Set the RabbitMQ admin user permissions in a way that does not overwrite other vhosts

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

roles/odcs/backend/tasks/main.yml

@@ -108,38 +108,17 @@
   - odcs
   - odcs/backend
 
-- name: Create the admin user for the odcs vhost
-  run_once: true
-  delegate_to: "rabbitmq01{{ env_suffix }}.phx2.fedoraproject.org"
-  rabbitmq_user:
-    user: admin
-    password: "{{ rabbitmq_odcs_admin_password_staging }}"
-    permissions:
-      - vhost: /odcs
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
-    tags: management
-  when: env == "staging"
-  tags:
-  - rabbitmq_cluster
-  - config
-  - odcs
-  - odcs/backend
-
 - name: Create the admin user for the odcs vhost (prod)
   run_once: true
   delegate_to: "rabbitmq01{{ env_suffix }}.phx2.fedoraproject.org"
   rabbitmq_user:
     user: admin
-    password: "{{ rabbitmq_odcs_admin_password_production }}"
+    password: "{{ (env == 'production')|ternary(rabbitmq_odcs_admin_password_production, rabbitmq_odcs_admin_password_staging) }}"
-    permissions:
+    vhost: /odcs
-      - vhost: /odcs
+    configure_priv: .*
-        configure_priv: .*
+    read_priv: .*
-        read_priv: .*
+    write_priv: .*
-        write_priv: .*
     tags: management
-  when: env != "staging"
   tags:
   - rabbitmq_cluster
   - config
@@ -167,11 +146,10 @@
   delegate_to: "rabbitmq01{{ env_suffix }}.phx2.fedoraproject.org"
   rabbitmq_user:
     user: "odcs-private-queue{{ env_suffix }}"
-    permissions:
+    vhost: /odcs
-      - vhost: /odcs
+    configure_priv: .*
-        configure_priv: .*
+    write_priv: .*
-        write_priv: .*
+    read_priv: .*
-        read_priv: .*
     state: present
   tags:
   - rabbitmq_cluster

roles/rabbitmq_cluster/tasks/main.yml

@@ -224,48 +224,20 @@
   - rabbitmq_cluster
   - config
 
-- name: Create the admin user for the pubsub vhost
+- name: Create the admin user for the {{ item }} vhost
   rabbitmq_user:
     user: admin
-    password: "{{ rabbitmq_admin_password_staging }}"
+    password: "{{ (env == 'production')|ternary(rabbitmq_admin_password_production, rabbitmq_admin_password_staging) }}"
-    permissions:
+    vhost: "{{ item }}"
-      - vhost: /
+    configure_priv: .*
-        configure_priv: .*
+    read_priv: .*
-        read_priv: .*
+    write_priv: .*
-        write_priv: .*
-      - vhost: /pubsub
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
-      - vhost: /public_pubsub
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
     tags: management
-  when: env == "staging" and inventory_hostname.startswith('rabbitmq01')
+  with_items:
-  tags:
+  - /
-  - rabbitmq_cluster
+  - /pubsub
-  - config
+  - /public_pubsub
-
+  when: inventory_hostname.startswith('rabbitmq01')
-- name: Create the admin user for the pubsub vhost
-  rabbitmq_user:
-    user: admin
-    password: "{{ rabbitmq_admin_password_production }}"
-    permissions:
-      - vhost: /
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
-      - vhost: /pubsub
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
-      - vhost: /public_pubsub
-        configure_priv: .*
-        read_priv: .*
-        write_priv: .*
-    tags: management
-  when: env == "production" and inventory_hostname.startswith('rabbitmq01')
   tags:
   - rabbitmq_cluster
   - config