spinifex/scripts/ansible/roles/vpc/tasks/present.yml

---
# Idempotent create. Every step describes-then-creates: re-running on an
# already-converged VPC produces zero changes. Tag everything with
# Name={{ dev_vpc_name }} so a single tag query finds the whole graph.

- name: vpc — find existing VPC by Name tag
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 describe-vpcs
    --filters Name=tag:Name,Values={{ dev_vpc_name }}
    --query Vpcs[0].VpcId --output text
  register: vpc_existing
  changed_when: false

- name: vpc — create VPC if missing
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-vpc
    --cidr-block {{ dev_vpc_cidr }}
    --tag-specifications
    ResourceType=vpc,Tags=[{Key=Name,Value={{ dev_vpc_name }}}]
    --query Vpc.VpcId --output text
  register: vpc_created
  when: vpc_existing.stdout | trim in ['', 'None']
  changed_when: true

- name: vpc — set VPC id fact
  ansible.builtin.set_fact:
    dev_vpc_id: >-
      {{ vpc_created.stdout | default('') | trim
         if (vpc_existing.stdout | trim in ['', 'None'])
         else vpc_existing.stdout | trim }}

- name: vpc — assert VPC id resolved
  ansible.builtin.assert:
    that: dev_vpc_id | length > 0
    fail_msg: "VPC id could not be resolved after describe/create"

- name: vpc — find existing IGW attached to this VPC
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 describe-internet-gateways
    --filters Name=attachment.vpc-id,Values={{ dev_vpc_id }}
    --query InternetGateways[0].InternetGatewayId --output text
  register: vpc_igw_existing
  changed_when: false

- name: vpc — create IGW if missing
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-internet-gateway
    --tag-specifications
    ResourceType=internet-gateway,Tags=[{Key=Name,Value={{ dev_vpc_name }}-igw}]
    --query InternetGateway.InternetGatewayId --output text
  register: vpc_igw_created
  when: vpc_igw_existing.stdout | trim in ['', 'None']
  changed_when: true

- name: vpc — set IGW id fact
  ansible.builtin.set_fact:
    dev_vpc_igw_id: >-
      {{ vpc_igw_created.stdout | default('') | trim
         if (vpc_igw_existing.stdout | trim in ['', 'None'])
         else vpc_igw_existing.stdout | trim }}

- name: vpc — attach IGW to VPC if needed
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 attach-internet-gateway
    --internet-gateway-id {{ dev_vpc_igw_id }}
    --vpc-id {{ dev_vpc_id }}
  register: vpc_igw_attach
  when: vpc_igw_existing.stdout | trim in ['', 'None']
  changed_when: true
  failed_when:
    - vpc_igw_attach.rc | default(0) != 0
    - "'Resource.AlreadyAssociated' not in (vpc_igw_attach.stderr | default(''))"

- name: vpc — find existing subnet by Name tag
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 describe-subnets
    --filters Name=vpc-id,Values={{ dev_vpc_id }}
    Name=tag:Name,Values={{ dev_vpc_name }}-public
    --query Subnets[0].SubnetId --output text
  register: vpc_subnet_existing
  changed_when: false

- name: vpc — create subnet if missing
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-subnet
    --vpc-id {{ dev_vpc_id }}
    --cidr-block {{ dev_vpc_subnet_cidr }}
    --availability-zone {{ dev_vpc_subnet_az }}
    --tag-specifications
    ResourceType=subnet,Tags=[{Key=Name,Value={{ dev_vpc_name }}-public}]
    --query Subnet.SubnetId --output text
  register: vpc_subnet_created
  when: vpc_subnet_existing.stdout | trim in ['', 'None']
  changed_when: true

- name: vpc — set subnet id fact
  ansible.builtin.set_fact:
    dev_vpc_subnet_id: >-
      {{ vpc_subnet_created.stdout | default('') | trim
         if (vpc_subnet_existing.stdout | trim in ['', 'None'])
         else vpc_subnet_existing.stdout | trim }}

- name: vpc — ensure subnet has map-public-ip-on-launch
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 modify-subnet-attribute
    --subnet-id {{ dev_vpc_subnet_id }}
    --map-public-ip-on-launch
  register: vpc_subnet_mapip
  changed_when: vpc_subnet_existing.stdout | trim in ['', 'None']
  failed_when: false

