Skip to content

Commit c06f97a

Browse files
mnietojimnietoji
committed
Add fdp_update_edpm role for EDPM node updates
Implement EDPM node update automation for FDP updates: - Role fdp_update_edpm: Updates EDPM nodes declaratively via Kubernetes CRs * Patches OpenStackDataPlaneNodeSet CRs with updated container images * Configures package updates via edpm_bootstrap_packages * Sets up registry authentication and CA certificates * Creates OpenStackDataPlaneDeployment to apply changes * Includes hypervisor firewall configuration for registry access - Integration in post-deployment.yml after control plane updates - Zuul CI configuration for automated testing This role enables updating Fast Data Path components on EDPM (External Data Plane Management) nodes using a declarative approach. Updates are applied by modifying Kubernetes CRs and letting the OpenStack Data Plane Operator execute the changes via native edpm-ansible roles. Works in conjunction with fdp_update_container_images to provide a complete FDP update workflow across both control plane and data plane. Assisted-By: Claude <[email protected]> Signed-off-by: Miguel Angel Nieto Jimenez <[email protected]>
1 parent c02c6ba commit c06f97a

File tree

16 files changed

+1063
-0
lines changed

16 files changed

+1063
-0
lines changed

‎docs/dictionary/en-custom.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ ipam
257257
ipi
258258
ipmi
259259
ips
260+
iptables
260261
ipv
261262
iscsi
262263
isdir
@@ -415,6 +416,7 @@ openstack
415416
openstackclient
416417
openstackcontrolplane
417418
openstackdataplane
419+
openstackdataplanedeployment
418420
openstackdataplanenodeset
419421
openstackdataplanenodesets
420422
openstackprovisioner

‎post-deployment.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@
5454
cifmw_fdp_update_container_images_target_package: "{{ cifmw_fdp_update_target_package }}"
5555
cifmw_fdp_update_container_images_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
5656

57+
- name: Update EDPM (containers and host packages)
58+
ansible.builtin.import_role:
59+
name: fdp_update_edpm
60+
vars:
61+
cifmw_fdp_update_edpm_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
62+
5763
- name: Run compliance scan for computes
5864
hosts: "{{ groups['computes'] | default ([]) }}"
5965
gather_facts: true

