Ensure that web and task deployments scale down for upgrades (#1522)

Co-authored-by: Imed Aouidene <imaouide@imaouide-thinkpadt14sgen2i.cdg.csb>

.github/workflows/ci.yaml

@@ -18,9 +18,9 @@ jobs:
     env:
       DOCKER_API_VERSION: "1.41"
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.8"
 
@@ -45,12 +45,12 @@ jobs:
     runs-on: ubuntu-latest
     name: helm
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.2.0
+        uses: helm/kind-action@v1.8.0
 
       - name: Build operator image and load into kind
         run: |
@@ -88,7 +88,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Check no_log statements
         run: |

.github/workflows/devel.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Push devel image
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Build Image
         run: |

.github/workflows/label_issue.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Label Issue - Community
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
       - name: Install python requests
         run: pip install requests

.github/workflows/label_pr.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Label PR - Community
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
       - name: Install python requests
         run: pip install requests

.github/workflows/stage.yml

@@ -38,13 +38,13 @@ jobs:
           exit 0
 
       - name: Checkout awx
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           repository: ${{ github.repository_owner }}/awx
           path: awx
 
       - name: Checkout awx-operator
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           repository: ${{ github.repository_owner }}/awx-operator
           path: awx-operator

.readthedocs.yml

@@ -0,0 +1,17 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# RTD API version
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.11"
+
+mkdocs:
+  configuration: mkdocs.yml
+
+python:
+  install:
+  - requirements: ./docs/requirements.txt

Makefile

@@ -334,6 +334,14 @@ helm-chart-generate: kustomize helm kubectl-slice yq charts
 	for file in charts/$(CHART_NAME)/raw-files/*rolebinding*; do\
 		$(YQ) -i '.subjects[0].namespace = "{{ .Release.Namespace }}"' $${file};\
 	done
+	# Correct .metadata.name for cluster scoped resources
+	cluster_scoped_files="charts/$(CHART_NAME)/raw-files/clusterrolebinding-awx-operator-proxy-rolebinding.yaml charts/$(CHART_NAME)/raw-files/clusterrole-awx-operator-metrics-reader.yaml charts/$(CHART_NAME)/raw-files/clusterrole-awx-operator-proxy-role.yaml";\
+	for file in $${cluster_scoped_files}; do\
+		$(YQ) -i '.metadata.name += "-{{ .Release.Name }}"' $${file};\
+	done
+
+	# Correct the reference for the clusterrolebinding
+	$(YQ) -i '.roleRef.name += "-{{ .Release.Name }}"' 'charts/$(CHART_NAME)/raw-files/clusterrolebinding-awx-operator-proxy-rolebinding.yaml'
 	# move all custom resource definitions to crds folder
 	mkdir charts/$(CHART_NAME)/crds
 	mv charts/$(CHART_NAME)/raw-files/customresourcedefinition*.yaml charts/$(CHART_NAME)/crds/.

README.md

@@ -47,8 +47,7 @@ All of our usage and configuration docs are nested in the `docs/` directory. Bel
   - [Authors](./docs/contributors-guide/author.md)
 - Installation
   - [Basic Install](./docs/installation/basic-install.md)
-  - [Creating a Minikube cluster for testing](./docs/creating-a-minikube-cluster-for-testing.md)
-  - [Installation](./docs/installation/installation.md)
+  - [Creating a Minikube cluster for testing](./docs/installation/creating-a-minikube-cluster-for-testing.md)
   - [Helm Install](./docs/installation/helm-install-on-existing-cluster.md)
 - [Migration](./docs/migration/migration.md)
 - [Uninstall](./docs/uninstall/uninstall.md)
@@ -57,7 +56,7 @@ All of our usage and configuration docs are nested in the `docs/` directory. Bel
   - [Database Configuration](./docs/user-guide/database-configuration.md)
   - [Network and TLS Configuration](./docs/user-guide/network-and-tls-configuration.md)
   - Advanced Configuration
-    - [No Log](./docs/no-log.md)
+    - [No Log](./docs/user-guide/advanced-configuration/no-log.md)
     - [Deploy a Specific Version of AWX](./docs/user-guide/advanced-configuration/deploying-a-specific-version-of-awx.md)
     - [Resource Requirements](./docs/user-guide/advanced-configuration/containers-resource-requirements.md)
     - [Extra Settings](./docs/user-guide/advanced-configuration/extra-settings.md)

