builtin.assert:
    that: bootstrap_kube_api_addr is ansible.utils.ipv4
    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is valid.
    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is invalid.

- name: Check if Kube API address is in node CIDR
  ansible.builtin.assert:
    that: bootstrap_node_cidr | ansible.utils.network_in_usable(bootstrap_kube_api_addr)
    success_msg: Kube API address {{ bootstrap_kube_api_addr }} is within {{ bootstrap_node_cidr }}.
    fail_msg: Kube API address {{ bootstrap_kube_api_addr }} is not within {{ bootstrap_node_cidr }}.

- name: Check if DNS server is ipv4
  ansible.builtin.assert:
    that: bootstrap_dns_server is ansible.utils.ipv4
    success_msg: DNS server {{ bootstrap_dns_server }} is valid.
    fail_msg: DNS server {{ bootstrap_dns_server }} is invalid.

- name: Check if all IP addresses are unique
  ansible.builtin.assert:
    that: >
      [
        bootstrap_k8s_gateway_addr,
        bootstrap_external_ingress_addr,
        bootstrap_internal_ingress_addr,
        bootstrap_kube_api_addr
      ] | unique | length == 4
    success_msg: All IP addresses are unique.
    fail_msg: All IP addresses are not unique.

- name: Check if nodes are not the same IPs as k8s_gateway or ingress external/internal
  when: not bootstrap_kube_vip_enabled | default(true)
  ansible.builtin.assert:
    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr)
    success_msg: Node address {{ item.address }} is different than k8s_gateway or ingress-nginx.
    fail_msg: Node address {{ item.address }} is not different than k8s_gateway or ingress-nginx.
    quiet: true
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"

- name: Check if nodes are not the same IPs as k8s_gateway, ingress external/internal or Kube API address
  when: (bootstrap_distribution == "k3s") and (bootstrap_kube_vip_enabled | default(true))
  ansible.builtin.assert:
    that: item.address not in (bootstrap_k8s_gateway_addr, bootstrap_external_ingress_addr, bootstrap_internal_ingress_addr, bootstrap_kube_api_addr)
    success_msg: Node address {{ item.address }} is different than k8s_gateway, ingress-nginx or Kube API.
    fail_msg: Node address {{ item.address }} is not different than k8s_gateway, ingress-nginx or Kube API.
    quiet: true
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"

- name: Check if node addresses are ipv4
  ansible.builtin.assert:
    that: item.address is ansible.utils.ipv4
    success_msg: Node address {{ item.address }} is valid.
    fail_msg: Node address {{ item.address }} is invalid.
    quiet: true
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"

- name: Check if node addresses are in node CIDR
  ansible.builtin.assert:
    that: bootstrap_node_cidr | ansible.utils.network_in_usable(item.address)
    success_msg: Node address {{ item.address }} is within {{ bootstrap_node_cidr }}.
    fail_msg: Node address {{ item.address }} is not within {{ bootstrap_node_cidr }}.
    quiet: true
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"

- name: Check if node IP addresses are unique
  ansible.builtin.assert:
    that: >
      (
        (bootstrap_nodes.master + bootstrap_nodes.worker | default([])) | map(attribute='address') | list
      ) | unique | length
      ==
      (
        (bootstrap_nodes.master + bootstrap_nodes.worker | default([])) | map(attribute='address') | list
      ) | length
    success_msg: All node IP addresses are unique.
    fail_msg: All node IP addresses are not unique.
    quiet: true

- name: Check if node names are unique
  ansible.builtin.assert:
    that: >
      (
        (bootstrap_nodes.master + bootstrap_nodes.worker | default([])) | map(attribute='name') | list
      ) | unique | length
      ==
      (
        (bootstrap_nodes.master + bootstrap_nodes.worker | default([])) | map(attribute='name') | list
      ) | length
    success_msg: All node names are unique.
    fail_msg: All node names are not unique.
    quiet: true

- name: Check if SSH ports are reachable
  when: (not ci_test | default(false)) and (not bootstrap_distribution == "talos")
  ansible.builtin.wait_for:
    host: "{{ item.address }}"
    port: 22
    timeout: 10
  connection: local
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"

- name: Check if Talos ports are reachable
  when: (not ci_test | default(false)) and (bootstrap_distribution == "talos")
  ansible.builtin.wait_for:
    host: "{{ item.address }}"
    port: 50000
    timeout: 10
  connection: local
  loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
  loop_control:
    label: "{{ item.address }}"