v2

tasks/validate.yml

@@ -0,0 +1,77 @@
+# SPDX-License-Identifier: MIT-0
+---
+- name: Validate deployment settings
+  ansible.builtin.assert:
+    that:
+      - wikideck_image is string and wikideck_image | length > 0
+      - wikideck_image is match('^[^\s@]+(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}|@sha256:[a-f0-9]{64})$')
+      - wikideck_name is string and wikideck_name is match('^[a-z]([a-z0-9-]*[a-z0-9])?$')
+      - wikideck_name | length <= 50
+      - wikideck_namespace is string and wikideck_namespace is match('^[a-z0-9]([a-z0-9-]*[a-z0-9])?$')
+      - wikideck_namespace | length <= 63
+      - wikideck_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
+      - wikideck_wait_timeout | string is match('^[1-9][0-9]*$')
+      - wikideck_resources is mapping
+      - wikideck_resources.requests is defined and wikideck_resources.requests is mapping
+      - wikideck_resources.limits is defined and wikideck_resources.limits is mapping
+      - wikideck_resources.requests.cpu is defined and wikideck_resources.requests.memory is defined
+      - wikideck_resources.limits.cpu is defined and wikideck_resources.limits.memory is defined
+      - wikideck_node_selector is mapping
+      - wikideck_affinity is mapping
+      - wikideck_ingress_annotations is mapping
+      - wikideck_storage_size is string and wikideck_storage_size | length > 0
+      - wikideck_storage_access_modes | length > 0
+      - wikideck_storage_access_modes | difference(['ReadWriteOnce', 'ReadWriteOncePod']) | length == 0
+      - wikideck_storage_class is none or wikideck_storage_class is string
+      - wikideck_existing_claim is string
+      - wikideck_existing_claim | length == 0 or wikideck_existing_claim is match('^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$')
+      - wikideck_public_origin is string
+      - wikideck_public_origin | length == 0 or wikideck_public_origin is match('^https://[a-z0-9.-]+(:[0-9]+)?$')
+      - wikideck_ingress_enabled is boolean
+      - wikideck_network_policy_enabled is boolean
+      - wikideck_offline is boolean
+      - wikideck_create_namespace is boolean
+      - wikideck_wait is boolean
+    fail_msg: >-
+      Provide a tagged or digest-pinned wikideck_image and valid Kubernetes names.
+      Resources need CPU/memory requests and limits; storage must be single-writer.
+      PUBLIC_ORIGIN must be an HTTPS origin without a path or trailing slash.
+
+- name: Validate TLS ingress settings
+  ansible.builtin.assert:
+    that:
+      - wikideck_ingress_host is string and wikideck_ingress_host | length > 0
+      - wikideck_ingress_host | length <= 253
+      - wikideck_ingress_host is match('^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$')
+      - wikideck_tls_secret_name is string and wikideck_tls_secret_name | length > 0
+      - wikideck_public_origin == 'https://' ~ wikideck_ingress_host
+    fail_msg: >-
+      Ingress requires a DNS hostname, a TLS Secret name, and wikideck_public_origin
+      set to https:// followed by exactly wikideck_ingress_host.
+  when: wikideck_ingress_enabled | bool
+
+- name: Validate list settings
+  ansible.builtin.assert:
+    that:
+      - lookup('ansible.builtin.vars', item) is sequence
+      - lookup('ansible.builtin.vars', item) is not string
+      - lookup('ansible.builtin.vars', item) is not mapping
+    fail_msg: "{{ item }} must be a list."
+  loop:
+    - wikideck_image_pull_secrets
+    - wikideck_tolerations
+    - wikideck_storage_access_modes
+    - wikideck_network_policy_ingress_from
+    - wikideck_network_policy_dns_to
+    - wikideck_network_policy_https_to
+
+- name: Require explicit network policy peers
+  ansible.builtin.assert:
+    that:
+      - item is mapping
+      - item | length > 0
+    fail_msg: Use an explicit podSelector, namespaceSelector, or ipBlock rather than an empty peer.
+  loop: >-
+    {{ wikideck_network_policy_ingress_from + wikideck_network_policy_dns_to
+       + wikideck_network_policy_https_to }}
+  when: wikideck_network_policy_enabled | bool