hack/publish-to-operator-hub.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+
+# Create PR to Publish to community-operators and community-operators-prod
+#
+# * Create upstream awx-operator release
+# * Check out tag (1.1.2).
+# * Run VERSION=1.1.2 make bundle
+# * Clone https://github.com/k8s-operatorhub/community-operators --branch main
+# * mkdir -p operators/awx-operator/0.31.0/
+# * Copy in manifests/ metadata/ and tests/ directories into operators/awx-operator/1.1.2/
+# * Use sed to add in a replaces or skip entry. replace by default.
+# * No need to update config.yaml
+# * Build and Push operator and bundle images
+# * Open PR or at least push to a branch so that a PR can be manually opened from it.
+#
+# Usage:
+#   First, check out awx-operator tag you intend to release, in this case, 1.0.0
+#   $ VERSION=1.1.2 PREV_VERSION=1.1.1 FORK=<your-fork> ./publish-operator.sh
+#
+# Remember to change update the VERSION and PREV_VERSION before running!!!
+
+
+set -e
+
+VERSION=${VERSION:-blah2}
+PREV_VERSION=${PREV_VERSION:-blah1}
+BRANCH=publish-awx-operator-$VERSION
+FORK=${FORK:-fork}
+
+IMG=quay.io/ansible/awx-operator:$VERSION
+CATALOG_IMG=quay.io/ansible/awx-operator-catalog:$VERSION
+BUNDLE_IMG=quay.io/ansible/awx-operator-bundle:$VERSION
+
+# Set path variables
+OPERATOR_PATH=${OPERATOR_PATH:-~/awx-operator}
+
+# Build & Push Operator Image  # Not needed because it is done as part of the GHA release automation
+# make docker-build docker-push IMG=$IMG
+
+# Build bundle directory
+rm -rf bundle/
+make bundle IMG=$IMG
+
+# Build bundle and catalog images
+make bundle-build bundle-push BUNDLE_IMG=$BUNDLE_IMG IMG=$IMG
+make catalog-build catalog-push CATALOG_IMG=$CATALOG_IMG BUNDLE_IMGS=$BUNDLE_IMG BUNDLE_IMG=$BUNDLE_IMG IMG=$IMG
+
+# Set containerImage & namespace variables in CSV
+sed -i -e "s|containerImage: quay.io/ansible/awx-operator:devel|containerImage: quay.io/ansible/awx-operator:${VERSION}|g" bundle/manifests/awx-operator.clusterserviceversion.yaml
+sed -i -e "s|namespace: placeholder|namespace: awx|g" bundle/manifests/awx-operator.clusterserviceversion.yaml
+
+# Add replaces to dependency graph for upgrade path
+if ! grep -qF 'replaces: awx-operator.v${PREV_VERSION}' bundle/manifests/awx-operator.clusterserviceversion.yaml; then
+  sed -i -e "/version: ${VERSION}/a \\
+  replaces: awx-operator.v$PREV_VERSION" bundle/manifests/awx-operator.clusterserviceversion.yaml
+fi
+
+# Rename CSV to contain version in name
+mv bundle/manifests/awx-operator.clusterserviceversion.yaml bundle/manifests/awx-operator.v${VERSION}.clusterserviceversion.yaml
+
+# Set Openshift Support Range (bump minKubeVersion in CSV when changing)
+if ! grep -qF 'openshift.versions' bundle/metadata/annotations.yaml; then
+  sed -i -e "/annotations:/a \\
+  com.redhat.openshift.versions: v4.10-v4.13\n" bundle/metadata/annotations.yaml
+fi
+
+# -- Put up community-operators PR
+cd $OPERATOR_PATH
+git clone git@github.com:k8s-operatorhub/community-operators.git
+
+mkdir -p community-operators/operators/awx-operator/$VERSION/
+cp -r bundle/* community-operators/operators/awx-operator/$VERSION/
+cd community-operators/operators/awx-operator/$VERSION/
+pwd
+ls -la
+
+# Commit and push PR
+git checkout -b $BRANCH
+git add ./
+git status
+
+message='operator [N] [CI] awx-operator'
+commitMessage="${message} ${VERSION}"
+git commit -m "$commitMessage" -s
+
+git remote add upstream git@github.com:$FORK/community-operators.git
+git push upstream $BRANCH
+
+
+# -- Put up community-operators-prod PR
+# Reset directory
+cd $OPERATOR_PATH
+
+pwd
+
+git clone git@github.com:redhat-openshift-ecosystem/community-operators-prod.git
+
+mkdir -p community-operators-prod/operators/awx-operator/$VERSION/
+cp -r bundle/* community-operators-prod/operators/awx-operator/$VERSION/
+cd community-operators-prod/operators/awx-operator/$VERSION/
+
+pwd
+ls -la
+
+# Commit and push PR
+git checkout -b $BRANCH
+git add ./
+git status
+
+message='operator [N] [CI] awx-operator'
+commitMessage="${message} ${VERSION}"
+git commit -m "$commitMessage" -s
+
+git remote add upstream git@github.com:$FORK/community-operators-prod.git
+git push upstream $BRANCH
+
+
+# -- Print Links to Branches
+echo "Commnity Operators: https://github.com/$FORK/community-operators/pull/new/$BRANCH"
+echo "Commnity Operators Prod: https://github.com/$FORK/community-operators-prod/pull/new/$BRANCH"
+
+# -- Cleanup
+
+rm -rf $OPERATOR_PATH/community-operators
+rm -rf $OPERATOR_PATH/community-operators-prod