# Try tag-based lookup first. If the gateway didn't tag a previously
# created RT (spinifex gateway silently drops --tag-specifications on
# create-route-table AND no-ops create-tags for route tables — see
# mulga-siv-94; works correctly for subnets), fall back to "RT
# associated with our subnet" which doesn't need tags.
- name: vpc — find existing route table by Name tag
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 describe-route-tables
    --filters Name=vpc-id,Values={{ dev_vpc_id }}
    Name=tag:Name,Values={{ dev_vpc_name }}-public
    --query RouteTables[0].RouteTableId --output text
  register: vpc_rt_existing
  changed_when: false

- name: vpc — fallback lookup by subnet association
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 describe-route-tables
    --filters Name=association.subnet-id,Values={{ dev_vpc_subnet_id }}
    --query RouteTables[0].RouteTableId --output text
  register: vpc_rt_byassoc
  changed_when: false
  when: vpc_rt_existing.stdout | trim in ['', 'None']

- name: vpc — create route table if neither lookup found one
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-route-table
    --vpc-id {{ dev_vpc_id }}
    --query RouteTable.RouteTableId --output text
  register: vpc_rt_created
  when:
    - vpc_rt_existing.stdout | trim in ['', 'None']
    - (vpc_rt_byassoc.stdout | default('') | trim) in ['', 'None']
  changed_when: true

- name: vpc — set route-table id fact
  ansible.builtin.set_fact:
    dev_vpc_rt_id: >-
      {%- if (vpc_rt_existing.stdout | trim) not in ['', 'None'] -%}
      {{ vpc_rt_existing.stdout | trim }}
      {%- elif (vpc_rt_byassoc.stdout | default('') | trim) not in ['', 'None'] -%}
      {{ vpc_rt_byassoc.stdout | default('') | trim }}
      {%- else -%}
      {{ vpc_rt_created.stdout | default('') | trim }}
      {%- endif -%}

- name: vpc — assert route-table id resolved
  ansible.builtin.assert:
    that: dev_vpc_rt_id | length > 0
    fail_msg: "Route table id could not be resolved after describe/create"

# Spinifex gateway dropped --tag-specifications on the create call;
# apply via create-tags so re-runs can find the RT via tag filter.
- name: vpc — tag route table (workaround for create-tag-specifications gap)
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-tags
    --resources {{ dev_vpc_rt_id }}
    --tags Key=Name,Value={{ dev_vpc_name }}-public
  changed_when: false
  failed_when: false

- name: vpc — add default route via IGW (ignore RouteAlreadyExists)
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 create-route
    --route-table-id {{ dev_vpc_rt_id }}
    --destination-cidr-block 0.0.0.0/0
    --gateway-id {{ dev_vpc_igw_id }}
  register: vpc_route_add
  changed_when:
    - vpc_route_add.rc == 0
    - "'RouteAlreadyExists' not in (vpc_route_add.stderr | default(''))"
  failed_when:
    - vpc_route_add.rc != 0
    - "'RouteAlreadyExists' not in (vpc_route_add.stderr | default(''))"

- name: vpc — associate subnet with route table (ignore already-associated)
  ansible.builtin.command: >-
    {{ spinifex_aws_cli }} ec2 associate-route-table
    --route-table-id {{ dev_vpc_rt_id }}
    --subnet-id {{ dev_vpc_subnet_id }}
  register: vpc_assoc
  changed_when:
    - vpc_assoc.rc == 0
    - "'Resource.AlreadyAssociated' not in (vpc_assoc.stderr | default(''))"
  failed_when:
    - vpc_assoc.rc != 0
    - "'Resource.AlreadyAssociated' not in (vpc_assoc.stderr | default(''))"

- name: vpc — summary (present)
  ansible.builtin.debug:
    msg: |
      Dev VPC ready:
        VPC         : {{ dev_vpc_id }} ({{ dev_vpc_cidr }})
        IGW         : {{ dev_vpc_igw_id }}
        Subnet      : {{ dev_vpc_subnet_id }} ({{ dev_vpc_subnet_cidr }} @ {{ dev_vpc_subnet_az }}, public)
        Route table : {{ dev_vpc_rt_id }}

      Smoketest now finds this subnet via its existing
      Name=map-public-ip-on-launch,Values=true filter.