‎roles/fdp_update_edpm/README.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# fdp_update_edpm
2+
3+
Role for updating OpenStack EDPM (Edge Data Plane Management) nodes with custom container images and host packages.
4+
5+
## Description
6+
7+
This role provides a declarative approach to update EDPM nodes with:
8+
9+
1. **Updates container images** by patching OpenStackDataPlaneNodeSet CRs with new image references
10+
2. **Updates host packages** by configuring `edpm_bootstrap_packages` and `edpm_bootstrap_repos` in the nodeset
11+
3. **Configures registry authentication** with OpenShift service account tokens
12+
4. **Installs CA certificates** for secure registry access
13+
5. **Optionally creates deployments** to apply the changes to EDPM nodes
14+
15+
### Key Features
16+
17+
- **Declarative approach**: Only modifies Kubernetes CRs, doesn't execute commands directly on EDPM nodes
18+
- **Uses native EDPM capabilities**: Leverages `edpm_bootstrap` and `edpm_podman` roles from edpm-ansible
19+
- **Secure by default**: Installs OpenShift CA certificates instead of using insecure registries
20+
- **Flexible**: Supports updating containers, packages, or both
21+
- **Idempotent**: Can be run multiple times safely
22+
23+
## Requirements
24+
25+
- OpenShift cluster with OpenStack operators installed
26+
- Access to `oc` command
27+
- OpenStackVersion CR with custom container images
28+
- Custom repository with updated packages (if updating host packages)
29+
30+
## Role Variables
31+
32+
### General Configuration
33+
34+
| Variable | Default | Description |
35+
|----------|---------|-------------|
36+
| `cifmw_fdp_update_edpm_namespace` | `"openstack"` | OpenShift namespace |
37+
| `cifmw_fdp_update_edpm_nodeset_name` | `"all"` | NodeSet to update (`"all"` or specific name) |
38+
| `cifmw_fdp_update_edpm_dry_run` | `false` | Show changes without applying |
39+
40+
### Container Image Updates
41+
42+
| Variable | Default | Description |
43+
|----------|---------|-------------|
44+
| `cifmw_fdp_update_edpm_containers_enabled` | `true` | Enable container image updates |
45+
| `cifmw_fdp_update_edpm_image_registry` | `""` | External registry URL (auto-detected if empty) |
46+
| `cifmw_fdp_update_edpm_image_variable_mapping` | See defaults | Mapping of image keys to EDPM variables |
47+
48+
### Host Package Updates
49+
50+
| Variable | Default | Description |
51+
|----------|---------|-------------|
52+
| `cifmw_fdp_update_edpm_packages_enabled` | `true` | Enable host package updates |
53+
| `cifmw_fdp_update_edpm_repo_baseurl` | `""` | **REQUIRED** Repository base URL |
54+
| `cifmw_fdp_update_edpm_repo_name` | `"fdp-update"` | Repository name |
55+
| `cifmw_fdp_update_edpm_packages` | See defaults | List of packages to install/update |
56+
57+
### Hypervisor Firewall Configuration
58+
59+
| Variable | Default | Description |
60+
|----------|---------|-------------|
61+
| `cifmw_fdp_update_edpm_setup_hypervisor_firewall` | `true` | Enable/disable hypervisor firewall setup for registry access |
62+
| `cifmw_fdp_update_compute_interface` | `"osp_trunk"` | Network interface on hypervisor connected to compute nodes (EDPM) |
63+
| `cifmw_fdp_update_registry_interface` | `"ocpbm"` | Network interface on hypervisor connected to OpenShift/registry |
64+
| `cifmw_fdp_update_compute_network` | `"192.168.122.0/24"` | Compute nodes network CIDR (source for NAT) |
65+
| `cifmw_fdp_update_registry_network` | `"192.168.201.0/24"` | OpenShift/registry network CIDR (destination for NAT) |
66+
67+
### Registry Configuration
68+
69+
| Variable | Default | Description |
70+
|----------|---------|-------------|
71+
| `cifmw_fdp_update_edpm_configure_registry_ca` | `true` | Install OpenShift CA certificate via bootstrap command |
72+
| `cifmw_fdp_update_edpm_configure_registry_auth` | `true` | Configure registry authentication |
73+
74+
### Deployment Configuration
75+
76+
