Change run_once to throttle to allow independent databases (#400)

* Change run_once to throttle to allow independent databases

* Use throttle also for icingaweb schema import

Author: dgoetz

changelogs/fragments/fix-runonce-serial.yml

@@ -0,0 +1,5 @@
+---
+bugfixes:
+  - |
+    Switch from :code:`run_once` which was used to ensure it runs only once in a cluster resulting in propagated the databases only on the first node even if nodes are independent to :code:`throttle`.
+    This was also fixed for some cases where :code:`run_once` was missing in the current state.

roles/icinga_kubernetes/tasks/manage_schema_mysql.yml

@@ -1,3 +1,4 @@
+---
 - name: MySQL import Kubernetes schema
   when: icinga_kubernetes_database_import_schema | default(False)
   block:
@@ -13,19 +14,15 @@
           -p{{ icinga_kubernetes_database_password | quote }}
           "{{ icinga_kubernetes_database_name | default('kubernetes') }}"
 
-    - name: MySQL check for Kubernetes schema
-      ansible.builtin.shell: >
-        {{ mysqlcmd }}
-        -Ns -e "select version from kubernetes_schema"
-      failed_when: false
-      changed_when: false
-      check_mode: false
-      register: _db_schema
-
     - name: MySQL import Kubernetes schema
       ansible.builtin.shell: >
         {{ mysqlcmd }}
-        < {{ icinga_kubernetes_database_schema }}
-      when: _db_schema.rc != 0
-      check_mode: false
-      run_once: true
+        -Ns -e "select version from kubernetes_schema" ||
+        (
+          {{ mysqlcmd }} < {{ icinga_kubernetes_database_schema }} &&
+          echo "Schema imported"
+        )
+      register: _icingakubernetes_schema
+      changed_when:
+        - '"Schema imported" in _icingakubernetes_schema.stdout_lines'
+      throttle: 1

roles/icinga_kubernetes/tasks/manage_schema_pgsql.yml

@@ -1,3 +1,4 @@
+---
 # temporarily disabled, pgsql at the moment is not available for icinga kubernetes
 
 # - name: PgSQL import Kubernetes schema
@@ -18,19 +19,16 @@
 #           {% if icinga_kubernetes_database_key is defined %} sslkey={{ icinga_kubernetes_database_key }} {%- endif %}
 #           {% if icinga_kubernetes_database_ssl_extra_options is defined %} {{ icinga_kubernetes_database_ssl_extra_options }} {%- endif %}"
 
-#     - name: PgSQL check for Kubernetes schema
-#       ansible.builtin.shell: >
-#         {{ _tmp_pgsqlcmd }}
-#         -w -c "select version from kubernetes_schema"
-#       failed_when: false
-#       changed_when: false
-#       check_mode: false
-#       register: _db_schema
-
 #     - name: PgSQL import Kubernetes schema
 #       ansible.builtin.shell: >
 #         {{ _tmp_pgsqlcmd }}
-#         -w -f {{ icinga_kubernetes_database_schema }}
-#       when: _db_schema.rc != 0
-#       check_mode: false
-#       run_once: true
+#         -w -c "select version from kubernetes_schema" ||
+#         (
+#           {{ _tmp_pgsqlcmd }}
+#           -w -f {{ icinga_kubernetes_database_schema }} &&
+#           echo "Schema imported"
+#         )
+#       register: _icingakubernetes_schema
+#       changed_when:
+#         - '"Schema imported" in _icingakubernetes_schema.stdout_lines'
+#       throttle: 1

roles/icingadb/tasks/manage_schema_mysql.yml

@@ -1,3 +1,4 @@
+---
 - name: MySQL import IcingaDB schema
   when: icingadb_database_import_schema | default(False)
   block:
@@ -13,19 +14,15 @@
           -p{{ icingadb_database_password | quote }}
           "{{ icingadb_database_name | default('icingadb') }}"
 
