# SPDX-License-Identifier: MIT
---
- name: Minimal cluster configuration
  hosts: all
  vars_files: vars/main.yml
  vars:
    ha_cluster_cluster_name: test-cluster
    ha_cluster_export_configuration: true

  tasks:
    - name: Run test
      tags: tests::verify
      block:
        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Ensure pre-shared keys and TLS certificates are not present
          file:
            path: "{{ item }}"
            state: absent
          loop:
            - /etc/corosync/authkey
            - /etc/pacemaker/authkey
            - /etc/cluster/fence_xvm.key
            - /var/lib/pcsd/pcsd.key
            - /var/lib/pcsd/pcsd.crt

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true

        - name: Get services status
          service_facts:

        - name: Check services status
          assert:
            that:
              - ansible_facts.services["pcsd.service"].status == "enabled"
              - ansible_facts.services["corosync.service"].status == "enabled"
              - ansible_facts.services["pacemaker.service"].status == "enabled"

        - name: Stat corosync authkey
          stat:
            path: /etc/corosync/authkey
          register: stat_corosync_key

        - name: Stat pacemaker authkey
          stat:
            path: /etc/pacemaker/authkey
          register: stat_pacemaker_key

        - name: Stat fence-virt authkey
          stat:
            path: /etc/cluster/fence_xvm.key
          register: stat_fence_xvm_key
          when: __test_fence_virt_supported

        - name: Stat pcsd TLS certificate
          stat:
            path: /var/lib/pcsd/pcsd.crt
          register: stat_pcsd_cert

        - name: Stat pcsd TLS key
          stat:
            path: /var/lib/pcsd/pcsd.key
          register: stat_pcsd_key

        - name: Check pre-shared keys and TLS certificates are present
          assert:
            that:
              - stat_corosync_key.stat.exists
              - stat_pacemaker_key.stat.exists
              - (
                  not __test_fence_virt_supported
                  or stat_fence_xvm_key.stat.exists
                )
              - stat_pcsd_cert.stat.exists
              - stat_pcsd_key.stat.exists

        - name: Check corosync
          include_tasks: tasks/assert_corosync_config.yml
          vars:
            # noqa jinja[spacing]
            __test_expected_lines:
              - 'totem {'
              - '    version: 2'
              - '    cluster_name: {{ ha_cluster_cluster_name }}'
              - '    transport: knet'
              - '    crypto_cipher: aes256'
              - '    crypto_hash: sha256'
              - '}'
              - 'nodelist {'
              - '}'
              - 'quorum {'
              - '    provider: corosync_votequorum'
              - "{{ (ansible_play_hosts_all | length == 2) | ternary(
                '    two_node: 1',
                '') }}"
              - '}'
              - 'logging {'
              - '    to_logfile: yes'
              - '    logfile: /var/log/cluster/corosync.log'
              - '    to_syslog: yes'
              - '    timestamp: on'
              - '}'

        - name: Check cluster status
          include_tasks: tasks/assert_cluster_running.yml

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml

        - name: Check exported configuration
          vars:
            __test_exported_config: >
              {{
                ha_cluster_facts | combine({
                  'ha_cluster_enable_repos': 'it depends on test environment',
                  'ha_cluster_enable_repos_resilient_storage': 'it depends on test environment',
                  'ha_cluster_manage_firewall': 'it depends on test environment',
                  'ha_cluster_manage_selinux': 'it depends on test environment',
                  'ha_cluster_install_cloud_agents': 'it depends on test environment',
                  'ha_cluster_node_options': 'it depends on test environment'
                })
              }}
            __test_expected_config:
              ha_cluster_cluster_present: true
              ha_cluster_cluster_name: test-cluster
              ha_cluster_start_on_boot: true
              ha_cluster_transport:
                type: knet
                crypto:
                  - name: cipher
                    value: aes256
                  - name: hash
                    value: sha256
              ha_cluster_pcs_permission_list:
                - name: haclient
                  type: group
                  allow_list: ["grant", "read", "write"]
              ha_cluster_enable_repos: "it depends on test environment"
              ha_cluster_enable_repos_resilient_storage: "it depends on test environment"
              ha_cluster_manage_firewall: "it depends on test environment"
              ha_cluster_manage_selinux: "it depends on test environment"
              ha_cluster_install_cloud_agents: "it depends on test environment"
              ha_cluster_node_options: "it depends on test environment"
          block:
            - name: Print exported configuration
              debug:
                var: __test_exported_config

            - name: Print expected configuration
              debug:
                var: __test_expected_config

            - name: Compare expected and exported configuration
              assert:
                that:
                  - __test_exported_config == __test_expected_config
