Ansible NGINX Plus Ingress Controller 업데이트, 롤백 자동화

ansible-nic-deploy/
├── site.yaml                      # 기존 배포 Playbook — `--tags deploy`로 업데이트에 재사용
├── rollback.yaml                  # 신규 롤백 Playbook
├── vars/
│   └── nic_vars.yaml              # helm_chart_version, nic_custom_values 정의
├── files/
│   └── npic-values.yaml           # NGINX Plus Ingress Controller 설정 등 chart values
└── tasks/
    └── deploy_nic.yaml            # site.yaml의 deploy 태그가 호출하는 Helm 배포/업데이트 task

---
# OCP 클러스터 접근 방식
cluster_auth_method: kubeconfig
cluster_validate_certs: false
# [기본값] 인벤토리에 정의되지 않았을 경우 사용 (선택 사항)
# kubeconfig_path: ~/.kube/config
cluster_token: "{{ vault_cluster_token | default('') }}"
# NIC 네임스페이스
nic_namespace: nginx-ingress
# Helm 설정
helm_release_name: npic
helm_chart_repo_name: nginx-stable
helm_chart_repo_url: https://helm.nginx.com/stable
helm_chart_name: nginx-stable/nginx-ingress
# Helm values
helm_values_file: "{{ playbook_dir }}/files/npic-values.yaml"
# NGINX 공식 프라이빗 레지스트리 로그인용 Secret (regcred) 생성 여부
# - 자체 사설 레지스트리를 사용하거나 이미지를 별도로 업로드해 두고 사용하는 경우 false로 설정하십시오.
create_nginx_registry_secret: true
# Helm Chart 버전 — 업그레이드 시 이 값만 변경하십시오.
# - Chart 버전에 호환되는 NIC 이미지 버전이 내장되어 있습니다. (예: chart 2.5.2 → app 5.4.2)
# - 실제 컨테이너 이미지는 npic-values.yaml 또는 차트 기본값을 따르므로 주석으로 기록만 해둡니다.
helm_chart_version: "2.5.2" # nginx-ingress chart version
# Helm --set 오버라이드 값 — 클러스터별로 host_vars에 재정의하여 병합할 수 있습니다.
nic_custom_values:
  controller.replicaCount: 2
  controller.service.type: "ClusterIP"
  controller.ingressClass.name: "nginx"
  # controller.resources.requests.cpu: "100m"
  # controller.resources.requests.memory: "128Mi"

---
- name: "[Deploy] Add NGINX Helm chart repository"
  ansible.builtin.command: >
    helm repo add {{ helm_chart_repo_name }} {{ helm_chart_repo_url }}
  register: repo_add_result
  changed_when: "'already exists' not in repo_add_result.stdout"
  failed_when:
    - repo_add_result.rc != 0
    - "'already exists' not in repo_add_result.stdout"
- name: "[Deploy] Update Helm repositories"
  ansible.builtin.command: helm repo update
  changed_when: false
- name: "[Deploy] Reconcile NIC via Helm"
  ansible.builtin.command: >
    helm upgrade --install {{ helm_release_name }}
    {{ helm_chart_name }}
    -n {{ nic_namespace }}
    -f {{ helm_values_file }}
    {% if helm_chart_version | default('') != '' %}--version {{ helm_chart_version }}{% endif %}
    {% for key, value in (nic_custom_values | default({})).items() %}
    --set {{ key }}={{ value }}
    {% endfor %}
    --create-namespace
    --wait
    --timeout 5m
    {{ helm_auth_opts }}
  register: helm_apply_result
  changed_when: >
    helm_apply_result.rc == 0 and
    ('has been upgraded' in helm_apply_result.stdout or
     'has been installed' in helm_apply_result.stdout or
     'STATUS: deployed' in helm_apply_result.stdout)
- name: "[Deploy] Show Helm apply result"
  ansible.builtin.debug:
    msg: "{{ helm_apply_result.stdout_lines }}"
  when: helm_apply_result is defined
- name: "[Deploy] Wait for NIC pod to be Running"
  ansible.builtin.command: >
    kubectl rollout status deployment
    -l app.kubernetes.io/instance={{ helm_release_name }}
    -n {{ nic_namespace }}
    --timeout=120s
    {{ kubectl_auth_opts }}
  register: rollout_status
  changed_when: false

rollback.yaml
  ① 릴리스 존재 검사        helm status → 없으면 end_host로 해당 호스트만 종료
  ② 히스토리 출력           helm history → revision 표 로그에 남기기
  ③ 롤백 전 버전 스냅샷     helm get metadata → chart/app 버전 저장
  ④ Helm 롤백 실행          helm rollback (--wait --timeout)
  ⑤ 롤아웃/Pod 확인         kubectl rollout status + get pods
  ⑥ 롤백 후 버전 비교 출력  helm get metadata → Before/After chart/app 버전 비교