-    - name: MySQL check for IcingaDB schema
-      ansible.builtin.shell: >
-        {{ mysqlcmd }}
-        -Ns -e "select version from icingadb_schema"
-      failed_when: false
-      changed_when: false
-      check_mode: false
-      register: _db_schema
-
     - name: MySQL import IcingaDB schema
       ansible.builtin.shell: >
         {{ mysqlcmd }}
-        < {{ icingadb_database_schema }}
-      when: _db_schema.rc != 0
-      check_mode: false
-      run_once: yes
+        -Ns -e "select version from icingadb_schema" ||
+        (
+          {{ mysqlcmd }} < {{ icingadb_database_schema }} &&
+          echo "Schema imported"
+        )
+      register: _icingadb_schema
+      changed_when:
+        - '"Schema imported" in _icingadb_schema.stdout_lines'
+      throttle: 1

roles/icingadb/tasks/manage_schema_pgsql.yml

@@ -1,3 +1,4 @@
+---
 - name: PgSQL import IcingaDB schema
   when: icingadb_database_import_schema| default(False)
   block:
@@ -16,19 +17,15 @@
           {% if icingadb_database_key is defined %} sslkey={{ icingadb_database_key }} {%- endif %}
           {% if icingadb_database_ssl_extra_options is defined %} {{ icingadb_database_ssl_extra_options }} {%- endif %}"
 
-    - name: PgSQL check for IcingaDB schema
-      ansible.builtin.shell: >
-        {{ _tmp_pgsqlcmd }}
-        -w -c "select version from icingadb_schema"
-      failed_when: false
-      changed_when: false
-      check_mode: false
-      register: _db_schema
-
     - name: PgSQL import IcingaDB schema
       ansible.builtin.shell: >
         {{ _tmp_pgsqlcmd }}
-        -w -f {{ icingadb_database_schema }}
-      when: _db_schema.rc != 0
-      check_mode: false
-      run_once: yes
+        -w -c "select version from icingadb_schema" ||
+        (
+          {{ _tmp_pgsqlcmd }} -w -f {{ icingadb_database_schema }} &&
+          echo "Schema imported"
+        )
+      register: _icingadb_schema
+      changed_when:
+        - '"Schema imported" in _icingadb_schema.stdout_lines'
+      throttle: 1

roles/icingaweb2/handlers/main.yml

@@ -1,11 +1,19 @@
 ---
 
-- name: Module Director | Apply pending migrations
-  ansible.builtin.command:
-    cmd: icingacli director migration run
+- name: Module Director | Apply pending migrations # noqa: command-instead-of-shell
+  ansible.builtin.shell:
+    cmd: icingacli director migration pending && icingacli director migration run || echo "No changes"
+  throttle: 1
   listen: "run_director_migrations"
+  register: _tmp_director_migration
+  changed_when: 'not "No changes" in _tmp_director_migration.stdout_lines'
+  failed_when: _tmp_director_migration.stderr_lines | length > 0
 
-- name: Module Director | Run kickstart if required
-  ansible.builtin.command:
-    cmd: icingacli director kickstart run
+- name: Module Director | Run kickstart if required # noqa: command-instead-of-shell
+  ansible.builtin.shell:
+    cmd: icingacli director kickstart required && icingacli director kickstart run || echo "No changes"
+  throttle: 1
   listen: "run_director_kickstart"
+  register: _tmp_director_kickstart
+  changed_when: 'not "No changes" in _tmp_director_kickstart.stdout_lines'
+  failed_when: _tmp_director_kickstart.stderr_lines | length > 0 or "Kickstart has not been configured" in _tmp_director_kickstart.stdout_lines

roles/icingaweb2/tasks/modules/manage_mysql_imports.yml

@@ -21,18 +21,15 @@
       -p{{ _db['password'] | quote }}
       "{{ _db['name'] }}"
 
-- name: MySQL check for db schema
+- name: MySQL import db schema
   ansible.builtin.shell: >
     {{ _tmp_mysqlcmd }}
-    -Ns -e "{{ _db['select_query'] }}"
-  failed_when: false
-  changed_when: false
-  check_mode: false
-  register: _db_schema
-
-- name: MySQL import  db schema
-  ansible.builtin.shell: >
-    {{ _tmp_mysqlcmd }}
-    < {{ _db['schema_path_mysql'] }}
-  when: _db_schema.rc != 0
-  run_once: yes
+    -Ns -e "{{ _db['select_query'] }}" ||
+    (
+      {{ _tmp_mysqlcmd }} < {{ _db['schema_path_mysql'] }} &&
+      echo "Schema imported"
+    )
+  register: _icingaweb2_schema
+  changed_when:
+    - '"Schema imported" in _icingaweb2_schema.stdout_lines'
+  throttle: 1

roles/icingaweb2/tasks/modules/manage_pgsql_imports.yml

@@ -20,18 +20,15 @@
       {% if _db['ssl_key'] is defined %} sslkey={{ _db['ssl_key'] }}{%- endif %}
       {% if _db['ssl_extra_options'] is defined %} {{ _db['ssl_extra_options'] }}{%- endif %}"
 
