Initial VPS operations handbook

ansible/roles/helm_client/tasks/main.yml

@@ -0,0 +1,28 @@
+---
+- name: Check whether Helm is installed
+  ansible.builtin.stat:
+    path: "{{ helm_client_binary }}"
+  register: helm_client_binary_state
+
+- name: Require explicit approval to install Helm when absent
+  ansible.builtin.assert:
+    that:
+      - helm_client_install_enabled | bool
+    fail_msg: >-
+      Helm is not installed. Re-run with helm_client_install_enabled=true after
+      reviewing the upstream installer source and checksum policy.
+  when: not helm_client_binary_state.stat.exists
+
+- name: Install Helm only when explicitly approved and absent
+  ansible.builtin.shell:
+    cmd: "curl -fsSL {{ helm_client_install_script_url }} | bash"
+    creates: "{{ helm_client_binary }}"
+  when:
+    - helm_client_install_enabled | bool
+    - not helm_client_binary_state.stat.exists
+  no_log: true
+
+- name: Read Helm version
+  ansible.builtin.command:
+    argv: ["{{ helm_client_binary }}", version, --short]
+  changed_when: false