ca0f11b1c9
- roles/snapshot/tasks/main.yml: replace xe CLI with XO REST API - POST /rest/v0/vms/<uuid>/actions/snapshot?sync=true - stores returned snapshot UUID as snapshot_id - baremetal: skips gracefully with warning - playbooks/snapshot_pre.yml: target linux_hosts only (was all) - playbooks/linux_patch.yml: remove snapshot + report roles (snapshot is separate step) - playbooks/site_maintenance.yml: remove bootstrap play (handled per-playbook), remove windows_patch import (WinRM not implemented)
94 lines
4.0 KiB
YAML
94 lines
4.0 KiB
YAML
---
|
|
# =============================================================================
|
|
# roles/snapshot/tasks/main.yml
|
|
#
|
|
# Creates pre-patch snapshots for guest VMs.
|
|
# Runs against linux_hosts — each host needs xcpng_vm_uuid or proxmox_vmid set.
|
|
#
|
|
# Hypervisor dispatch:
|
|
# proxmox → community.general.proxmox_snap (delegate_to: localhost)
|
|
# xcpng → XO REST API snapshot action (delegate_to: localhost)
|
|
# baremetal → skipped entirely
|
|
#
|
|
# Required vars:
|
|
# XCP-NG: xcpng_vm_uuid, XO_URL, XO_TOKEN (from variable group)
|
|
# Proxmox: proxmox_vmid, PROXMOX_HOST, PROXMOX_TOKEN_ID, PROXMOX_TOKEN_SECRET
|
|
# =============================================================================
|
|
|
|
# ─── Proxmox snapshots ────────────────────────────────────────────────────────
|
|
|
|
- name: Create pre-patch snapshot (Proxmox)
|
|
community.general.proxmox_snap:
|
|
api_host: "{{ PROXMOX_HOST }}"
|
|
api_user: "{{ PROXMOX_TOKEN_ID | split('!') | first }}"
|
|
api_token_id: "{{ PROXMOX_TOKEN_ID | split('!') | last }}"
|
|
api_token_secret: "{{ PROXMOX_TOKEN_SECRET }}"
|
|
vmid: "{{ proxmox_vmid }}"
|
|
state: present
|
|
snapname: >-
|
|
{{ snapshot_name_prefix }}-{{ ansible_date_time.date }}-{{ ansible_date_time.hour }}{{ ansible_date_time.minute }}
|
|
description: "Ansible pre-patch snapshot {{ ansible_date_time.iso8601 }}"
|
|
register: proxmox_snapshot_result
|
|
when: hypervisor_type == "proxmox"
|
|
delegate_to: localhost
|
|
|
|
- name: Store Proxmox snapshot name
|
|
ansible.builtin.set_fact:
|
|
snapshot_id: >-
|
|
{{ snapshot_name_prefix }}-{{ ansible_date_time.date }}-{{ ansible_date_time.hour }}{{ ansible_date_time.minute }}
|
|
when: hypervisor_type == "proxmox"
|
|
|
|
# ─── XCP-NG snapshots via XO REST API ────────────────────────────────────────
|
|
|
|
- name: Create pre-patch snapshot (XCP-NG via XO REST API)
|
|
ansible.builtin.uri:
|
|
url: "{{ XO_URL }}/rest/v0/vms/{{ xcpng_vm_uuid }}/actions/snapshot?sync=true"
|
|
method: POST
|
|
headers:
|
|
Cookie: "authenticationToken={{ XO_TOKEN }}"
|
|
Content-Type: "application/json"
|
|
Accept: "application/json"
|
|
body_format: json
|
|
body:
|
|
name_label: >-
|
|
{{ snapshot_name_prefix }}-{{ ansible_date_time.date }}-{{ ansible_date_time.hour }}{{ ansible_date_time.minute }}
|
|
validate_certs: "{{ xo_validate_certs | default(true) }}"
|
|
status_code: [200, 201]
|
|
timeout: 120
|
|
register: xcpng_snapshot_result
|
|
when: hypervisor_type == "xcpng" or hypervisor_type == "mixed"
|
|
delegate_to: localhost
|
|
|
|
- name: Store XCP-NG snapshot UUID
|
|
ansible.builtin.set_fact:
|
|
snapshot_id: "{{ xcpng_snapshot_result.json | regex_replace('\"', '') }}"
|
|
when:
|
|
- hypervisor_type == "xcpng" or hypervisor_type == "mixed"
|
|
- xcpng_snapshot_result is not skipped
|
|
- xcpng_snapshot_result.json is defined
|
|
|
|
# ─── Verify and assert ───────────────────────────────────────────────────────
|
|
|
|
- name: Assert snapshot was created
|
|
ansible.builtin.assert:
|
|
that:
|
|
- snapshot_id is defined
|
|
- snapshot_id | length > 0
|
|
fail_msg: >-
|
|
SNAPSHOT FAILED: Could not create or verify snapshot for {{ inventory_hostname }}.
|
|
Aborting to protect against unsnapshotted patch run.
|
|
success_msg: "Snapshot OK: {{ snapshot_id }} for {{ inventory_hostname }}"
|
|
when: hypervisor_type != "baremetal"
|
|
|
|
- name: Log snapshot result
|
|
ansible.builtin.debug:
|
|
msg: "Pre-patch snapshot created: {{ snapshot_id }} for {{ inventory_hostname }}"
|
|
when: hypervisor_type != "baremetal"
|
|
|
|
- name: Log snapshot skipped (baremetal)
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
Snapshot skipped for {{ inventory_hostname }} — hypervisor_type is baremetal.
|
|
Ensure change approval is in place before patching.
|
|
when: hypervisor_type == "baremetal"
|