| Variable | Default | Description |
77+
|----------|---------|-------------|
78+
| `cifmw_fdp_update_edpm_auto_deploy` | `true` | Automatically create deployment |
79+
| `cifmw_fdp_update_edpm_deployment_per_nodeset` | `true` | Create separate deployment per nodeset |
80+
| `cifmw_fdp_update_edpm_wait_for_deployment` | `true` | Wait for deployment to complete |
81+
| `cifmw_fdp_update_edpm_deployment_timeout` | `3600` | Deployment timeout (seconds) |
82+
| `cifmw_fdp_update_edpm_deployment_services` | See defaults | Services to run in deployment |
83+
84+
## Dependencies
85+
86+
None (uses native OpenStack Data Plane operators and edpm-ansible roles)
87+
88+
## Example Playbook
89+
90+
### Update both containers and packages
91+
92+
```yaml
93+
- hosts: localhost
94+
roles:
95+
- role: fdp_update_edpm
96+
vars:
97+
cifmw_fdp_update_edpm_namespace: openstack
98+
cifmw_fdp_update_edpm_nodeset_name: openstack-edpm
99+
cifmw_fdp_update_edpm_repo_baseurl: "http://example.com/repos/fdp-updates"
100+
cifmw_fdp_update_edpm_packages:
101+
- openvswitch3.5
102+
- openvswitch-selinux-extra-policy
103+
```
104+
105+
### Update only containers
106+
107+
```yaml
108+
- hosts: localhost
109+
roles:
110+
- role: fdp_update_edpm
111+
vars:
112+
cifmw_fdp_update_edpm_packages_enabled: false
113+
cifmw_fdp_update_edpm_containers_enabled: true
114+
```
115+
116+
### Update only packages
117+
118+
```yaml
119+
- hosts: localhost
120+
roles:
121+
- role: fdp_update_edpm
122+
vars:
123+
cifmw_fdp_update_edpm_containers_enabled: false
124+
cifmw_fdp_update_edpm_packages_enabled: true
125+
cifmw_fdp_update_edpm_repo_baseurl: "http://example.com/repos/updates"
126+
```
127+
128+
### Dry run (show changes without applying)
129+
130+
```yaml
131+
- hosts: localhost
132+
roles:
133+
- role: fdp_update_edpm
134+
vars:
135+
cifmw_fdp_update_edpm_dry_run: true
136+
```
137+
138+
### Custom network configuration
139+
140+
```yaml
141+
- hosts: localhost
142+
roles:
143+
- role: fdp_update_edpm
144+
vars:
145+
cifmw_fdp_update_compute_interface: "br-ex"
146+
cifmw_fdp_update_registry_interface: "br-ocp"
147+
cifmw_fdp_update_compute_network: "10.0.0.0/24"
148+
cifmw_fdp_update_registry_network: "172.16.0.0/24"
149+
```
150+
151+
## How It Works
152+
153+
1. **Validates parameters**: Ensures required variables are set
154+
2. **Configures hypervisor firewall** (if enabled): Sets up iptables rules to allow EDPM nodes to access the OpenShift registry
155+
3. **Fetches NodeSets**: Gets OpenStackDataPlaneNodeSet CRs from the cluster
156+
4. **Fetches container images** (if enabled): Gets custom images from OpenStackVersion CR
157+
5. **For each NodeSet**:
158+
- Patches container image variables (e.g., `edpm_ovn_controller_agent_image`)
159+
- Patches `edpm_bootstrap_packages` with packages to install
160+
- Patches `edpm_bootstrap_repos` with custom repository configuration
161+
- Configures registry authentication (`edpm_container_registry_logins`)
162+
- Installs CA certificate via `edpm_bootstrap_command` (if enabled)
163+
6. **Creates deployment** (if enabled): Creates OpenStackDataPlaneDeployment CR
164+
7. **Waits for completion** (if enabled): Monitors deployment until Ready
165+
166+
## Architecture: Declarative vs Imperative
167+
168+
This role follows the **declarative** approach of Kubernetes/OpenStack:
169+
170+
- ❌ **Does NOT** SSH to nodes and run `dnf install` directly
171+
- ❌ **Does NOT** SSH to nodes and run `systemctl restart` directly
172+
- ✅ **Does** patch NodeSet CRs with desired state
173+
- ✅ **Does** let OpenStack Data Plane Operator apply the changes
174+
- ✅ **Does** use native `edpm_bootstrap` role for package installation
175+
- ✅ **Does** use native `edpm_podman` role for container management
176+
- ✅ **Does** use `edpm_bootstrap_command` for CA certificate installation
177+
178+
## License
179+
180+
Apache 2.0
181+
182+
## Author Information
183+
184+
Red Hat OpenStack CI Framework Team

