From afa3685e6e466626ad6130b404b51b4f242e624b Mon Sep 17 00:00:00 2001
From: GeertJohan <git@geertjohan.net>
Date: Tue, 4 Aug 2026 14:12:36 +0200
Subject: [PATCH] validate rendered service configs before installing them

---
 partition/roles/frr/tasks/main.yaml                        | 1 +
 partition/roles/mgmt-server/tasks/main.yaml                | 2 ++
 partition/roles/sonic-config/tasks/generate_config_db.yaml | 1 +
 partition/roles/sonic-config/tasks/main.yaml               | 1 +
 4 files changed, 5 insertions(+)

diff --git a/partition/roles/frr/tasks/main.yaml b/partition/roles/frr/tasks/main.yaml
index decc2c360..db560d39f 100644
--- a/partition/roles/frr/tasks/main.yaml
+++ b/partition/roles/frr/tasks/main.yaml
@@ -56,5 +56,6 @@
   ansible.builtin.copy:
     content: "{{ frr_conf }}"
     dest: /etc/frr/frr.conf
+    validate: "/usr/bin/vtysh --dryrun --inputfile %s"
     mode: "0640"
   notify: Reload frr
diff --git a/partition/roles/mgmt-server/tasks/main.yaml b/partition/roles/mgmt-server/tasks/main.yaml
index d8601db32..495d5827b 100644
--- a/partition/roles/mgmt-server/tasks/main.yaml
+++ b/partition/roles/mgmt-server/tasks/main.yaml
@@ -69,6 +69,7 @@
   ansible.builtin.template:
     src: daemon.json.j2
     dest: /etc/docker/daemon.json
+    validate: /usr/bin/python3 -m json.tool %s
     mode: "0640"
   notify: Reload docker
 
@@ -168,6 +169,7 @@
   ansible.builtin.template:
     src: ssh_config.j2
     dest: /home/metal/.ssh/config
+    validate: /usr/bin/ssh -G -F %s localhost
     mode: "0644"
     owner: metal
     group: metal
diff --git a/partition/roles/sonic-config/tasks/generate_config_db.yaml b/partition/roles/sonic-config/tasks/generate_config_db.yaml
index e15a33d59..ae5ce89fe 100644
--- a/partition/roles/sonic-config/tasks/generate_config_db.yaml
+++ b/partition/roles/sonic-config/tasks/generate_config_db.yaml
@@ -38,6 +38,7 @@
   ansible.builtin.copy:
     src: /tmp/sonic/config_db.json
     dest: /etc/sonic/config_db.json
+    validate: /usr/bin/python3 -m json.tool %s
     mode: "0644"
     owner: root
     group: root
diff --git a/partition/roles/sonic-config/tasks/main.yaml b/partition/roles/sonic-config/tasks/main.yaml
index 106a0a2c1..b787b9784 100644
--- a/partition/roles/sonic-config/tasks/main.yaml
+++ b/partition/roles/sonic-config/tasks/main.yaml
@@ -40,6 +40,7 @@
   ansible.builtin.template:
     src: iptables.json.j2
     dest: /etc/sonic/iptables.json
+    validate: /usr/bin/python3 -m json.tool %s
     mode: "0644"
   when: sonic_config_extended_cacl is defined
   notify: