Skip to content

Commit f290329

Browse files
mnietojimnietoji
committed
Add FDP update automation for EDPM deployments
Implement comprehensive FDP update workflow including: - New playbook fdp_update.yml orchestrating the update process - Role fdp_edpm_update_host_packages: Updates packages on EDPM hosts - Role fdp_update_container_images: Rebuilds container images with updated packages * Includes Molecule tests for validation * Jinja2 templates for Dockerfile and repo configuration - Role fdp_update_edpm_containers: Updates running EDPM containers This automation streamlines the process of updating Fast Data Path components across OpenStack EDPM (External Data Plane Management) deployments by coordinating host package updates, container image rebuilds, and container deployment updates. Assisted-By: Claude <[email protected]> Signed-off-by: Miguel Angel Nieto Jimenez <[email protected]>
1 parent 84c46b6 commit f290329

27 files changed

+1644
-1
lines changed

‎docs/dictionary/en-custom.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ ezzmy
186186
favorit
187187
fbqufbqkfbzxrja
188188
fci
189+
fdp
189190
fedoraproject
190191
fil
191192
filesystem
@@ -414,6 +415,7 @@ openstack
414415
openstackclient
415416
openstackcontrolplane
416417
openstackdataplane
418+
openstackdataplanedeployment
417419
openstackdataplanenodeset
418420
openstackdataplanenodesets
419421
openstackprovisioner

‎post-deployment.yml‎

Lines changed: 113 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
tasks_from: admin_setup.yml
99
tags:
1010
- admin-setup
11-
1211
- name: Run Test
1312
ansible.builtin.import_role:
1413
name: cifmw_setup
@@ -26,6 +25,119 @@
2625
tags:
2726
- compliance
2827

