NetApp · kaminis85 · Jun 3, 2026 · Jun 2, 2026
diff --git a/roles/backup_and_restore_scenario/README.md b/roles/backup_and_restore_scenario/README.md
@@ -31,19 +31,20 @@ The role does not ship opinionated defaults. The caller must provide the
 following variables (typically via `-e @your_vars.yml` or under `vars:` in the
 playbook):
 
-| Variable | Description |
-|----------|-------------|
-| `oc_api_url` | OpenShift/Kubernetes API server URL of the target cluster. |
-| `oc_api_token` | Bearer token used to authenticate against the OpenShift API. |
-| `appvault_name` | Trident Protect AppVault used to store the backup. |
-| `application_name` | Trident Protect Application that is backed up. |
-| `vm_namespace` | Namespace containing the source VMs. |
-| `on_demand_backup_name` | Name of the on-demand Backup CR to create. |
-| `restore_namespace` | Namespace into which VMs will be restored. |
-| `backuprestore_name` | Name of the BackupRestore CR used for restoration. |
-| `vm_list` | List of VM names (used during validation/restore). |
-| `pvc_list` | List of PVC names associated with the VMs. |
-| `vm_label` | Label value applied to VMs and PVCs. |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `oc_api_url` | OpenShift/Kubernetes API server URL of the target cluster. | Required |
+| `oc_api_token` | Bearer token used to authenticate against the OpenShift API. | Required |
+| `validate_certs` | Whether to validate TLS certificates when connecting to the OpenShift/Kubernetes API. | `false` |
+| `appvault_name` | Trident Protect AppVault used to store the backup. | Required |
+| `application_name` | Trident Protect Application that is backed up. | Required |
+| `vm_namespace` | Namespace containing the source VMs. | Required |
+| `on_demand_backup_name` | Name of the on-demand Backup CR to create. | Required |
+| `restore_namespace` | Namespace into which VMs will be restored. | Required |
+| `backuprestore_name` | Name of the BackupRestore CR used for restoration. | Required |
+| `vm_list` | List of VM names (used during validation/restore). | Required |
+| `pvc_list` | List of PVC names associated with the VMs. | Required |
+| `vm_label` | Label value applied to VMs and PVCs. | Required |
 
 > Note: Sensitive values (API tokens, S3 credentials) should be stored in an
 > Ansible Vault file rather than committed in plain text.

diff --git a/roles/backup_and_restore_scenario/defaults/main.yml b/roles/backup_and_restore_scenario/defaults/main.yml
@@ -1,4 +1,3 @@
 ---
 # defaults file for backup_and_restore_scenario
-# This role has no opinionated defaults; all variables are expected to be
-# provided by the caller (see README.md for the full list).
+validate_certs: false
diff --git a/roles/backup_and_restore_scenario/tasks/main.yml b/roles/backup_and_restore_scenario/tasks/main.yml
@@ -4,15 +4,36 @@
 # OpenShift cluster and that the common tasks in roles/trident-protect/trident-protect-common have been
 # executed to configure the prerequisites like AppVault and Application.
 
