Add safety checks to site production environments & Lock instances after site.yml

ansible/adhoc/lock_unlock_instances.yml

@@ -0,0 +1,11 @@
+---
+
+- hosts: cluster
+  gather_facts: no
+  become: no
+  tasks:
+    - name: Lock/Unlock instances
+      openstack.cloud.server_action:
+        action: "{{ appliances_server_action | default('lock') }}"
+        server: "{{ inventory_hostname }}"
+      delegate_to: localhost

ansible/adhoc/rebuild-via-slurm.yml

@@ -8,6 +8,11 @@
 
 # See docs/slurm-controlled-rebuild.md.
 
+- name: Unlock compute instances for rebuild
+  vars:
+    appliances_server_action: unlock
+  ansible.builtin.command: ansible-playbook --limit compute adhoc/lock_unlock_instances.yml
+
 - hosts: login
   run_once: true
   gather_facts: false

ansible/safe-env.yml

@@ -0,0 +1,19 @@
+---
+- hosts: localhost
+  gather_facts: no
+  become: no
+  tasks:
+    - name: Confirm continuing if using production environment
+      ansible.builtin.pause:
+        prompt: |
+          *************************************
+          *  WARNING: PROTECTED ENVIRONMENT!  *
+          *************************************
+
+          Current environment: {{ appliances_environment_name }}
+          Do you really want to continue (yes/no)?
+      register: env_confirm_safe
+      when:
+        - appliances_environment_name in appliances_protected_environments
+        - not (appliances_protected_environment_autoapprove | default(false) | bool)
+      failed_when: not (env_confirm_safe.user_input | bool)

ansible/site.yml

@@ -1,4 +1,10 @@
 ---
+
+- ansible.builtin.import_playbook: safe-env.yml
+
+- name: Lock cluster instances
+  ansible.builtin.command: ansible-playbook adhoc/lock_unlock_instances.yml
+
 - name: Run pre.yml hook
   vars:
     # hostvars not available here, so have to recalculate environment root:

environments/common/inventory/group_vars/all/defaults.yml

@@ -4,6 +4,8 @@ ansible_user: rocky
 appliances_repository_root: "{{ lookup('env', 'APPLIANCES_REPO_ROOT') }}"
 appliances_environment_root: "{{ lookup('env', 'APPLIANCES_ENVIRONMENT_ROOT') }}"
 appliances_environment_name: "{{ appliances_environment_root | basename | regex_replace('\\W+', '') }}" # [a-zA-Z0-9_] only
+appliances_protected_environments:
+  - prd
 appliances_cockpit_state: absent # RHEL cockpit installed but not enabled in genericcloud images; appliance defaults to removing it
 # appliances_state_dir: # define an absolute path here to use for persistent state: NB: This is defined as /var/lib/state in inventory by the default Terraform
 appliances_mode: configure