Initial VPS operations handbook

ansible/roles/helm_client/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# Helm is required by the patched matrix-stack release. Existing installs are
+# reported and retained; this role only installs Helm when it is absent.
+helm_client_install_enabled: false
+helm_client_install_script_url: https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
+helm_client_binary: /usr/local/bin/helm

ansible/roles/helm_client/tasks/main.yml

@@ -0,0 +1,28 @@
+---
+- name: Check whether Helm is installed
+  ansible.builtin.stat:
+    path: "{{ helm_client_binary }}"
+  register: helm_client_binary_state
+
+- name: Require explicit approval to install Helm when absent
+  ansible.builtin.assert:
+    that:
+      - helm_client_install_enabled | bool
+    fail_msg: >-
+      Helm is not installed. Re-run with helm_client_install_enabled=true after
+      reviewing the upstream installer source and checksum policy.
+  when: not helm_client_binary_state.stat.exists
+
+- name: Install Helm only when explicitly approved and absent
+  ansible.builtin.shell:
+    cmd: "curl -fsSL {{ helm_client_install_script_url }} | bash"
+    creates: "{{ helm_client_binary }}"
+  when:
+    - helm_client_install_enabled | bool
+    - not helm_client_binary_state.stat.exists
+  no_log: true
+
+- name: Read Helm version
+  ansible.builtin.command:
+    argv: ["{{ helm_client_binary }}", version, --short]
+  changed_when: false