Don't update image field when we can't manage it (#29)

* If deploymentconfigs are configured to trigger on image stream updates don't try to replace image field

* First pass at parsing the trigger annotation

* First draft of IS idempotence tests

* Found even more not idempotent stuff

* Separate handling of annotation and dc spec

* handle malformed annotations

* refactor incluster integration test to catch last flake

* Add proper DNS01 regex for container names

* fix broken conditional for trigger annotations

* Handle namespace field that is added to trigger

* deduplicate shared code

* Set namespace in incluster script

* Give high permissions to test pod

* Still working on permissions issues in prow

* Fix inventory test

* add namespace to watch

* run in default namespace

* fix recursive call

* Fix ansible collection path for downstream test

* Clone the proper ansible collection

molecule/default/converge.yml

@@ -5,6 +5,8 @@
   gather_facts: no
   vars:
     ansible_python_interpreter: '{{ virtualenv_interpreter }}'
+  vars_files:
+    - vars/main.yml
   tasks:
     # OpenShift Resources
     - name: Create a project
@@ -22,41 +24,76 @@
     - name: Create deployment config
       community.okd.k8s:
         state: present
-        inline: &dc
-          apiVersion: v1
-          kind: DeploymentConfig
-          metadata:
-            name: hello-world
-            labels:
-              app: galaxy
-              service: hello-world
-            namespace: testing
-          spec:
-            template:
-              metadata:
-                labels:
-                  app: galaxy
-                  service: hello-world
-              spec:
-                containers:
-                  - name: hello-world
-                    image: python
-                    command:
-                      - python
-                      - '-m'
-                      - http.server
-                    env:
-                      - name: TEST
-                        value: test
-            replicas: 1
-            strategy:
-              type: Recreate
+        name: hello-world
+        namespace: testing
+        definition: '{{ okd_dc_template }}'
         wait: yes
         wait_condition:
           type: Available
           status: True
+      vars:
+        k8s_pod_name: hello-world
+        k8s_pod_image: python
+        k8s_pod_command:
+          - python
+          - '-m'
+          - http.server
+        k8s_pod_env:
+          - name: TEST
+            value: test
+        okd_dc_triggers:
+          - type: ConfigChange
       register: output
 
     - name: Show output
       debug:
         var: output
+
+    - vars:
+        image: docker.io/python
+        image_name: python
+        image_tag: latest
+        k8s_pod_image: python
+        k8s_pod_command:
+          - python
+          - '-m'
+          - http.server
+        namespace: idempotence-testing
+      block:
+        - name: Create a namespace
+          community.okd.k8s:
+            name: '{{ namespace }}'
+            kind: Namespace
+            api_version: v1
+
+        - name: Create imagestream
+          community.okd.k8s:
+            namespace: '{{ namespace }}'
+            definition: '{{ okd_imagestream_template }}'
+
+        - name: Create DeploymentConfig to reference ImageStream
+          community.okd.k8s:
+            name: '{{ k8s_pod_name }}'
+            namespace: '{{ namespace }}'
+            definition: '{{ okd_dc_template }}'
+          vars:
+            k8s_pod_name: is-idempotent-dc
+
+        - name: Create Deployment to reference ImageStream
+          community.okd.k8s:
+            name: '{{ k8s_pod_name }}'
+            namespace: '{{ namespace }}'
+            definition: '{{ k8s_deployment_template | combine(metadata)  }}'
+          vars:
+            k8s_pod_annotations:
+              "alpha.image.policy.openshift.io/resolve-names": "*"
+            k8s_pod_name: is-idempotent-deployment
+            annotation:
+              - from:
+                  kind: ImageStreamTag
+                  name: "{{ image_name }}:{{ image_tag}}}"
+                fieldPath: 'spec.template.spec.containers[?(@.name=="{{ k8s_pod_name }}")].image}'
+            metadata:
+              metadata:
+                annotations:
+                  image.openshift.io/triggers: '{{ annotation | to_json }}'

molecule/default/molecule.yml

@@ -9,6 +9,9 @@ platforms:
       - k8s
 provisioner:
   name: ansible
+  log: true
+  options:
+    vvv: True
   config_options:
     inventory:
       enable_plugins: community.okd.openshift
@@ -26,7 +29,7 @@ provisioner:
         playbook_namespace: molecule-tests
   env:
     ANSIBLE_FORCE_COLOR: 'true'
-    ANSIBLE_COLLECTIONS_PATHS: ${MOLECULE_PROJECT_DIRECTORY}
+    ANSIBLE_COLLECTIONS_PATHS: ${OVERRIDE_COLLECTION_PATH:-$MOLECULE_PROJECT_DIRECTORY}
 verifier:
   name: ansible
   lint: |

molecule/default/vars/main.yml

@@ -0,0 +1,94 @@
+---
+k8s_pod_annotations: {}
+
+k8s_pod_metadata:
+  labels:
+    app: '{{ k8s_pod_name }}'
+  annotations: '{{ k8s_pod_annotations }}'
+
+k8s_pod_spec:
+  serviceAccount: "{{ k8s_pod_service_account }}"
+  containers:
+    - image: "{{ k8s_pod_image }}"
+      imagePullPolicy: Always
+      name: "{{ k8s_pod_name }}"
+      command: "{{ k8s_pod_command }}"
+      readinessProbe:
+        initialDelaySeconds: 15
+        exec:
+          command:
+            - /bin/true
+      resources: "{{ k8s_pod_resources }}"
+      ports: "{{ k8s_pod_ports }}"
+      env: "{{ k8s_pod_env }}"
+
+k8s_pod_service_account: default
+
+k8s_pod_resources:
+  limits:
+    cpu: "100m"
+    memory: "100Mi"
+
+k8s_pod_command: []
+
+k8s_pod_ports: []
+
+k8s_pod_env: []
+
+k8s_pod_template:
+  metadata: "{{ k8s_pod_metadata }}"
+  spec: "{{ k8s_pod_spec }}"
+
+k8s_deployment_spec:
+  template: '{{ k8s_pod_template }}'
+  selector:
+    matchLabels:
+      app: '{{ k8s_pod_name }}'
+  replicas: 1
+
+k8s_deployment_template:
+  apiVersion: apps/v1
+  kind: Deployment
+  spec: '{{ k8s_deployment_spec }}'
+
+okd_dc_triggers:
+  - type: ConfigChange
+  - type: ImageChange
+    imageChangeParams:
+      automatic: true
+      containerNames:
+        - '{{ k8s_pod_name }}'
+      from:
+        kind: ImageStreamTag
+        name: '{{ image_name }}:{{ image_tag }}'
+
+okd_dc_spec:
+  template: '{{ k8s_pod_template }}'
+  triggers: '{{ okd_dc_triggers }}'
+  replicas: 1
+  strategy:
+    type: Recreate
+
+okd_dc_template:
+  apiVersion: v1
+  kind: DeploymentConfig
+  spec: '{{ okd_dc_spec }}'
+
+okd_imagestream_template:
+  apiVersion: image.openshift.io/v1
+  kind: ImageStream
+  metadata:
+    name: '{{ image_name }}'
+  spec:
+    lookupPolicy:
+      local: true
+    tags:
+    - annotations: null
+      from:
+        kind: DockerImage
+        name: '{{ image }}'
+      name: '{{ image_tag }}'
+      referencePolicy:
+        type: Source
+
+image_tag: latest