version: 11.1.0

nova/core/galaxy.yml

@@ -1,6 +1,6 @@
 namespace: nova
 name: core
-version: 11.0.3
+version: 11.1.0
 readme: README.md
 authors:
   - https://github.com/novateams

nova/core/plugins/inventory/providentia_v3.py

@@ -230,56 +230,53 @@ async def fetch_from_providentia(self, endpoint=""):
     def fetch_creds(self):
         """
         Retrieve deployer credentials from Ansible Vault in the following order of precedence:
-        1. Environment and project specific credentials eg. dev_projectA_providentia_api_token or dev_projectA_deployer_username and dev_projectA_deployer_password
-        2. Project specific credentials eg. projectA_providentia_api_token or projectA_deployer_username and projectA_deployer_password
-        3. Environment specific credentials eg. dev_providentia_api_token or dev_deployer_username and dev_deployer_password
-
-        4. Default credentials eg. providentia_api_token or deployer_username and deployer_password
-
-        API token is preferred over username/password when both are available.
+        1. env_project_providentia_api_token
+        2. project_providentia_api_token
+        3. env_providentia_api_token
+        4. env_project_deployer_username + env_project_deployer_password
+        5. project_deployer_username + project_deployer_password
+        6. env_deployer_username + env_deployer_password
+        7. providentia_api_token
+        8. deployer_username + deployer_password
+
+        API token is preferred at each prefixed level, but falls back to all prefixed
+        credential pairs before the unprefixed api token.
+        Username and password must both be defined at the same prefix level.
         """
-        # Build prefixes in precedence order
+
         prefixes = []
         if self.environment and self.project:
-            prefixes.append((f"{self.environment}_{self.project}_", 'project_'))
+            prefixes.append(f"{self.environment}_{self.project}_")
         if self.project:
-            prefixes.append((f"{self.project}_", 'project_'))
+            prefixes.append(f"{self.project}_")
         if self.environment:
-            prefixes.append((f"{self.environment}_", 'env_'))
+            prefixes.append(f"{self.environment}_")
 
-        # Check for API token first (preferred over username/password)
-        for option_prefix, inv_prefix in prefixes:
-            api_token = self._options.get(f"{option_prefix}providentia_api_token")
-            if api_token is not None:
-                self.inventory.set_variable("all", f"{inv_prefix}providentia_api_token", api_token)
+        for prefix in prefixes:
+            api_token = self._options.get(f"{prefix}providentia_api_token")
+            if api_token:
                 return {'api_token': api_token}
 
-        default_api_token = self._options.get('providentia_api_token')
-        if default_api_token is not None:
-            return {'api_token': default_api_token}
-
-        # Fall back to username/password credentials
-        for option_prefix, inv_prefix in prefixes:
-            username = self._options.get(f"{option_prefix}deployer_username")
-            password = self._options.get(f"{option_prefix}deployer_password")
-            if username is not None and password is not None:
-                self.inventory.set_variable("all", f"{inv_prefix}deployer_username", username)
-                self.inventory.set_variable("all", f"{inv_prefix}deployer_password", password)
+        for prefix in prefixes:
+            username = self._options.get(f"{prefix}deployer_username")
+            password = self._options.get(f"{prefix}deployer_password")
+            if username and password:
                 return {'username': username, 'password': password}
 
-        default_username = self.get_option('deployer_username')
-        default_password = self.get_option('deployer_password')
+        api_token = self._options.get("providentia_api_token")
+        if api_token:
+            return {'api_token': api_token}
 
-        if default_username is None:
-            raise AnsibleParserError('Error - deployer_username not found in Ansible vault')
+        username = self._options.get("deployer_username")
+        password = self._options.get("deployer_password")
+        if username and password:
+            return {'username': username, 'password': password}
 
-        if default_password is None:
-            raise AnsibleParserError('Error - deployer_password not found in Ansible vault')
-
-        return {
-            'username': default_username,
-            'password': default_password
-        }
+        raise AnsibleParserError(
+            'Error - No valid Providentia credentials found in Ansible vault, '
+            'please provide a minimum of:\n'
+            'providentia_api_token or deployer_username and deployer_password'
+        )
 
     def fetch_access_token(self, creds):
         if 'api_token' in creds:

nova/core/roles/cleanup/tasks/routeros.yml

@@ -2,3 +2,4 @@
 - name: Cleaning up RouterOS...
   community.routeros.command:
     commands: "{{ cleanup_routeros_commands }}"
+  retries: 3

nova/core/roles/connection/tasks/main.yml

@@ -102,3 +102,14 @@
     - ansible_facts.system | default('') == "Win32NT"
     - not role_only
     - not role_only_wp
+
+# Temporary workaround for Ubuntu 26.04 since the sudo.rs does not currently work with become in Ansible
+# It's done here since it needs to happen at a very early stage of the deployment
+# https://github.com/ansible/ansible/pull/86905
+- name: Setting sudo.ws as default for {{ ansible_facts.distribution_release | default('') }}...
+  ansible.builtin.command: update-alternatives --set sudo /usr/bin/sudo.ws
+  changed_when: true
+  when:
+    - ansible_facts.distribution_release | default('') == "resolute"
+    - fresh_deploy | bool
+    - sudo_requires_password | bool

nova/core/roles/deploy_vars/README.md

@@ -10,21 +10,16 @@ none
 
 Refer to the [defaults/main.yml](https://github.com/novateams/nova.core/blob/main/nova/core/roles/deploy_vars/defaults/main.yml) file for a list and description of the variables used in this role.
 
-Pre-built variables that come from the Providentia inventory plugin if it's used. These can be useful when working with multiple projects with the same name. To avoid using incorrect information for projects, the deployer username and password can be prefixed with either `project` or `project` and `environment` to make them unique.
+Pre-built variables that come from the Providentia inventory plugin if it's used. These can be useful when working with multiple projects with the same name. To avoid using incorrect information for projects, the deployer username and password can be prefixed with either `environment` + `project`, `project` or `environment` to make them unique when multiple projects with the same name are used in different environments.
 
-The username and password of the deployer for a specific project in a specific environment. When both `project` and `environment` are defined in the Providentia inventory configuration.
-
-`env_project_deployer_username`
-`env_project_deployer_password`
-
-For the following example Providentia inventory configuration the variables in Ansible Vault can be `test_testing_deployer_username` and `test_testing_deployer_password`.
+For the following example Providentia inventory configuration the variables in Ansible Vault can be `test1_testing_deployer_username` and `test1_testing_deployer_password`.
 
 ```yaml
 ---
 plugin: nova.core.providentia_v3
 providentia_host: https://providentia.example.com
 project: testing
-environment: test
+environment: test1
 sso_token_url: https://keycloak.example.com/realms/Apps/protocol/openid-connect/token
 ```