Merge tag '0.7.2' into 0.7.2-sync

Author: MoteHue

.github/environments/arcus-ha/inventory/group_vars/all/variables.yml

@@ -6,20 +6,19 @@ infra_fixed_floatingip:
 capi_cluster_addons_ingress_load_balancer_ip: "{{ lookup('env', 'INGRESS_IP') }}"
 
 # Flavor auto-detection picks the wrong flavors on Arcus, so override them
-#   The flavor to use for the seed VM (vm.ska.cpu.general.small)
-infra_flavor_id: c8b72062-5d52-4590-9d7a-68a670b44442
+#   The flavor to use for the seed VM
+infra_flavor_id: >-
+  {{ lookup('pipe', 'openstack flavor show vm.azimuth.ci.ec1.medium -f value -c id') }}
 #   The flavor to use for the control plane nodes
-capi_cluster_control_plane_flavor: vm.ska.cpu.general.small
+capi_cluster_control_plane_flavor: vm.azimuth.ci.ec1.medium
 #   The flavor to use for worker nodes
-capi_cluster_worker_flavor: vm.ska.cpu.general.small
+capi_cluster_worker_flavor: vm.azimuth.ci.en1.medium
 
 # Although this is a "HA" test, what we are really testing is the spawning
 # of the CAPI cluster and deployment of Azimuth onto that
-# We have also preferred to use 3 small workers rather than 1 or 2 eighth workers,
-# as they are more likely to fit in the gaps between other workloads
-# So one control plane node and two workers is sufficient for that
+# So one control plane node is sufficient for that
 capi_cluster_control_plane_count: 1
-capi_cluster_worker_count: 3
+capi_cluster_worker_count: 2
 
 # Use a single replica for Consul
 # The risk of failed upgrades is too great, and it is going away soon
@@ -34,4 +33,4 @@ velero_backup_schedule_name: default
 velero_backup_schedule_timings: "0 0 * * *"
 velero_backup_schedule_ttl: "168h"
 velero_aws_access_key_id: required-but-not-used
-velero_aws_secret_access_key : required-but-not-used
+velero_aws_secret_access_key : required-but-not-used

.github/environments/arcus/inventory/group_vars/all/variables.yml

@@ -8,10 +8,12 @@ infra_network_id: "{{ lookup('pipe', 'openstack network show portal-internal -f
 infra_fixed_floatingip: "{{ lookup('env', 'INGRESS_IP') }}"
 
 # Flavor auto-detection picks the wrong flavors on Arcus, so override them
-#   The flavor to use for the Azimuth AIO VM (vm.ska.cpu.general.eighth)
-infra_flavor_id: 5f9def81-c93f-4c1f-a521-3b810061ff6c
-#   The flavor to use for the workstation test case (vm.ska.cpu.general.small)
-generate_tests_caas_test_case_workstation_param_cluster_flavor: c8b72062-5d52-4590-9d7a-68a670b44442
+#   The flavor to use for the Azimuth AIO VM
+infra_flavor_id: >-
+  {{ lookup('pipe', 'openstack flavor show vm.azimuth.ci.en1.medium -f value -c id') }}
+#   The flavor to use for the workstation test case
+generate_tests_caas_test_case_workstation_param_cluster_flavor: >-
+  {{ lookup('pipe', 'openstack flavor show vm.azimuth.ci.ec1.medium -f value -c id') }}
 #   The flavor to use for the repo2docker test case
 generate_tests_caas_test_case_repo2docker_param_cluster_flavor: "{{ generate_tests_caas_test_case_workstation_param_cluster_flavor }}"
 #   The flavor to use for the R-Studio test case

.github/environments/leafcloud-ha/inventory/group_vars/all/variables.yml

@@ -34,3 +34,14 @@ capi_cluster_addons_csi_cinder_volume_type: unencrypted
 # Use a single replica for Consul
 # The risk of failed upgrades is too great, and it is going away soon
 consul_server_replicas: 1
+
+# Enable Velero just to check that installation works
+velero_enabled: true
+velero_s3_url: https://required-but-not-used.com
+velero_bucket_name: not-used
+velero_backup_schedule_enabled: true
+velero_backup_schedule_name: default
+velero_backup_schedule_timings: "0 0 * * *"
+velero_backup_schedule_ttl: "168h"
+velero_aws_access_key_id: required-but-not-used
+velero_aws_secret_access_key : required-but-not-used

.github/workflows/test-full.yml

@@ -47,12 +47,15 @@ jobs:
         uses: ./.github/actions/destroy
         if: ${{ always() }}
 
