54 lines
2.0 KiB
YAML
54 lines
2.0 KiB
YAML
---
|
|
- name: "Agents | Resolve catalog entry | {{ _agent_key }}"
|
|
ansible.builtin.set_fact:
|
|
_agent: "{{ multica_agent_cli_catalog[_agent_key] }}"
|
|
|
|
- name: "Agents | Read the installed version | {{ _agent_key }}"
|
|
ansible.builtin.command:
|
|
argv: ["/bin/sh", "-c", "command -v {{ _agent.binary }} >/dev/null 2>&1 && {{ _agent.version_command }}"]
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
register: _agent_installed
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
|
|
# Piping a vendor script into a shell is a supply-chain decision, so the role
|
|
# refuses rather than making it quietly on the operator's behalf.
|
|
- name: "Agents | Refuse to run a remote installer unless allowed | {{ _agent_key }}"
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
{{ _agent_key }} installs by executing {{ _agent.install_url }}.
|
|
Set multica_allow_remote_install_scripts: true to permit that, vendor the
|
|
installer yourself, or drop {{ _agent_key }} from multica_agent_clis.
|
|
when:
|
|
- _agent_installed.rc != 0
|
|
- not (multica_allow_remote_install_scripts | bool)
|
|
|
|
- name: "Agents | Install via the vendor script | {{ _agent_key }}"
|
|
when:
|
|
- _agent_installed.rc != 0
|
|
- multica_allow_remote_install_scripts | bool
|
|
block:
|
|
- name: "Agents | Fetch the installer | {{ _agent_key }}"
|
|
ansible.builtin.get_url:
|
|
url: "{{ _agent.install_url }}"
|
|
dest: "{{ multica_user_home }}/.cache/{{ _agent_key }}-install.sh"
|
|
owner: "{{ multica_user }}"
|
|
group: "{{ multica_group }}"
|
|
mode: "0700"
|
|
become: true
|
|
|
|
- name: "Agents | Run it as the daemon user | {{ _agent_key }}"
|
|
ansible.builtin.command:
|
|
argv: ["/bin/bash", "{{ multica_user_home }}/.cache/{{ _agent_key }}-install.sh"]
|
|
become: true
|
|
become_user: "{{ multica_user }}"
|
|
environment: "{{ _multica_user_env }}"
|
|
changed_when: true
|
|
notify: restart multica daemon
|
|
|
|
- name: "Agents | Resolve and link onto the default PATH | {{ _agent_key }}"
|
|
ansible.builtin.include_tasks: _link.yml
|