fix: Make Consul commands conditional on TLS configuration (#1345)

Author: tired-engineer

automation/playbooks/remove_node.yml

@@ -216,14 +216,20 @@
   gather_facts: true
   vars:
     target_node: "{{ node_to_remove | default('') }}"
+    consul_http_addr: "{% if consul_tls_enable | default(true) | bool %}https{% else %}http{% endif %}://127.0.0.1:8500"
+    consul_ca_flag: "{% if consul_tls_enable | default(true) | bool %}-ca-file=/etc/consul/tls/ca.crt{% endif %}"
+    consul_client_flags: >-
+      {% if consul_tls_enable | default(true) | bool %}
+      -client-cert=/etc/consul/tls/server.crt -client-key=/etc/consul/tls/server.key
+      {% endif %}
   tasks:
     - block:
         - name: Fetch consul cluster members before removal
           run_once: true # noqa run-once
           ansible.builtin.command: >-
-            consul operator raft list-peers \
-              -http-addr=https://127.0.0.1:8500 \
-              -ca-file=/etc/consul/tls/ca.crt
+            consul operator raft list-peers
+            -http-addr={{ consul_http_addr }}
+            {{ consul_ca_flag }}
           changed_when: false
           register: consul_members_list_before
           until: consul_members_list_before.rc == 0
@@ -250,10 +256,10 @@
         - name: Force-leave target node from consul cluster
           run_once: true # noqa run-once
           ansible.builtin.command: >-
-            consul force-leave \
-              -http-addr=https://127.0.0.1:8500 \
-              -ca-file=/etc/consul/tls/ca.crt \
-              {{ hostvars[target_node].ansible_hostname | default(target_node) }}
+            consul force-leave
+            -http-addr={{ consul_http_addr }}
+            {{ consul_ca_flag }}
+            {{ hostvars[target_node].ansible_hostname | default(target_node) }}
           when:
             - inventory_hostname != target_node
             - consul_members_list_before.stdout | default('') is search(hostvars[target_node].ansible_hostname | default(target_node))
@@ -278,11 +284,10 @@
         - name: Remove target node from the Raft configuration
           run_once: true # noqa run-once
           ansible.builtin.command: >-
-            consul operator raft remove-peer -id="{{ target_raft_id }}" \
-              -http-addr=https://127.0.0.1:8500 \
-              -ca-file=/etc/consul/tls/ca.crt \
-              -client-cert=/etc/consul/tls/server.crt \
-              -client-key=/etc/consul/tls/server.key
+            consul operator raft remove-peer -id="{{ target_raft_id }}"
+            -http-addr={{ consul_http_addr }}
+            {{ consul_ca_flag }}
+            {{ consul_client_flags }}
           register: raft_remove_result
           until: raft_remove_result.rc == 0
           retries: 3
@@ -313,9 +318,9 @@
         - name: Fetch consul cluster members after removal
           run_once: true # noqa run-once
           ansible.builtin.command: >-
-            consul operator raft list-peers \
-              -http-addr=https://127.0.0.1:8500 \
-              -ca-file=/etc/consul/tls/ca.crt
+            consul operator raft list-peers
+            -http-addr={{ consul_http_addr }}
+            {{ consul_ca_flag }}
           changed_when: false
           register: consul_members_list_after
           until: consul_members_list_after.rc == 0