---
- name: NIC Rollback on OpenShift
  hosts: ocp_clusters
  gather_facts: false
  vars_files:
    - vars/nic_vars.yaml
    # - vars/vault.yaml
  tasks:
    - name: Include common facts setup
      ansible.builtin.import_tasks: tasks/set_common_facts.yaml
      tags: always
    - name: "[Rollback] Check if Helm release exists"
      ansible.builtin.command: >
        helm status {{ helm_release_name }}
        -n {{ nic_namespace }}
        {{ helm_auth_opts }}
      register: helm_check
      failed_when: false
      changed_when: false
    - name: "[Rollback] Abort if release not found"
      ansible.builtin.debug:
        msg: "Helm release '{{ helm_release_name }}' not found. Skipping rollback for this host."
      when: helm_check.rc != 0
    - name: "[Rollback] Stop play for this host if release not found"
      ansible.builtin.meta: end_host
      when: helm_check.rc != 0
    - name: "[Rollback] Show Helm release history"
      ansible.builtin.command: >
        helm history {{ helm_release_name }}
        -n {{ nic_namespace }}
        {{ helm_auth_opts }}
      register: helm_history
      changed_when: false
    - name: "[Rollback] Print Helm release history"
      ansible.builtin.debug:
        msg: "{{ helm_history.stdout_lines }}"
    - name: "[Rollback] Get current chart/app version before rollback"
      ansible.builtin.command: >
        helm get metadata {{ helm_release_name }}
        -n {{ nic_namespace }}
        {{ helm_auth_opts }}
      register: metadata_before
      changed_when: false
    - name: "[Rollback] Execute Helm rollback"
      ansible.builtin.command: >
        helm rollback {{ helm_release_name }}
        {{ rollback_revision | default('') }}
        -n {{ nic_namespace }}
        --wait
        --timeout 5m
        {{ helm_auth_opts }}
      register: rollback_result
      changed_when: rollback_result.rc == 0
    - name: "[Rollback] Show rollback result"
      ansible.builtin.debug:
        msg: "{{ rollback_result.stdout_lines }}"
    - name: "[Rollback] Wait for NIC pod to be Running"
      ansible.builtin.command: >
        kubectl rollout status deployment
        -l app.kubernetes.io/instance={{ helm_release_name }}
        -n {{ nic_namespace }}
        --timeout=120s
        {{ kubectl_auth_opts }}
      register: rollout_status
      changed_when: false
    - name: "[Rollback] Show NIC pod status"
      ansible.builtin.command: >
        kubectl get pods
        -n {{ nic_namespace }}
        -l app.kubernetes.io/instance={{ helm_release_name }}
        {{ kubectl_auth_opts }}
      register: pod_status
      changed_when: false
    - name: "[Rollback] Print NIC pod status"
      ansible.builtin.debug:
        msg: "{{ pod_status.stdout_lines }}"
    - name: "[Rollback] Get chart/app version after rollback"
      ansible.builtin.command: >
        helm get metadata {{ helm_release_name }}
        -n {{ nic_namespace }}
        {{ helm_auth_opts }}
      register: metadata_after
      changed_when: false
    - name: "[Rollback] Print rollback summary"
      ansible.builtin.debug:
        msg: "{{ ['=== Before ==='] + metadata_before.stdout_lines + ['=== After ==='] + metadata_after.stdout_lines }}"

- name: "[Rollback] Check if Helm release exists"
  ansible.builtin.command: >
    helm status {{ helm_release_name }}
    -n {{ nic_namespace }}
    {{ helm_auth_opts }}
  register: helm_check
  failed_when: false
  changed_when: false
- name: "[Rollback] Stop play for this host if release not found"
  ansible.builtin.meta: end_host
  when: helm_check.rc != 0

- name: "[Rollback] Show Helm release history"
  ansible.builtin.command: >
    helm history {{ helm_release_name }}
    -n {{ nic_namespace }}
    {{ helm_auth_opts }}
  register: helm_history
  changed_when: false
- name: "[Rollback] Print Helm release history"
  ansible.builtin.debug:
    msg: "{{ helm_history.stdout_lines }}"

- name: "[Rollback] Get current chart/app version before rollback"
  ansible.builtin.command: >
    helm get metadata {{ helm_release_name }}
    -n {{ nic_namespace }}
    {{ helm_auth_opts }}
  register: metadata_before
  changed_when: false

- name: "[Rollback] Execute Helm rollback"
  ansible.builtin.command: >
    helm rollback {{ helm_release_name }}
    {{ rollback_revision | default('') }}
    -n {{ nic_namespace }}
    --wait
    --timeout 5m
    {{ helm_auth_opts }}
  register: rollback_result
  changed_when: rollback_result.rc == 0

- name: "[Rollback] Wait for NIC pod to be Running"
  ansible.builtin.command: >
    kubectl rollout status deployment
    -l app.kubernetes.io/instance={{ helm_release_name }}
    -n {{ nic_namespace }}
    --timeout=120s
    {{ kubectl_auth_opts }}
  register: rollout_status
  changed_when: false
- name: "[Rollback] Show NIC pod status"
  ansible.builtin.command: >
    kubectl get pods
    -n {{ nic_namespace }}
    -l app.kubernetes.io/instance={{ helm_release_name }}
    {{ kubectl_auth_opts }}
  register: pod_status
  changed_when: false
- name: "[Rollback] Print NIC pod status"
  ansible.builtin.debug:
    msg: "{{ pod_status.stdout_lines }}"

- name: "[Rollback] Get chart/app version after rollback"
  ansible.builtin.command: >
    helm get metadata {{ helm_release_name }}
    -n {{ nic_namespace }}
    {{ helm_auth_opts }}
  register: metadata_after
  changed_when: false
- name: "[Rollback] Print rollback summary"
  ansible.builtin.debug:
    msg: "{{ ['=== Before ==='] + metadata_before.stdout_lines + ['=== After ==='] + metadata_after.stdout_lines }}"