playbook-windows.yml

# We need to have a separate playbook for windows

- name: Prepare Controller (Install gh)
  hosts: localhost
  gather_facts: yes # Required for role dependencies
  vars:
    # FORCE these variables to prevent "undefined" errors on minimal runners
    ansible_os_family: Debian
    ansible_distribution: Ubuntu
  # The 'gh' CLI tool is required on the controller (localhost) because the Windows 
  # hosts fetch their reports back to this machine, and the 'gh release upload' 
  # task is delegated to run here, not on the Windows instances themselves.
  roles:
    - role: andrewrothstein.gh
      vars:
        gh_version: "2.36.0"
        gh_os: linux
        gh_arch: amd64

- name: (windows) Install CrowdStrike Falcon
  hosts: windows
  # The any_errors_fatal field doesn't work with free strategy.
  # If there are spurious failures in the PLAY, it is good to run
  # the playbook again by removing free strategy.
  any_errors_fatal: true
  strategy: free
  gather_facts: no
  vars:
    ansible_connection_timeout: 300
  tasks:
    - name: Establish connection to Windows host
      block:
        - name: Wait for connection to be available
          wait_for_connection:
            delay: 15
            timeout: 300
            connect_timeout: 60
        - name: Verify connection with ping
          ansible.windows.win_ping:
      rescue:
        - name: Reset connection on failure
          ansible.builtin.meta: reset_connection
        - name: Retry connection with extended timeout
          wait_for_connection:
            delay: 30
            timeout: 600
            connect_timeout: 120
          retries: 5
          delay: 60
          register: retry_conn
          until: retry_conn is succeeded
    - name: Gather facts for first time
      ansible.builtin.setup:
#    - name: Install crowdstrike falcon
#      ansible.builtin.include_role:
#        name: caos.ansible_roles.install_crowdstrike_falcon
#      vars:
#        falcon_client_id: "{{ lookup('env', 'CROWDSTRIKE_CLIENT_ID') }}"
#        falcon_client_secret: "{{ lookup('env', 'CROWDSTRIKE_CLIENT_SECRET') }}"
#        falcon_customer_id: "{{ lookup('env', 'CROWDSTRIKE_CUSTOMER_ID') }}"
#        api_base_url: "https://api.laggar.gcw.crowdstrike.com"
#        win_download_path: 'C:\Windows\Temp\falcon-sensor.exe'

- name: Provision Windows test executor instances and execute tests
  hosts: windows
  # The any_errors_fatal field doesn't work with free strategy.
  # If there are spurious failures in the PLAY, it is good to run
  # the playbook again by removing free strategy.
  any_errors_fatal: true
  strategy: free 
  vars:
    ansible_win_async_startup_timeout: 180
    ansible_connection_timeout: 300
    node_version: 21.6.0
    # The following information is populated using the gathered inventory variables
    fluent_bit_package_name: "{{ tags.fb_package_name }}"
    pre_release_name: "{{ tags.pre_release_name }}"
    fb_version: "{{ tags.fb_version }}"
    os_distro: "{{ tags.os_distro }}"
    os_version: "{{ tags.os_version }}"
    arch: "{{ tags.arch }}"

    new_relic_api_key: "{{ lookup('ansible.builtin.env', 'NEW_RELIC_API_KEY') }}"
    new_relic_account_id: "{{ lookup('ansible.builtin.env', 'NEW_RELIC_ACCOUNT_ID') }}"
    new_relic_region: "{{ lookup('ansible.builtin.env', 'NEW_RELIC_REGION') }}"

    monitored_file: 'C:\Windows\Temp\tail-log-file-test'
    monitored_tcp_port: 5170
    monitored_windows_log_name_using_winevtlog: 'Application'
    monitored_windows_log_name_using_winlog: 'Application'

    test_suite_folder: 'C:\Windows\Temp\test-suite'
    test_suite_report_path: '{{ test_suite_folder }}\reports\tests\test-report.xml'
    test_reports_dir: /tmp/test-reports

    node_path: 'C:\Program Files\nodejs\'

    # Value set in versions/common.yml (nrFbOutputPluginVersion) and can be overridden via extra vars (-e nr_fb_output_plugin_version=<version>)
    nr_fb_output_plugin_version: "{{ nr_fb_output_plugin_version }}"
  environment:
    NEW_RELIC_API_KEY: "{{ new_relic_api_key }}"
    NEW_RELIC_ACCOUNT_ID: "{{ new_relic_account_id }}"
    NEW_RELIC_REGION: "{{ new_relic_region }}"
  tasks:
    - name: Establish connection to Windows host
      block:
        - name: Wait for connection to be available
          wait_for_connection:
            delay: 15
            timeout: 300
            connect_timeout: 60
        - name: Verify connection
          ansible.windows.win_ping:
      rescue:
        - name: Reset connection on failure
          ansible.builtin.meta: reset_connection
        - name: Retry connection with extended timeout
          wait_for_connection:
            delay: 30
            timeout: 600
            connect_timeout: 120
          retries: 5
          delay: 60
          register: retry_conn
          until: retry_conn is succeeded

    - name: Install Infrastructure Agent
      ansible.builtin.include_role:
        name: newrelic.newrelic_install
        # Despite being the default, I want to emphasize that we do NOT want the role variables to be
        # exposed to the play. Otherwise, the "tags" variable specified below would overwrite the AWS "tags"
        # variable object (that comes from the inventory), which would cause that the `fluent_bit_package_name`
        # (or any variable depending on the AWS tags) would not be resolvable. Note that this option is only
        # available in "include_role", and not in "import_role".
        public: false
      vars:
        targets:
          - infrastructure
        tags:
          product: logging
          owning_team: logging
          project: fluent-bit-packaging-and-testing

    - name: Configure log forwarding
      ansible.builtin.include_role:
        name: create_logging_configs

    - name: Install Fluent Bit package to be tested for this distro
      ansible.builtin.include_role:
        name: install_fluent_bit_from_gh_prerelease
      vars:
        fb_package_name: "{{ fluent_bit_package_name }}"
        gh_prerelease_tag: "{{ pre_release_name }}"
      when: pre_release_name is not regex('^local-.*')

    - name: Install NR Fluent Bit output
      ansible.builtin.include_role:
        name: install_nr_fluent_bit_output
      vars:
        plugin_arch: "{{ (arch == 'win64') | ternary('amd64','386') }}"
        plugin_version: "{{ nr_fb_output_plugin_version }}"

    - name: Install Node
      win_chocolatey:
        name: nodejs
        version: '{{ node_version }}'

    - name: Capture contents of PATH environment variable
      ansible.windows.win_shell: echo "$env:PATH"
      register: original_path

    - name: Include node paths into patched_path
      set_fact:
        patched_path: '{{ original_path.stdout }};{{ node_path }}'

    - name: Copy test suite
      ansible.windows.win_copy:
        src: ../../integration-tests/test-suite
        dest: 'C:\Windows\Temp\'

    - name: Install test-suite dependencies
      ansible.windows.win_shell: 'npm i'
      args:
        chdir: '{{ test_suite_folder }}'
      environment:
        PATH: '{{ patched_path }}'

    - name: Remove previous reports
      ansible.windows.win_file:
        path: '{{ test_suite_folder }}\reports'
        state: absent

    - name: Validate fb_version variable is set and valid
      ansible.builtin.assert:
        that:
          - fb_version is defined
          - fb_version | length > 0
          - fb_version is match('^[0-9]+\.[0-9]+\.[0-9]+(?:-[\w.-]+)?$')
        fail_msg: "fb_version must be set to a valid semantic version (e.g., 4.2.2 or 4.2.2-beta). Current value: {{ fb_version | default('UNDEFINED') }}"
        success_msg: "fb_version is valid: {{ fb_version }}"

