78 lines
3.9 KiB
YAML
78 lines
3.9 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
- name: Validate deployment settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wikideck_image is string and wikideck_image | length > 0
|
|
- wikideck_image is match('^[^\s@]+(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}|@sha256:[a-f0-9]{64})$')
|
|
- wikideck_name is string and wikideck_name is match('^[a-z]([a-z0-9-]*[a-z0-9])?$')
|
|
- wikideck_name | length <= 50
|
|
- wikideck_namespace is string and wikideck_namespace is match('^[a-z0-9]([a-z0-9-]*[a-z0-9])?$')
|
|
- wikideck_namespace | length <= 63
|
|
- wikideck_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
|
|
- wikideck_wait_timeout | string is match('^[1-9][0-9]*$')
|
|
- wikideck_resources is mapping
|
|
- wikideck_resources.requests is defined and wikideck_resources.requests is mapping
|
|
- wikideck_resources.limits is defined and wikideck_resources.limits is mapping
|
|
- wikideck_resources.requests.cpu is defined and wikideck_resources.requests.memory is defined
|
|
- wikideck_resources.limits.cpu is defined and wikideck_resources.limits.memory is defined
|
|
- wikideck_node_selector is mapping
|
|
- wikideck_affinity is mapping
|
|
- wikideck_ingress_annotations is mapping
|
|
- wikideck_storage_size is string and wikideck_storage_size | length > 0
|
|
- wikideck_storage_access_modes | length > 0
|
|
- wikideck_storage_access_modes | difference(['ReadWriteOnce', 'ReadWriteOncePod']) | length == 0
|
|
- wikideck_storage_class is none or wikideck_storage_class is string
|
|
- wikideck_existing_claim is string
|
|
- wikideck_existing_claim | length == 0 or wikideck_existing_claim is match('^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$')
|
|
- wikideck_public_origin is string
|
|
- wikideck_public_origin | length == 0 or wikideck_public_origin is match('^https://[a-z0-9.-]+(:[0-9]+)?$')
|
|
- wikideck_ingress_enabled is boolean
|
|
- wikideck_network_policy_enabled is boolean
|
|
- wikideck_offline is boolean
|
|
- wikideck_create_namespace is boolean
|
|
- wikideck_wait is boolean
|
|
fail_msg: >-
|
|
Provide a tagged or digest-pinned wikideck_image and valid Kubernetes names.
|
|
Resources need CPU/memory requests and limits; storage must be single-writer.
|
|
PUBLIC_ORIGIN must be an HTTPS origin without a path or trailing slash.
|
|
|
|
- name: Validate TLS ingress settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wikideck_ingress_host is string and wikideck_ingress_host | length > 0
|
|
- wikideck_ingress_host | length <= 253
|
|
- wikideck_ingress_host is match('^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$')
|
|
- wikideck_tls_secret_name is string and wikideck_tls_secret_name | length > 0
|
|
- wikideck_public_origin == 'https://' ~ wikideck_ingress_host
|
|
fail_msg: >-
|
|
Ingress requires a DNS hostname, a TLS Secret name, and wikideck_public_origin
|
|
set to https:// followed by exactly wikideck_ingress_host.
|
|
when: wikideck_ingress_enabled | bool
|
|
|
|
- name: Validate list settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- lookup('ansible.builtin.vars', item) is sequence
|
|
- lookup('ansible.builtin.vars', item) is not string
|
|
- lookup('ansible.builtin.vars', item) is not mapping
|
|
fail_msg: "{{ item }} must be a list."
|
|
loop:
|
|
- wikideck_image_pull_secrets
|
|
- wikideck_tolerations
|
|
- wikideck_storage_access_modes
|
|
- wikideck_network_policy_ingress_from
|
|
- wikideck_network_policy_dns_to
|
|
- wikideck_network_policy_https_to
|
|
|
|
- name: Require explicit network policy peers
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item is mapping
|
|
- item | length > 0
|
|
fail_msg: Use an explicit podSelector, namespaceSelector, or ipBlock rather than an empty peer.
|
|
loop: >-
|
|
{{ wikideck_network_policy_ingress_from + wikideck_network_policy_dns_to
|
|
+ wikideck_network_policy_https_to }}
|
|
when: wikideck_network_policy_enabled | bool
|