Skip to content

Commit a3cf0b2

Browse files
mnietojimnietoji
committed
[multiple] Add fdp_update_edpm role for EDPM node updates
[fdp_update_edpm] Implement EDPM node update automation for FDP updates: - Role fdp_update_edpm: Updates EDPM nodes declaratively via Kubernetes CRs * Patches OpenStackDataPlaneNodeSet CRs with updated container images * Configures package updates via edpm_bootstrap_packages * Sets up registry authentication and CA certificates * Creates OpenStackDataPlaneDeployment to apply changes * Includes hypervisor firewall configuration for registry access - Fix hypervisor firewall configuration * Add delegate_to to execute iptables on correct hypervisor host * Previously executed on localhost instead of hypervisor - Integration in post-deployment.yml after control plane updates - Zuul CI configuration for automated testing [fdp_update_container_images] Fix to properly update OpenStackVersion CR * Add set_fact task to build customContainerImages dict correctly Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Miguel Angel Nieto Jimenez <mnietoji@redhat.com>
1 parent 5f5393f commit a3cf0b2

19 files changed

+1084
-19
lines changed

‎cleanup-edpm.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88
hosts: localhost
99
gather_facts: true
1010
tasks:
11+
- name: Clean up hypervisor firewall rules
12+
ansible.builtin.include_role:
13+
name: fdp_update_edpm
14+
tasks_from: cleanup_hypervisor_firewall.yml
15+
1116
- name: Clean up all directories
1217
ansible.builtin.import_role:
1318
name: ci_setup

‎docs/dictionary/en-custom.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,7 @@ ipam
259259
ipi
260260
ipmi
261261
ips
262+
iptables
262263
ipv
263264
iscsi
264265
isdir
@@ -417,6 +418,7 @@ openstack
417418
openstackclient
418419
openstackcontrolplane
419420
openstackdataplane
421+
openstackdataplanedeployment
420422
openstackdataplanenodeset
421423
openstackdataplanenodesets
422424
openstackprovisioner

‎post-deployment.yml‎

Lines changed: 23 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,6 @@
99
tags:
1010
- admin-setup
1111

12-
- name: Run Test
13-
ansible.builtin.import_role:
14-
name: cifmw_setup
15-
tasks_from: run_tests.yml
16-
tags:
17-
- run-tests
18-
19-
- name: Run compliance scan for controllers
20-
ansible.builtin.import_role:
21-
name: compliance
22-
vars:
23-
cifmw_compliance_podman_username: "{{ cifmw_registry_token.credentials.username }}"
24-
cifmw_compliance_podman_password: "{{ cifmw_registry_token.credentials.password }}"
25-
when: cifmw_run_operators_compliance_scans | default(false) | bool
26-
tags:
27-
- compliance
28-
2912
# FDP Update - OpenStack package updates across all layers
3013
- name: FDP Update - Validate required variables
3114
when: cifmw_fdp_update_enabled | default(false) | bool
@@ -54,6 +37,29 @@
5437
cifmw_fdp_update_container_images_target_package: "{{ cifmw_fdp_update_target_package }}"
5538
cifmw_fdp_update_container_images_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
5639

40+
- name: Update EDPM (containers and host packages)
41+
ansible.builtin.import_role:
42+
name: fdp_update_edpm
43+
vars:
44+
cifmw_fdp_update_edpm_repo_baseurl: "{{ cifmw_fdp_update_repo_baseurl }}"
45+
46+
- name: Run Test
47+
ansible.builtin.import_role:
48+
name: cifmw_setup
49+
tasks_from: run_tests.yml
50+
tags:
51+
- run-tests
52+
53+
- name: Run compliance scan for controllers
54+
ansible.builtin.import_role:
55+
name: compliance
56+
vars:
57+
cifmw_compliance_podman_username: "{{ cifmw_registry_token.credentials.username }}"
58+
cifmw_compliance_podman_password: "{{ cifmw_registry_token.credentials.password }}"
59+
when: cifmw_run_operators_compliance_scans | default(false) | bool
60+
tags:
61+
- compliance
62+
5763
- name: Run compliance scan for computes
5864
hosts: "{{ groups['computes'] | default ([]) }}"
5965
gather_facts: true

‎roles/fdp_update_container_images/tasks/process_image.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,7 @@
5353
namespace: "{{ cifmw_fdp_update_container_images_namespace }}"
5454
definition:
5555
spec:
56-
customContainerImages:
57-
"{{ image_entry.key }}": "{{ _cifmw_fdp_update_container_images_new_image_path_internal }}"
56+
customContainerImages: "{{ { image_entry.key: _cifmw_fdp_update_container_images_new_image_path_internal } }}"
5857

