Skip to content

Commit 78e14cb

Browse files
mnietojiclaude
mnietoji
and
claude
committed
Add FDP update automation for EDPM deployments
Implement comprehensive FDP update workflow including: - New playbook fdp_update.yml orchestrating the update process - Role fdp_edpm_update_host_packages: Updates packages on EDPM hosts - Role fdp_update_container_images: Rebuilds container images with updated packages * Includes Molecule tests for validation * Jinja2 templates for Dockerfile and repo configuration - Role fdp_update_edpm_containers: Updates running EDPM containers This automation streamlines the process of updating Fast Data Path components across OpenStack EDPM (External Data Plane Management) deployments by coordinating host package updates, container image rebuilds, and container deployment updates. Co-Authored-By: Claude <[email protected]>
1 parent 9ccc1ee commit 78e14cb

28 files changed

+1685
-1
lines changed

‎docs/dictionary/en-custom.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ ezzmy
186186
favorit
187187
fbqufbqkfbzxrja
188188
fci
189+
fdp
189190
fedoraproject
190191
fil
191192
filesystem
@@ -413,6 +414,7 @@ openstack
413414
openstackclient
414415
openstackcontrolplane
415416
openstackdataplane
417+
openstackdataplanedeployment
416418
openstackdataplanenodeset
417419
openstackdataplanenodesets
418420
openstackprovisioner

