USHIFT-7443: Ansible: modernize task syntax

.ansible-lint

@@ -8,23 +8,20 @@ exclude_paths:
 
 # Existing roles use hyphenated names throughout the repository. Keep that
 # convention out of scope for this lint cleanup.
+# Shared task files also publish variables consumed across roles, so enforcing
+# role-specific prefixes would require behavioral variable renames.
 skip_list:
   - role-name
+  - var-naming[no-role-prefix]
 
 # These rule families are promoted to fatal errors as the follow-up cleanup
 # changes land. New findings in a warned family remain warnings until then.
 warn_list:
   - command-instead-of-module
-  - fqcn
   - ignore-errors
-  - jinja
-  - key-order
   - latest
-  - name
   - no-changed-when
   - no-handler
   - package-latest
   - risky-file-permissions
   - risky-shell-pipe
-  - var-naming
-  - yaml

ansible/roles/add-kubelet-logging/files/metrics-sa.yaml

@@ -16,15 +16,15 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
   name: system:aggregated-metrics-reader
 rules:
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -33,21 +33,21 @@ metadata:
     k8s-app: metrics-server
   name: system:metrics-server
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - nodes/metrics
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/metrics
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -61,9 +61,9 @@ roleRef:
   kind: Role
   name: extension-apiserver-authentication-reader
 subjects:
-- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: kube-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -76,9 +76,9 @@ roleRef:
   kind: ClusterRole
   name: system:auth-delegator
 subjects:
-- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: kube-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -91,6 +91,6 @@ roleRef:
   kind: ClusterRole
   name: system:metrics-server
 subjects:
-- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: kube-system

ansible/roles/add-kubelet-logging/tasks/main.yml

@@ -49,7 +49,7 @@
           ansible.builtin.copy:
             content: "{{ bearer_token_slurp.content | b64decode }}"
             dest: "{{ kubelet_auth_token_file }}"
-            mode: '0644'
+            mode: "0644"
             setype: container_file_t
           register: prometheus_token_install
           no_log: true
@@ -78,7 +78,7 @@
       ansible.builtin.file:
         path: "{{ kubelet_auth_token_file }}"
         state: file
-        mode: '0644'
+        mode: "0644"
         setype: container_file_t
       register: prometheus_token_permissions
 
@@ -88,7 +88,7 @@
           ansible.builtin.template:
             src: kubelet.yml.j2
             dest: "{{ prometheus_kubelet_scrape_config }}"
-            mode: '0644'
+            mode: "0644"
             setype: container_file_t
             backup: true
           register: prometheus_kubelet_config_template
@@ -111,7 +111,7 @@
             src: "{{ prometheus_kubelet_config_template.backup_file }}"
             dest: "{{ prometheus_kubelet_scrape_config }}"
             remote_src: true
-            mode: '0644'
+            mode: "0644"
             setype: container_file_t
           when:
             - prometheus_kubelet_config_template is defined

ansible/roles/common/tasks/boot.yml

@@ -3,73 +3,73 @@
 
 # Include shared microshift version configuration
 - name: Include shared microshift version configuration
-  include_vars:
+  ansible.builtin.include_vars:
     file: "{{ playbook_dir }}/vars/microshift_versions.yml"
 
-- name: initialize results directory
-  include_tasks: roles/common/tasks/results-dir.yml
+- name: Initialize results directory
+  ansible.builtin.include_tasks: roles/common/tasks/results-dir.yml
 
-- block:
-  - name: find microshift cleanup script
-    ansible.builtin.find:
-      paths: /usr/bin
-      patterns:
-        - '.*microshift.*cleanup.*'
-        - '.*cleanup.*microshift.*'
-      use_regex: yes
-    register: find_cleanup
-
-  - name: set microshift_cleanup_bin variable
-    set_fact:
-      microshift_cleanup_bin: "{{ find_cleanup.files[0].path if find_cleanup.files }}"
-
-  - name: cleanup microshift data
-    become: true
-    ansible.builtin.shell: echo 1 | {{ microshift_cleanup_bin }} --all
+- name: Clean up MicroShift data when requested
   when: cleanup_microshift | default('false') | bool
+  block:
+    - name: Find microshift cleanup script
+      ansible.builtin.find:
+        paths: /usr/bin
+        patterns:
+          - ".*microshift.*cleanup.*"
+          - ".*cleanup.*microshift.*"
+        use_regex: true
+      register: find_cleanup
+
+    - name: Set microshift_cleanup_bin variable
+      ansible.builtin.set_fact:
+        microshift_cleanup_bin: "{{ find_cleanup.files[0].path if find_cleanup.files }}"
 
-- block:
-  - name: reboot machine
-    become: true
-    ansible.builtin.reboot:
-      reboot_timeout: 600
-
-  - name: Pause for 60 seconds for steady state post reboot
-    ansible.builtin.pause:
-      seconds: 60
+    - name: Cleanup microshift data
+      become: true
+      ansible.builtin.shell: echo 1 | {{ microshift_cleanup_bin }} --all
+- name: Reboot when requested
   when: reboot | default('false') | bool
+  block:
+    - name: Reboot machine
+      become: true
+      ansible.builtin.reboot:
+        reboot_timeout: 600
 
+    - name: Pause for 60 seconds for steady state post reboot
+      ansible.builtin.pause:
+        seconds: 60
 - name: Normalize microshift version for pod counts
-  set_fact:
+  ansible.builtin.set_fact:
     microshift_version_clean: "{{ microshift_version | regex_replace('^latest-', '') }}"
 