+# Verify required variables are defined and not empty
+- name: Verify required variables are defined and not empty
+  ansible.builtin.fail:
+    msg: "{{ item }} is not defined or empty"
+  when: "vars[item] is not defined or (vars[item] | default('') | string | length == 0)"
+  loop:
+    - oc_api_url
+    - oc_api_token
+    - appvault_name
+    - application_name
+    - vm_namespace
+    - on_demand_backup_name
+    - restore_namespace
+    - backuprestore_name
+
+# Define anchor for OpenShift/Kubernetes API login info
+- name: Define anchor for OpenShift/Kubernetes API login info
+  ansible.builtin.set_fact:
+    k8s_auth: &k8s_auth
+      host: "{{ oc_api_url | default(omit) }}"
+      api_key: "{{ oc_api_token | default(omit) }}"
+      validate_certs: "{{ validate_certs | default(false) }}"
+
 # Create on-demand backup of specific VMs in a namespace by using corresponding application
 - name: >-
     Create on-demand backup of specific VMs by using corresponding application -
     {{ application_name | default('') ~ ' / ' ~ vm_namespace | default('') }}
   kubernetes.core.k8s:
+    <<: *k8s_auth
     state: present
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
     namespace: "{{ vm_namespace | default('') }}"
     definition:
       apiVersion: protect.trident.netapp.io/v1
@@ -36,9 +57,7 @@
 # Note: Adjust retries and delay as needed based on expected backup duration
 - name: Wait for the backup to complete
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: protect.trident.netapp.io/v1
     namespace: "{{ vm_namespace | default('') }}"
     kind: Backup
@@ -60,9 +79,7 @@
 # Verify that the backup was created successfully
 - name: Verify that the on-demand backup was created successfully - {{ on_demand_backup_name | default('') }}
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: protect.trident.netapp.io/v1
     kind: Backup
     namespace: "{{ vm_namespace | default('') }}"
@@ -88,10 +105,8 @@
 # Create a new namespace for restoration
 - name: Create a new restore namespace - {{ restore_namespace | default('') }}
   kubernetes.core.k8s:
+    <<: *k8s_auth
     state: present
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
     definition:
       apiVersion: v1
       kind: Namespace
@@ -105,10 +120,8 @@
 # Create a BackupRestore object to restore the VMs from the on-demand backup to a different namespace
 - name: Create a BackupRestore object to restore the VMs from the on-demand backup - {{ restore_namespace | default('') }}
   kubernetes.core.k8s:
+    <<: *k8s_auth
     state: present
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
     namespace: "{{ restore_namespace | default('') }}"
     definition:
       apiVersion: protect.trident.netapp.io/v1
@@ -134,9 +147,7 @@
 # Wait for the restore to complete
 - name: Wait for the restore to complete
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: protect.trident.netapp.io/v1
     namespace: "{{ restore_namespace | default('') }}"
     kind: BackupRestore
@@ -158,9 +169,7 @@
 # Verify that the BackupRestore object was created successfully
 - name: Verify that the BackupRestore was created successfully - {{ backuprestore_name | default('') }}
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: protect.trident.netapp.io/v1
     kind: BackupRestore
     namespace: "{{ restore_namespace | default('') }}"
@@ -184,9 +193,7 @@
 # Verify that the VMs have been restored successfully to the new namespace
 - name: Verify VMs restored to namespace - {{ restore_namespace | default('') }}
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: kubevirt.io/v1
     kind: VirtualMachine
     namespace: "{{ restore_namespace | default('') }}"
@@ -199,9 +206,7 @@
 # Verify that the PVCs have been restored successfully to the new namespace
 - name: Verify PVCs restored to namespace - {{ restore_namespace | default('') }}
   kubernetes.core.k8s_info:
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
+    <<: *k8s_auth
     api_version: v1
     kind: PersistentVolumeClaim
     namespace: "{{ restore_namespace | default('') }}"

diff --git a/roles/backup_and_restore_scenario/tests/test.yml b/roles/backup_and_restore_scenario/tests/test.yml
@@ -8,5 +8,19 @@
     # README.md for a full list.
     oc_api_url: https://api.example.openshift.com:6443
     oc_api_token: <your_api_token>
+    validate_certs: false
+    appvault_name: appvault-ontap
+    application_name: my-application
+    vm_namespace: vm-namespace
+    on_demand_backup_name: on-demand-backup
+    restore_namespace: restore-namespace
+    backuprestore_name: backup-restore
+    vm_list:
+      - vm-1
+      - vm-2
+    pvc_list:
+      - pvc-1
+      - pvc-2
+    vm_label: app=my-vm
   roles:
     - backup_and_restore_scenario
diff --git a/roles/create_snapshot_schedule/README.md b/roles/create_snapshot_schedule/README.md
@@ -31,20 +31,21 @@ The role does not ship opinionated defaults. The caller must provide the
 following variables (typically via `-e @your_vars.yml` or under `vars:` in the
 playbook):
 
