Initial version to make it run on Podman #69
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| --- | ||
| - name: Detecting existing PyPI installation | ||
| ansible.builtin.stat: | ||
| path: "{{ ara_api_venv_path }}" | ||
| register: existing_pypi_install | ||
|
|
||
| - name: Notify about existing PyPI installation | ||
| ansible.builtin.debug: | ||
| msg: | | ||
| You seem to have ARA-API installed via PyPI in the past, you might | ||
| want to clean up that installation and migrate your data | ||
| when: existing_pypi_install['stat']['exists'] | ||
|
|
||
| - name: Override file locations with path in container | ||
| ansible.builtin.set_fact: | ||
| ara_api_database_name: "/opt/ara/ansible.sqlite" | ||
| ara_api_log_dir: "/opt/ara/logs" | ||
| ara_api_settings: "{{ ara_api_root_dir }}/settings.yaml" | ||
|
|
||
| - name: Ensure ARA API container | ||
|
There was a problem hiding this comment. There is kind of a gotcha here. I think it is succeeding in starting the container when running from an unprivileged user (since podman can start rootless no problem) but then it tries to set up the systemd unit for it and fails due to lack of privileges. If we set Note that there would also be a failure on the following task (service) since it doesn't have There was a problem hiding this comment. I propose that we don't use the # Example of creating a container and integrate it into systemd
- name: A postgres container must exist, stopped
containers.podman.podman_container:
name: postgres_local
image: docker.io/library/postgres:latest
state: stopped
- name: Systemd unit files for postgres container must exist
containers.podman.podman_generate_systemd:
name: postgres_local
dest: ~/.config/systemd/user/
- name: Postgres container must be started and enabled on systemd
ansible.builtin.systemd:
name: container-postgres_local
scope: user
daemon_reload: true
state: started
enabled: trueThis way we don't need to elevate privileges for the task that starts the container so the ara API container can remain rootless unless the role is run as root. When running as root it'd look more like this (from the examples): - become: true
block:
- name: Generate systemd unit file for postgres container
containers.podman.podman_generate_systemd:
name: postgres
new: true
no_header: true
dest: /etc/systemd/system
- name: Ensure postgres container is started and enabled
ansible.builtin.systemd:
name: container-postgres
daemon_reload: true
state: started
enabled: trueThere was a problem hiding this comment. I have tried to do this but it's still WIP: dmsimard@8fa017e In truth I am running into unrelated issues amongst which debian 12 is not supported so it would break when I wanted to test this with it: #68 I will revive that PR. |
||
| containers.podman.podman_container: | ||
| name: ara-api | ||
| image: "{{ ara_api_image }}:{{ ara_api_version }}" | ||
| pull: newer | ||
| state: present | ||
| auto_remove: true | ||
|
There was a problem hiding this comment. Should it really be "auto_remove" ? If it deletes itself on exit, then the systemd service wouldn't really have the opportunity to stop or restart it. There was a problem hiding this comment. I put it there to make the The systemd service knows how to handle it, but it needs an existing container to template from |
||
| generate_systemd: "{{ ara_api_systemd_config }}" | ||
| ports: | ||
| - 127.0.0.1:8000:8000 | ||
| volume: | ||
| - "{{ ara_api_root_dir }}:/opt/ara{{ (ansible_facts['selinux']['status'] == 'enabled') | ternary(':z', '') }}" | ||
|
|
||
| - name: Ensure service | ||
| ansible.builtin.systemd: | ||
| name: ara-api.service | ||
| state: started | ||
| enabled: true | ||
| daemon_reload: true | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| --- | ||
| ara_api_systemd_config: | ||
| path: '/etc/systemd/system' | ||
| restart_policy: 'always' | ||
| time: 120 | ||
| names: true | ||
| new: true | ||
| container_prefix: '' | ||
| separator: '' |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| --- | ||
| # Copyright (c) 2020 The ARA Records Ansible authors | ||
| # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) | ||
|
|
||
| - name: Deploy and test ARA API with podman | ||
| hosts: ara-api-server | ||
| gather_facts: yes | ||
| vars: | ||
| ara_api_install_method: podman | ||
| ara_api_version: latest | ||
| ara_api_root_dir: "{{ ansible_user_dir }}/.ara-tests" | ||
| ara_api_secret_key: testing | ||
| ara_api_debug: true | ||
| ara_api_log_level: DEBUG | ||
| # Configure cleanup crons to exercise the code path during tests | ||
| ara_api_configure_cron: true | ||
| tasks: | ||
| - name: Install podman | ||
| become: yes | ||
| package: | ||
| name: podman | ||
| state: present | ||
|
|
||
| - name: Set up the API with the ara_api Ansible role | ||
| include_role: | ||
| name: ara_api | ||
| public: yes | ||
|
|
||
| # These are tasks rather than a standalone playbook to give us an easy | ||
| # access to all the variables within the same play. | ||
| - include_tasks: test_tasks.yaml |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cool! We should bump that to Fedora 38 like I did recently for ara but I can take care of that in another PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's split that, first let's make this work ^^
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like that there is already a job for testing podman and that it is even passing, nice work :)