Prevent broad Ansible playbooks from entering module roles on unrelated hosts

[Vonng]

Problem

Several Pigsty deployment playbooks intentionally use hosts: all so that module membership can be selected from inventory variables. In a mixed inventory, however, hosts that do not belong to a module may still enter or partially evaluate that module's role/tasks.

A practical example is an inventory that defines MinIO hosts but no PostgreSQL cluster. Running the broad deployment playbook can reach PostgreSQL identity/task evaluation on a MinIO-only host and fail with errors such as:

Error while resolving value for 'pg_instance': 'pg_cluster' is undefined
Task failed: 'item' is undefined

MinIO has a related membership problem:

• A fixed inventory group name such as hosts: minio does not support user-defined MinIO group names.
• A role default such as minio_cluster: minio makes the variable unsuitable as a host-membership marker, because unrelated hosts may inherit it.

Expected behavior

• A broad module play should operate only on hosts where the corresponding cluster marker is explicitly defined:
  • pg_cluster
  • minio_cluster
  • redis_cluster
  • mysql_cluster
  • kafka_cluster
• A non-member host should leave only the current play. Later plays in deploy.yml must remain reachable.
• Membership filtering should check only the cluster marker. Missing instance identity such as *_seq, node number, or role should fail explicitly inside the module's existing identity validation instead of silently skipping the host.
• Custom MinIO inventory group names should work without requiring a hard-coded minio group.
• The implementation must remain compatible with Ansible 2.9.

Proposed minimal change

Use a compact play-level gate on broad module entry points:

pre_tasks: [ { name: skip non-pgsql hosts, meta: end_host, when: pg_cluster is not defined, tags: always } ]

Keep the corresponding role/block-level when: <cluster> is defined as a second safety layer for execution paths that bypass pre-tasks, such as --start-at-task.

Where a destructive role does not already run a dedicated identity role, add one small fail-fast assertion before any removal task. For example, pgsql-rm.yml currently runs node_id and pg_remove, not the full pg_id role. The removal role should validate only the local identity it requires rather than introducing cluster-wide topology checks that could block cleanup of a degraded cluster.

Likely broad-entry surfaces include:

• deploy.yml (MinIO and PostgreSQL plays)
• slim.yml
• pgsql.yml, pgsql-rm.yml
• minio.yml, minio-rm.yml
• redis.yml, redis-rm.yml
• mysql.yml
• kafka.yml, kafka-rm.yml

Explicit-target operational playbooks such as PostgreSQL user/database/PITR workflows, strict removal workflows, and fixed-group plays such as ETCD should retain their existing contracts unless they independently exhibit the same broad-entry behavior.

This issue is limited to play/role entry filtering. Task-local loops that intentionally traverse hostvars or inventory groups should be reviewed separately.

Acceptance criteria

• All affected playbooks pass --syntax-check with Ansible 2.9 and the current supported Ansible version.
• In a synthetic mixed inventory, a non-member host exits the current module play without failure.
• A later play still runs on that host, confirming that meta: end_host is play-local.
• Role/block-level guards prevent execution when pre-tasks are bypassed.
• A host with a cluster marker but missing required instance identity fails at the first identity assertion.
• No new validation framework or broad role refactor is introduced.

[Vonng]

Proposed solution

A minimal implementation following the issue's design has been prepared and validated locally.

1. Use the cluster variable only as the membership marker

Each broad module play gets one compact, Ansible 2.9-compatible entry gate:

pre_tasks: [ { name: skip non-pgsql hosts, meta: end_host, when: pg_cluster is not defined, tags: always } ]

Equivalent gates use minio_cluster, redis_cluster, mysql_cluster, or kafka_cluster.

The gate intentionally does not check *_seq, node number, or role. A host with a declared cluster but incomplete instance identity belongs to the module and should fail explicitly during identity validation rather than disappear as a silent skip.

2. Keep a small second-layer guard

The corresponding role or outer execution block retains:

when: <cluster> is defined

This is a safety fallback for paths such as --start-at-task that can bypass pre-tasks. It prevents module actions on unrelated hosts without introducing a shared gating framework.

3. Fail fast at destructive role boundaries

Existing MinIO, Kafka, and MySQL identity checks remain in place. The missing PostgreSQL and Redis removal checks are handled with one local assertion at the beginning of each destructive role.

Notably, pgsql-rm.yml runs node_id followed by pg_remove; it does not run the full pg_id role. The proposed pg_remove assertion validates only pg_cluster, pg_seq, and pg_role. Adding the complete pg_id role would unnecessarily impose cluster-wide topology checks, such as requiring exactly one primary, and could prevent legitimate cleanup of a degraded cluster.

4. Make MinIO membership explicit

minio_cluster should not have an active role default. It becomes an explicit inventory membership marker, while deploy.yml selects from hosts: all and filters by that marker. This supports conventional and user-defined MinIO group names without making unrelated hosts appear to be MinIO members.

ETCD keeps its existing fixed-group contract and default because it is not selected through a broad marker-driven play.

Validation completed locally

• Syntax checks passed with Ansible 2.9.27 and 2.21.1.
• A synthetic mixed inventory confirmed that non-member hosts leave only the current play.
• Later plays still execute on those hosts.
• Role-level guards prevent action when pre-tasks are bypassed.
• Missing PostgreSQL or Redis identity fields fail at the first assertion even under play-level ignore_errors: true.
• Valid identities pass on both Ansible versions.
• No real initialization or removal playbook was executed.

The implementation deliberately excludes task-local inventory traversal, PostgreSQL user/database/PITR workflows, and unrelated cleanup or validation refactors.