‎playbooks/fdp_update.yml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
# Master playbook to update OpenStack packages across all layers:
18+
# - Control plane containers
19+
# - EDPM compute containers
20+
# - EDPM compute node hosts
21+
#
22+
# Granular control via flags:
23+
# cifmw_fdp_update_container_images_update_control_plane_images: true/false
24+
# cifmw_fdp_update_container_images_update_edpm_images: true/false
25+
# cifmw_fdp_update_container_images_update_edpm_host_packages: true/false
26+
#
27+
# Usage Examples:
28+
#
29+
# 1. Update everything (default):
30+
# ansible-playbook playbooks/fdp_update.yml \
31+
# -e cifmw_fdp_update_container_images_target_package=ovn24.03 \
32+
# -e cifmw_fdp_update_container_images_repo_baseurl=http://example.com/repo/
33+
#
34+
# 2. Update only control plane:
35+
# ansible-playbook playbooks/fdp_update.yml \
36+
# -e cifmw_fdp_update_container_images_target_package=ovn24.03 \
37+
# -e cifmw_fdp_update_container_images_repo_baseurl=http://example.com/repo/ \
38+
# -e cifmw_fdp_update_container_images_update_edpm_images=false \
39+
# -e cifmw_fdp_update_container_images_update_edpm_host_packages=false
40+
#
41+
# 3. Update only EDPM host packages:
42+
# ansible-playbook playbooks/fdp_update.yml \
43+
# -e cifmw_fdp_update_container_images_target_package=openvswitch3.3 \
44+
# -e cifmw_fdp_update_container_images_repo_baseurl=http://example.com/ovs-repo/ \
45+
# -e cifmw_fdp_update_container_images_update_control_plane_images=false \
46+
# -e cifmw_fdp_update_container_images_update_edpm_images=false
47+
48+
- name: Update OpenStack packages across all layers
49+
hosts: "{{ cifmw_target_host | default('localhost') }}"
50+
gather_facts: true
51+
vars:
52+
# Control flags for what to update (can be overridden via -e)
53+
cifmw_fdp_update_container_images_update_edpm_images: true
54+
cifmw_fdp_update_container_images_update_edpm_host_packages: true
55+
56+
pre_tasks:
57+
- name: Early playbook stop if disabled
58+
when:
59+
- not cifmw_fdp_update_enabled | default(false) | bool
60+
ansible.builtin.meta: end_play
61+
62+
- name: Validate required variables are set
63+
ansible.builtin.assert:
64+
that:
65+
- cifmw_fdp_update_container_images_target_package is defined
66+
- cifmw_fdp_update_container_images_target_package | length > 0
67+
- cifmw_fdp_update_container_images_repo_baseurl is defined
68+
- cifmw_fdp_update_container_images_repo_baseurl | length > 0
69+
fail_msg: |
70+
Required variables are missing!
71+
72+
You must set:
73+
- cifmw_fdp_update_container_images_target_package: Name of the RPM package to update
74+
- cifmw_fdp_update_container_images_repo_baseurl: Repository base URL containing the updated package
75+
76+
Example:
77+
ansible-playbook playbooks/fdp_update.yml \
78+
-e cifmw_fdp_update_container_images_target_package=ovn24.03 \
79+
-e cifmw_fdp_update_container_images_repo_baseurl=http://example.com/repo/
80+
success_msg: "Required variables validated successfully"
81+
82+
- name: Display update configuration
83+
ansible.builtin.debug:
84+
msg:
85+
- "=============================================="
86+
- "OpenStack Package Update Configuration"
87+
- "=============================================="
88+
- "Target Package: {{ cifmw_fdp_update_container_images_target_package }}"
89+
- "Repository: {{ cifmw_fdp_update_container_images_repo_baseurl }}"
90+
- ""
91+
- "Update Control Flags:"
92+
- " Control Plane Images: {{ cifmw_fdp_update_container_images_update_control_plane_images | default(true) }}"
93+
- " EDPM Container Images: {{ cifmw_fdp_update_container_images_update_edpm_images | default(true) }}"
94+
- " EDPM Host Packages: {{ cifmw_fdp_update_container_images_update_edpm_host_packages | default(true) }}"
95+
- ""
96+
- "Namespace: {{ cifmw_fdp_update_container_images_namespace | default('openstack') }}"
97+
- "=============================================="
98+
99+
- name: Setup hypervisor firewall for registry access
