shantanoo-desai/flows_cred_updater.yml

## flows_cred_updater.yml
- hosts: all
  gather_facts: false
  vars_files:
    - defaults/main.yml
    - vault.yml

  tasks:
    - name: Do Not Execute Playbook if No Flows File extra variable is mentioned
      fail:
        msg: >
          Please specify the flows file to be deployed on the fleet using:
          ansible-playbook deploy_flow.yml -e "flow=<name>.json" --ask-vault-pass
      when: flow is not defined

    - name: Checking if Flow File Exists in Directory
      stat:
        path: "{{flows_directory }}/{{ flow }}"
      delegate_to: localhost
      register: flow_file

    - name: Flow File doesn't exist
      fail:
        msg: "The Flow File does not exist in Path: {{flows_directory}}"
      when: not flow_file.stat.exists

    - name: Reading the Flow File
      set_fact:
        flow_json: "{{ lookup('ansible.builtin.file', flows_directory + '/' + flow) | from_json }}"
      when: flow_file.stat.exists

    - name: Check for Existence of either InfluxDB, MySQL or MQTT nodes in Flows
      set_fact:
        nodes_exist: true
      when: "flow_json | selectattr('type', 'equalto', node) | list | count > 0"
      loop:
        - influxdb
        - mqtt-broker
        - mysql
      loop_control:
        loop_var: node

    - name: Dynamic Credential Insertion for InfluxDB, MySQL, or MQTT Configuration Nodes
      # Use set_fact on `flow_json` variable because we want to update the same JSON structure
      set_fact:
        # Extract the dict and combine the credentials block in it
        # and merge it back into the list and update `flow_json` fact
        flow_json: "{{ flow_json[0:index]
                    + [ node | combine(node_replacements[node.type]) ]
                    + flow_json[index|int+1:] }}"

      # Loop over the list of dictionaries and determine the index of the dict
      # which has `type` value either `influxdb`, `mysql` or `mqtt`
      when: (nodes_exist is not undefined) and (nodes_exist is true)
      loop: "{{ query('ansible.utils.index_of', flow_json, 'in', matched_nodes) }}"
      loop_control:
        # Use `idx` as the variable name for the index obtained by loop
        loop_var: index
        # Observe the matches made on the Terminal as <node.id>, <node.type> for better clarity
        label: "{{ node.id ~ ', ' ~ node.type }}"
      # Variables needed for the loop
      vars:
        # call each indexed dictionary in the list as `node`
        node: "{{ flow_json[index] }}"
        # check if `type` is either `influxdb`, `mysql`, or `mqtt` and store it `matched_nodes` variable
        matched_nodes: "{{ flow_json | selectattr('type', 'in', node_replacements.keys()) }}"
        # The general Structure of the "credentials" block to be inserted if there are `matched_nodes`
        # The username, password credentials will be extracted from Ansible-Vault
        node_replacements:
          influxdb:
            credentials:
              username: "{{ influxdb.username }}"
              password: "{{ influxdb.password }}"
          MySQLdatabase:
            credentials:
              user: "{{ mysql.username }}"
              password: "{{ mysql.password }}"
          mqtt-broker:
            credentials:
              username: "{{ mqtt.username }}"
              password: "{{ mqtt.password }}"

    - name: Preparing Flow File for Deployment
      copy:
        dest: "{{ flows_directory + '/.' + flow  }}"
        content: "{{ flow_json | to_nice_json }}"
      delegate_to: localhost

    - name: Obtain the Authentication Token for Node-RED Instance
      ansible.builtin.uri:
        # API: /auth/token HTTP POST
        # Headers: Content-Type: application/json
        # Body:
        #   client_id: node-red-admin
        #   grant_type: password
        #   scope: *
        #   username: Node-RED instance username
        #   password: Node-RED instance username
        # Expected Response Code: 200
        # Response Body:
        #   {
        #     "access_token": "<token>",
        #     "expires_in": 604800,
        #     "token_type": "Bearer"
        #   }
        url: "{{ nodered_base_url }}/auth/token"
        method: POST
        body:
          client_id: node-red-admin
          grant_type: password
          scope: "*"
          username: "{{ nodered.username }}"
          password: "{{ nodered.password }}"
        body_format: form-urlencoded
        status_code: 200
      # Store the Response in a variable called `login`
      register: login
      when: flow is defined

