Do not install glusterd if we are not going to run it

roles/common/handlers/known_hosts.yaml

@@ -0,0 +1,50 @@
+- name: Wait for SSH
+  wait_for:
+    host: "{{ inventory_hostname }}"
+    port: "{{ ansible_port | default('22') }}"
+    search_regex: OpenSSH
+  delegate_to: localhost
+  become: false
+  listen: known_hosts
+
+- name: Find IP(s) for hostname
+  set_fact:
+    known_hosts_ips: "{{ lookup('community.general.dig', inventory_hostname + '.', wantlist=true) }}"
+  delegate_to: localhost
+  become: false
+  listen: known_hosts
+
+- name: Find /etc/hosts IP(s) for host
+  shell: cat /etc/hosts | awk '$2 == "{{ inventory_hostname }}" {print $1}'
+  register: known_hosts_etc
+  delegate_to: localhost
+  become: false
+  listen: known_hosts
+- name: Append /etc/hosts results
+  set_fact:
+    known_hosts_ips: "{{ known_hosts_ips + [ item ]}}"
+  when: item != ''
+  loop: "{{ known_hosts_etc.stdout_lines }}"
+  delegate_to: localhost
+  become: false
+  listen: known_hosts
+
+- name: Delete old host keys
+  shell: "sleep {{ 2 | random }}.{{ 9 | random }} && ssh-keygen -R '{{ item }}' && rm -f ~/.ssh/known_hosts.old"
+  when: item != '' and item != 'NXDOMAIN'
+  loop: "{{ known_hosts_ips + [ inventory_hostname ] }}"
+  register: known_hosts_del
+  changed_when: "'not found in' in known_hosts_del.stderr"
+  delegate_to: localhost
+  become: false
+  listen: known_hosts
+
+- name: Add new keys
+  shell: "sleep {{ 2 | random }}.{{ 9 | random }} && ssh-keyscan -H '{{ inventory_hostname }}' >> ~/.ssh/known_hosts 2>/dev/null"
+  register: keys
+  until: keys.rc == 0
+  retries: 5
+  delay: 5
+  delegate_to: localhost
+  become: false
+  listen: known_hosts

roles/common/handlers/main.yml

@@ -4,6 +4,12 @@
     state: restarted
   listen: sshd_restart
 
+- name: Known_Hosts handlers
+  ansible.builtin.include_tasks: known_hosts.yaml
+
+- name: Gluster handlers
+  ansible.builtin.include_tasks: gluster.yaml
+
 - name: Wait for SSH
   wait_for:
     host: "{{ inventory_hostname }}"

roles/gluster/defaults/main.yml

@@ -1,10 +1,6 @@
 # Disable the daemon by default
 gluster_run: false
 
-# Set a limit for port numbers
-gluster_volfile: /etc/glusterfs/glusterd.vol
-gluster_max_port: 49159
-
 # TLS params
 gluster_cert_depth: 1
 
@@ -14,15 +10,11 @@ gluster_group: gluster
 
 # Where gluster normally keeps things
 gluster_ssldir: /usr/lib/ssl
-gluster_libmnt: /var/lib/glusterd
-gluster_secure: "{{ gluster_libmnt }}/secure-access"
 
 # Where we want gluster to keep things
-gluster_datadir: /data/gluster
 gluster_keydir: /data/keys/gluster
-# Undefined by default - we only need this for persistance
-#gluster_libdev: /dev/mapper/gluster-lib
 
+# Local TLS paths
 gluster_tls_prefix: tls
 gluster_tls_cert_ext: pem
 gluster_tls_cert_dir: "{{ gluster_tls_prefix }}/certs"

roles/gluster/tasks/main.yml

@@ -1,29 +1,17 @@
-- name: Add base_user to the group "{{ gluster_group }}"
+- name: Populate group "{{ gluster_group }}"
   include_role:
     name: add_group
   vars:
     add_group_groups: "{{ gluster_group }}"
-- name: Init gluster paths
+
+- name: Gluster keys
   file:
-    path: "{{ item }}"
+    path: "{{ gluster_keydir }}"
     owner: "{{ gluster_owner }}"
     group: "{{ gluster_group }}"
     mode: '0750'
     state: directory
-  loop: [ "{{ gluster_datadir }}", "{{ gluster_keydir }}", "{{ gluster_libmnt }}" ]
-- name: Mount gluster lib storage
-  include_role:
-    name: mount
-  vars:
-    mount_dev: "{{ gluster_libdev }}"
-    mount_path: "{{ gluster_libmnt }}"
-    mount_owner: "{{ gluster_owner }}"
-    mount_group: "{{ gluster_group }}"
-    mount_mode: '0750'
-    mount_fs: xfs
-  when: gluster_libdev is defined
-
-- name: Install the TLS CA
+- name: TLS CA
   copy:
     src: "{{ gluster_tls_prefix }}/{{ gluster_ca }}"
     dest: "{{ gluster_keydir }}/ca.pem"
@@ -34,7 +22,7 @@
   changed_when: gluster_copy.src is defined
   when: gluster_ca is defined
   notify: gluster_restart
-- name: Install the TLS certificate
+- name: TLS certificate
   copy:
     src: "{{ gluster_tls_cert_dir }}/{{ gluster_tls_name }}.{{ gluster_tls_cert_ext }}"
     dest: "{{ gluster_keydir }}/node.pem"
@@ -45,7 +33,7 @@
   changed_when: gluster_copy.src is defined
   when: gluster_tls_name is defined
   notify: gluster_restart
-- name: Install the TLS key
+- name: TLS key
   copy:
     src: "{{ gluster_tls_key_dir }}/{{ gluster_tls_name }}.{{ gluster_tls_key_ext }}"
     dest: "{{ gluster_keydir }}/node.key"
@@ -57,7 +45,7 @@
   when: gluster_tls_name is defined
   notify: gluster_restart
 