 - name: Extract major version for pod counts
-  set_fact:
+  ansible.builtin.set_fact:
     microshift_major_version: "{{ microshift_version_clean.split('.')[:2] | join('.') }}"
 
 - name: Validate that version exists in config
-  fail:
+  ansible.builtin.fail:
     msg: "Error: MicroShift version {{ microshift_major_version }} not found in microshift_versions dictionary. Please update vars/microshift_versions.yml."
   when: microshift_major_version not in microshift_versions
 
 - name: Set expected pod counts
-  set_fact:
+  ansible.builtin.set_fact:
     expected_pods: "{{ microshift_versions[microshift_major_version].expected_pods }}"
     all_pods: "{{ microshift_versions[microshift_major_version].all_pods }}"
 
-- name: run the microshift boot script
+- name: Run the microshift boot script
   ansible.builtin.script:
     cmd: >
       ready.sh
       {{ expected_pods }}
       {{ all_pods }}
   register: script_output
 
-- name: display script output
+- name: Display script output
   ansible.builtin.debug:
     var: script_output.stdout
 
-- name: save microshift boot info to local file
+- name: Save microshift boot info to local file
   ansible.builtin.copy:
     content: "{{ script_output.stdout }}"
     dest: "{{ results_dir }}/{{ boot_output_filename | default('boot_quick.txt') }}"

ansible/roles/common/tasks/disk.yml

@@ -1,27 +1,27 @@
-- name: initialize results directory
-  include_tasks: roles/common/tasks/results-dir.yml
+---
+- name: Initialize results directory
+  ansible.builtin.include_tasks: roles/common/tasks/results-dir.yml
 
-- name: disk space block
+- name: Disk space block
   block:
-    - name: find disk usage
-      become: yes
+    - name: Find disk usage
+      become: true
       ansible.builtin.shell:
         cmd: du -BM -t 1M --max-depth=1 {{ item }} | sort -rh
       register: disk_usage
 
-    - name: print disk_usage var
+    - name: Print disk_usage var
       ansible.builtin.debug:
         var: disk_usage.stdout_lines
 
     - name: Add disk info to local file
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: "{{ results_dir }}/{{ filename }}"
         line: "{{ disk_item }}"
-        create: yes
+        create: true
       delegate_to: localhost
       with_items:
         - "{{ item }}:"
         - "{{ disk_usage.stdout_lines }}"
       loop_control:
         loop_var: disk_item
-

ansible/roles/common/tasks/nodename.yml

@@ -14,7 +14,7 @@
 # to ansible_facts.hostname even when an override is configured.
 
 - name: Resolve kubernetes nodename
-  become: yes
+  become: true
   block:
     - name: Find microshift config drop-ins
       ansible.builtin.find:
@@ -55,6 +55,4 @@
 
 - name: Set kubernetes_nodename fact
   ansible.builtin.set_fact:
-    kubernetes_nodename: "{{ ((_microshift_hostname_override | length > 0)
-                              | ternary(_microshift_hostname_override, ansible_facts.hostname))
-                              | lower }}"
+    kubernetes_nodename: "{{ ((_microshift_hostname_override | length > 0) | ternary(_microshift_hostname_override, ansible_facts.hostname)) | lower }}"

ansible/roles/common/tasks/results-dir.yml

@@ -3,42 +3,42 @@
 # Creates: results/{{ microshift_version }}/{{ timestamp }}/
 # Updates: results/{{ microshift_version }}/latest -> {{ timestamp }}/
 
-- name: set results base directory
+- name: Set results base directory
   ansible.builtin.set_fact:
     results_base_dir: "{{ results_base_dir | default(playbook_dir + '/results') }}"
   when: results_base_dir is not defined
 
-- name: set results timestamp
+- name: Set results timestamp
   ansible.builtin.set_fact:
     results_timestamp: "{{ results_timestamp | default(lookup('pipe', 'date +%Y-%m-%d_%H-%M-%S')) }}"
   when: results_timestamp is not defined
 
-- name: set results directory with version
+- name: Set results directory with version
   ansible.builtin.set_fact:
     results_dir: "{{ results_base_dir }}/{{ microshift_version }}/{{ results_timestamp }}"
   when: results_dir is not defined
 
-- name: ensure results directory exists on localhost
+- name: Ensure results directory exists on localhost
   ansible.builtin.file:
     path: "{{ results_dir }}"
     state: directory
-    mode: '0755'
+    mode: "0755"
   delegate_to: localhost
 
-- name: update latest symlink
+- name: Update latest symlink
   ansible.builtin.file:
     src: "{{ results_dir | basename }}"
     dest: "{{ results_dir | dirname }}/latest"
     state: link
-    force: yes
+    force: true
   delegate_to: localhost
   when: results_latest_src is not defined
 
-- name: set results latest source
+- name: Set results latest source
   ansible.builtin.set_fact:
     results_latest_src: "{{ results_dir }}"
   when: results_latest_src is not defined
 
-- name: display results directory
+- name: Display results directory
   ansible.builtin.debug:
     msg: "Results will be saved to: {{ results_dir }}"

ansible/roles/configure-firewall/defaults/main.yml

@@ -27,4 +27,3 @@ firewall_trusted_cidr:
   - 10.42.0.0/16
   - 169.254.169.1/32
   - fd01::/48
-