    - name: Upload Dedicated Flow on Each Node-RED Instance in Fleet
      ansible.builtin.uri:
        # API: /nodered/flows HTTP POST
        # Headers:
        #  Authorization: Bearer <token>
        #  Content-Type: application/json
        #  Node-RED-API-Version: v1
        #  Node-RED-Deployment-Type: full
        # Body:
        #   <Flow JSON File>
        # Expected Response Code: 204
        # Response body: none
        url: "{{ nodered_base_url }}/flows"
        method: POST
        headers:
          # Obtain the Token and its Type from the `login` variable from previous task
          Authorization: "{{ login.json.token_type }} {{ login.json.access_token }}"
          Content-Type: application/json
          Node-RED-API-Version: v1
          Node-RED-Deployment-Type: full
        # `flow` is a variable containing the <name>.json of the node-RED flow to be deployed
        body: "{{ lookup('ansible.builtin.file', flows_directory + '/.' + flow) }}"
        body_format: json
        status_code: 204
      register: flow_upload_status
      when: flow is defined

    - name: Revoke the Authentication Token for Node-RED Instance
      ansible.builtin.uri:
        # API: /nodered/auth/revoke HTTP POST
        # Headers:
        #  Authorization: Bearer <token>
        #  Content-Type: application/json
        # Body:
        #   {"token": "<token>"}
        # Expected Response Code: 200
        # Response body: none
        url: "{{ nodered_base_url }}/auth/revoke"
        method: POST
        headers:
          # Obtain the Token and its Type from the `login` variable from previous task
          Authorization: "{{ login.json.token_type }} {{ login.json.access_token }}"
          Content-Type: application/json
        body: '{"token": "{{ login.json.access_token }}" }'
        body_format: json
        status_code: 200

    - name: Post Deployment Cleanup
      file:
        name: "{{ flows_directory + '/.' + flow }}"
        state: absent
      when: flow_upload_status.status == 204
      delegate_to: localhost
	- hosts: all
	gather_facts: false
	vars_files:
	- defaults/main.yml
	- vault.yml

	tasks:
	- name: Do Not Execute Playbook if No Flows File extra variable is mentioned
	fail:
	msg: >
	Please specify the flows file to be deployed on the fleet using:
	ansible-playbook deploy_flow.yml -e "flow=<name>.json" --ask-vault-pass
	when: flow is not defined

	- name: Checking if Flow File Exists in Directory
	stat:
	path: "{{flows_directory }}/{{ flow }}"
	delegate_to: localhost
	register: flow_file

	- name: Flow File doesn't exist
	fail:
	msg: "The Flow File does not exist in Path: {{flows_directory}}"
	when: not flow_file.stat.exists

	- name: Reading the Flow File
	set_fact:
	flow_json: "{{ lookup('ansible.builtin.file', flows_directory + '/' + flow) \| from_json }}"
	when: flow_file.stat.exists

	- name: Check for Existence of either InfluxDB, MySQL or MQTT nodes in Flows
	set_fact:
	nodes_exist: true
	when: "flow_json \| selectattr('type', 'equalto', node) \| list \| count > 0"
	loop:
	- influxdb
	- mqtt-broker
	- mysql
	loop_control:
	loop_var: node

	- name: Dynamic Credential Insertion for InfluxDB, MySQL, or MQTT Configuration Nodes
	# Use set_fact on `flow_json` variable because we want to update the same JSON structure
	set_fact:
	# Extract the dict and combine the credentials block in it
	# and merge it back into the list and update `flow_json` fact
	flow_json: "{{ flow_json[0:index]
	+ [ node \| combine(node_replacements[node.type]) ]
	+ flow_json[index\|int+1:] }}"

