# SPDX-License-Identifier: MIT
---
- name: Check pcs auth status
  command:
    cmd: >
      pcs status pcsd --
      {% for node in ansible_play_hosts %}
        {{ hostvars[node].__ha_cluster_node_name | quote }}
      {% endfor %}
      {% if __ha_cluster_qdevice_model == "net" and __ha_cluster_qdevice_host %}
        {{ __ha_cluster_qdevice_host | quote }}
      {% endif %}
  register: __ha_cluster_pcs_auth_status
  check_mode: false
  # rc == 0 means all nodes are authenticated
  # rc == 2 means not all nodes are authenticated
  # any other rc means an error
  changed_when: __ha_cluster_pcs_auth_status.rc == 2
  failed_when:
    - __ha_cluster_pcs_auth_status.rc != 0
    - __ha_cluster_pcs_auth_status.rc != 2

- name: Run pcs auth
  include_tasks: cluster-auth-{{ __ha_cluster_pcs_provider }}.yml
  # Include the tasks for nodes which can not talk to other nodes due to
  # missing pcs auth tokens. The pcs-auth-*.yml contains "run_once: true" as
  # running the auth on one node is sufficient (auth tokens are distributed by
  # pcs automatically). By applying "when" here and "run_once" in the included
  # task, it is achieved that the pcs auth command is run once on one of the
  # nodes which lack pcs auth tokens.
  when: not ansible_check_mode and __ha_cluster_pcs_auth_status.rc == 2