-  # Tests an Azimuth upgrade from the current latest release
-  # Currently, this just tests the Azimuth upgrade itself with no appliances
-  # TODO(mkjpryor) add appliance provisioning and verification before and after upgrade
+  # Tests an Azimuth upgrade from the current latest release to the code under test
+  #
+  # Note that success() and failure() consider *all previous steps*, and continue-on-failure
+  # prevents the job from being marked as failed if that step fails
+  # This means that in order to get the execution flow that we want while still resulting in a
+  # failed job when required, we need to use step ids and the conclusions of specific steps
   test_azimuth_upgrade:
-    needs: [test_clean_ha]
     runs-on: ubuntu-latest
+    needs: [test_clean_ha]
     steps:
       - name: Get latest tag
         id: latest-tag
@@ -87,31 +90,105 @@ jobs:
         # So wait a maximum of 3 hours to acquire the lock, leaving 3 hours for other tasks in the job
         timeout-minutes: 180
 
-      - name: Provision Azimuth
+      - name: Provision Azimuth at latest tag
         uses: ./.actions/.github/actions/provision
 
+      - name: Generate test suite
+        id: generate-tests
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ansible-playbook stackhpc.azimuth_ops.generate_tests -e @extra-vars.yml
+
+      - name: Create test platforms
+        id: tests-create
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ./.actions/bin/run-tests --include create --outputdir reports/create
+
+      - name: Verify test platforms
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ./.actions/bin/run-tests --include verify --outputdir reports/verify-create
+        if: ${{ !cancelled() && contains(fromJSON('["success", "failure"]'), steps.tests-create.conclusion) }}
+
       - name: Checkout code under test
+        id: checkout-latest
         uses: actions/checkout@v3
         with:
           # Make sure not to remove working directories
           clean: false
+        if: ${{ !cancelled() && steps.generate-tests.conclusion == 'success' }}
 
       - name: Install updated Python dependencies
+        id: update-py
         run: |
           set -e
           source ci.env
           source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
           python -m pip install -r requirements.txt
+        if: ${{ !cancelled() && steps.checkout-latest.conclusion == 'success' }}
 
       - name: Upgrade Ansible dependencies
+        id: update-ansible
         run: |
           set -e
           source ci.env
           source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
           ansible-galaxy install -f -r requirements.yml
+        if: ${{ !cancelled() && steps.update-py.conclusion == 'success' }}
 
       - name: Upgrade Azimuth
+        id: upgrade-azimuth
         uses: ./.actions/.github/actions/provision
+        if: ${{ !cancelled() && steps.update-ansible.conclusion == 'success' }}
+
+      - name: Verify test platforms post upgrade
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ./.actions/bin/run-tests --include verify --outputdir reports/verify-post-upgrade
+        if: ${{ !cancelled() && steps.upgrade-azimuth.conclusion == 'success' }}
+
+      # TODO(mkjpryor) patch/upgrade not implemented in test generation yet
+      # - name: Upgrade test platforms
+      # - name: Verify test platforms
+
+      - name: Delete test platforms
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ./.actions/bin/run-tests --include delete --outputdir reports/delete
+        if: ${{ always() }}
+
+      - name: Upload test report artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: azimuth-upgrade-test-reports
+          path: reports/*
+        if: ${{ always() }}
+
+      - name: Create debug bundle
+        run: |
+          set -e
+          source ./ci.env
+          source ./bin/activate "$AZIMUTH_CONFIG_ENVIRONMENT" "$AZIMUTH_ENVIRONMENT"
+          ./.actions/bin/create-debug-bundle
+        if: ${{ always() }}
+
+      - name: Upload debug bundle
+        uses: actions/upload-artifact@v3
+        with:
+          name: azimuth-upgrade-debug-bundle
+          path: debug-bundle.tar.gz
+        if: ${{ always() }}
 