	# Loop over the list of dictionaries and determine the index of the dict
	# which has `type` value either `influxdb`, `mysql` or `mqtt`
	when: (nodes_exist is not undefined) and (nodes_exist is true)
	loop: "{{ query('ansible.utils.index_of', flow_json, 'in', matched_nodes) }}"
	loop_control:
	# Use `idx` as the variable name for the index obtained by loop
	loop_var: index
	# Observe the matches made on the Terminal as <node.id>, <node.type> for better clarity
	label: "{{ node.id ~ ', ' ~ node.type }}"
	# Variables needed for the loop
	vars:
	# call each indexed dictionary in the list as `node`
	node: "{{ flow_json[index] }}"
	# check if `type` is either `influxdb`, `mysql`, or `mqtt` and store it `matched_nodes` variable
	matched_nodes: "{{ flow_json \| selectattr('type', 'in', node_replacements.keys()) }}"
	# The general Structure of the "credentials" block to be inserted if there are `matched_nodes`
	# The username, password credentials will be extracted from Ansible-Vault
	node_replacements:
	influxdb:
	credentials:
	username: "{{ influxdb.username }}"
	password: "{{ influxdb.password }}"
	MySQLdatabase:
	credentials:
	user: "{{ mysql.username }}"
	password: "{{ mysql.password }}"
	mqtt-broker:
	credentials:
	username: "{{ mqtt.username }}"
	password: "{{ mqtt.password }}"

	- name: Preparing Flow File for Deployment
	copy:
	dest: "{{ flows_directory + '/.' + flow }}"
	content: "{{ flow_json \| to_nice_json }}"
	delegate_to: localhost

	- name: Obtain the Authentication Token for Node-RED Instance
	ansible.builtin.uri:
	# API: /auth/token HTTP POST
	# Headers: Content-Type: application/json
	# Body:
	# client_id: node-red-admin
	# grant_type: password
	# scope: *
	# username: Node-RED instance username
	# password: Node-RED instance username
	# Expected Response Code: 200
	# Response Body:
	# {
	# "access_token": "<token>",
	# "expires_in": 604800,
	# "token_type": "Bearer"
	# }
	url: "{{ nodered_base_url }}/auth/token"
	method: POST
	body:
	client_id: node-red-admin
	grant_type: password
	scope: "*"
	username: "{{ nodered.username }}"
	password: "{{ nodered.password }}"
	body_format: form-urlencoded
	status_code: 200
	# Store the Response in a variable called `login`
	register: login
	when: flow is defined

	- name: Upload Dedicated Flow on Each Node-RED Instance in Fleet
	ansible.builtin.uri:
	# API: /nodered/flows HTTP POST
	# Headers:
	# Authorization: Bearer <token>
	# Content-Type: application/json
	# Node-RED-API-Version: v1
	# Node-RED-Deployment-Type: full
	# Body:
	# <Flow JSON File>
	# Expected Response Code: 204
	# Response body: none
	url: "{{ nodered_base_url }}/flows"
	method: POST
	headers:
	# Obtain the Token and its Type from the `login` variable from previous task
	Authorization: "{{ login.json.token_type }} {{ login.json.access_token }}"
	Content-Type: application/json
	Node-RED-API-Version: v1
	Node-RED-Deployment-Type: full
	# `flow` is a variable containing the <name>.json of the node-RED flow to be deployed
	body: "{{ lookup('ansible.builtin.file', flows_directory + '/.' + flow) }}"
	body_format: json
	status_code: 204
	register: flow_upload_status
	when: flow is defined

	- name: Revoke the Authentication Token for Node-RED Instance
	ansible.builtin.uri:
	# API: /nodered/auth/revoke HTTP POST
	# Headers:
	# Authorization: Bearer <token>
	# Content-Type: application/json
	# Body:
	# {"token": "<token>"}
	# Expected Response Code: 200
	# Response body: none
	url: "{{ nodered_base_url }}/auth/revoke"
	method: POST
	headers:
	# Obtain the Token and its Type from the `login` variable from previous task
	Authorization: "{{ login.json.token_type }} {{ login.json.access_token }}"
	Content-Type: application/json
	body: '{"token": "{{ login.json.access_token }}" }'
	body_format: json
	status_code: 200

	- name: Post Deployment Cleanup
	file:
	name: "{{ flows_directory + '/.' + flow }}"
	state: absent
	when: flow_upload_status.status == 204
	delegate_to: localhost