100+
become: true
101+
when: cifmw_fdp_update_setup_hypervisor_firewall | default(true) | bool
102+
block:
103+
- name: Allow traffic from osp_trunk to ocpbm (compute -> registry)
104+
ansible.builtin.command: # noqa: command-instead-of-module
105+
cmd: iptables -I FORWARD -i osp_trunk -o ocpbm -j ACCEPT
106+
register: _fdp_update_fw_rule1
107+
failed_when: false
108+
changed_when: _fdp_update_fw_rule1.rc == 0
109+
110+
- name: Allow return traffic from ocpbm to osp_trunk (registry -> compute)
111+
ansible.builtin.command: # noqa: command-instead-of-module
112+
cmd: iptables -I FORWARD -i ocpbm -o osp_trunk -m state --state RELATED,ESTABLISHED -j ACCEPT
113+
register: _fdp_update_fw_rule2
114+
failed_when: false
115+
changed_when: _fdp_update_fw_rule2.rc == 0
116+
117+
- name: Enable NAT for compute nodes to access registry
118+
ansible.builtin.command: # noqa: command-instead-of-module
119+
cmd: iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -d 192.168.201.0/24 -o ocpbm -j MASQUERADE
120+
register: _fdp_update_nat_rule
121+
failed_when: false
122+
changed_when: _fdp_update_nat_rule.rc == 0
123+
124+
- name: Persist firewall rules
125+
ansible.builtin.shell: # noqa: command-instead-of-shell
126+
cmd: iptables-save > /etc/sysconfig/iptables
127+
when: _fdp_update_fw_rule1.changed or _fdp_update_fw_rule2.changed or _fdp_update_nat_rule.changed
128+
129+
roles:
130+
# Update control plane container images
131+
- role: fdp_update_container_images
132+
when: cifmw_fdp_update_container_images_update_control_plane_images | default(true) | bool
133+
134+
# Update EDPM (containers and host packages unified)
135+
- role: fdp_update_edpm
136+
vars:
137+
# Map old variables to new unified role
138+
cifmw_fdp_update_edpm_namespace: "{{ cifmw_fdp_update_container_images_namespace | default('openstack') }}"
139+
cifmw_fdp_update_edpm_repo_baseurl: "{{ cifmw_fdp_update_container_images_repo_baseurl }}"
140+
cifmw_fdp_update_edpm_containers_enabled: "{{ cifmw_fdp_update_container_images_update_edpm_images | default(true) | bool }}"
141+
cifmw_fdp_update_edpm_packages_enabled: "{{ cifmw_fdp_update_container_images_update_edpm_host_packages | default(true) | bool }}"
142+
when: >-
143+
(cifmw_fdp_update_container_images_update_edpm_images | default(true) | bool) or
144+
(cifmw_fdp_update_container_images_update_edpm_host_packages | default(true) | bool)
145+
146+
post_tasks:
147+
- name: Build status messages
148+
ansible.builtin.set_fact:
149+
_cifmw_fdp_update_cp_status: "{{ 'Updated' if (cifmw_fdp_update_container_images_update_control_plane_images | default(true) | bool) else 'Skipped' }}"
150+
_cifmw_fdp_update_edpm_images_status: "{{ 'Updated' if (cifmw_fdp_update_container_images_update_edpm_images | default(true) | bool) else 'Skipped' }}"
151+
_cifmw_fdp_update_edpm_packages_status: "{{ 'Service created' if (cifmw_fdp_update_container_images_update_edpm_host_packages | default(true) | bool) else 'Skipped' }}"
152+
_cifmw_fdp_update_edpm_enabled: "{{ (cifmw_fdp_update_container_images_update_edpm_images | default(true) | bool) or (cifmw_fdp_update_container_images_update_edpm_host_packages | default(true) | bool) }}"
153+
154+
- name: Display completion summary
155+
ansible.builtin.debug:
156+
msg:
157+
- "=============================================="
158+
- "OpenStack Package Update Completed"
159+
- "=============================================="
160+
- ""
161+
- "Control plane containers: {{ _cifmw_fdp_update_cp_status }}"
162+
- "EDPM container images: {{ _cifmw_fdp_update_edpm_images_status }}"
163+
- "EDPM host packages: {{ _cifmw_fdp_update_edpm_packages_status }}"
164+
- ""
165+
- "Package: {{ cifmw_fdp_update_container_images_target_package }}"
166+
- "Repository: {{ cifmw_fdp_update_container_images_repo_baseurl }}"
167+
- "Namespace: {{ cifmw_fdp_update_edpm_containers_namespace | default('openstack') }}"
168+
- "=============================================="

