# SPDX-License-Identifier: MIT
---
# The role is limited to *adding* ports in firewall and selinux and cannot be
# used for *removing* ports. If the underlying system is already configured
# with HA cluster services and ports in firewall and selinux, the role would
# not change that even if run with ha_cluster_manage_firewall=False. Hence,
# only ha_cluster_manage_firewall=true is tested. The same applies to
# ha_cluster_manage_selinux.
- name: Exporting manage_firewall and manage_selinux variables
  hosts: all
  vars_files: vars/main.yml
  vars:
    __properties_capability: pcmk.properties.cluster.config.output-formats
    ha_cluster_cluster_name: test-cluster
    ha_cluster_export_configuration: true
    ha_cluster_manage_firewall: true
    ha_cluster_manage_selinux: true

  tasks:
    - name: Run test
      tags:
        - tests::booted
        - tests::verify
      block:
        - name: Skip test in bootc mode
          include_tasks: tasks/skip_if_bootc.yml

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Ensure required packages are installed
          package:
            name:
              - firewalld
              - python3-firewall
            state: present
            use: "{{ (__ha_cluster_is_ostree | d(false)) |
                    ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true

        - name: Fetch cluster versions of cluster components
          include_tasks: tasks/fetch_versions.yml

        - name: Check cluster status
          include_tasks: tasks/assert_cluster_running.yml

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml

        - name: Check exported configuration
          vars:
            __test_exported_config: >
              {{
                ha_cluster_facts | combine({
                  'ha_cluster_enable_repos': 'it depends on test environment',
                  'ha_cluster_enable_repos_resilient_storage': 'it depends on test environment',
                  'ha_cluster_install_cloud_agents': 'it depends on test environment',
                  'ha_cluster_node_options': 'it depends on test environment'
                })
              }}
            __test_expected_config_always:
              ha_cluster_cluster_present: true
              ha_cluster_manage_firewall: true
              ha_cluster_manage_selinux: true
              ha_cluster_cluster_name: test-cluster
              ha_cluster_start_on_boot: true
              ha_cluster_transport:
                type: knet
                crypto:
                  - name: cipher
                    value: aes256
                  - name: hash
                    value: sha256
              ha_cluster_pcs_permission_list:
                - name: haclient
                  type: group
                  allow_list: ["grant", "read", "write"]
              ha_cluster_enable_repos: "it depends on test environment"
              ha_cluster_enable_repos_resilient_storage: "it depends on test environment"
              ha_cluster_install_cloud_agents: "it depends on test environment"
              ha_cluster_node_options: "it depends on test environment"
            __test_expected_config_sometimes: >-
              {{
                (__properties_capability in __test_pcs_capabilities) | ternary({
                  "ha_cluster_cluster_properties": [{
                    "attrs": [
                      {
                        "name": "fencing-watchdog-timeout",
                        "value": "0"
                      },
                      {
                        "name": "stonith-watchdog-timeout",
                        "value": "0"
                      },
                    ]
                  }]
                }, {})
              }}
            __test_expected_config: >-
              {{
                __test_expected_config_always
                  | combine(__test_expected_config_sometimes)
              }}
          block:
            - name: Print exported configuration
              debug:
                var: __test_exported_config

            - name: Print expected configuration
              debug:
                var: __test_expected_config

            - name: Compare expected and exported configuration
              assert:
                that:
                  - __test_exported_config == __test_expected_config
