Synchronise 2026.1 with upstream

ansible/network-connectivity.yml

@@ -68,6 +68,11 @@
           network.
       run_once: True
 
+    - name: Compute a mapping of network name to hosts on that network
+      run_once: True
+      set_fact:
+        network_hosts_map: "{{ ansible_play_batch | net_hosts_by_network }}"
+
     - name: Ensure hosts on the same network are reachable
       command: >
         ping {{ remote_ip }} -c1 -M do {% if mtu %} -s {{ mtu | int - icmp_overhead_bytes }}{% endif %}
@@ -82,13 +87,9 @@
       vars:
         # Select other hosts targeted by this play which have this network
         # interface (item).
-        remote_hosts: >
-          {{ hostvars.values() |
-             selectattr('inventory_hostname', 'is_in', ansible_play_batch) |
-             selectattr('network_interfaces', 'defined') |
-             selectattr('network_interfaces', 'issuperset', [item]) |
-             rejectattr('inventory_hostname', 'equalto', inventory_hostname) |
-             map(attribute='inventory_hostname') |
+        remote_hosts: >-
+          {{ (network_hosts_map[item] | default([])) |
+             reject('equalto', inventory_hostname) |
              list }}
         # NOTE(wszumski): Needed to fix random choice for the run otherwise the
         # when check: remote_ip | length > 0, would pass, but remote_ip was ''

ansible/physical-network.yml

@@ -28,7 +28,9 @@
     physical_network_display: False
     # List of supported values for the 'switch_type' variable.
     supported_switch_types:
+      - alliedware-plus
       - arista
+      - cisco-nxos
       - dellos6
       - dellos9
       - dellos10
@@ -109,6 +111,22 @@
       debug:
         var: switch_interface_config
 
+- name: Ensure AlliedWare Plus physical switches are configured
+  hosts: switches_of_type_alliedware-plus:&switches_in_display_mode_False
+  gather_facts: no
+  max_fail_percentage: >-
+    {{ physical_network_max_fail_percentage |
+       default(kayobe_max_fail_percentage) |
+       default(100) }}
+  roles:
+    - role: ssh-known-host
+      when: not switch_skip_keyscan | bool
+
+    - role: alliedware-plus-switch
+      alliedware_plus_switch_config: "{{ switch_config }}"
+      alliedware_plus_switch_interface_config: "{{ switch_interface_config }}"
+      alliedware_plus_switch_save: "{{ switch_config_save }}"
+
 - name: Ensure Arista physical switches are configured
   hosts: switches_of_type_arista:&switches_in_display_mode_False
   gather_facts: no
@@ -126,6 +144,22 @@
       arista_switch_config: "{{ switch_config }}"
       arista_switch_interface_config: "{{ switch_interface_config }}"
 
+- name: Ensure Cisco NX-OS physical switches are configured
+  hosts: switches_of_type_cisco-nxos:&switches_in_display_mode_False
+  gather_facts: no
+  max_fail_percentage: >-
+    {{ physical_network_max_fail_percentage |
+       default(kayobe_max_fail_percentage) |
+       default(100) }}
+  roles:
+    - role: ssh-known-host
+      when: not switch_skip_keyscan | bool
+
+    - role: cisco-nxos-switch
+      cisco_nxos_switch_config: "{{ switch_config }}"
+      cisco_nxos_switch_interface_config: "{{ switch_interface_config }}"
+      cisco_nxos_switch_save: "{{ switch_config_save }}"
+
 - name: Ensure DellOS physical switches are configured
   hosts: switches_of_type_dellos6:switches_of_type_dellos9:switches_of_type_dellos10:&switches_in_display_mode_False
   gather_facts: no