‎post-deployment.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
- name: Run FDP update after deployment
2+
ansible.builtin.import_playbook: playbooks/fdp_update.yml
3+
when: cifmw_fdp_update_enabled | default(false) | bool
4+
15
- name: Run Post-deployment admin setup steps, test, and compliance scan
26
hosts: "{{ cifmw_target_host | default('localhost') }}"
37
gather_facts: true
@@ -8,7 +12,6 @@
812
tasks_from: admin_setup.yml
913
tags:
1014
- admin-setup
11-
1215
- name: Run Test
1316
ansible.builtin.import_role:
1417
name: cifmw_setup

‎roles/fdp_update_container_images/README.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# fdp_update_container_images
2+
3+
Ansible role to update specific RPM packages in OpenStack container images by rebuilding them with custom repositories.
4+
5+
This role automates the process of:
6+
1. Fetching container images from OpenStackVersion CR
7+
2. Checking if target package exists in each image
8+
3. Building new images with updated packages from custom repository
9+
4. Pushing updated images to OpenShift internal registry
10+
5. Patching OpenStackVersion CR to use the new images
11+
12+
## Privilege escalation
13+
None - Runs as the user executing Ansible
14+
15+
## Parameters
16+
17+
* `cifmw_fdp_update_container_images_basedir`: (String) Base directory. Defaults to `cifmw_basedir` which defaults to `~/ci-framework-data`.
18+
* `cifmw_fdp_update_container_images_namespace`: (String) OpenShift namespace where OpenStack is deployed. Defaults to `openstack`.
19+
* `cifmw_fdp_update_container_images_openstack_cr_name`: (String) Name of the OpenStackVersion CR. Defaults to `controlplane`.
20+
* `cifmw_fdp_update_container_images_target_package`: (String) Name of the RPM package to update (e.g., `ovn24.03`). **Required**.
21+
* `cifmw_fdp_update_container_images_repo_name`: (String) Repository name. Defaults to `custom-repo`.
22+
* `cifmw_fdp_update_container_images_repo_baseurl`: (String) Repository base URL. **Required**.
23+
* `cifmw_fdp_update_container_images_repo_enabled`: (Integer) Enable repository (0 or 1). Defaults to `1`.
24+
* `cifmw_fdp_update_container_images_repo_gpgcheck`: (Integer) Enable GPG check (0 or 1). Defaults to `0`.
25+
* `cifmw_fdp_update_container_images_repo_priority`: (Integer) Repository priority. Defaults to `0`.
26+
* `cifmw_fdp_update_container_images_repo_sslverify`: (Integer) Enable SSL verification (0 or 1). Defaults to `0`.
27+
* `cifmw_fdp_update_container_images_image_registry`: (String) External OpenShift image registry URL. Auto-detected from cluster if not specified. Leave empty for auto-detection.
28+
* `cifmw_fdp_update_container_images_image_registry_internal`: (String) Internal OpenShift image registry URL. Defaults to `image-registry.openshift-image-registry.svc:5000`.
29+
* `cifmw_fdp_update_container_images_image_name_prefix`: (String) Prefix for new image names. Defaults to `fdp-update`.
30+
* `cifmw_fdp_update_container_images_update_control_plane_images`: (Boolean) Update control plane container images. Defaults to `true`.
31+
* `cifmw_fdp_update_container_images_temp_dir`: (String) Temporary directory for build context. Auto-generated if not specified.
32+
* `cifmw_fdp_update_container_images_update_dnf_args`: (String) Additional arguments for dnf update command. Defaults to `--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }}`.
33+
34+
## Examples
35+
36+
### Update OVN package in all containers
37+
```yaml
38+
---
39+
- hosts: localhost
40+
vars:
41+
cifmw_fdp_update_container_images_target_package: "ovn24.03"
42+
cifmw_fdp_update_container_images_repo_name: "custom-repo"
43+
cifmw_fdp_update_container_images_repo_baseurl: "http://example.com/custom-repo/"
44+
cifmw_fdp_update_container_images_namespace: "openstack"
45+
roles:
46+
- role: "fdp_update_container_images"
47+
```
48+
49+
### Update with custom registry and image prefix
50+
```yaml
51+
---
52+
- hosts: localhost
53+
vars:
54+
cifmw_fdp_update_container_images_target_package: "ovn24.03"
55+
cifmw_fdp_update_container_images_repo_baseurl: "http://custom-repo.example.com/repo/"
56+
cifmw_fdp_update_container_images_image_registry: "registry.example.com"
57+
cifmw_fdp_update_container_images_image_name_prefix: "ovn-hotfix"
58+
roles:
59+
- role: "fdp_update_container_images"
60+
```
61+
62+
### Update with specific DNF arguments
63+
```yaml
64+
---
65+
- hosts: localhost
66+
vars:
67+
cifmw_fdp_update_container_images_target_package: "neutron-ovn-metadata-agent"
68+
cifmw_fdp_update_container_images_repo_baseurl: "http://custom-repo.example.com/repo/"
69+
cifmw_fdp_update_container_images_update_dnf_args: "--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }} --nobest"
70+
roles:
71+
- role: "fdp_update_container_images"
72+
```
73+
74+
## How it works
75+
76+
1. **Registry Setup**:
77+
- Enables the default route for OpenShift image registry
78+
- Auto-detects the registry hostname or uses the configured value
79+
2. **Authentication**: Obtains a token from OpenShift and authenticates with the internal registry using TLS
80+
3. **Image Discovery**: Queries the OpenStackVersion CR for all container images
81+
4. **Package Check**: For each image, creates a temporary container to check if the target package is installed
82+
5. **Image Build**: If the package exists, builds a new image with the updated package from the custom repository
83+
6. **Registry Push**: Pushes the new image to the OpenShift internal registry
84+
7. **CR Update**: Patches the OpenStackVersion CR's `spec.customContainerImages` field with the new image reference
85+
8. **Summary**: Provides a summary of all updated images
86+
87+
## Requirements
88+
89+
* OpenShift CLI (`oc`) must be available
90+
* Podman must be installed and accessible
91+
* User must have permissions to:
92+
- Create tokens in the target namespace
93+
- Get and patch OpenStackVersion CRs
94+
- Push images to the internal registry
95+
- Patch image registry configuration (`configs.imageregistry.operator.openshift.io/cluster`)
96+
97+
## Notes
98+
99+
* The role uses podman to build and push images with TLS verification
100+
* Each updated image gets a unique tag with timestamp: `<prefix>-<image-key>-<timestamp>`
101+
* Only images containing the target package will be updated
102+
* The role cleans up temporary containers automatically
103+
* All build contexts are created in a temporary directory that is cleaned up after execution
104+
* The role automatically configures the OpenShift image registry for external access:
105+
- Enables the default route if not already enabled
106+
- Auto-detects the registry hostname from the route

