Refs #31614: Drop Pulp 2, Pulpcore only #306

ehelms · 2020-12-10T21:03:07Z

This is similar in nature to #299 and #271 in it's goal. I have attempted to create individual commits that paint the picture of items that can be removed, or adjusted. The landing place for this configuration is:

this module will deploy Pulpcore, optionally with mirror configured to true
this module will deploy Qpid routers when Pulpcore is configured as a mirror on EL7 only
puppet-katello will continue to handle deploying Pulp 2 for the interim katello-agent support

This does require some ecosystem changes to go in first:

ehelms · 2020-12-17T13:42:49Z

Here is a layout of scenarios and how they will be handled:

EL8: Fresh install, no upgrade handling needed, this will install Pulpcore or Pulpcore in mirror mode

EL7:

New Install: Will deploy Pulpcore or Pulpcore in mirror mode along with Qpid bits to handle katello-agent

Upgrade:

Server: Will deploy Pulpcore and leave Pulp running which is handled by puppet-katello, Qpid bits will remain
Content proxy: Will deploy Pulpcore in mirror mode and leave Pulp running, users will need to perform a forced re-sync of the content proxy to populate Pulpcore. A foreman-maintain command will be available to shutdown services, remove RPMs and clean up data from Pulp 2. A similar command will be needed on the main server to clean it up.

wbclark · 2021-01-04T22:29:26Z

I tested a new install on EL7 using forklift with this PR ('checkout' merge strategy) and found that in fact Pulp 2 was still installed:

# hammer ping
database:         
    Status:          ok
    Server Response: Duration: 0ms
candlepin:        
    Status:          ok
    Server Response: Duration: 40ms
candlepin_events: 
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
candlepin_auth:   
    Status:          ok
    Server Response: Duration: 24ms
katello_events:   
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
pulp:             
    Status:          ok
    Server Response: Duration: 136ms
pulp_auth:        
    Status:          ok
    Server Response: Duration: 44ms
pulp3:            
    Status:          ok
    Server Response: Duration: 49ms
foreman_tasks:    
    Status:          ok
    Server Response: Duration: 2ms

# systemctl status pulp_workers
● pulp_workers.service - Pulp Celery Workers
   Loaded: loaded (/usr/lib/systemd/system/pulp_workers.service; enabled; vendor preset: disabled)
   Active: active (exited) since Mon 2021-01-04 21:52:50 UTC; 33min ago
 Main PID: 13144 (code=exited, status=0/SUCCESS)
    Tasks: 0
   CGroup: /system.slice/pulp_workers.service

Jan 04 21:52:49 centos7-katello-nightly.mercury.example.com systemd[1]: Starting Pulp Celery Workers...
Jan 04 21:52:50 centos7-katello-nightly.mercury.example.com systemd[1]: Started Pulp Celery Workers.

# cat /etc/httpd/conf.d/pulp_content.conf 
WSGISocketPrefix run/wsgi
WSGIProcessGroup pulp-content
WSGIApplicationGroup pulp-content
WSGIScriptAlias /pulp2/content /usr/share/pulp/wsgi/content.wsgi
WSGIDaemonProcess pulp-content user=apache group=apache processes=3 display-name=%{GROUP}
WSGIImportScript /usr/share/pulp/wsgi/content.wsgi process-group=pulp-content application-group=pulp-content

<Files content.wsgi>
    WSGIPassAuthorization On
    WSGIProcessGroup pulp-content
    WSGIApplicationGroup pulp-content
    SSLRenegBufferSize  1048576
    SSLVerifyDepth 9
    SSLOptions +StdEnvVars +ExportCertData
    SSLVerifyClient require
</Files>

<Location /pulp2/content/>
    XSendFile on
    XSendFilePath /var/lib/pulp/content
    XSendFilePath /var/lib/pulp/published
</Location>

Is anything else required in order to properly test?

P.S. relevant configuration in forklift/roles/foreman_installer/defaults/main.yml is below:

# Comma-separated list of "organization/module/pr_number", e.g. "katello/foreman_proxy_content/37,katello/certs/34"
foreman_installer_module_prs: ["katello/foreman_proxy_content/306"]
# Another option is checkout which can be useful if you're not based on master
foreman_installer_module_prs_strategy: "checkout"

And I did validate that the changes to puppet-FPC were reflected on the provisioned box in /usr/share/foreman-installer/modules/foreman_proxy_content

wbclark · 2021-01-05T14:11:38Z

Server: Will deploy Pulpcore and leave Pulp running which is handled by puppet-katello, Qpid bits will remain

Right, of course.

wbclark · 2021-01-05T19:47:10Z

When I install content proxy with this PR I'm getting an AVC denial here:

[root@centos7-foreman-proxy-nightly ~]# systemctl status postgresql
● postgresql.service - PostgreSQL database server
   Loaded: loaded (/etc/systemd/system/postgresql.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2021-01-05 19:42:00 UTC; 4min 27s ago
  Process: 31928 ExecStart=/bin/sh -c source scl_source enable rh-postgresql12 ; exec postmaster -D ${PGDATA} (code=exited, status=2)
  Process: 31926 ExecStartPre=/opt/rh/rh-postgresql12/root/usr/libexec/postgresql-check-db-dir %N (code=exited, status=0/SUCCESS)
 Main PID: 31928 (code=exited, status=2)

