Merge pull request sap-linuxlab#1213 from marcelmamula/swpm_idempotent

sap_swpm: Add Pseudo-Idempotency

Author: marcelmamula

roles/sap_swpm/README.md

@@ -685,6 +685,13 @@ Define UID of Linux user SIDADM.
 
 ### Miscellaneous Variables
 
+#### sap_swpm_force
+- _Type:_ `bool`
+- _Default:_ `false`
+
+Optional override that forces execution of installation tasks if existing SAP instance is detected.<br>
+This variable should be used with caution as running SWPM installation with active SAP instances can lead to corruption of existing SAP installation.
+
 #### sap_swpm_ascs_install_gateway
 - _Type:_ `string`
 - _Default:_ `true`

roles/sap_swpm/defaults/main.yml

@@ -508,3 +508,20 @@ sap_swpm_display_unattended_output: false
 
 # Set which Ansible Collection to use when calling sap_install roles.
 sap_swpm_sap_install_collection: 'community.sap_install'
+
+# Optional override that forces execution of installation tasks if existing SAP instance is detected (Boolean).
+# WARNING: This variable should be used with caution
+# as running SWPM installation with active SAP instances can lead to corruption of existing SAP installation.
+sap_swpm_force: false
+
+# Skip all detection checks. Use ONLY for testing/development on clean systems.
+# WARNING: Skipping detection can lead to data loss if installation already exists!
+# This will bypass all safety checks including saphostctrl, sapcontrol, and file existence checks.
+# sap_swpm_skip_detection: false
+
+# Explicit acknowledgement required for Database Load products (NW_ABAP_DB, NW_Java_DB, etc.) (Boolean).
+# These products cannot be detected by this role on empty managed hosts, because no local instance files are created.
+# Running SWPM against an existing database WILL DROP and recreate the schema user, causing DATA LOSS on existing systems.
+# Set to 'true' only after confirming the target database is empty or intended to be overwritten.
+# WARNING: sap_swpm_force does NOT cover this scenario and it only applies to detection of existing instances.
+sap_swpm_db_load_force: false

roles/sap_swpm/tasks/main.yml

@@ -40,17 +40,22 @@
   tags: always
 
 - name: SAP SWPM - Run pre_install tasks
-  ansible.builtin.import_tasks: pre_install.yml
+  ansible.builtin.import_tasks:
+    file: pre_install.yml
   tags:
     - sap_swpm_pre_install
     - sap_swpm_install
 
 - name: SAP SWPM - Run swpm
-  ansible.builtin.import_tasks: swpm.yml
-  when: sap_swpm_run_sapinst
+  ansible.builtin.import_tasks:
+    file: swpm.yml
+  when:
+    - sap_swpm_run_sapinst
+    - not __sap_swpm_sap_detected | d(false) or sap_swpm_force | d(false)
   tags:
     - sap_swpm_install
 
-- name: SAP SWPM - Run postinstall task
-  ansible.builtin.import_tasks: post_install.yml
+- name: SAP SWPM - Run post_install task
+  ansible.builtin.import_tasks:
+    file: post_install.yml
   when: sap_swpm_run_sapinst

roles/sap_swpm/tasks/post_install.yml

@@ -1,35 +1,25 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 
-# Reason for noqa: The command might change things but we do not yet attempt to find out
-- name: SAP SWPM Post Install - ensure password expiry disabled {{ sap_swpm_sid | lower + 'adm' }}
-  ansible.builtin.shell: |
-    chage -m 0 -M 99999 -I -1 -E -1 {{ sap_swpm_sid | lower }}adm
-    chage -m 0 -M 99999 -I -1 -E -1 sapadm
-  args:
-    executable: /bin/bash
-  become: true
-  register: __sap_swpm_post_install_register_sidadm_noexpire
-  changed_when: __sap_swpm_post_install_register_sidadm_noexpire is succeeded
-  when: sap_swpm_set_sidadm_noexpire | default(true)
+# Set user expiration update
+- name: SAP SWPM Post Install - Get list of available OS users
+  ansible.builtin.getent:
+    database: passwd
 
-# Firewall steps are part of pre_tasks to ensure that ports are open before installation.
-
-########################################################################################################################
+# New task file includes detailed steps to set each parameter, instead of all at same time.
+- name: SAP SWPM Post Install - Execute user expiration task file
+  ansible.builtin.include_tasks:
+    file: post_install/set_password_expiration.yml
+  loop:
+    - "{{ sap_swpm_sid | lower }}adm"
+    - "sapadm"
+  loop_control:
+    loop_var: user_item
+  when:
+    - user_item in ansible_facts['getent_passwd']
+    - sap_swpm_set_sidadm_noexpire | d(true)
 
-- name: SAP SWPM Deployment - Finished
-  ansible.builtin.debug:
-    msg: |
-      "   SAP SWPM deployment successfully completed "
-      " "
-      "   SAP Product        -       {{ sap_swpm_product_catalog_id }}  "
-      "   SID                -       {{ sap_swpm_sid | d('') }} "
-      "   Primary Instance   -       {{ sap_swpm_pas_instance_nr | d('') }} "
-      "   Host               -       {{ ansible_facts['hostname'] }} "
-      "   FQDN               -       {{ ansible_facts['fqdn'] }}  "
-      "   IP                 -       {{ ansible_facts['default_ipv4'].address | d(ansible_facts['all_ipv4_addresses'][0]) }}  "
-#      "   Master Password    -       {{ sap_swpm_master_password }} "
-#      "   DDIC 000 Password  -       {{ sap_swpm_ddic_000_password }} "
+# Firewall steps are part of pre_tasks to ensure that ports are open before installation.
 