28+
# FDP Update - OpenStack package updates across all layers
29+
- name: FDP Update - Validate required variables
30+
when: cifmw_fdp_update_enabled | default(false) | bool
31+
block:
32+
- name: Validate required variables are set
33+
ansible.builtin.assert:
34+
that:
35+
- cifmw_fdp_update_target_package is defined
36+
- cifmw_fdp_update_target_package | length > 0
37+
- cifmw_fdp_update_repo_baseurl is defined
38+
- cifmw_fdp_update_repo_baseurl | length > 0
39+
fail_msg: |
40+
Required variables are missing!
41+
42+
You must set:
43+
- cifmw_fdp_update_target_package: Name of the RPM package to update
44+
- cifmw_fdp_update_repo_baseurl: Repository base URL containing the updated package
45+
success_msg: "Required variables validated successfully"
46+
47+
- name: Display update configuration
48+
ansible.builtin.debug:
49+
msg:
50+
- "=============================================="
51+
- "OpenStack Package Update Configuration"
52+
- "=============================================="
53+
- "Target Package: {{ cifmw_fdp_update_target_package }}"
54+
- "Repository: {{ cifmw_fdp_update_repo_baseurl }}"
55+
- ""
56+
- "Update Control Flags:"
57+
- " Control Plane Images: {{ cifmw_fdp_update_container_images_enabled | default(true) }}"
58+
- " EDPM Update: {{ cifmw_fdp_update_edpm_enabled | default(true) }}"
59+
- " - Container Images: {{ cifmw_fdp_update_edpm_containers_enabled | default(true) }}"
60+
- " - Host Packages: {{ cifmw_fdp_update_edpm_packages_enabled | default(true) }}"
61+
- "=============================================="
62+
63+
- name: Setup hypervisor firewall for registry access
64+
become: true
65+
when: cifmw_fdp_update_setup_hypervisor_firewall | default(true) | bool
66+
block:
67+
- name: Allow traffic from osp_trunk to ocpbm (compute -> registry)
68+
ansible.builtin.iptables:
69+
chain: FORWARD
70+
in_interface: osp_trunk
71+
out_interface: ocpbm
72+
jump: ACCEPT
73+
action: insert
74+
rule_num: '1'
75+
76+
- name: Allow return traffic from ocpbm to osp_trunk (registry -> compute)
77+
ansible.builtin.iptables:
78+
chain: FORWARD
79+
in_interface: ocpbm
80+
out_interface: osp_trunk
81+
ctstate: RELATED,ESTABLISHED
82+
jump: ACCEPT
83+
action: insert
84+
rule_num: '1'
85+
86+
- name: Enable NAT for compute nodes to access registry
87+
ansible.builtin.iptables:
88+
table: nat
89+
chain: POSTROUTING
90+
source: 192.168.122.0/24
91+
destination: 192.168.201.0/24
92+
out_interface: ocpbm
93+
jump: MASQUERADE
94+
95+
- name: Persist firewall rules
96+
community.general.iptables_state:
97+
state: saved
98+
path: /etc/sysconfig/iptables
99+
100+
- name: Update control plane container images
101+
ansible.builtin.import_role:
102+
name: fdp_update_container_images
103+
vars:
104+
cifmw_fdp_update_container_images_target_package: "{{ cifmw_fdp_update_target_package }}"
105+
cifmw_fdp_update_container_images_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
106+
cifmw_fdp_update_container_images_namespace: "{{ cifmw_fdp_update_namespace | default('openstack') }}"
107+
when: cifmw_fdp_update_container_images_enabled | default(true) | bool
108+
109+
- name: Update EDPM (containers and host packages)
110+
ansible.builtin.import_role:
111+
name: fdp_update_edpm
112+
vars:
113+
cifmw_fdp_update_edpm_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
114+
when: cifmw_fdp_update_edpm_enabled | default(true) | bool
115+
116+
- name: Build FDP status messages
117+
ansible.builtin.set_fact:
118+
_cifmw_fdp_update_cp_status: "{{ 'Updated' if (cifmw_fdp_update_container_images_enabled | default(true) | bool) else 'Skipped' }}"
119+
_cifmw_fdp_update_edpm_status: "{{ 'Updated' if (cifmw_fdp_update_edpm_enabled | default(true) | bool) else 'Skipped' }}"
120+
_cifmw_fdp_update_edpm_images_status: "{{ 'Updated' if (cifmw_fdp_update_edpm_containers_enabled | default(true) | bool) else 'Skipped' }}"
121+
_cifmw_fdp_update_edpm_packages_status: "{{ 'Service created' if (cifmw_fdp_update_edpm_packages_enabled | default(true) | bool) else 'Skipped' }}"
122+
123+
- name: Display FDP completion summary
124+
ansible.builtin.debug:
125+
msg:
126+
- "=============================================="
127+
- "OpenStack Package Update Completed"
128+
- "=============================================="
129+
- ""
130+
- "Control plane containers: {{ _cifmw_fdp_update_cp_status }}"
131+
- "EDPM update: {{ _cifmw_fdp_update_edpm_status }}"
132+
- " - Container images: {{ _cifmw_fdp_update_edpm_images_status }}"
133+
- " - Host packages: {{ _cifmw_fdp_update_edpm_packages_status }}"
134+
- ""
135+
- "Package: {{ cifmw_fdp_update_target_package }}"
136+
- "Repository: {{ cifmw_fdp_update_repo_baseurl }}"
137+
- "=============================================="
138+
tags:
139+
- fdp-update
140+
29141
- name: Run compliance scan for computes
30142
hosts: "{{ groups['computes'] | default ([]) }}"
31143
gather_facts: true