‎roles/fdp_update_edpm/defaults/main.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
# ============================================
18+
# General Configuration
19+
# ============================================
20+
21+
# OpenShift namespace where EDPM resources are deployed
22+
cifmw_fdp_update_edpm_namespace: "openstack"
23+
24+
# NodeSet selector - can be a specific name or 'all' for all nodesets
25+
cifmw_fdp_update_edpm_nodeset_name: "all"
26+
27+
# Dry run - show changes without applying
28+
cifmw_fdp_update_edpm_dry_run: false
29+
30+
# ============================================
31+
# Container Image Updates
32+
# ============================================
33+
34+
# Enable/disable container image updates
35+
cifmw_fdp_update_edpm_containers_enabled: true
36+
37+
# Image registry URL (auto-detected from OpenShift if empty)
38+
cifmw_fdp_update_edpm_image_registry: ""
39+
40+
# Mapping of control plane image keys to EDPM ansible variables
41+
# Only ovnControllerImage is used on EDPM compute nodes
42+
cifmw_fdp_update_edpm_image_variable_mapping:
43+
ovnControllerImage: edpm_ovn_controller_agent_image
44+
45+
# ============================================
46+
# Host Package Updates
47+
# ============================================
48+
49+
# Enable/disable host package updates
50+
cifmw_fdp_update_edpm_packages_enabled: true
51+
52+
# Repository configuration for host package updates
53+
cifmw_fdp_update_edpm_repo_name: "fdp-update"
54+
cifmw_fdp_update_edpm_repo_baseurl: "" # REQUIRED if packages_enabled is true
55+
cifmw_fdp_update_edpm_repo_enabled: true
56+
cifmw_fdp_update_edpm_repo_gpgcheck: false
57+
cifmw_fdp_update_edpm_repo_priority: 1
58+
59+
# Packages to update on the host
60+
# These will be added to edpm_bootstrap_packages in the nodeset
61+
cifmw_fdp_update_edpm_packages:
62+
- openvswitch3.5
63+
- openvswitch-selinux-extra-policy
64+
65+
# ============================================
66+
# Hypervisor Firewall Configuration
67+
# ============================================
68+
69+
# Enable/disable hypervisor firewall setup for registry access
70+
cifmw_fdp_update_edpm_setup_hypervisor_firewall: true
71+
72+
# Network interface on hypervisor connected to compute nodes (EDPM)
73+
cifmw_fdp_update_compute_interface: "osp_trunk"
74+
75+
# Network interface on hypervisor connected to OpenShift/registry
76+
cifmw_fdp_update_registry_interface: "ocpbm"
77+
78+
# Compute nodes network CIDR (source for NAT)
79+
cifmw_fdp_update_compute_network: "192.168.122.0/24"
80+
81+
# OpenShift/registry network CIDR (destination for NAT)
82+
cifmw_fdp_update_registry_network: "192.168.201.0/24"
83+
84+
# ============================================
85+
# Registry Configuration
86+
# ============================================
87+
88+
# Configure OpenShift registry CA certificate on EDPM nodes
89+
cifmw_fdp_update_edpm_configure_registry_ca: true
90+
91+
# Configure registry authentication automatically
92+
# Uses 'oc create token' or 'oc whoami -t' to get a service account token
93+
cifmw_fdp_update_edpm_configure_registry_auth: true
94+
95+
# ============================================
96+
# Deployment Configuration
97+
# ============================================
98+
99+
# Automatically create OpenStackDataPlaneDeployment after updating NodeSets
100+
# Creates a single deployment for all updated NodeSets
101+
cifmw_fdp_update_edpm_auto_deploy: true
102+
103+
# Wait for deployment to complete before continuing
104+
cifmw_fdp_update_edpm_wait_for_deployment: true
105+
106+
# Timeout for deployment completion (in seconds)
107+
# Default: 3600 seconds (60 minutes / 1 hour)
108+
cifmw_fdp_update_edpm_deployment_timeout: 3600
109+
110+
# Polling interval when waiting for deployment (in seconds)
111+
cifmw_fdp_update_edpm_deployment_poll_interval: 30
112+
113+
# Services to run in the deployment
114+
# For updates, we need to:
115+
# 1. bootstrap - Install host packages and configure repos
116+
# 2. configure-os - Configure registry authentication
117+
# 3. configure-network - Ensure network is configured
118+
# 4. Service-specific services (ovn, nova, etc) - Pull updated images and restart
119+
cifmw_fdp_update_edpm_deployment_services:
120+
- bootstrap # MUST be first to install packages and configure repos
121+
- configure-os # MUST be second to authenticate before pulling images
122+
- configure-network
123+
- ovn
124+
125+
# ============================================
126+
# Internal Variables (do not override)
127+
# ============================================
128+
129+
_cifmw_fdp_update_edpm_updated_images: {}
130+
_cifmw_fdp_update_edpm_nodesets: []
131+
_cifmw_fdp_update_edpm_updated_nodesets: []
132+
_cifmw_fdp_update_edpm_external_registry: ""

‎roles/fdp_update_edpm/meta/main.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
galaxy_info:
18+
author: Red Hat
19+
description: Update OpenStack EDPM container images and host packages with FDP updates
20+
company: Red Hat
21+
license: Apache-2.0
22+
min_ansible_version: "2.15"
23+
platforms:
24+
- name: Fedora
25+
versions:
26+
- all
27+
- name: EL
28+
versions:
29+
- "9"
30+
galaxy_tags:
31+
- openstack
32+
- edpm
33+
- dataplane
34+
- kubernetes
35+
- openshift
36+
- rpm
37+
- containers
38+
39+
dependencies: []

0 commit comments

Comments
 (0)