Jan 05 19:42:00 centos7-foreman-proxy-nightly.mercury.example.com systemd[1]: Starting PostgreSQL database server...
Jan 05 19:42:00 centos7-foreman-proxy-nightly.mercury.example.com systemd[1]: postgresql.service: main process exited, code=exited, status=2/INVALIDARGUMENT
Jan 05 19:42:00 centos7-foreman-proxy-nightly.mercury.example.com systemd[1]: Failed to start PostgreSQL database server.
Jan 05 19:42:00 centos7-foreman-proxy-nightly.mercury.example.com systemd[1]: Unit postgresql.service entered failed state.
Jan 05 19:42:00 centos7-foreman-proxy-nightly.mercury.example.com systemd[1]: postgresql.service failed.
[root@centos7-foreman-proxy-nightly ~]# grep -i avc /var/log/audit/audit.log  | grep postgres
type=AVC msg=audit(1609862840.692:2247): avc:  denied  { getattr } for  pid=9071 comm="postmaster" path="/var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf" dev="vda1" ino=33696691 scontext=system_u:system_r:postgresql_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0
type=AVC msg=audit(1609875720.490:2343): avc:  denied  { getattr } for  pid=31928 comm="postmaster" path="/var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf" dev="vda1" ino=33696691 scontext=system_u:system_r:postgresql_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=0
[root@centos7-foreman-proxy-nightly ~]#

wbclark · 2021-01-05T20:17:19Z

Installer completes successfully after restorecon -RvF /var/opt/rh/rh-postgresql12/lib/pgsql/

ekohl · 2021-01-05T20:33:51Z

puppetlabs/puppetlabs-postgresql@171a1be sould fix that btw. I'll see about nagging people for a release.

wbclark · 2021-01-05T22:04:18Z

puppetlabs/puppetlabs-postgresql@171a1be sould fix that btw. I'll see about nagging people for a release.

Great, thanks. It also made me realize we need theforeman/foreman-installer#636

ekohl

Looks like I failed to submit my review.

manifests/init.pp

ekohl

I think it should make a declaration of foreman_proxy::plugin::pulp:

class { 'foreman_proxy::plugin::pulp':
  enabled              => false,
  pulpnode_enabled     => false,
  pulpcore_enabled     => true,
  pulpcore_mirror      => $pulpcore_mirror,
  pulpcore_api_url     => $pulpcore_api_url, # TODO: derive this from $pulpcore::apache
  pulpcore_content_url => $pulpcore_content_url, # TODO: derive this too
  require              => Class['pulpcore'],
}

manifests/init.pp

ekohl

Could you open an issue for this and relate the installer migration to it as well?

ekohl · 2021-01-13T00:42:25Z

manifests/init.pp

-      $apache_https_key = $certs::apache::apache_key
-      $apache_https_ca = $certs::katello_default_ca_cert
-      $apache_https_chain = $certs::katello_server_ca_cert
+  if $enable_docker {


If we're doing a breaking change, thoughts about renaming this to $enable_container?

I was thinking a similar thing. Given this will require an installer migration alongside it, I thought to do it as an individual follow up change after this all went in.

My reasoning was that it already required an installer migration anyway. Might as well combine them into one.

spec/classes/foreman_proxy_content__pub_dir_spec.rb

spec/classes/foreman_proxy_content__reverse_proxy_spec.rb

ekohl · 2021-01-13T00:49:07Z

Could you open an issue for this and relate the installer migration to it as well?

I now see there was one, but it wasn't in the subject.

We can rely on the Pulpcore Apache setup now to insert the GPG fragment that proxies calls for the GPG key by repositories back to the server rather than the Pulp 2 Apache setup.

spec/classes/foreman_proxy_content_spec.rb

ekohl

Overall I think this looks good. A minor inline comment about tests. Other than that I wonder how we deal with the installed qpid. Do we clean up the installed broker or is that something we leave for other processes?

ehelms · 2021-01-21T15:46:00Z

We still need the qpid broker for katello-agent, so we want to leave it be on upgrades.

ekohl

Please take a look at the pub dir. It probably works, but it feels redundant.

manifests/init.pp

manifests/pub_dir.pp

ehelms · 2021-01-27T20:02:22Z

Connecting the pieces, this change needs to go in alongside theforeman/foreman-installer#638

ekohl

Small nit: probably good to require pulpcore version 3.0.0 in metadata.json for the include pulpcore fix.

theforeman-bot added Needs testing Not yet reviewed labels Dec 10, 2020

ekohl mentioned this pull request Dec 14, 2020

Remove Pulp 2 functionality #271

Closed

ehelms force-pushed the pulpcore-only branch from 380bef5 to a76c9cc Compare December 16, 2020 16:00

wbclark mentioned this pull request Jan 5, 2021

assume pulpcore is always enabled on katello and content_proxy theforeman/foreman-installer#636

