Persist scylla-monitoring start/stop wrapper scripts on deploy (#529)

* Persist scylla-monitoring start/stop wrapper scripts on deploy.

Write /opt/scylla-monitoring/{start,stop}-monitoring.sh during monitoring
role deploy so operators can restart the stack without re-running ansible
or reconstructing start-all.sh arguments by hand.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Address Copilot review on monitoring wrapper scripts.

Quote paths and credentials, use conditional sudo for stop, move CQL
secrets to a 0600 env file sourced at runtime, and restore env vars for
ansible-driven starts.

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci: retrigger molecule workflow

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ManjotS

ansible-scylla-monitoring/defaults/main.yml

@@ -24,6 +24,9 @@ scylla_monitoring_archive_url: 'https://github.com/scylladb/scylla-monitoring/ar
 scylla_monitoring_role_config_path: "{{ inventory_dir }}"
 
 scylla_monitoring_deploy_path: /opt/scylla-monitoring
+scylla_monitoring_start_script_path: "{{ scylla_monitoring_deploy_path }}/start-monitoring.sh"
+scylla_monitoring_stop_script_path: "{{ scylla_monitoring_deploy_path }}/stop-monitoring.sh"
+scylla_monitoring_start_env_path: "{{ scylla_monitoring_deploy_path }}/start-monitoring.env"
 scylla_monitoring_data_path: "{{ scylla_monitoring_deploy_path }}/data"
 scylla_monitoring_config_path:  "{{ scylla_monitoring_deploy_path }}/config"
 scylla_monitoring_prom_rules_path:  "{{ scylla_monitoring_config_path }}/prom_rules"

ansible-scylla-monitoring/tasks/docker.yml

@@ -31,6 +31,28 @@
   when: "'cql_credentials' in groups and item.split('=')[0] == scylla_monitoring_cql_default_user | default('scylla_cql_monitor')"
   loop: "{{ groups['cql_credentials'] }}"
 
+- name: "docker.yml: Write stop monitoring wrapper script"
+  template:
+    src: stop-monitoring.sh.j2
+    dest: "{{ scylla_monitoring_stop_script_path }}"
+    mode: '0750'
+    owner: "{{ ansible_user_id }}"
+
+- name: "docker.yml: Write start monitoring env file"
+  template:
+    src: start-monitoring.env.j2
+    dest: "{{ scylla_monitoring_start_env_path }}"
+    mode: '0600'
+    owner: "{{ ansible_user_id }}"
+  when: monitoring_cql_username is defined and monitoring_cql_password is defined
+
+- name: "docker.yml: Write start monitoring wrapper script"
+  template:
+    src: start-monitoring.sh.j2
+    dest: "{{ scylla_monitoring_start_script_path }}"
+    mode: '0750'
+    owner: "{{ ansible_user_id }}"
+
 - name: "docker.yml: restart the docker daemon again"
   service:
     name: docker
@@ -49,15 +71,10 @@
   when: ansible_facts.services["docker.service"] is defined
 
 - name: "docker.yml: Stop monitoring"
-  shell: |
-    cd {{ base_dir }}
-    ./kill-all.sh
-    sudo ./kill-all.sh
+  command: "{{ scylla_monitoring_stop_script_path }}"
 
 - name: "docker.yml: start scylla-monitoring"
-  shell: "{{ start_command }}"
-  args:
-    chdir: "{{ base_dir }}"
+  command: "{{ scylla_monitoring_start_script_path }}"
   become: "{{ 'true' if run_docker_with_sudo is defined and run_docker_with_sudo|bool == True else 'false' }}"
   environment:
     SCYLLA_USER: "{% if monitoring_cql_username is defined and monitoring_cql_password is defined %}{{ monitoring_cql_username }}{% endif %}"

ansible-scylla-monitoring/templates/start-monitoring.env.j2

@@ -0,0 +1,4 @@
+{% if monitoring_cql_username is defined and monitoring_cql_password is defined %}
+export SCYLLA_USER={{ monitoring_cql_username | quote }}
+export SCYLLA_PSSWD={{ monitoring_cql_password | quote }}
+{% endif %}

ansible-scylla-monitoring/templates/start-monitoring.sh.j2

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd {{ base_dir | quote }}
+ENV_FILE={{ scylla_monitoring_start_env_path | quote }}
+if [ -f "$ENV_FILE" ]; then
+  # shellcheck disable=SC1090
+  . "$ENV_FILE"
+fi
+{{ start_command }}

ansible-scylla-monitoring/templates/stop-monitoring.sh.j2

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd {{ base_dir | quote }}
+./kill-all.sh || sudo ./kill-all.sh || true