‎roles/fdp_update_container_images/defaults/main.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
# ============================================================================
18+
# Update Control Flags
19+
# ============================================================================
20+
# Enable/disable control plane container image updates
21+
cifmw_fdp_update_container_images_update_control_plane_images: true
22+
23+
# ============================================================================
24+
# Base Configuration
25+
# ============================================================================
26+
27+
# Base directory for artifacts and temporary files
28+
cifmw_fdp_update_container_images_basedir: "{{ cifmw_basedir | default(ansible_user_dir ~ '/ci-framework-data') }}"
29+
30+
# OpenShift namespace where OpenStack is deployed
31+
cifmw_fdp_update_container_images_namespace: "openstack"
32+
33+
# Name of the OpenStackVersion custom resource
34+
cifmw_fdp_update_container_images_openstack_cr_name: "controlplane"
35+
36+
# Target package to update (REQUIRED - must be set by user)
37+
cifmw_fdp_update_container_images_target_package: ""
38+
39+
# List of images to update with the target package
40+
# Only these images will be updated (no package scanning is performed)
41+
cifmw_fdp_update_container_images_images_to_scan:
42+
- ovnControllerImage
43+
- ovnControllerOvsImage
44+
- ovnNbDbclusterImage
45+
- ovnNorthdImage
46+
- ovnSbDbclusterImage
47+
- ceilometerSgcoreImage
48+
49+
# Repository configuration
50+
cifmw_fdp_update_container_images_repo_name: "custom-repo"
51+
cifmw_fdp_update_container_images_repo_baseurl: "" # REQUIRED - must be set by user
52+
cifmw_fdp_update_container_images_repo_enabled: 1
53+
cifmw_fdp_update_container_images_repo_gpgcheck: 0
54+
cifmw_fdp_update_container_images_repo_priority: 0
55+
cifmw_fdp_update_container_images_repo_sslverify: 0
56+
57+
# Image registry configuration
58+
# External registry URL (for compute nodes/EDPM and pushing images)
59+
# Leave empty to auto-detect external route from OpenShift cluster
60+
cifmw_fdp_update_container_images_image_registry: ""
61+
62+
# Internal registry URL (for OpenShift pods to pull images)
63+
# This is auto-detected and should not normally need to be changed
64+
cifmw_fdp_update_container_images_image_registry_internal: "image-registry.openshift-image-registry.svc:5000"
65+
66+
# Image naming
67+
cifmw_fdp_update_container_images_image_name_prefix: "fdp-update"
68+
69+
# Temporary directory for build context
70+
cifmw_fdp_update_container_images_temp_dir: ""
71+
72+
# DNF update arguments
73+
cifmw_fdp_update_container_images_update_dnf_args: "--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }}"
74+
75+
# Internal variables (do not override)
76+
_cifmw_fdp_update_container_images_modified_images: []
77+
_cifmw_fdp_update_container_images_updated_cr_keys: []
78+
_cifmw_fdp_update_container_images_total_images: 0
79+
_cifmw_fdp_update_container_images_processed_images: 0

0 commit comments

Comments
 (0)