From 8d5cc5ef66b140fb1f2c1b03d57c9c85f457b1af Mon Sep 17 00:00:00 2001 From: Franciszek Przewozny Date: Tue, 1 Sep 2026 22:16:14 +0200 Subject: prometheus: accept vault-encrypted values in precheck Ansible's "is string" Jinja test returns False for values encrypted with ansible-vault (AnsibleVaultEncryptedUnicode), so a precheck using such an encrypted password/salt failed incorrectly. Accept the value if it is either a plain string or vault_encrypted. Closes-Bug: #2115495 Change-Id: I0bf783c40ca5be66717193be9dece971805fca55 Signed-off-by: fprzewozn (cherry picked from commit ed74de7e9a76fac01554fc876c4a581b857903ea) --- ansible/roles/prometheus/tasks/precheck.yml | 8 ++++---- .../notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml | 10 ++++++++++ 2 files changed, 14 insertions(+), 4 deletions(-) create mode 100644 releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml diff --git a/ansible/roles/prometheus/tasks/precheck.yml b/ansible/roles/prometheus/tasks/precheck.yml index d4bdf0eba..5b98a09b4 100644 --- a/ansible/roles/prometheus/tasks/precheck.yml +++ b/ansible/roles/prometheus/tasks/precheck.yml @@ -28,21 +28,21 @@ ansible.builtin.assert: that: - prometheus_bcrypt_salt is defined - - prometheus_bcrypt_salt is string + - prometheus_bcrypt_salt is string or prometheus_bcrypt_salt is vault_encrypted - prometheus_bcrypt_salt | length == 22 - name: Check that prometheus_password is correctly set ansible.builtin.assert: that: - prometheus_password is defined - - prometheus_password is string + - prometheus_password is string or prometheus_password is vault_encrypted - prometheus_password | length > 0 - name: Check that prometheus_grafana_password is correctly set ansible.builtin.assert: that: - prometheus_grafana_password is defined - - prometheus_grafana_password is string + - prometheus_grafana_password is string or prometheus_grafana_password is vault_encrypted - prometheus_grafana_password | length > 0 when: enable_grafana | bool @@ -50,7 +50,7 @@ ansible.builtin.assert: that: - prometheus_skyline_password is defined - - prometheus_skyline_password is string + - prometheus_skyline_password is string or prometheus_skyline_password is vault_encrypted - prometheus_skyline_password | length > 0 when: enable_skyline | bool diff --git a/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml b/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml new file mode 100644 index 000000000..8a6bc53a9 --- /dev/null +++ b/releasenotes/notes/fix_prometheus_vault_prechecks-5335880cd18680dd.yaml @@ -0,0 +1,10 @@ +--- +fixes: + - | + Fixes Prometheus precheck failing on ``prometheus_bcrypt_salt``, + ``prometheus_password``, ``prometheus_grafana_password`` and + ``prometheus_skyline_password`` when these are Ansible Vault encrypted + values, due to a known Ansible limitation where the ``is string`` Jinja + test does not recognise vault-encrypted strings. See + `ansible/ansible#33067 `__ + for details. -- cgit v1.2.3