mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
1cd4203c34
This commit addresses three critical compatibility issues with Ansible 12:
1. **Nested Jinja template deprecation warning**
- Fixed: `{{ lookup('file', '{{ SSH_keys.public }}') }}`
- Now: `{{ lookup('file', SSH_keys.public) }}`
- Location: files/cloud-init/base.sh:20
2. **String to boolean conversion errors in conditionals**
- Fixed: `when: item.item` (evaluates strings as truthy)
- Now: `when: item.item is defined and item.item != none`
- Location: roles/common/tasks/main.yml:20
3. **Sysctl list with None values causing boolean errors**
- Restructured list to dynamically exclude None entries
- IPv6 forwarding sysctl only added when ipv6_support is true
- Location: roles/common/tasks/ubuntu.yml:132
These changes maintain backward compatibility with older Ansible versions
while ensuring forward compatibility with Ansible 12's stricter type checking.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
Cloud-Init Files - Critical Format Requirements
⚠️ CRITICAL WARNING ⚠️
The files in this directory have STRICT FORMAT REQUIREMENTS that must not be changed by linters or automated formatting tools.
Cloud-Config Header Format
The first line of base.yml MUST be exactly:
#cloud-config
❌ DO NOT CHANGE TO:
# cloud-config(space after #) - BREAKS CLOUD-INIT PARSING- Add YAML document start
---- NOT ALLOWED IN CLOUD-INIT
Why This Matters
Cloud-init's YAML parser expects the exact string #cloud-config as the first line. Any deviation causes:
- Complete parsing failure - All directives are skipped
- SSH configuration not applied - Servers remain on port 22 instead of 4160
- Deployment timeouts - Ansible cannot connect to configure the VPN
- DigitalOcean specific impact - Other providers may be more tolerant
Historical Context
- Working: All versions before PR #14775 (August 2025)
- Broken: PR #14775 "Apply ansible-lint improvements" added space by mistake
- Fixed: PR #14801 restored correct format + added protections
See GitHub issue #14800 for full technical details.
Linter Configuration
These files are excluded from:
yamllint(.yamllintconfig)ansible-lint(.ansible-lintconfig)
This prevents automated tools from "fixing" the format and breaking deployments.
Template Variables
The cloud-init files use Jinja2 templating:
{{ ssh_port }}- Configured SSH port (typically 4160){{ lookup('file', '{{ SSH_keys.public }}') }}- SSH public key
Editing Guidelines
- Never run automated formatters on these files
- Test immediately after any changes with real deployments
- Check yamllint warnings are expected (missing space in comment, missing ---)
- Verify first line remains exactly
#cloud-config