5958
- name: Update tracking
6059
ansible.builtin.set_fact:

‎roles/fdp_update_edpm/README.md‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
# fdp_update_edpm
2+
3+
Role for updating OpenStack EDPM (Edge Data Plane Management) nodes with custom container images and host packages.
4+
5+
## Description
6+
7+
This role provides a declarative approach to update EDPM nodes with:
8+
9+
1. **Updates container images** by patching OpenStackDataPlaneNodeSet CRs with new image references
10+
2. **Updates host packages** by configuring `edpm_bootstrap_packages` and `edpm_bootstrap_repos` in the nodeset
11+
3. **Configures registry authentication** with OpenShift service account tokens
12+
4. **Installs CA certificates** for secure registry access
13+
5. **Optionally creates deployments** to apply the changes to EDPM nodes
14+
15+
### Key Features
16+
17+
- **Declarative approach**: Only modifies Kubernetes CRs, doesn't execute commands directly on EDPM nodes
18+
- **Uses native EDPM capabilities**: Leverages `edpm_bootstrap` and `edpm_podman` roles from edpm-ansible
19+
- **Secure by default**: Installs OpenShift CA certificates instead of using insecure registries
20+
- **Flexible**: Supports updating containers, packages, or both
21+
- **Idempotent**: Can be run multiple times safely
22+
23+
## Requirements
24+
25+
- OpenShift cluster with OpenStack operators installed
26+
- Access to `oc` command
27+
- OpenStackVersion CR with custom container images
28+
- Custom repository with updated packages (if updating host packages)
29+
30+
## Role Variables
31+
32+
### General Configuration
33+
34+
| Variable | Default | Description |
35+
|----------|---------|-------------|
36+
| `cifmw_fdp_update_edpm_namespace` | `"openstack"` | OpenShift namespace |
37+
| `cifmw_fdp_update_edpm_nodeset_name` | `"all"` | NodeSet to update (`"all"` or specific name) |
38+
| `cifmw_fdp_update_edpm_dry_run` | `false` | Show changes without applying |
39+
40+
### Container Image Updates
41+
42+
| Variable | Default | Description |
43+
|----------|---------|-------------|
44+
| `cifmw_fdp_update_edpm_containers_enabled` | `true` | Enable container image updates |
45+
| `cifmw_fdp_update_edpm_image_registry` | `""` | External registry URL (auto-detected if empty) |
46+
| `cifmw_fdp_update_edpm_image_variable_mapping` | See defaults | Mapping of image keys to EDPM variables |
47+
48+
### Host Package Updates
49+
50+
| Variable | Default | Description |
51+
|----------|---------|-------------|
52+
| `cifmw_fdp_update_edpm_packages_enabled` | `true` | Enable host package updates |
53+
| `cifmw_fdp_update_edpm_repo_baseurl` | `""` | **REQUIRED** Repository base URL |
54+
| `cifmw_fdp_update_edpm_repo_name` | `"fdp-update"` | Repository name |
55+
| `cifmw_fdp_update_edpm_packages` | See defaults | List of packages to install/update |
56+
57+
### Hypervisor Firewall Configuration
58+
59+
| Variable | Default | Description |
60+
|----------|---------|-------------|
61+
| `cifmw_fdp_update_edpm_setup_hypervisor_firewall` | `true` | Enable/disable hypervisor firewall setup for registry access |
62+
| `cifmw_fdp_update_edpm_hypervisor_host` | `"hypervisor"` | Hostname or inventory name of the hypervisor where firewall rules will be configured via delegate_to |
63+
| `cifmw_fdp_update_compute_interface` | `"osp_trunk"` | Network interface on hypervisor connected to compute nodes (EDPM) |
64+
| `cifmw_fdp_update_registry_interface` | `"ocpbm"` | Network interface on hypervisor connected to OpenShift/registry |
65+
| `cifmw_fdp_update_compute_network` | `"192.168.122.0/24"` | Compute nodes network CIDR (source for NAT) |
66+
| `cifmw_fdp_update_registry_network` | `"192.168.201.0/24"` | OpenShift/registry network CIDR (destination for NAT) |
67+
68+
### Registry Configuration
69+
70+
| Variable | Default | Description |
71+
|----------|---------|-------------|
72+
| `cifmw_fdp_update_edpm_configure_registry_ca` | `true` | Install OpenShift CA certificate via bootstrap command |
73+
| `cifmw_fdp_update_edpm_configure_registry_auth` | `true` | Configure registry authentication |
