# SPDX-License-Identifier: MIT
---
- name: Test mssql_run_selinux_confined
  hosts: all
  gather_facts: false
  vars:
    mssql_accept_microsoft_odbc_driver_for_sql_server_eula: true
    mssql_accept_microsoft_cli_utilities_for_sql_server_eula: true
    mssql_accept_microsoft_sql_server_standard_eula: true
    mssql_version: 2022
    mssql_password: "p@55w0rD"
    mssql_edition: Evaluation
    __mssql_gather_facts_no_log: true
  tasks:
    - name: Assert expected failures on unsupported platforms
      include_tasks: tasks/assert_fail_on_unsupported_ver.yml

    - name: Check error message on not supported hosts and clean up
      when:
        - ansible_distribution in ['CentOS', 'RedHat']
        - ansible_distribution_major_version is version('9', '<')
      block:
        - name: Check error message on not supported hosts
          include_role:
            name: linux-system-roles.mssql
          vars:
            mssql_manage_selinux: true
            mssql_run_selinux_confined: true
      rescue:
        - name: Assert that the role failed with selinux_confined not supported
          assert:
            that: >-
              'Variables mssql_run_selinux_confined and mssql_manage_selinux are
              supported only on RHEL 9' in ansible_failed_result.msg
      always:
        - name: Clean up after the role invocation
          include_tasks: tasks/cleanup.yml

        - name: End unsupported host
          meta: end_host

    - name: Run test in a block to clean up in always
      block:
        - name: Run with selinux_confined
          include_role:
            name: linux-system-roles.mssql
          vars:
            mssql_manage_selinux: true
            mssql_run_selinux_confined: true

        - name: Verify settings
          include_tasks: tasks/verify_settings.yml
          vars:
            __verify_mssql_password: "p@55w0rD"
            __verify_mssql_edition: Evaluation
            __verify_mssql_is_confined: true

        - name: Configure the mssql-server service start limit interval and burst
          include_tasks: tasks/mssql-sever-increase-start-limit.yml

        - name: Run without selinux_confined
          include_role:
            name: linux-system-roles.mssql
          vars:
            mssql_manage_selinux: false
            mssql_run_selinux_confined: false

        - name: Verify settings
          include_tasks: tasks/verify_settings.yml
          vars:
            __verify_mssql_password: "p@55w0rD"
            __verify_mssql_edition: Evaluation
            __verify_mssql_is_confined: false
      always:
        - name: Clean up after the role invocation
          include_tasks: tasks/cleanup.yml
