fix: Make Consul commands conditional on TLS configuration

[tired-engineer]

Fixes #1344

Problem

Consul operator commands in remove_node.yml were hardcoded to use HTTPS and TLS certificates, causing failures when TLS is disabled on the cluster.

Error encountered:
FAILED! => {"attempts": 3, "cmd": ["consul", "operator", "raft",
"list-peers", "-http-addr=https://127.0.0.1:8500",
"-ca-file=/etc/consul/tls/ca.crt"], "msg": "non-zero return code",
"rc": 1, "stderr": "Error initializing client: Error loading CA File:
open /etc/consul/tls/ca.crt: no such file or directory"}

Solution

Made all Consul CLI commands conditionally use TLS based on the consul_tls_enable variable:

• Added play-level variables to eliminate code duplication:

  • consul_http_addr: Conditionally uses https/http
  • consul_ca_flag: Conditionally includes -ca-file flag
  • consul_client_flags: Conditionally includes client cert/key flags

• Updated four Consul commands to use these variables:

  1. consul operator raft list-peers (pre-removal check)
  2. consul force-leave
  3. consul operator raft remove-peer
  4. consul operator raft list-peers (post-removal verification)

Implementation

Uses Jinja2 templating to check consul_tls_enable | default(false) | bool, defaulting to false if undefined. This ensures backward compatibility and allows the playbook to work with both TLS-enabled and TLS-disabled Consul clusters.

Resolved with: Claude Sonnet 4.5 (Cascade IDE)

[vitabaks]

Ok. Thanks for the contribution!

[Copilot]

Pull Request Overview

This PR fixes Consul operator commands in the remove_node.yml playbook to work correctly when TLS is disabled. Previously, commands were hardcoded to use HTTPS and TLS certificates, causing failures when consul_tls_enable was false.

• Introduced play-level variables (consul_http_addr, consul_ca_flag, consul_client_flags) to conditionally include TLS-related flags based on consul_tls_enable
• Updated four Consul CLI commands to use these conditional variables instead of hardcoded TLS parameters
• Added proper defaults to ensure backward compatibility (defaults to false if undefined)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.