‎roles/fdp_update_container_images/README.md‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# fdp_update_container_images
2+
3+
Ansible role to update specific RPM packages in OpenStack container images by rebuilding them with custom repositories.
4+
5+
This role automates the process of:
6+
1. Fetching container images from OpenStackVersion CR
7+
2. Checking if target package exists in each image
8+
3. Building new images with updated packages from custom repository
9+
4. Pushing updated images to OpenShift internal registry
10+
5. Patching OpenStackVersion CR to use the new images
11+
12+
## Privilege escalation
13+
None - Runs as the user executing Ansible
14+
15+
## Parameters
16+
17+
* `cifmw_fdp_update_container_images_basedir`: (String) Base directory. Defaults to `cifmw_basedir` which defaults to `~/ci-framework-data`.
18+
* `cifmw_fdp_update_container_images_namespace`: (String) OpenShift namespace where OpenStack is deployed. Defaults to `openstack`.
19+
* `cifmw_fdp_update_container_images_openstack_cr_name`: (String) Name of the OpenStackVersion CR. Defaults to `controlplane`.
20+
* `cifmw_fdp_update_container_images_target_package`: (String) Name of the RPM package to update (e.g., `ovn24.03`). **Required**.
21+
* `cifmw_fdp_update_container_images_repo_name`: (String) Repository name. Defaults to `custom-repo`.
22+
* `cifmw_fdp_update_container_images_repo_baseurl`: (String) Repository base URL. **Required**.
23+
* `cifmw_fdp_update_container_images_repo_enabled`: (Integer) Enable repository (0 or 1). Defaults to `1`.
24+
* `cifmw_fdp_update_container_images_repo_gpgcheck`: (Integer) Enable GPG check (0 or 1). Defaults to `0`.
25+
* `cifmw_fdp_update_container_images_repo_priority`: (Integer) Repository priority. Defaults to `0`.
26+
* `cifmw_fdp_update_container_images_repo_sslverify`: (Integer) Enable SSL verification (0 or 1). Defaults to `0`.
27+
* `cifmw_fdp_update_container_images_image_registry`: (String) External OpenShift image registry URL. Auto-detected from cluster if not specified. Leave empty for auto-detection.
28+
* `cifmw_fdp_update_container_images_image_registry_internal`: (String) Internal OpenShift image registry URL. Defaults to `image-registry.openshift-image-registry.svc:5000`.
29+
* `cifmw_fdp_update_container_images_image_name_prefix`: (String) Prefix for new image names. Defaults to `fdp-update`.
30+
* `cifmw_fdp_update_container_images_temp_dir`: (String) Temporary directory for build context. Auto-generated if not specified.
31+
* `cifmw_fdp_update_container_images_update_dnf_args`: (String) Additional arguments for dnf update command. Defaults to `--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }}`.
32+
33+
## Examples
34+
35+
### Update OVN package in all containers
36+
```yaml
37+
---
38+
- hosts: localhost
39+
vars:
40+
cifmw_fdp_update_container_images_target_package: "ovn24.03"
41+
cifmw_fdp_update_container_images_repo_name: "custom-repo"
42+
cifmw_fdp_update_container_images_repo_baseurl: "http://example.com/custom-repo/"
43+
cifmw_fdp_update_container_images_namespace: "openstack"
44+
roles:
45+
- role: "fdp_update_container_images"
46+
```
47+
48+
### Update with custom registry and image prefix
49+
```yaml
50+
---
51+
- hosts: localhost
52+
vars:
53+
cifmw_fdp_update_container_images_target_package: "ovn24.03"
54+
cifmw_fdp_update_container_images_repo_baseurl: "http://custom-repo.example.com/repo/"
55+
cifmw_fdp_update_container_images_image_registry: "registry.example.com"
56+
cifmw_fdp_update_container_images_image_name_prefix: "ovn-hotfix"
57+
roles:
58+
- role: "fdp_update_container_images"
59+
```
60+
61+
### Update with specific DNF arguments
62+
```yaml
63+
---
64+
- hosts: localhost
65+
vars:
66+
cifmw_fdp_update_container_images_target_package: "neutron-ovn-metadata-agent"
67+
cifmw_fdp_update_container_images_repo_baseurl: "http://custom-repo.example.com/repo/"
68+
cifmw_fdp_update_container_images_update_dnf_args: "--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }} --nobest"
69+
roles:
70+
- role: "fdp_update_container_images"
71+
```
72+
73+
## How it works
74+
75+
1. **Registry Setup**:
76+
- Enables the default route for OpenShift image registry
77+
- Auto-detects the registry hostname or uses the configured value
78+
2. **Authentication**: Obtains a token from OpenShift and authenticates with the internal registry using TLS
79+
3. **Image Discovery**: Queries the OpenStackVersion CR for all container images
80+
4. **Package Check**: For each image, creates a temporary container to check if the target package is installed
81+
5. **Image Build**: If the package exists, builds a new image with the updated package from the custom repository
82+
6. **Registry Push**: Pushes the new image to the OpenShift internal registry
83+
7. **CR Update**: Patches the OpenStackVersion CR's `spec.customContainerImages` field with the new image reference
84+
8. **Summary**: Provides a summary of all updated images
85+
86+
## Requirements
87+
88+
* OpenShift CLI (`oc`) must be available
89+
* Podman must be installed and accessible
90+
* User must have permissions to:
91+
- Create tokens in the target namespace
92+
- Get and patch OpenStackVersion CRs
93+
- Push images to the internal registry
94+
- Patch image registry configuration (`configs.imageregistry.operator.openshift.io/cluster`)
95+
96+
## Notes
97+
98+
* The role uses podman to build and push images with TLS verification
99+
* Each updated image gets a unique tag with timestamp: `<prefix>-<image-key>-<timestamp>`
100+
* Only images containing the target package will be updated
101+
* The role cleans up temporary containers automatically
102+
* All build contexts are created in a temporary directory that is cleaned up after execution
103+
* The role automatically configures the OpenShift image registry for external access:
104+
- Enables the default route if not already enabled
105+
- Auto-detects the registry hostname from the route