       - name: Destroy Azimuth
         uses: ./.actions/.github/actions/destroy

.gitlab-ci.yml.sample

@@ -100,25 +100,18 @@ deploy_aio:
       when: never
     # Allow deployments to be manually triggered even when there are no changed files
     - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
-    # Run when there is a push to a branch with a merge request that changes one of the relevant files
-    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        # Files that affect the aio environment
-        - env
-        - env.secret
-        - requirements.yml
-        - environments/base/**/*
-        - environments/singlenode/**/*
-        - environments/site/**/*
-        - environments/aio/**/*
+    # Run when there is a push to a branch with a merge request to main
+    - if: >-
+        $CI_PIPELINE_SOURCE == "merge_request_event" &&
+        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
   environment:
     name: aio/$CI_COMMIT_REF_SLUG
     on_stop: stop_aio
   variables:
     # This is normally taken from the GitLab environment name, but in this case that
     # depends on the branch name so we need to be explicit about the config to use
     AZIMUTH_CONFIG_ENVIRONMENT: aio
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:
@@ -130,27 +123,17 @@ deploy_aio:
 test_aio:
   stage: aio_test
   rules:
-    # Do not run for commits to main
     - if: $CI_COMMIT_BRANCH == "main"
       when: never
-    # Allow deployments to be manually triggered even when there are no changed files
     - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
-    # Run when there is a push to a branch with a merge request that changes one of the relevant files
-    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        # Files that affect the aio environment
-        - env
-        - env.secret
-        - requirements.yml
-        - environments/base/**/*
-        - environments/singlenode/**/*
-        - environments/site/**/*
-        - environments/aio/**/*
+    - if: >-
+        $CI_PIPELINE_SOURCE == "merge_request_event" &&
+        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
   environment:
     name: aio/$CI_COMMIT_REF_SLUG
   variables:
     AZIMUTH_CONFIG_ENVIRONMENT: aio
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:
@@ -174,16 +157,9 @@ stop_aio:
     - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "web"
       when: manual
       allow_failure: true
-    - if: $CI_COMMIT_BRANCH && $CI_PIPELINE_SOURCE == "merge_request_event"
-      changes:
-        # Files that affect the aio environment
-        - env
-        - env.secret
-        - requirements.yml
-        - environments/base/**/*
-        - environments/singlenode/**/*
-        - environments/site/**/*
-        - environments/aio/**/*
+    - if: >-
+        $CI_PIPELINE_SOURCE == "merge_request_event" &&
+        $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"
       when: manual
       allow_failure: true
   environment:
@@ -192,7 +168,7 @@ stop_aio:
   variables:
     AZIMUTH_CONFIG_ENVIRONMENT: aio
     GIT_STRATEGY: none
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - git clone ${CI_REPOSITORY_URL} ${CI_PROJECT_NAME}
     - cd ${CI_PROJECT_NAME}
@@ -232,7 +208,7 @@ deploy_staging:
   environment:
     name: staging
   variables:
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:
@@ -264,7 +240,7 @@ test_staging:
   environment:
     name: staging
   variables:
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:
@@ -305,7 +281,7 @@ deploy_production:
   environment:
     name: production
   variables:
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:
@@ -333,7 +309,7 @@ test_production:
   environment:
     name: production
   variables:
-    ANSIBLE_FORCE_COLOR: true
+    ANSIBLE_FORCE_COLOR: "true"
   before_script:
     - source ./bin/ci-setup
   script:

bin/ci-setup

@@ -40,7 +40,16 @@ if [ -z "$AZIMUTH_ENVIRONMENT" ]; then
 fi
 
 run_apt update
-run_apt install -y git python3 python3-pip qemu-utils
+run_apt install -y git jq python3 python3-pip qemu-utils software-properties-common zip
+
+if [ "$(id -u)" -eq 0 ]; then
+  add-apt-repository ppa:mozillateam/ppa
+else
+  sudo add-apt-repository ppa:mozillateam/ppa
+fi
+
+run_apt update
+run_apt install -y -t 'o=LP-PPA-mozillateam' firefox
 
 pip install -U pip
 pip install -r requirements.txt

bin/port-forward

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 #####
-## This script sets up a port-forward to the specified Azimuth service, via the K3S
+## This script sets up a port-forward to the specified Azimuth service, via the K3s
 ## node for the environment
 #####
 

docs/configuration/01-prerequisites.md

@@ -16,12 +16,12 @@ Currently, Azimuth is able to target OpenStack clouds with the following service
     * Amphora and OVN drivers supported
 
 Azimuth has no specific requirement on the version of OpenStack. It is known to work on
-on Train release and newer.
+the OpenStack Train release and newer.
 
 ### Networking
 
-OpenStack projects that are used for Azimuth deployments (infra projects) or into which
-Azimuth will deploy platforms on behalf of users (workload projects) require access to a
+OpenStack projects that are used for Azimuth deployments (infra projects), or into which
+Azimuth will deploy platforms on behalf of users (workload projects), require access to a
 network that is shared as `external` in Neutron, on which floating IPs can be allocated.
 
 This network must provide egress to the internet, but does not need to provide ingress