molecule/default/tasks/awx_replicas_test.yml

@@ -1,64 +1,64 @@
 ---
 - block:
-  - debug:
-      msg: test - web_replicas and task_replicas should override replicas
+    - debug:
+        msg: test - web_replicas and task_replicas should override replicas
 
-  - include_tasks: apply_awx_spec.yml
-    vars:
-      additional_fields:
-        replicas: 2
-        web_replicas: 0
-        task_replicas: 0
+    - include_tasks: apply_awx_spec.yml
+      vars:
+        additional_fields:
+          replicas: 2
+          web_replicas: 0
+          task_replicas: 0
 
-  - include_tasks: _test_case_replicas.yml
-    vars:
-      expected_web_replicas: 0
-      expected_task_replicas: 0
+    - include_tasks: _test_case_replicas.yml
+      vars:
+        expected_web_replicas: 0
+        expected_task_replicas: 0
 
 ####
 
-  - debug:
-      msg: test - replicas should act as a default
+    - debug:
+        msg: test - replicas should act as a default
 
-  - include_tasks: apply_awx_spec.yml
-    vars:
-      additional_fields:
-        replicas: 2
-        web_replicas: 1
+    - include_tasks: apply_awx_spec.yml
+      vars:
+        additional_fields:
+          replicas: 2
+          web_replicas: 1
 
-  - include_tasks: _test_case_replicas.yml
-    vars:
-      expected_web_replicas: 1
-      expected_task_replicas: 2
+    - include_tasks: _test_case_replicas.yml
+      vars:
+        expected_web_replicas: 1
+        expected_task_replicas: 2
 
 ####
 
-  - debug:
-      msg: test - replicas=0 should kill all pods
+    - debug:
+        msg: test - replicas=0 should kill all pods
 
-  - include_tasks: apply_awx_spec.yml
-    vars:
-      additional_fields:
-        replicas: 0
+    - include_tasks: apply_awx_spec.yml
+      vars:
+        additional_fields:
+          replicas: 0
 
-  - include_tasks: _test_case_replicas.yml
-    vars:
-      expected_web_replicas: 0
-      expected_task_replicas: 0
+    - include_tasks: _test_case_replicas.yml
+      vars:
+        expected_web_replicas: 0
+        expected_task_replicas: 0
 