-- name: Init gluster SSL path
+- name: Gluster TLS links
   file:
     path: "{{ gluster_ssldir }}"
     owner: root
@@ -66,21 +54,21 @@
     state: directory
   when: gluster_cert is defined or gluster_ca is defined
   notify: gluster_restart
-- name: Link the SSL CA
+- name: Link CA
   file:
     src: "{{ gluster_keydir }}/ca.pem"
     dest: "{{ gluster_ssldir }}/glusterfs.ca"
     state: link
   when: gluster_ca is defined
   notify: gluster_restart
-- name: Link the SSL certificate
+- name: Link certificate
   file:
     src: "{{ gluster_keydir }}/node.pem"
     dest: "{{ gluster_ssldir }}/glusterfs.pem"
     state: link
   when: gluster_tls_name is defined
   notify: gluster_restart
-- name: Link the SSL key
+- name: Link key
   file:
     src: "{{ gluster_keydir }}/node.key"
     dest: "{{ gluster_ssldir }}/glusterfs.key"
@@ -88,41 +76,7 @@
   when: gluster_tls_name is defined
   notify: gluster_restart
 
-- name: Install gluster
-  apt:
-    name: glusterfs-server
-    state: latest
-  notify: gluster_restart
-
-- name: Require TLS on the mgmt path
-  file:
-    path: "{{ gluster_secure }}"
-    owner: "{{ gluster_owner }}"
-    group: "{{ gluster_group }}"
-    mode: '0640'
-    state: touch
-  register: gluster_touch
-  when: gluster_cert is defined or gluster_ca is defined
-  changed_when: gluster_touch.diff.before.state != "file"
-  notify: gluster_restart
-- name: Accept CA-based auth on the mgmt path
-  lineinfile:
-    path: "{{ gluster_secure }}"
-    insertbefore: BOF
-    line: "option transport.socket.ssl-cert-depth {{ gluster_cert_depth }}"
-  when: gluster_ca is defined
-  notify: gluster_restart
-- name: Limit dynamic ports to a small range
-  lineinfile:
-    path: "{{ gluster_volfile }}"
-    regexp: "^[#\\s]*option max-port"
-    line: "    option max-port  {{ gluster_max_port }}"
-  notify: gluster_restart
-
-- name: Start glusterd
-  systemd:
-    name: glusterd
-    enabled: no
-    state: started
-  notify: gluster_probe
-  when: gluster_run
+- name: Install Gluster
+  include_role:
+    name: gluster_run
+  when: gluster_run

roles/gluster_run/defaults/main.yml

@@ -0,0 +1,22 @@
+# Disable the daemon by default
+gluster_run: false
+
+# Set a limit for port numbers
+gluster_volfile: /etc/glusterfs/glusterd.vol
+gluster_max_port: 49159
+
+# TLS params
+gluster_cert_depth: 1
+
+# Local FS params
+gluster_owner: root
+gluster_group: gluster
+
+# Where gluster normally keeps things
+gluster_libmnt: /var/lib/glusterd
+gluster_secure: "{{ gluster_libmnt }}/secure-access"
+
+# Where we want gluster to keep things
+gluster_datadir: /data/gluster
+# Undefined by default - we only need this for persistance
+#gluster_libdev: /dev/mapper/gluster-lib

roles/gluster_run/tasks/main.yml

@@ -0,0 +1,58 @@
+- name: Gluster paths
+  file:
+    path: "{{ item }}"
+    owner: "{{ gluster_owner }}"
+    group: "{{ gluster_group }}"
+    mode: '0750'
+    state: directory
+  loop: [ "{{ gluster_datadir }}", "{{ gluster_libmnt }}" ]
+- name: Mount gluster lib storage
+  include_role:
+    name: mount
+  vars:
+    mount_dev: "{{ gluster_libdev }}"
+    mount_path: "{{ gluster_libmnt }}"
+    mount_owner: "{{ gluster_owner }}"
+    mount_group: "{{ gluster_group }}"
+    mount_mode: '0750'
+    mount_fs: xfs
+  when: gluster_libdev is defined
+
+- name: Install gluster
+  apt:
+    name: glusterfs-server
+    state: latest
+  notify: gluster_restart
+
+- name: Require TLS on the mgmt path
+  file:
+    path: "{{ gluster_secure }}"
+    owner: "{{ gluster_owner }}"
+    group: "{{ gluster_group }}"
+    mode: '0640'
+    state: touch
+  register: gluster_touch
+  when: gluster_cert is defined or gluster_ca is defined
+  changed_when: gluster_touch.diff.before.state != "file"
+  notify: gluster_restart
+- name: Accept CA-based auth on the mgmt path
+  lineinfile:
+    path: "{{ gluster_secure }}"
+    insertbefore: BOF
+    line: "option transport.socket.ssl-cert-depth {{ gluster_cert_depth }}"
+  when: gluster_ca is defined
+  notify: gluster_restart
+- name: Limit dynamic ports to a small range
+  lineinfile:
+    path: "{{ gluster_volfile }}"
+    regexp: "^[#\\s]*option max-port"
+    line: "    option max-port  {{ gluster_max_port }}"
+  notify: gluster_restart
+
+- name: Start glusterd
+  systemd:
+    name: glusterd
+    enabled: no
+    state: started
+  notify: gluster_probe
+  when: gluster_run