ansible/roles/alliedware-plus-switch/README.md

@@ -0,0 +1,79 @@
+AlliedWare Plus Switch
+======================
+
+This role configures AlliedWare Plus switches using the
+`alliedtelesis.awplus.awplus_config` Ansible module. It provides a fairly
+minimal abstraction of the configuration interface provided by the
+`awplus_config` module, allowing for application of arbitrary switch
+configuration options.
+
+Requirements
+------------
+
+The switches should be configured to allow SSH access.
+
+The `alliedtelesis.awplus` Ansible collection must be installed.
+
+Role Variables
+--------------
+
+`alliedware_plus_switch_config` is a list of configuration lines to apply to
+the switch, and defaults to an empty list.
+
+`alliedware_plus_switch_interface_config` contains interface configuration. It
+is a dict mapping switch interface names to configuration dicts, and defaults
+to an empty dict. Each dict may contain the following items:
+
+- `description` - an optional description to apply to the interface.
+- `config` - a list of per-interface configuration commands.
+
+`alliedware_plus_switch_save` controls whether the running configuration is
+saved to the startup configuration when they differ, including any previously
+unsaved changes. Defaults to `false`.
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+The following playbook configures hosts in the `alliedware-plus-switches`
+group. It assumes host variables for each switch holding the host and SSH
+credentials.
+
+    ---
+    - name: Ensure AlliedWare Plus switches are configured
+      hosts: alliedware-plus-switches
+      gather_facts: no
+      vars:
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_network_os: alliedtelesis.awplus.awplus
+      roles:
+        - role: alliedware-plus-switch
+          alliedware_plus_switch_config:
+            - "vlan database"
+            - " vlan 1000,1001 state enable"
+          alliedware_plus_switch_interface_config:
+            port1.0.1:
+              description: server-1
+              config:
+                - "no shutdown"
+                - "switchport"
+                - "switchport mode trunk"
+                - "switchport trunk native vlan 1000"
+                - "switchport trunk allowed vlan add 1001"
+            port1.0.2:
+              description: server-2
+              config:
+                - "no shutdown"
+                - "switchport"
+                - "switchport mode trunk"
+                - "switchport trunk native vlan 1000"
+                - "switchport trunk allowed vlan add 1001"
+
+Author Information
+------------------
+
+- Pierre Riteau (<pierre@stackhpc.com>)

ansible/roles/alliedware-plus-switch/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# List of configuration lines to apply to the switch.
+alliedware_plus_switch_config: []
+
+# Interface configuration. Dict mapping switch interface names to configuration
+# dicts. Each dict contains an optional 'description' item and a 'config' item
+# which should contain a list of per-interface configuration.
+alliedware_plus_switch_interface_config: {}
+
+# Whether to save the configuration.
+alliedware_plus_switch_save: false

ansible/roles/alliedware-plus-switch/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Ensure AlliedWare Plus switches are configured
+  alliedtelesis.awplus.awplus_config:
+    lines: "{{ lookup('template', 'alliedware-plus-config.j2') }}"
+    save_when: >-
+      {{ alliedware_plus_switch_save | bool | ternary('modified', 'never') }}

ansible/roles/alliedware-plus-switch/templates/alliedware-plus-config.j2

@@ -0,0 +1,15 @@
+#jinja2: trim_blocks: True,lstrip_blocks: True
+
+{% for line in alliedware_plus_switch_config %}
+{{ line }}
+{% endfor %}
+
+{% for interface, config in alliedware_plus_switch_interface_config.items() %}
+interface {{ interface }}
+{% if config.description is defined %}
+ description {{ config.description }}
+{% endif %}
+{% for line in config.config %}
+ {{ line }}
+{% endfor %}
+{% endfor %}

ansible/roles/cisco-nxos-switch/README.md

@@ -0,0 +1,59 @@
+Cisco NX-OS Switch
+==================
+
+This role configures Cisco NX-OS switches using the `cisco.nxos.nxos_config`
+Ansible module. It allows global and per-interface configuration commands to
+be applied to the switch.
+
+Requirements
+------------
+
+The switches should be configured to allow SSH access.
+
+The `cisco.nxos` Ansible collection must be installed.
+
+Role Variables
+--------------
+
+`cisco_nxos_switch_config` is a list of configuration lines to apply to the
+switch, and defaults to an empty list.
+
+`cisco_nxos_switch_interface_config` is a dict mapping switch interface names
+to configuration dicts, and defaults to an empty dict. Each dict contains:
+
+- `description` - an optional description to apply to the interface.
+- `config` - a list of per-interface configuration commands.
+
+`cisco_nxos_switch_save` controls whether the running configuration is saved
+to the startup configuration when they differ, including any previously unsaved
+changes. Defaults to `false`.
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+The following playbook configures hosts in the `cisco-nxos-switches` group.
+It assumes host variables for each switch holding the host and SSH credentials.
+It enables LLDP and configures an Ethernet interface as a switchport.
+
+    ---
+    - name: Ensure Cisco NX-OS switches are configured
+      hosts: cisco-nxos-switches
+      gather_facts: no
+      vars:
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_network_os: cisco.nxos.nxos
+      roles:
+        - role: cisco-nxos-switch
+          cisco_nxos_switch_config:
+            - "feature lldp"
+          cisco_nxos_switch_interface_config:
+            Ethernet1/1:
+              description: server-1
+              config:
+                - "switchport"
+                - "switchport mode access"

