Centralize package installation in repos role

Author: tbauriedel

docs/10-role-repos.md

@@ -8,10 +8,12 @@ The role adds Elastic repositories to the package manager. It's main use is in c
 Requirements
 ------------
 
-* You need `gpg` to be installed because packages / repositories are digitally signed and verified.
-* Debian and Ubuntu hosts need to have `apt-transport-https` installed to deal with Elastics repositories.
-* Ubuntu hosts also need to have `gpg-agent` installed.
-* For SuSE hosts you need the Ansible collection `community.general` on your Ansible controller.
+GPG needs to be installed on the systems to verify the package signature. This will be installed as part of the role. Below you can find a list of packages that will be installed.
+* Debian family: `apt-transport-https`, `gpg` and `gpg-agent`
+* RedHat family: `gnupg`
+* Suse family: `gpg2`
+
+For SuSE hosts you will need the Ansible collection `community.general` on your Ansible controller.
 
 Role Variables
 --------------

roles/repos/tasks/debian.yml

@@ -1,11 +1,4 @@
 ---
-- name: Ensure gpg exists, for signing keys
-  ansible.builtin.apt:
-    name:
-      - gpg
-      - gpg-agent
-    state: present
-
 - name: Ensure Elastic Stack key is removed (Debian legacy format)
   ansible.builtin.apt_key:
     url: "{{ elasticstack_repo_key }}"

roles/repos/tasks/main.yml

@@ -5,6 +5,29 @@
     name: netways.elasticstack.elasticstack
   when: not hostvars[inventory_hostname]._elasticstack_role_imported | default(false)
 
+- name: Include OS specific vars
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+        - "{{ ansible_os_family }}-{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
+        - "{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml"
+        - "{{ ansible_os_family }}-{{ ansible_distribution }}.yml"
+        - "{{ ansible_os_family }}-{{ ansible_lsb.id if ansible_lsb.id is defined else ansible_distribution }}.yml"
+        - "{{ ansible_os_family }}.yml"
+        - default.yml
+      paths:
+        - "{{ role_path }}/vars"
+
+- name: Install package dependencies
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ repos_packages }}"
+  when:
+    - repos_packages is defined
+    - repos_packages | length > 0
+
 - name: Import RedHat tasks
   ansible.builtin.import_tasks: redhat.yml
   when: ansible_os_family == 'RedHat'

roles/repos/tasks/redhat.yml

@@ -1,13 +1,6 @@
 ---
-
 # See https://github.com/elastic/elasticsearch/issues/85876
 # for more information why this is needed
-
-- name: Ensure gpg exists, for signing keys
-  ansible.builtin.package:
-    name: gnupg
-    state: present
-
 - name: Workaround for EL > 8
   when:
     - ansible_distribution_major_version >= "9"

roles/repos/tasks/suse.yml

@@ -1,10 +1,4 @@
 ---
-
-- name: Ensure gpg exists, for signing keys
-  community.general.zypper:
-    name: gpg2
-    state: present
-
 - name: Ensure Elastic Stack yum repository is configured (SuSE)
   community.general.zypper_repository:
     name: elastic-{{ elasticstack_release }}.x

roles/repos/vars/Debian.yml

@@ -0,0 +1,5 @@
+---
+repos_packages:
+  - gpg
+  - gpg-agent
+  - apt-transport-https

roles/repos/vars/RedHat.yml

@@ -0,0 +1,3 @@
+---
+repos_packages:
+  - gnupg

roles/repos/vars/Suse.yml

@@ -0,0 +1,3 @@
+---
+repos_packages:
+  - gpg2

roles/repos/vars/default.yml

@@ -0,0 +1 @@
+---