 ####
 
-  - debug:
-      msg: test - replicas=3 should give 3 of each
+    - debug:
+        msg: test - replicas=3 should give 3 of each
 
-  - include_tasks: apply_awx_spec.yml
-    vars:
-      additional_fields:
-        replicas: 3
+    - include_tasks: apply_awx_spec.yml
+      vars:
+        additional_fields:
+          replicas: 3
 
-  - include_tasks: _test_case_replicas.yml
-    vars:
-      expected_web_replicas: 3
-      expected_task_replicas: 3
+    - include_tasks: _test_case_replicas.yml
+      vars:
+        expected_web_replicas: 3
+        expected_task_replicas: 3
   tags:
     - replicas

roles/installer/defaults/main.yml

@@ -273,7 +273,7 @@ _init_projects_container_image: quay.io/centos/centos:stream9
 
 create_preload_data: true
 
-replicas: "1"
+replicas: 1
 web_replicas: ''
 task_replicas: ''
 

roles/installer/tasks/migrate_data.yml

@@ -59,14 +59,29 @@
     namespace: "{{ ansible_operator_meta.namespace }}"
     pod: "{{ postgres_pod_name }}"
     command: |
-      bash -c """
+      bash -c "
+      function end_keepalive {
+        rc=$?
+        rm -f \"$1\"
+        kill $(cat /proc/$2/task/$2/children 2>/dev/null) 2>/dev/null || true
+        wait $2 || true
+        exit $rc
+      }
+      keepalive_file=\"$(mktemp)\"
+      while [[ -f \"$keepalive_file\" ]]; do
+        echo 'Migrating data from old database...'
+        sleep 60
+      done &
+      keepalive_pid=$!
+      trap 'end_keepalive \"$keepalive_file\" \"$keepalive_pid\"' EXIT SIGINT SIGTERM
+      echo keepalive_pid: $keepalive_pid
       set -e -o pipefail
-      PGPASSWORD='{{ awx_old_postgres_pass }}' {{ pgdump }} | PGPASSWORD='{{ awx_postgres_pass }}' {{ pg_restore }}
+      PGPASSWORD=\"$PGPASSWORD_OLD\" {{ pgdump }} | PGPASSWORD=\"$POSTGRES_PASSWORD\" {{ pg_restore }}
+      set +e +o pipefail
       echo 'Successful'
-      """
+      "
   no_log: "{{ no_log }}"
   register: data_migration
-  failed_when: "'Successful' not in data_migration.stdout"
 
 - name: Set flag signifying that this instance has been migrated
   set_fact:

roles/installer/tasks/scale_down_deployment.yml

@@ -1,12 +1,14 @@
 ---
-
 - name: Check for presence of Deployment
   k8s_info:
     api_version: apps/v1
     kind: Deployment
-    name: "{{ ansible_operator_meta.name }}"
     namespace: "{{ ansible_operator_meta.namespace }}"
-  register: this_deployment
+    label_selectors:
+      - 'app.kubernetes.io/part-of={{ ansible_operator_meta.name }}'
+      - 'app.kubernetes.io/managed-by={{ deployment_type }}-operator'
+      - 'app.kubernetes.io/component={{ deployment_type }}'
+  register: _deployments
 
 - name: Scale down Deployment for migration
   kubernetes.core.k8s_scale:
@@ -16,7 +18,5 @@
     namespace: "{{ ansible_operator_meta.namespace }}"
     replicas: 0
     wait: yes
-  loop:
-    - "{{ ansible_operator_meta.name }}-task"
-    - "{{ ansible_operator_meta.name }}-web"
-  when: this_deployment['resources'] | length
+  loop: "{{ _deployments.resources | map(attribute='metadata.name') | list }}"
+  when: _deployments.resources | length