ansible/roles/cisco-nxos-switch/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# List of configuration lines to apply to the switch.
+cisco_nxos_switch_config: []
+
+# Interface configuration. Dict mapping switch interface names to configuration
+# dicts. Each dict contains an optional 'description' item and a 'config' item
+# which should contain a list of per-interface configuration.
+cisco_nxos_switch_interface_config: {}
+
+# Whether to save the configuration.
+cisco_nxos_switch_save: false

ansible/roles/cisco-nxos-switch/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Ensure Cisco NX-OS switches are configured
+  cisco.nxos.nxos_config:
+    content: "{{ lookup('template', 'cisco-nxos-config.j2') }}"
+    save_when: >-
+      {{ cisco_nxos_switch_save | bool | ternary('modified', 'never') }}

ansible/roles/cisco-nxos-switch/templates/cisco-nxos-config.j2

@@ -0,0 +1,16 @@
+#jinja2: trim_blocks: True,lstrip_blocks: True
+
+{% for line in cisco_nxos_switch_config %}
+{{ line }}
+{% endfor %}
+
+{% for interface, config in cisco_nxos_switch_interface_config.items() %}
+interface {{ interface }}
+{% if config.description is defined %}
+  description {{ config.description }}
+{% endif %}
+{% for line in config.config %}
+  {{ line }}
+{% endfor %}
+!
+{% endfor %}

ansible/roles/dell-switch/templates/dellos10-config.j2

@@ -4,13 +4,28 @@
 {{ line }}
 {% endfor %}
 
+{# Configure VLAN interfaces first as others might depend on them. #}
+
 {% for interface, config in dell_switch_interface_config.items() %}
+{% if 'vlan' in interface %}
 interface {{ interface }}
 {% if config.description is defined %}
-description "{{ config.description }}"
+ description "{{ config.description }}"
 {% endif %}
 {% for line in config.config %}
-{{ line }}
+ {{ line }}
+{% endfor %}
+{% endif %}
+{% endfor %}
+
+{% for interface, config in dell_switch_interface_config.items() %}
+{% if 'vlan' not in interface %}
+interface {{ interface }}
+{% if config.description is defined %}
+ description "{{ config.description }}"
+{% endif %}
+{% for line in config.config %}
+ {{ line }}
 {% endfor %}
-exit
+{% endif %}
 {% endfor %}

ansible/roles/firewalld/tasks/enabled.yml

@@ -13,6 +13,23 @@
     state: started
   become: true
 
+# NOTE: The firewalld Ansible module decides whether to use online or offline
+# (on-disk only) operations when it is imported, based on whether the firewalld
+# D-Bus interface is available. Starting the service does not guarantee that
+# the interface is ready yet, so if the first zone is created too early it is
+# written to disk only and is not loaded into the running daemon. A subsequent
+# attempt to assign an interface to that zone then fails with
+# 'INVALID_ZONE'. Wait until firewalld can be queried before configuring it.
+- name: Wait for firewalld to be ready
+  command:
+    cmd: firewall-cmd --state
+  register: firewalld_state
+  until: firewalld_state.rc == 0
+  retries: 30
+  delay: 1
+  changed_when: false
+  become: true
+
 - block:
     - name: Get firewalld current default zone
       command:

ansible/roles/ntp/tasks/sync.yml

@@ -32,4 +32,6 @@
       retries: 60
       delay: 10
       failed_when: sync_check.rc != 0
+      # NOTE(wszumski): Need to explitly skip due to retries checking stdout/rc
+      when: not ansible_check_mode | bool
   when: ntp_force_sync | bool