From c9ceecc0b1408c3e0089a6b9df9d319d3d22d605 Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Wed, 21 Oct 2026 10:54:12 +0200 Subject: [PATCH 1/3] fix(roles/graylog_datanode, roles/graylog_server): derive major.minor from the package version robustly The version was cut to its first three characters, so 7.10.x would select the 7.1 template and 10.0.x would abort. On Debian/Ubuntu, package_facts reports the version with the Debian revision (verified on Debian 13), which the previous regex did not strip. --- roles/graylog_datanode/tasks/main.yml | 14 ++++++++------ roles/graylog_server/tasks/main.yml | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml index 2946baf7b..13480ebee 100644 --- a/roles/graylog_datanode/tasks/main.yml +++ b/roles/graylog_datanode/tasks/main.yml @@ -40,20 +40,22 @@ - name: 'Get Graylog Data Node version' ansible.builtin.set_fact: - graylog_datanode__installed_version: '{{ ansible_facts["packages"]["graylog-datanode"][0]["version"] | regex_replace("\.\d+$", "") }}' + # keep major.minor only. the version is `7.2.1` on the Red Hat family, but carries the + # Debian revision on Debian and Ubuntu (`7.2.1-1`), and the minor version can have two digits + graylog_datanode__installed_version: '{{ ansible_facts["packages"]["graylog-datanode"][0]["version"] | regex_search("^\d+\.\d+") }}' - # the same slice the template src below uses, so the assert matches what is looked up + # the same value the template src below uses, so the assert matches what is looked up - name: 'Assert that a configuration template for the installed Graylog Data Node version exists' ansible.builtin.assert: that: - - 'graylog_datanode__installed_version[:3] in __graylog_datanode__supported_versions' + - 'graylog_datanode__installed_version in __graylog_datanode__supported_versions' quiet: true - fail_msg: 'Graylog Data Node {{ graylog_datanode__installed_version[:3] }} is not supported by this role. Supported versions: {{ __graylog_datanode__supported_versions | join(", ") }}.' + fail_msg: 'Graylog Data Node {{ graylog_datanode__installed_version }} is not supported by this role. Supported versions: {{ __graylog_datanode__supported_versions | join(", ") }}.' - - name: 'Deploy /etc/graylog/datanode/datanode.conf (version: {{ graylog_datanode__installed_version[:3] }})' + - name: 'Deploy /etc/graylog/datanode/datanode.conf (version: {{ graylog_datanode__installed_version }})' ansible.builtin.template: backup: true - src: 'etc/graylog/datanode/{{ graylog_datanode__installed_version[:3] }}-datanode.conf.j2' + src: 'etc/graylog/datanode/{{ graylog_datanode__installed_version }}-datanode.conf.j2' dest: '/etc/graylog/datanode/datanode.conf' owner: 'root' group: 'root' diff --git a/roles/graylog_server/tasks/main.yml b/roles/graylog_server/tasks/main.yml index 1bee3f694..09a6f26f5 100644 --- a/roles/graylog_server/tasks/main.yml +++ b/roles/graylog_server/tasks/main.yml @@ -41,20 +41,22 @@ - name: 'Get Graylog version' ansible.builtin.set_fact: - graylog_server__installed_version: '{{ ansible_facts["packages"]["graylog-server"][0]["version"] | regex_replace("\.\d+$", "") }}' + # keep major.minor only. the version is `7.2.1` on the Red Hat family, but carries the + # Debian revision on Debian and Ubuntu (`7.2.1-1`), and the minor version can have two digits + graylog_server__installed_version: '{{ ansible_facts["packages"]["graylog-server"][0]["version"] | regex_search("^\d+\.\d+") }}' - # the same slice the template src below uses, so the assert matches what is looked up + # the same value the template src below uses, so the assert matches what is looked up - name: 'Assert that a configuration template for the installed Graylog version exists' ansible.builtin.assert: that: - - 'graylog_server__installed_version[:3] in __graylog_server__supported_versions' + - 'graylog_server__installed_version in __graylog_server__supported_versions' quiet: true - fail_msg: 'Graylog {{ graylog_server__installed_version[:3] }} is not supported by this role. Supported versions: {{ __graylog_server__supported_versions | join(", ") }}.' + fail_msg: 'Graylog {{ graylog_server__installed_version }} is not supported by this role. Supported versions: {{ __graylog_server__supported_versions | join(", ") }}.' - - name: 'Deploy /etc/graylog/server/server.conf (version: {{ graylog_server__installed_version[:3] }})' + - name: 'Deploy /etc/graylog/server/server.conf (version: {{ graylog_server__installed_version }})' ansible.builtin.template: backup: true - src: 'etc/graylog/server/{{ graylog_server__installed_version[:3] }}-server.conf.j2' + src: 'etc/graylog/server/{{ graylog_server__installed_version }}-server.conf.j2' dest: '/etc/graylog/server/server.conf' owner: 'graylog' group: 'graylog' From f19153c6a25390d22a71337d97d2f5ee220d8b04 Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Wed, 21 Oct 2026 10:55:00 +0200 Subject: [PATCH 2/3] fix(roles/opensearch): derive the major version from the package version robustly The major was cut to the first character, so OpenSearch 10.x would select the 1.x template. --- roles/opensearch/tasks/main.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/roles/opensearch/tasks/main.yml b/roles/opensearch/tasks/main.yml index af9e3910e..840a6854a 100644 --- a/roles/opensearch/tasks/main.yml +++ b/roles/opensearch/tasks/main.yml @@ -19,22 +19,23 @@ ansible.builtin.package_facts: # yamllint disable-line rule:empty-values check_mode: false # run task even if `--check` is specified - - name: 'Get installed OpenSearch version' + - name: 'Get installed OpenSearch major version' ansible.builtin.set_fact: - __opensearch__installed_version: '{{ ansible_facts["packages"]["opensearch"][0]["version"] | regex_replace("\.\d+$", "") }}' + # all digits up to the first dot, so a major version 10 and above stays intact + __opensearch__installed_major: '{{ ansible_facts["packages"]["opensearch"][0]["version"] | regex_search("^\d+") }}' # only the major selects the template, so the assert matches on the same expression - name: 'Assert that a configuration template for the installed OpenSearch version exists' ansible.builtin.assert: that: - - '__opensearch__installed_version[:1] ~ ".x" in __opensearch__supported_versions' + - '__opensearch__installed_major ~ ".x" in __opensearch__supported_versions' quiet: true - fail_msg: 'OpenSearch {{ __opensearch__installed_version[:1] }}.x is not supported by this role. Supported versions: {{ __opensearch__supported_versions | join(", ") }}.' + fail_msg: 'OpenSearch {{ __opensearch__installed_major }}.x is not supported by this role. Supported versions: {{ __opensearch__supported_versions | join(", ") }}.' - - name: 'Deploy /etc/opensearch/{{ __opensearch__installed_version[:1] }}.x-opensearch.yml' + - name: 'Deploy /etc/opensearch/{{ __opensearch__installed_major }}.x-opensearch.yml' ansible.builtin.template: backup: true - src: 'etc/opensearch/{{ __opensearch__installed_version[:1] }}.x-opensearch.yml.j2' + src: 'etc/opensearch/{{ __opensearch__installed_major }}.x-opensearch.yml.j2' dest: '/etc/opensearch/opensearch.yml' owner: 'opensearch' group: 'opensearch' From ff0df75d554f32033c889d049a7be1b4a59f53ea Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Wed, 21 Oct 2026 10:55:00 +0200 Subject: [PATCH 3/3] fix(roles/mongodb): derive major.minor from the package version robustly The previous regex only stripped a trailing patch number, so a Debian revision (8.0.4-1) would have broken the template lookup. The current MongoDB DEBs carry none. --- roles/mongodb/tasks/main.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/mongodb/tasks/main.yml b/roles/mongodb/tasks/main.yml index fb7a75703..c13cf4a28 100644 --- a/roles/mongodb/tasks/main.yml +++ b/roles/mongodb/tasks/main.yml @@ -51,7 +51,8 @@ - name: 'Get mongodb-org-server version' ansible.builtin.set_fact: - mongodb__installed_version: '{{ ansible_facts["packages"]["mongodb-org-server"][0]["version"] | regex_replace("\.\d+$", "") }}' # strip the patch version + # keep major.minor only, also if a package version ever carries a Debian revision (`8.0.4-1`) + mongodb__installed_version: '{{ ansible_facts["packages"]["mongodb-org-server"][0]["version"] | regex_search("^\d+\.\d+") }}' # the template name carries the OS family, so the supported versions are per family too - name: 'Assert that a configuration template for the installed MongoDB version exists'