roles/installer/tasks/upgrade_postgres.yml

@@ -91,11 +91,27 @@
     namespace: "{{ ansible_operator_meta.namespace }}"
     pod: "{{ postgres_pod_name }}"
     command: |
-      bash -c """
+      bash -c "
+      function end_keepalive {
+        rc=$?
+        rm -f \"$1\"
+        kill $(cat /proc/$2/task/$2/children 2>/dev/null) 2>/dev/null || true
+        wait $2 || true
+        exit $rc
+      }
+      keepalive_file=\"$(mktemp)\"
+      while [[ -f \"$keepalive_file\" ]]; do
+        echo 'Migrating data to new PostgreSQL {{ supported_postgres_version }} Database...'
+        sleep 60
+      done &
+      keepalive_pid=$!
+      trap 'end_keepalive \"$keepalive_file\" \"$keepalive_pid\"' EXIT SIGINT SIGTERM
+      echo keepalive_pid: $keepalive_pid
       set -e -o pipefail
-      PGPASSWORD='{{ awx_postgres_pass }}' {{ pgdump }} | PGPASSWORD='{{ awx_postgres_pass }}' {{ pg_restore }}
+      PGPASSWORD=\"$POSTGRES_PASSWORD\" {{ pgdump }} | PGPASSWORD=\"$POSTGRES_PASSWORD\" {{ pg_restore }}
+      set +e +o pipefail
       echo 'Successful'
-      """
+      "
   no_log: "{{ no_log }}"
   register: data_migration
   failed_when: "'Successful' not in data_migration.stdout"

roles/installer/templates/statefulsets/postgres.yaml.j2

@@ -94,6 +94,13 @@ spec:
               value: '{{ postgres_initdb_args }}'
             - name: POSTGRES_HOST_AUTH_METHOD
               value: '{{ postgres_host_auth_method }}'
+{% if 'resources' in old_pg_config and old_pg_config['resources'] and 'password' in old_pg_config['resources'][0]['data'] %}
+            - name: PGPASSWORD_OLD
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ old_pg_config['resources'][0]['metadata']['name'] }}'
+                  key: password
+{% endif %}
           ports:
             - containerPort: {{ awx_postgres_port | default('5432')}}
               name: postgres-{{ supported_pg_version }}

roles/restore/tasks/postgres.yml

@@ -50,7 +50,7 @@
   k8s_info:
     api_version: apps/v1
     kind: Deployment
-    name: "{{ ansible_operator_meta.namespace }}-task"
+    name: "{{ deployment_name }}-task"
     namespace: "{{ ansible_operator_meta.namespace }}"
   register: this_deployment
 
@@ -63,8 +63,8 @@
     replicas: 0
     wait: yes
   loop:
-    - "{{ ansible_operator_meta.name }}-task"
-    - "{{ ansible_operator_meta.name }}-web"
+    - "{{ deployment_name }}-task"
+    - "{{ deployment_name }}-web"
   when: this_deployment['resources'] | length
 
 - name: Set full resolvable host name for postgres pod
@@ -87,11 +87,27 @@
     namespace: "{{ backup_pvc_namespace }}"
     pod: "{{ ansible_operator_meta.name }}-db-management"
     command: |
-      bash -c """
+      bash -c "
+      function end_keepalive {
+        rc=$?
+        rm -f \"$1\"
+        kill $(cat /proc/$2/task/$2/children 2>/dev/null) 2>/dev/null || true
+        wait $2 || true
+        exit $rc
+      }
+      keepalive_file=\"$(mktemp)\"
+      while [[ -f \"$keepalive_file\" ]]; do
+        echo 'Migrating data from old database...'
+        sleep 60
+      done &
+      keepalive_pid=$!
+      trap 'end_keepalive \"$keepalive_file\" \"$keepalive_pid\"' EXIT SIGINT SIGTERM
+      echo keepalive_pid: $keepalive_pid
       set -e -o pipefail
       cat {{ backup_dir }}/tower.db | PGPASSWORD='{{ awx_postgres_pass }}' {{ pg_restore }}
+      set +e +o pipefail
       echo 'Successful'
-      """
+      "
   register: data_migration
   no_log: "{{ no_log }}"
   failed_when: "'Successful' not in data_migration.stdout"