-- name: PostgresQL check for db schema
+- name: PostgresQL import db schema
   ansible.builtin.shell: >
     {{ _tmp_pgsqlcmd }}
-    -tq -c "{{ _db['select_query'] }}"
-  failed_when: false
-  changed_when: false
-  check_mode: false
-  register: _db_schema
-
-- name: PostgresQL import  db schema
-  ansible.builtin.shell: >
-    {{ _tmp_pgsqlcmd }}
-    < {{ _db['schema_path_pgsql'] }}
-  when: _db_schema.rc != 0
-  run_once: yes
+    -tq -c "{{ _db['select_query'] }}" ||
+    (
+      {{ _tmp_pgsqlcmd }} < {{ _db['schema_path_pgsql'] }} &&
+      echo "Schema imported"
+    )
+  register: _icingaweb2_schema
+  changed_when:
+    - '"Schema imported" in _icingaweb2_schema.stdout_lines'
+  throttle: 1

roles/icingaweb2/tasks/mysql/import_db.yml

@@ -3,14 +3,13 @@
 - name: MySQL check for icingaweb db schema
   ansible.builtin.shell: >
     {{ _tmp_mysqlcmd }}
-    -Ns -e "select * from icingaweb_user"
-  failed_when: false
-  changed_when: false
-  check_mode: false
-  register: _icingaweb2_db_schema
+    -Ns -e "select * from icingaweb_user" ||
+    (
+      {{ _tmp_mysqlcmd }} < /usr/share/icingaweb2/schema/mysql.schema.sql &&
+      echo "Schema imported"
+    )
+  register: _icingaweb_schema
+  changed_when:
+    - '"Schema imported" in _icingaweb_schema.stdout_lines'
+  throttle: 1
 
-- name: MySQL import icingaweb db schema
-  ansible.builtin.shell: >
-    {{ _tmp_mysqlcmd }}
-    < /usr/share/icingaweb2/schema/mysql.schema.sql
-  when: _icingaweb2_db_schema.rc != 0

roles/icingaweb2/tasks/mysql/users_db.yml

@@ -1,18 +1,25 @@
 ---
-
-- name: MySQL check for icingaweb db schema
+- name: MySQL create Icinga Web 2 user
   ansible.builtin.shell: >
     {{ _tmp_mysqlcmd }}
     -Ns -e "select name from icingaweb_user where name like '{{ _current_user.username }}'"
-  failed_when: false
-  changed_when: false
-  check_mode: false
+    | grep '{{ _current_user.username }}' ||
+    (
+      echo "INSERT INTO icingaweb_user (name, active, password_hash) VALUES ('{{ _current_user.username }}', 1,
+      '"`php -r 'echo password_hash("{{ _current_user.password }}", PASSWORD_DEFAULT);'`"')
+      ON DUPLICATE KEY UPDATE active = 1, password_hash = '"`php -r 'echo password_hash("{{ _current_user.password }}", PASSWORD_DEFAULT);'`"'" |  {{ _tmp_mysqlcmd }} -Ns &&
+      echo "User created"
+    )
   register: _icingaweb2_db_user
+  when: (_current_user.recreate | default(false)) is false
+  changed_when:
+    - '"User created" in _icingaweb2_db_user.stdout_lines'
+  throttle: 1
 
-- name: Create user in Icinga Web (or reenable user / reset password)
-  run_once: true
-  ansible.builtin.shell: >-
+- name: MySQL recreate Icinga Web 2 user
+  ansible.builtin.shell: >
     echo "INSERT INTO icingaweb_user (name, active, password_hash) VALUES ('{{ _current_user.username }}', 1,
     '"`php -r 'echo password_hash("{{ _current_user.password }}", PASSWORD_DEFAULT);'`"')
     ON DUPLICATE KEY UPDATE active = 1, password_hash = '"`php -r 'echo password_hash("{{ _current_user.password }}", PASSWORD_DEFAULT);'`"'" |  {{ _tmp_mysqlcmd }} -Ns
-  when: (_icingaweb2_db_user.stdout_lines | length <= 0) or (_current_user.recreate is true)
+  when: (_current_user.recreate | default(false)) is true
+  throttle: 1