-| Variable | Description |
-|----------|-------------|
-| `oc_api_url` | OpenShift/Kubernetes API server URL of the target cluster. |
-| `oc_api_token` | Bearer token used to authenticate against the OpenShift API. |
-| `appvault_name` | AppVault referenced by the Schedule CR. |
-| `application_name` | Trident Protect Application targeted by the schedule. |
-| `vm_namespace` | Namespace where the Schedule CR is created. |
-| `snapshot_schedule_name` | Name of the Schedule CR to create. |
-| `snapshot_retention_count` | Number of snapshots to retain. |
-| `snapshot_granularity` | Granularity of the snapshot schedule (Hourly, Daily, Weekly, Monthly). |
-| `snapshot_hour` | Hour of day for Daily/Weekly/Monthly snapshots (0-23). |
-| `snapshot_minute` | Minute of hour for snapshots (0-59). |
-| `snapshot_day_of_month` | Day of the month for Monthly snapshots (1-31). |
-| `snapshot_day_of_week` | Day of the week for Weekly snapshots (0-6). |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `oc_api_url` | OpenShift/Kubernetes API server URL of the target cluster. | Required |
+| `oc_api_token` | Bearer token used to authenticate against the OpenShift API. | Required |
+| `validate_certs` | Whether to validate TLS certificates when connecting to the OpenShift/Kubernetes API. | `false` |
+| `appvault_name` | AppVault referenced by the Schedule CR. | Required |
+| `application_name` | Trident Protect Application targeted by the schedule. | Required |
+| `vm_namespace` | Namespace where the Schedule CR is created. | Required |
+| `snapshot_schedule_name` | Name of the Schedule CR to create. | Required |
+| `snapshot_retention_count` | Number of snapshots to retain. | Required |
+| `snapshot_granularity` | Granularity of the snapshot schedule (Hourly, Daily, Weekly, Monthly). | Required |
+| `snapshot_hour` | Hour of day for Daily/Weekly/Monthly snapshots (0-23). | Required |
+| `snapshot_minute` | Minute of hour for snapshots (0-59). | Required |
+| `snapshot_day_of_month` | Day of the month for Monthly snapshots (1-31). | Required |
+| `snapshot_day_of_week` | Day of the week for Weekly snapshots (0-6). | Required |
 
 > Note: Sensitive values (API tokens, S3 credentials) should be stored in an
 > Ansible Vault file rather than committed in plain text.

diff --git a/roles/create_snapshot_schedule/defaults/main.yml b/roles/create_snapshot_schedule/defaults/main.yml
@@ -1,4 +1,3 @@
 ---
 # defaults file for create_snapshot_schedule
-# This role has no opinionated defaults; all variables are expected to be
-# provided by the caller (see README.md for the full list).
+validate_certs: false
diff --git a/roles/create_snapshot_schedule/tasks/main.yml b/roles/create_snapshot_schedule/tasks/main.yml
@@ -1,15 +1,36 @@
 ---
 # Ansible tasks to create Snapshot schedules for VMs in OpenShift Virtualization using Trident protect
 
+# Verify required variables are defined and not empty
+- name: Verify required variables are defined and not empty
+  ansible.builtin.fail:
+    msg: "{{ item }} is not defined or empty"
+  when: "vars[item] is not defined or (vars[item] | default('') | string | length == 0)"
+  loop:
+    - oc_api_url
+    - oc_api_token
+    - snapshot_schedule_name
+    - application_name
+    - appvault_name
+    - vm_namespace
+    - snapshot_granularity
+    - snapshot_retention_count
+
+# Define anchor for OpenShift/Kubernetes API login info
+- name: Define anchor for OpenShift/Kubernetes API login info
+  ansible.builtin.set_fact:
+    k8s_auth: &k8s_auth
+      host: "{{ oc_api_url | default(omit) }}"
+      api_key: "{{ oc_api_token | default(omit) }}"
+      validate_certs: "{{ validate_certs | default(false) }}"
+
 # Create snapshot schedule for specific VMs in a namespace by using corresponding application
 - name: >-
     Create snapshot schedule for specific VMs by using corresponding application -
     {{ application_name | default('') ~ ' / ' ~ vm_namespace | default('') }}
   kubernetes.core.k8s:
+    <<: *k8s_auth
     state: present
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
     namespace: "{{ vm_namespace | default('') }}"
     definition:
       apiVersion: protect.trident.netapp.io/v1
@@ -40,13 +61,11 @@
 # Verify the newly created snapshot schedule is in place
 - name: Get snapshot schedule from namespace - {{ snapshot_schedule_name | default('') ~ ' / ' ~ vm_namespace | default('') }}
   kubernetes.core.k8s_info:
+    <<: *k8s_auth
     api_version: protect.trident.netapp.io/v1
     kind: Schedule
     name: "{{ snapshot_schedule_name | default('') }}"
     namespace: "{{ vm_namespace | default('') }}"
-    host: "{{ oc_api_url }}"
-    api_key: "{{ oc_api_token }}"
-    validate_certs: false
   register: schedule_output
   when:
     - snapshot_schedule_name is defined and snapshot_schedule_name != ""