Closed

ehelms force-pushed the pulpcore-only branch 2 times, most recently from e28edc4 to 46f61f9 Compare January 7, 2021 13:56

ekohl reviewed Jan 8, 2021

View reviewed changes

manifests/init.pp Show resolved Hide resolved

ekohl requested changes Jan 12, 2021

View reviewed changes

theforeman-bot added Waiting on contributor Needs re-review and removed Not yet reviewed Waiting on contributor labels Jan 12, 2021

ehelms force-pushed the pulpcore-only branch from 3c71a4e to 25605e3 Compare January 12, 2021 17:20

ehelms commented Jan 12, 2021

View reviewed changes

manifests/init.pp Outdated Show resolved Hide resolved

ekohl reviewed Jan 12, 2021

View reviewed changes

manifests/init.pp Show resolved Hide resolved

ehelms force-pushed the pulpcore-only branch 2 times, most recently from a76e64c to aff0524 Compare January 12, 2021 20:24

ehelms mentioned this pull request Jan 12, 2021

Fixes #31614: Enable Pulp 3 by default on server and proxies theforeman/foreman-installer#638

Merged

ekohl reviewed Jan 13, 2021

View reviewed changes

ekohl changed the title ~~Pulpcore only~~ Refs #31614: Drop Pulp 2, Pulpcore only Jan 13, 2021

ehelms force-pushed the pulpcore-only branch from aff0524 to 0d31e29 Compare January 13, 2021 02:11

ehelms added 6 commits January 20, 2021 15:46

Deploy GPG key reverse proxy fragment in Pulpcore vhost

4191601

We can rely on the Pulpcore Apache setup now to insert the GPG fragment that proxies calls for the GPG key by repositories back to the server rather than the Pulp 2 Apache setup.

Always install Pulpcore

cd09e20

Do not enable Pulp 2 types and always proxy to Pulpcore

f0db5fd

Deploy Pulp 2 if EL7 only for katello-agent

963fc8c

Drop Pulp 2 to 3 migration plugin

6e922e9

Drop Pulp 2 as puppet-katello handles deploying for main server

2805f70

ehelms force-pushed the pulpcore-only branch from 0d31e29 to 7d50ca0 Compare January 20, 2021 20:47

ekohl reviewed Jan 21, 2021

View reviewed changes

spec/classes/foreman_proxy_content_spec.rb Outdated Show resolved Hide resolved

ekohl reviewed Jan 21, 2021

View reviewed changes

ehelms force-pushed the pulpcore-only branch 4 times, most recently from e6fa176 to 251cef0 Compare January 26, 2021 01:57

ekohl approved these changes Jan 27, 2021

View reviewed changes

manifests/init.pp Show resolved Hide resolved

manifests/pub_dir.pp Outdated Show resolved Hide resolved

theforeman-bot removed the Needs re-review label Jan 27, 2021

ehelms force-pushed the pulpcore-only branch from 251cef0 to 0d7e348 Compare January 27, 2021 14:39

ekohl reviewed Jan 27, 2021

View reviewed changes

manifests/pub_dir.pp Show resolved Hide resolved

Deploy pub dir on Pulpcore vhost when deploying a mirror

25fcc1b

ehelms force-pushed the pulpcore-only branch from 0d7e348 to 03dcbe6 Compare January 27, 2021 19:49

ehelms mentioned this pull request Jan 28, 2021

Update katello-devel scenario for Pulp 3 theforeman/forklift#1284

Merged

ekohl approved these changes Jan 28, 2021

View reviewed changes

Refs #31614: Wrap foreman_proxy::plugin::pulp and configure it

feb0b6f

ehelms force-pushed the pulpcore-only branch from 03dcbe6 to feb0b6f Compare January 28, 2021 12:39

ekohl approved these changes Jan 28, 2021

View reviewed changes

ehelms merged commit 46cfe75 into theforeman:master Jan 28, 2021

ehelms added Backwards incompatible Enhancement labels Jan 29, 2021

jlsherrill mentioned this pull request Jun 23, 2021

Fixes #32777 - remove pulp 2to3 migration plugin and tables theforeman/foreman_maintain#483

Merged

Refs #31614: Drop Pulp 2, Pulpcore only #306

Refs #31614: Drop Pulp 2, Pulpcore only #306

Uh oh!

Conversation

ehelms commented Dec 10, 2020

Uh oh!

ehelms commented Dec 17, 2020

Uh oh!

wbclark commented Jan 4, 2021

Uh oh!

wbclark commented Jan 5, 2021

Uh oh!

wbclark commented Jan 5, 2021

Uh oh!

wbclark commented Jan 5, 2021

Uh oh!

ekohl commented Jan 5, 2021

Uh oh!

wbclark commented Jan 5, 2021

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

ekohl Jan 13, 2021

Choose a reason for hiding this comment

Uh oh!

ehelms Jan 13, 2021

Choose a reason for hiding this comment

Uh oh!

ekohl Jan 13, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ekohl commented Jan 13, 2021

Uh oh!

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

ehelms commented Jan 21, 2021

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehelms commented Jan 27, 2021

Uh oh!

ekohl left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants