Add FDP update automation for EDPM deployments #3432

mnietoji · 2025-10-22T13:43:57Z

Add FDP update automation for EDPM deployments

Implement comprehensive FDP update workflow including:
- New playbook fdp_update.yml orchestrating the update process
- Role fdp_edpm_update_host_packages: Updates packages on EDPM hosts
- Role fdp_update_container_images: Rebuilds container images with updated packages
  * Includes Molecule tests for validation
  * Jinja2 templates for Dockerfile and repo configuration
- Role fdp_update_edpm_containers: Updates running EDPM containers

This automation streamlines the process of updating Fast Data Path
components across OpenStack EDPM (External Data Plane Management)
deployments by coordinating host package updates, container image
rebuilds, and container deployment updates.

Assisted-By: Claude <[email protected]>

openshift-ci · 2025-10-22T13:44:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

softwarefactory-project-zuul · 2025-10-23T12:25:41Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/7c305864d102485fbe9dafd0ff85da35

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 47m 25s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 13m 57s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 34m 12s
❌ cifmw-pod-zuul-files FAILURE in 4m 11s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 39s
❌ cifmw-pod-pre-commit FAILURE in 7m 48s
✔️ build-push-container-cifmw-client SUCCESS in 17m 24s

softwarefactory-project-zuul · 2025-10-23T14:28:54Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/30c74ff1ec854ebd94ca1da1b1070b64

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 41m 57s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 15m 26s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 27m 08s
❌ cifmw-pod-zuul-files FAILURE in 4m 12s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 37s
❌ cifmw-pod-pre-commit FAILURE in 7m 52s
✔️ build-push-container-cifmw-client SUCCESS in 16m 05s

softwarefactory-project-zuul · 2025-10-24T14:53:20Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/15ccfc3015ed498c8bec52bc522be2c3

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 59m 47s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 16m 09s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 41m 06s
❌ cifmw-pod-zuul-files FAILURE in 4m 28s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 7m 46s
❌ cifmw-pod-pre-commit FAILURE in 6m 21s
✔️ build-push-container-cifmw-client SUCCESS in 16m 13s

evallesp · 2025-11-06T17:18:25Z

playbooks/fdp_update.yml

+          changed_when: _fdp_update_nat_rule.rc == 0
+
+        - name: Persist firewall rules
+          ansible.builtin.shell: # noqa: command-instead-of-shell


I don't think is raising any error, here is the same situation: https://github.com/openstack-k8s-operators/ci-framework/pull/3432/files#diff-a961c65eda0f40d05092b70d7ecb9015ee9d2236e273248178dc0c2406268deeR23

evallesp · 2025-11-06T17:20:57Z

roles/fdp_update_container_images/tasks/authenticate_registry.yml

+  changed_when: false
+
+- name: Authenticate podman with TLS verification
+  ansible.builtin.shell: |


Can we use here: podman_login https://docs.ansible.com/ansible/latest/collections/containers/podman/podman_login_module.html

danpawlik · 2025-11-07T13:16:13Z

roles/fdp_update_container_images/defaults/main.yml

+cifmw_fdp_update_container_images_repo_name: "custom-repo"
+cifmw_fdp_update_container_images_repo_baseurl: ""  # REQUIRED - must be set by user
+cifmw_fdp_update_container_images_repo_enabled: 1
+cifmw_fdp_update_container_images_repo_gpgcheck: 0


just a nit: do we really want to have so much parameters available?

danpawlik · 2025-11-07T13:17:48Z

roles/fdp_update_container_images/defaults/main.yml

+# DNF update arguments
+cifmw_fdp_update_container_images_update_dnf_args: "--disablerepo='*' --enablerepo={{ cifmw_fdp_update_container_images_repo_name }}"
+
+# Internal variables (do not override)


if later you set fact with empty vars, why in defaults you put same? Please remove, otherwise we will be confused why e.g. this var is available where set_fact is setting it.

danpawlik · 2025-11-07T13:21:27Z

roles/fdp_update_container_images/tasks/detect_registry.yml

+
+- name: Extract registry host from route
+  ansible.builtin.set_fact:
+    _cifmw_fdp_update_container_images_route:


why you do dict here with {'stdout': {{ cifmw_fdp_update_container_images_route_info.resources[0].spec.host if _cifmw_fdp_update_container_images_route_info.resources | length > 0 else '' }}"} ? No need to make dict.

danpawlik · 2025-11-07T13:22:06Z

roles/fdp_update_container_images/tasks/detect_registry.yml

+    _cifmw_fdp_update_container_images_route:
+      stdout: "{{ _cifmw_fdp_update_container_images_route_info.resources[0].spec.host if _cifmw_fdp_update_container_images_route_info.resources | length > 0 else '' }}"
+
+- name: Set registry URL


do we really want to make var reassign here?

danpawlik · 2025-11-07T13:24:07Z

roles/fdp_update_container_images/tasks/detect_registry.yml

+- name: Verify registry URL
+  ansible.builtin.fail:
+    msg: "Failed to determine registry URL. Set cifmw_fdp_update_container_images_image_registry manually."
+  when: cifmw_fdp_update_container_images_image_registry is not defined or cifmw_fdp_update_container_images_image_registry | length == 0


so if you verify here length because other condition fail, why not move the condition here instead of verify length?

danpawlik · 2025-11-07T13:24:55Z

roles/fdp_update_container_images/tasks/main.yml

+  ansible.builtin.debug:
+    msg:
+      - "=========================================="
+      - "✓ Container image update complete"


please remove the non-ascii chars

danpawlik · 2025-11-07T13:25:52Z

roles/fdp_update_container_images/tasks/process_image.yml

+# under the License.
+
+- name: Create repository file
+  ansible.builtin.template:


nit: consider to use module, just a hint, not something important.

danpawlik · 2025-11-07T13:28:47Z

roles/fdp_update_container_images/tasks/process_image.yml

+
+- name: Display progress
+  ansible.builtin.debug:
+    msg: "✓ Updated {{ image_entry.key }} ({{ _cifmw_fdp_update_container_images_processed_images }}/{{ _cifmw_fdp_update_container_images_image_entries | length }})"


same with non ascii chars

danpawlik · 2025-11-07T13:29:43Z

roles/fdp_update_container_images/templates/Dockerfile.j2

@@ -0,0 +1,3 @@
+FROM {{ base_image }}
+COPY ./{{ cifmw_fdp_update_container_images_repo_name }}.repo /etc/yum.repos.d/
+RUN dnf update -y {{ cifmw_fdp_update_container_images_update_dnf_args }} {{ cifmw_fdp_update_container_images_target_package }}*


nit: dnf clean all can save few MB

danpawlik · 2025-11-07T13:30:13Z

roles/fdp_update_container_images/README.md

+4. Pushing updated images to OpenShift internal registry
+5. Patching OpenStackVersion CR to use the new images
+
+## Privilege escalation


you can remove the chapter

Implement comprehensive FDP update workflow including: - New playbook fdp_update.yml orchestrating the update process - Role fdp_edpm_update_host_packages: Updates packages on EDPM hosts - Role fdp_update_container_images: Rebuilds container images with updated packages * Includes Molecule tests for validation * Jinja2 templates for Dockerfile and repo configuration - Role fdp_update_edpm_containers: Updates running EDPM containers This automation streamlines the process of updating Fast Data Path components across OpenStack EDPM (External Data Plane Management) deployments by coordinating host package updates, container image rebuilds, and container deployment updates. Assisted-By: Claude <[email protected]> Signed-off-by: Miguel Angel Nieto Jimenez <[email protected]>

openshift-ci · 2025-11-07T14:05:10Z

@mnietoji: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	`0796edc`	link	true	`/test images`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

softwarefactory-project-zuul · 2025-11-07T15:16:23Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/a7d3f702a34f4e228d124d8d2e863162

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 35m 50s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 17m 01s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 21m 58s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 16s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 20s
❌ cifmw-pod-pre-commit FAILURE in 7m 50s
✔️ build-push-container-cifmw-client SUCCESS in 18m 58s
✔️ cifmw-molecule-fdp_update_container_images SUCCESS in 1m 47s
✔️ cifmw-molecule-fdp_update_edpm SUCCESS in 1m 44s

mnietoji · 2025-11-07T16:08:45Z

Splitted in 2 PRs for the code review:
#3466
#3467

Closing this one

danpawlik · 2025-11-07T16:27:26Z

so now I need to check 3466 and compare with my comments that I left here. Might take 2x more time to review it.

evallesp · 2025-11-10T11:23:49Z

so now I need to check 3466 and compare with my comments that I left here. Might take 2x more time to review it.

I'm reviewing it, I'm moving you'r reviews there.

mnietoji requested a review from a team as a code owner October 22, 2025 13:43

mnietoji marked this pull request as draft October 22, 2025 13:44

openshift-ci bot added the do-not-merge/work-in-progress label Oct 22, 2025

mnietoji force-pushed the update_containers_package branch 6 times, most recently from 19e68bb to 55d1b16 Compare October 23, 2025 10:41

mnietoji force-pushed the update_containers_package branch from 55d1b16 to cfe3b16 Compare October 23, 2025 12:45

mnietoji force-pushed the update_containers_package branch 10 times, most recently from 6a356e7 to d6d0563 Compare October 24, 2025 13:43

mnietoji force-pushed the update_containers_package branch 6 times, most recently from e0f9071 to f46652f Compare October 24, 2025 15:09

evallesp reviewed Nov 6, 2025

View reviewed changes

mnietoji dismissed evallesp’s stale review via 063c2a8 November 7, 2025 10:34

mnietoji force-pushed the update_containers_package branch from 78e14cb to 063c2a8 Compare November 7, 2025 10:34

github-actions bot removed the Ready For Review label Nov 7, 2025

mnietoji force-pushed the update_containers_package branch 5 times, most recently from f290329 to 0ac0413 Compare November 7, 2025 12:14

danpawlik reviewed Nov 7, 2025

View reviewed changes

mnietoji force-pushed the update_containers_package branch from 0ac0413 to 0796edc Compare November 7, 2025 13:39

mnietoji closed this Nov 7, 2025

mnietoji reopened this Nov 7, 2025

mnietoji closed this Nov 7, 2025

danpawlik mentioned this pull request Nov 12, 2025

Add fdp_update_container_images role for control plane updates #3466

Merged

Add FDP update automation for EDPM deployments #3432

Add FDP update automation for EDPM deployments #3432

Uh oh!

Conversation

mnietoji commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Oct 22, 2025

Uh oh!

softwarefactory-project-zuul bot commented Oct 23, 2025

Uh oh!

softwarefactory-project-zuul bot commented Oct 23, 2025

Uh oh!

softwarefactory-project-zuul bot commented Oct 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 7, 2025

Uh oh!

softwarefactory-project-zuul bot commented Nov 7, 2025

Uh oh!

mnietoji commented Nov 7, 2025

Uh oh!

danpawlik commented Nov 7, 2025

Uh oh!

evallesp commented Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mnietoji commented Oct 22, 2025 •

edited

Loading