diff --git a/roles/create_snapshot_schedule/tests/test.yml b/roles/create_snapshot_schedule/tests/test.yml
@@ -8,5 +8,16 @@
     # README.md for a full list.
     oc_api_url: https://api.example.openshift.com:6443
     oc_api_token: <your_api_token>
+    validate_certs: false
+    snapshot_schedule_name: snapshot-schedule
+    application_name: my-application
+    appvault_name: appvault-ontap
+    vm_namespace: vm-namespace
+    snapshot_granularity: Hourly
+    snapshot_retention_count: 5
+    snapshot_hour: 0
+    snapshot_minute: 0
+    snapshot_day_of_month: 1
+    snapshot_day_of_week: 1
   roles:
     - create_snapshot_schedule
diff --git a/roles/dr_amr_config/README.md b/roles/dr_amr_config/README.md
@@ -29,18 +29,19 @@ The role does not ship opinionated defaults. The caller must provide the
 following variables (typically via `-e @your_vars.yml` or under `vars:` in the
 playbook):
 
-| Variable | Description |
-|----------|-------------|
-| `src_oc_api_url` | Source OpenShift cluster API server URL (DR scenarios). |
-| `src_oc_api_token` | Source OpenShift cluster bearer token (DR scenarios). |
-| `dst_oc_api_url` | Destination OpenShift cluster API server URL (DR scenarios). |
-| `dst_oc_api_token` | Destination OpenShift cluster bearer token (DR scenarios). |
-| `src_appvault_name` | AppVault on the source cluster. |
-| `dst_appvault_name` | AppVault on the destination cluster. |
-| `src_application_name` | Source Application referenced by the AMR. |
-| `src_vm_namespace` | Source namespace. |
-| `dst_vm_namespace` | Destination namespace where replicated VMs are materialized. |
-| `appmirrorrelationship_specs` | Dict with `name`, `storage_class`, and `recurrence_rule` (`dtstart`, `rrule`) for the AMR CR. |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `src_oc_api_url` | Source OpenShift cluster API server URL (DR scenarios). | Required |
+| `src_oc_api_token` | Source OpenShift cluster bearer token (DR scenarios). | Required |
+| `dst_oc_api_url` | Destination OpenShift cluster API server URL (DR scenarios). | Required |
+| `dst_oc_api_token` | Destination OpenShift cluster bearer token (DR scenarios). | Required |
+| `validate_certs` | Whether to validate TLS certificates when connecting to the OpenShift/Kubernetes API. | `false` |
+| `src_appvault_name` | AppVault on the source cluster. | Required |
+| `dst_appvault_name` | AppVault on the destination cluster. | Required |
+| `src_application_name` | Source Application referenced by the AMR. | Required |
+| `src_vm_namespace` | Source namespace. | Required |
+| `dst_vm_namespace` | Destination namespace where replicated VMs are materialized. | Required |
+| `appmirrorrelationship_specs` | Dict with `name`, `storage_class`, and `recurrence_rule` (`dtstart`, `rrule`) for the AMR CR. | Required |
 
 > Note: Sensitive values (API tokens, S3 credentials) should be stored in an
 > Ansible Vault file rather than committed in plain text.
@@ -54,8 +55,8 @@ playbook):
   gather_facts: false
   connection: local
   vars:
-    oc_api_url: "https://api.aa02-ocp.example.com:6443"
-    oc_api_token: "{{ OC_API_TOKEN }}"
+    src_oc_api_url: "https://api.src.example.openshift.com:6443"
+    src_oc_api_token: "{{ SRC_OC_API_TOKEN }}"
     # ... add the role-specific variables listed above ...
   roles:
     - dr_amr_config

diff --git a/roles/dr_amr_config/defaults/main.yml b/roles/dr_amr_config/defaults/main.yml
@@ -1,4 +1,3 @@
 ---
 # defaults file for dr_amr_config
-# This role has no opinionated defaults; all variables are expected to be
-# provided by the caller (see README.md for the full list).
+validate_certs: false