 # SAP HANA Client will not be installed for any installation with SAP AnyDB
 # and will only be installed alongside SAP NWAS PAS or AAS (not NWAS ASCS)
@@ -55,6 +45,49 @@
   register: __sap_swpm_post_install_register_hdbuserstore_connection
   changed_when: __sap_swpm_post_install_register_hdbuserstore_connection is succeeded
 
+
+# Restart saphostctrl process to ensure it loads information about newly installed SAP system.
+- name: SAP SWPM Post Install - Restart saphostctrl process
+  ansible.builtin.command:
+    cmd: /usr/sap/hostctrl/exe/saphostexec -restart
+  become: true
+  when:
+    - sap_swpm_install_saphostagent | d(true)
+    # Restart only for freshly installed SAP system.
+    - not __sap_swpm_sap_detected | d(false) or sap_swpm_force | d(false)
+  # Restart can be always considered changed.
+  changed_when: true
+
+
+########################################################################################################################
+
+- name: SAP SWPM Deployment - Display SAP System details after completion
+  ansible.builtin.debug:
+    msg: |
+      SAP System or Instance is deployed.
+      {% if __sap_swpm_sap_detected | d(false) and not sap_swpm_force | d(false) %}
+
+      NOTE: SAP Instance(s) were detected before installation.
+      SWPM installation steps were skipped to avoid potential issues with existing installation.
+
+      If you intend to proceed with the installation despite this warning,
+      set 'sap_swpm_force' variable to 'true' and execute this Ansible Role again.
+      {% endif %}
+      {% if __sap_swpm_sap_detected | d(false) and sap_swpm_force | d(false) %}
+
+      NOTE: SAP Instance(s) were detected before installation.
+      SWPM installation steps were executed regardless,
+      because 'sap_swpm_force' variable is set to 'true' (default is 'false').
+      {% endif %}
+
+      SAP Product        -       {{ sap_swpm_product_catalog_id }}
+      SID                -       {{ sap_swpm_sid | d('') }}
+      Primary Instance   -       {{ sap_swpm_pas_instance_nr | d('') }}
+      Host               -       {{ ansible_facts['hostname'] }}
+      FQDN               -       {{ ansible_facts['fqdn'] }}
+      IP                 -       {{ ansible_facts['default_ipv4'].address | d(ansible_facts['all_ipv4_addresses'][0]) }}
+
+
 # Now that SWPM finished we may need to deal with SUM before continuing when sap_swpm_sum_start: 'true'
 # and if we are doing OneHost or CI/PAS installation
 # If observer mode is enabled, SWPM will wait for SUM to finish before continuing so we can't do anything here
@@ -65,3 +98,4 @@
     - not __sap_swpm_fact_observer_mode
     - "'NW_ABAP_CI:' in sap_swpm_product_catalog_id | string or
        'NW_ABAP_OneHost:' in sap_swpm_product_catalog_id | string"
+    - not __sap_swpm_sap_detected | d(false) or sap_swpm_force | d(false)

roles/sap_swpm/tasks/post_install/set_password_expiration.yml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: Apache-2.0
+---
+
+# NOTE: This can be replaced completely by 'ansible.builtin.user' module when we increase minimum ansible version to 2.18!
+# Argument '-I' is set by module parameter 'password_expire_account_disable' added in 2.18.
+# ansible.builtin.user:
+#   name: "{{ user_item }}"
+#   password_expire_min: 0  # chage -m 0
+#   password_expire_max: 99999  # chage -M 99999
+#   password_expire_account_disable: -1  # chage -I -1
+#   expires: -1  # chage -E -1
+
+
+- name: SAP SWPM Post Install - Get current chage status for user {{ user_item }}
+  ansible.builtin.command:
+    cmd: chage -l {{ user_item }}
+  register: __sap_swpm_register_post_install_change
+  changed_when: false
+  become: true
+
+# Reason for noqa: Command 'chage' does not have stdout to check against so we let module decide what is considered change.
+- name: SAP SWPM Post Install - Ensure min days is 0 for {{ user_item }}  # noqa no-changed-when
+  ansible.builtin.command:
+    cmd: chage -m 0 {{ user_item }}
+  become: true
+  when: not __sap_swpm_register_post_install_change.stdout
+    | regex_search('Minimum number of days between password change\\s+:\\s+0')
+
+# Reason for noqa: Command 'chage' does not have stdout to check against so we let module decide what is considered change.
+- name: SAP SWPM Post Install - Ensure max days is 99999 for {{ user_item }}  # noqa no-changed-when
+  ansible.builtin.command:
+    cmd: chage -M 99999 {{ user_item }}
+  become: true
+  when: not __sap_swpm_register_post_install_change.stdout
+    | regex_search('Maximum number of days between password change\\s+:\\s+99999')
+
+# Reason for noqa: Command 'chage' does not have stdout to check against so we let module decide what is considered change.
+- name: SAP SWPM Post Install - Ensure password inactive is disabled (-1) for {{ user_item }}  # noqa no-changed-when
+  ansible.builtin.command:
+    cmd: chage -I -1 {{ user_item }}
+  become: true
+  when: not __sap_swpm_register_post_install_change.stdout
+    | regex_search('Password inactive\\s+:\\s+never')
+
+# Reason for noqa: Command 'chage' does not have stdout to check against so we let module decide what is considered change.
+- name: SAP SWPM Post Install - Ensure account expiration is disabled (-1) for {{ user_item }}  # noqa no-changed-when
+  ansible.builtin.command:
+    cmd: chage -E -1 {{ user_item }}
+  become: true
+  when: not __sap_swpm_register_post_install_change.stdout
+    | regex_search('Account expires\\s+:\\s+never')