‎roles/fdp_update_container_images/defaults/main.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
# ============================================================================
18+
# Base Configuration
19+
# ============================================================================
20+
21+
# Base directory for artifacts and temporary files
22+
cifmw_fdp_update_container_images_basedir: "{{ cifmw_basedir | default(ansible_user_dir ~ '/ci-framework-data') }}"
23+
24+
# OpenShift namespace where OpenStack is deployed
25+
cifmw_fdp_update_container_images_namespace: "openstack"
26+
27+
# Name of the OpenStackVersion custom resource
28+
cifmw_fdp_update_container_images_openstack_cr_name: "controlplane"
29+
30+
# Target package to update (REQUIRED - must be set by user)
31+
cifmw_fdp_update_container_images_target_package: ""
32+
33+
# List of images to update with the target package
34+
# Only these images will be updated (no package scanning is performed)
35+
cifmw_fdp_update_container_images_images_to_scan:
36+
- ovnControllerImage
37+
- ovnControllerOvsImage
38+
- ovnNbDbclusterImage
39+
- ovnNorthdImage
40+
- ovnSbDbclusterImage
41+
- ceilometerSgcoreImage
42+
43+
# Repository configuration
44+
cifmw_fdp_update_container_images_repo_name: "custom-repo"
45+
cifmw_fdp_update_container_images_repo_baseurl: "" # REQUIRED - must be set by user
46+
cifmw_fdp_update_container_images_repo_enabled: 1
47+
cifmw_fdp_update_container_images_repo_gpgcheck: 0
48+
cifmw_fdp_update_container_images_repo_priority: 0
49+
cifmw_fdp_update_container_images_repo_sslverify: 0
50+
51+
# Image registry configuration
52+
# External registry URL (for compute nodes/EDPM and pushing images)
53+
# Leave empty to auto-detect external route from OpenShift cluster
54+
cifmw_fdp_update_container_images_image_registry: ""
55+
56+
# Internal registry URL (for OpenShift pods to pull images)
57+
# This is auto-detected and should not normally need to be changed
58+
cifmw_fdp_update_container_images_image_registry_internal: "image-registry.openshift-image-registry.svc:5000"
59+
60+
# Image naming
61+
cifmw_fdp_update_container_images_image_name_prefix: "fdp-update"
62+
63+
# Temporary directory for build context
64+
cifmw_fdp_update_container_images_temp_dir: ""
65+
66+
# DNF update arguments
67+
cifmw_fdp_update_container_images_update_dnf_args: "--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }}"
68+
69+
# Internal variables (do not override)
70+
_cifmw_fdp_update_container_images_modified_images: []
71+
_cifmw_fdp_update_container_images_updated_cr_keys: []
72+
_cifmw_fdp_update_container_images_total_images: 0
73+
_cifmw_fdp_update_container_images_processed_images: 0

‎roles/fdp_update_container_images/meta/main.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
galaxy_info:
18+
author: Red Hat
19+
description: Update RPM packages in OpenStack container images
20+
company: Red Hat
21+
license: Apache-2.0
22+
min_ansible_version: "2.15"
23+
platforms:
24+
- name: Fedora
25+
versions:
26+
- all
27+
- name: EL
28+
versions:
29+
- "9"
30+
galaxy_tags:
31+
- openstack
32+
- containers
33+
- kubernetes
34+
- openshift
35+
- podman
36+
- rpm
37+
38+
dependencies: []

‎roles/fdp_update_container_images/tasks/authenticate_registry.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
- name: Create registry token
18+
ansible.builtin.command: oc create token builder -n {{ cifmw_fdp_update_container_images_namespace }}
19+
register: _cifmw_fdp_update_container_images_token
20+
changed_when: false
21+
22+
- name: Authenticate podman with TLS verification
23+
containers.podman.podman_login:
24+
username: unused
25+
password: "{{ _cifmw_fdp_update_container_images_token.stdout }}"
26+
registry: "{{ cifmw_fdp_update_container_images_image_registry }}"
27+
no_log: true

0 commit comments

Comments
 (0)