Initial VPS operations handbook

ansible/roles/matrix_certificate_smoke/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+- name: Require explicit approval before certificate smoke test
+  ansible.builtin.assert:
+    that:
+      - matrix_certificate_smoke_enabled | bool
+    fail_msg: >-
+      Refusing certificate smoke test changes. Re-run with
+      matrix_certificate_smoke_enabled=true after creating the test DNS record.
+
+- name: Render non-sensitive certificate smoke-test resources
+  ansible.builtin.template:
+    src: smoke.yaml.j2
+    dest: "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Apply certificate smoke-test resources
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - apply
+      - -f
+      - "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
+  changed_when: false
+
+- name: Wait for smoke-test deployment
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - rollout
+      - status
+      - "deployment/{{ matrix_certificate_smoke_name }}"
+      - "--namespace={{ matrix_certificate_smoke_namespace }}"
+      - --timeout=180s
+  changed_when: false
+
+- name: Wait for smoke-test certificate
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - wait
+      - --for=condition=Ready
+      - "certificate/{{ matrix_certificate_smoke_name }}-tls"
+      - "--namespace={{ matrix_certificate_smoke_namespace }}"
+      - --timeout=10m
+  changed_when: false
+  when: not (matrix_certificate_smoke_cleanup | bool)
+
+- name: Remove smoke-test resources after verification
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - delete
+      - -f
+      - "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
+      - --ignore-not-found=true
+  changed_when: false
+  when: matrix_certificate_smoke_cleanup | bool