    - name: Run test-suite (async with timeout)
      ansible.windows.win_shell: 'npm run test'
      args:
        chdir: '{{ test_suite_folder }}'
        creates: '{{ test_suite_folder }}\reports'
      async: 1800  # 30 minutes timeout
      poll: 0      # fire and forget, check status separately
      environment:
        PATH: '{{ patched_path }}'
        LOGGING_ENDPOINT: https://log-api.newrelic.com/log/v1
        NERD_GRAPH_URL: https://api.newrelic.com/graphql
        API_KEY: "{{ new_relic_api_key }}"
        ACCOUNT_ID: "{{ new_relic_account_id }}"
        MONITORED_FILE: '{{ monitored_file }}'
        MONITORED_TCP_PORT: "{{ monitored_tcp_port }}"
        MONITORED_WINDOWS_LOG_NAME_USING_WINLOG: "{{ monitored_windows_log_name_using_winevtlog }}"
        MONITORED_WINDOWS_LOG_NAME_USING_WINEVTLOG: "{{ monitored_windows_log_name_using_winlog }}"
        EXPECTED_FB_VERSION: "{{ fb_version }}"
      register: test_job

    # Robust async status check with connection recovery for Windows
    - name: Wait for test-suite to complete (with reconnection support)
      block:
        - name: Check async job status
          ansible.builtin.async_status:
            jid: "{{ test_job.ansible_job_id }}"
          register: test_result
          until: test_result.finished
          retries: 60       # retry up to 60 times
          delay: 30         # wait 30 seconds between retries (total ~30 min)
      rescue:
        - name: Attempt to re-establish connection after failure
          wait_for_connection:
            delay: 15
            timeout: 180
            connect_timeout: 60
          retries: 5
          delay: 30
          register: reconnect_attempt
          until: reconnect_attempt is succeeded

        - name: Reset connection
          ansible.builtin.meta: reset_connection

        - name: Verify connection is working
          ansible.windows.win_ping:
          retries: 3
          delay: 10

        - name: Retry async status check after reconnection
          ansible.builtin.async_status:
            jid: "{{ test_job.ansible_job_id }}"
          register: test_result
          until: test_result.finished
          retries: 30
          delay: 30
          ignore_errors: yes

    - name: Log test result status
      ansible.builtin.debug:
        msg: "Test result for {{ inventory_hostname }}: finished={{ test_result.finished | default('unknown') }}"
      when: test_result is defined

    # Reconnect before fetch
    - name: Re-establish connection before fetching results
      block:
        - name: Wait for connection
          wait_for_connection:
            delay: 5
            timeout: 180
            connect_timeout: 60
        - name: Verify with ping
          ansible.windows.win_ping:
      rescue:
        - name: Reset connection on failure
          ansible.builtin.meta: reset_connection
        - name: Retry connection
          wait_for_connection:
            delay: 15
            timeout: 300
            connect_timeout: 120
          retries: 5
          delay: 45

    - name: Fetch results
      fetch:
        flat: true # behave like copy, we only want the file, not the whole path
        src: '{{ test_suite_report_path }}'
        dest: '{{ test_reports_dir }}/{{ fb_version }}_{{ os_distro }}_{{ os_version }}_{{ arch }}.xml'
      register: fetch_result
      retries: 5
      delay: 15
      until: fetch_result is succeeded
     
    - name: Rename Windows report for merging (Unique per host)
      ansible.builtin.copy:
        src: "{{ test_reports_dir }}/{{ fb_version }}_{{ os_distro }}_{{ os_version }}_{{ arch }}.xml"
        dest: "{{ test_reports_dir }}/{{ lookup('env', 'TEST_REPORT_NAME') | regex_replace('\\.xml$', '') }}-windows-{{ os_version }}-{{ arch }}.xml"
      delegate_to: localhost

    - name: Upload Windows report to release
      command: "gh release upload {{ pre_release_name }} {{ test_reports_dir }}/{{ lookup('env', 'TEST_REPORT_NAME') | regex_replace('\\.xml$', '') }}-windows-{{ os_version }}-{{ arch }}.xml --clobber"
      delegate_to: localhost
      register: upload_result
      until: upload_result.rc == 0
      retries: 5
      delay: 10