74+
75+
### Deployment Configuration
76+
77+
| Variable | Default | Description |
78+
|----------|---------|-------------|
79+
| `cifmw_fdp_update_edpm_auto_deploy` | `true` | Automatically create deployment |
80+
| `cifmw_fdp_update_edpm_deployment_per_nodeset` | `true` | Create separate deployment per nodeset |
81+
| `cifmw_fdp_update_edpm_wait_for_deployment` | `true` | Wait for deployment to complete |
82+
| `cifmw_fdp_update_edpm_deployment_timeout` | `3600` | Deployment timeout (seconds) |
83+
| `cifmw_fdp_update_edpm_deployment_services` | See defaults | Services to run in deployment |
84+
85+
## Dependencies
86+
87+
None (uses native OpenStack Data Plane operators and edpm-ansible roles)
88+
89+
## Example Playbook
90+
91+
### Update both containers and packages
92+
93+
```yaml
94+
- hosts: localhost
95+
roles:
96+
- role: fdp_update_edpm
97+
vars:
98+
cifmw_fdp_update_edpm_namespace: openstack
99+
cifmw_fdp_update_edpm_nodeset_name: openstack-edpm
100+
cifmw_fdp_update_edpm_repo_baseurl: "http://example.com/repos/fdp-updates"
101+
cifmw_fdp_update_edpm_packages:
102+
- openvswitch3.5
103+
- openvswitch-selinux-extra-policy
104+
```
105+
106+
### Update only containers
107+
108+
```yaml
109+
- hosts: localhost
110+
roles:
111+
- role: fdp_update_edpm
112+
vars:
113+
cifmw_fdp_update_edpm_packages_enabled: false
114+
cifmw_fdp_update_edpm_containers_enabled: true
115+
```
116+
117+
### Update only packages
118+
119+
```yaml
120+
- hosts: localhost
121+
roles:
122+
- role: fdp_update_edpm
123+
vars:
124+
cifmw_fdp_update_edpm_containers_enabled: false
125+
cifmw_fdp_update_edpm_packages_enabled: true
126+
cifmw_fdp_update_edpm_repo_baseurl: "http://example.com/repos/updates"
127+
```
128+
129+
### Dry run (show changes without applying)
130+
131+
```yaml
132+
- hosts: localhost
133+
roles:
134+
- role: fdp_update_edpm
135+
vars:
136+
cifmw_fdp_update_edpm_dry_run: true
137+
```
138+
139+
### Custom network configuration
140+
141+
```yaml
142+
- hosts: localhost
143+
roles:
144+
- role: fdp_update_edpm
145+
vars:
146+
cifmw_fdp_update_compute_interface: "br-ex"
147+
cifmw_fdp_update_registry_interface: "br-ocp"
148+
cifmw_fdp_update_compute_network: "10.0.0.0/24"
149+
cifmw_fdp_update_registry_network: "172.16.0.0/24"
150+
```
151+
152+
## How It Works
153+
154+
1. **Validates parameters**: Ensures required variables are set
155+
2. **Configures hypervisor firewall** (if enabled): Sets up iptables rules to allow EDPM nodes to access the OpenShift registry
156+
3. **Fetches NodeSets**: Gets OpenStackDataPlaneNodeSet CRs from the cluster
157+
4. **Fetches container images** (if enabled): Gets custom images from OpenStackVersion CR
158+
5. **For each NodeSet**:
159+
- Patches container image variables (e.g., `edpm_ovn_controller_agent_image`)
160+
- Patches `edpm_bootstrap_packages` with packages to install
161+
- Patches `edpm_bootstrap_repos` with custom repository configuration
162+
- Configures registry authentication (`edpm_container_registry_logins`)
163+
- Installs CA certificate via `edpm_bootstrap_command` (if enabled)
164+
6. **Creates deployment** (if enabled): Creates OpenStackDataPlaneDeployment CR
165+
7. **Waits for completion** (if enabled): Monitors deployment until Ready
166+
167+
## Architecture: Declarative vs Imperative
168+
169+
This role follows the **declarative** approach of Kubernetes/OpenStack:
170+
171+
- [X] **Does NOT** SSH to nodes and run `dnf install` directly
172+
- [X] **Does NOT** SSH to nodes and run `systemctl restart` directly
173+
- [OK] **Does** patch NodeSet CRs with desired state
174+
- [OK] **Does** let OpenStack Data Plane Operator apply the changes
175+
- [OK] **Does** use native `edpm_bootstrap` role for package installation
176+
- [OK] **Does** use native `edpm_podman` role for container management
177+
- [OK] **Does** use `edpm_bootstrap_command` for CA certificate installation
178+
179+
## License
180+
181+
Apache 2.0
182+
183+
## Author Information
184+
185+
Red Hat OpenStack CI Framework Team

‎roles/fdp_update_edpm/defaults/main.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
# Copyright Red Hat, Inc.
3+
# All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
6+
# not use this file except in compliance with the License. You may obtain
7+
# a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
17+
# General Configuration
18+
# OpenShift namespace where EDPM resources are deployed
19+
cifmw_fdp_update_edpm_namespace: "openstack"
20+
21+
# NodeSet selector - can be a specific name or 'all' for all nodesets
22+
cifmw_fdp_update_edpm_nodeset_name: "all"
23+
24+
# Dry run - show changes without applying
25+
cifmw_fdp_update_edpm_dry_run: false
26+
27+
# Container Image Updates
28+
# Enable/disable container image updates
29+
cifmw_fdp_update_edpm_containers_enabled: true
30+
31+
# Image registry URL (auto-detected from OpenShift if empty)
32+
cifmw_fdp_update_edpm_image_registry: ""
33+
34+
# Mapping of control plane image keys to EDPM ansible variables
35+
# Only ovnControllerImage is used on EDPM compute nodes
36+
cifmw_fdp_update_edpm_image_variable_mapping:
37+
ovnControllerImage: edpm_ovn_controller_agent_image
38+
39+
# Host Package Updates
40+
# Enable/disable host package updates
41+
cifmw_fdp_update_edpm_packages_enabled: true
42+
43+
# Repository configuration for host package updates
44+
cifmw_fdp_update_edpm_repo_name: "fdp-update"
45+
cifmw_fdp_update_edpm_repo_baseurl: "" # REQUIRED if packages_enabled is true
46+
cifmw_fdp_update_edpm_repo_enabled: true
47+
cifmw_fdp_update_edpm_repo_gpgcheck: false
48+
cifmw_fdp_update_edpm_repo_priority: 1
49+
50+
# Packages to update on the host
51+
# These will be added to edpm_bootstrap_packages in the nodeset
52+
cifmw_fdp_update_edpm_packages:
53+
- openvswitch3.5
54+
- openvswitch-selinux-extra-policy
55+
56+
# Hypervisor Firewall Configuration
57+
# Enable/disable hypervisor firewall setup for registry access
58+
cifmw_fdp_update_edpm_setup_hypervisor_firewall: true
59+
60+
# Network interface on hypervisor connected to compute nodes (EDPM)
61+
cifmw_fdp_update_compute_interface: "osp_trunk"
62+
63+
# Network interface on hypervisor connected to OpenShift/registry
64+
cifmw_fdp_update_registry_interface: "ocpbm"
65+
66+
# Compute nodes network CIDR (source for NAT)
67+
cifmw_fdp_update_compute_network: "192.168.122.0/24"
68+
69+
# OpenShift/registry network CIDR (destination for NAT)
70+
cifmw_fdp_update_registry_network: "192.168.201.0/24"
71+
72+
# Registry Configuration
73+
# Configure OpenShift registry CA certificate on EDPM nodes
74+
cifmw_fdp_update_edpm_configure_registry_ca: true
75+
76+
# Configure registry authentication automatically
77+
# Uses 'oc create token' or 'oc whoami -t' to get a service account token
78+
cifmw_fdp_update_edpm_configure_registry_auth: true
79+
80+
# Deployment Configuration
81+
# Automatically create OpenStackDataPlaneDeployment after updating NodeSets
82+
# Creates a single deployment for all updated NodeSets
83+
cifmw_fdp_update_edpm_auto_deploy: true
84+
85+
# Wait for deployment to complete before continuing
86+
cifmw_fdp_update_edpm_wait_for_deployment: true
87+
88+
# Timeout for deployment completion (in seconds)
89+
# Default: 3600 seconds (60 minutes / 1 hour)
90+
cifmw_fdp_update_edpm_deployment_timeout: 3600
91+
92+
# Polling interval when waiting for deployment (in seconds)
93+
cifmw_fdp_update_edpm_deployment_poll_interval: 30
94+
95+
# Services to run in the deployment
96+
# For updates, we need to:
97+
# 1. bootstrap - Install host packages and configure repos
98+
# 2. configure-os - Configure registry authentication
99+
# 3. configure-network - Ensure network is configured
100+
# 4. Service-specific services (ovn, nova, etc) - Pull updated images and restart
101+
cifmw_fdp_update_edpm_deployment_services:
102+
- bootstrap # MUST be first to install packages and configure repos
103+
- configure-os # MUST be second to authenticate before pulling images
104+
- configure-network
105+
- ovn
106+
107+
# Internal Variables (do not override)
108+
_cifmw_fdp_update_edpm_updated_images: {}
109+
_cifmw_fdp_update_edpm_nodesets: []
110+
_cifmw_fdp_update_edpm_updated_nodesets: []
111+
_cifmw_fdp_update_edpm_external_registry: ""

0 commit comments

Comments
 (0)