openshift adm prune images (#133)

molecule/default/tasks/openshift_import_images.yml

@@ -0,0 +1,179 @@
+- name: Openshift import image testing
+  block:
+
+  - set_fact:
+      test_ns: "import-images"
+
+  - name: Ensure namespace
+    community.okd.k8s:
+      kind: Namespace
+      name: '{{ test_ns }}'
+
+  - name: Import image using tag (should import latest tag only)
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name: "ansible/awx"
+    check_mode: yes
+    register: import_tag
+
+  - name: Assert only latest was imported
+    assert:
+      that:
+        - import_tag is changed
+        - import_tag.result | length == 1
+        - import_tag.result.0.spec.import
+        - import_tag.result.0.spec.images.0.from.kind == "DockerImage"
+        - import_tag.result.0.spec.images.0.from.name == "ansible/awx"
+
+  - name: check image stream
+    kubernetes.core.k8s_info:
+      kind: ImageStream
+      namespace: "{{ test_ns }}"
+      name: awx
+    register: resource
+
+  - name: assert that image stream is not created when using check_mode=yes
+    assert:
+      that:
+        - resource.resources == []
+
+  - name: Import image using tag (should import latest tag only)
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name: "ansible/awx"
+    register: import_tag
+
+  - name: Assert only latest was imported
+    assert:
+      that:
+        - import_tag is changed
+
+  - name: check image stream
+    kubernetes.core.k8s_info:
+      kind: ImageStream
+      namespace: "{{ test_ns }}"
+      name: awx
+    register: resource
+
+  - name: assert that image stream contains only tag latest
+    assert:
+      that:
+        - resource.resources | length == 1
+        - resource.resources.0.status.tags.0.tag == 'latest'
+  
+  - name: Import once again the latest tag
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name: "ansible/awx"
+    register: import_tag
+
+  - name: assert change was performed
+    assert:
+      that:
+        - import_tag is changed
+
+  - name: check image stream
+    kubernetes.core.k8s_info:
+      kind: ImageStream
+      version: image.openshift.io/v1
+      namespace: "{{ test_ns }}"
+      name: awx
+    register: resource
+
+  - name: assert that image stream still contains unique tag
+    assert:
+      that:
+        - resource.resources | length == 1
+        - resource.resources.0.status.tags.0.tag == 'latest'
+
+  - name: Import another tags
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name: "ansible/awx:17.1.0"
+    register: import_another_tag
+    ignore_errors: yes
+
+  - name: assert that another tag was imported
+    assert:
+      that:
+        - import_another_tag is failed
+        - '"the tag 17.1.0 does not exist on the image stream" in import_another_tag.msg'
+
+  - name: Create simple ImageStream (without docker external container)
+    community.okd.k8s:
+      namespace: "{{ test_ns }}"
+      name: "local-is"
+      definition:
+        apiVersion: image.openshift.io/v1
+        kind: ImageStream
+        spec:
+          lookupPolicy:
+            local: false
+          tags: []
+
+  - name: Import all tag for image stream not pointing on external container image should failed
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name: "local-is"
+      all: true
+    register: error_tag
+    ignore_errors: true
+    check_mode: yes
+
+  - name: Assert module cannot import from non-existing tag from ImageStream
+    assert:
+      that:
+        - error_tag is failed
+        - 'error_tag.msg == "image stream {{ test_ns }}/local-is does not have tags pointing to external container images"'
+
+  - name: import all tags for container image ibmcom/pause and specific tag for redhat/ubi8-micro
+    community.okd.openshift_import_image:
+      namespace: "{{ test_ns }}"
+      name:
+        - "ibmcom/pause"
+        - "redhat/ubi8-micro:8.5-437"
+      all: true
+    register: multiple_import
+
+  - name: Assert that import succeed
+    assert:
+      that:
+        - multiple_import is changed
+        - multiple_import.result | length == 2
+
+  - name: Read ibmcom/pause ImageStream
+    kubernetes.core.k8s_info:
+      version: image.openshift.io/v1
+      kind: ImageStream
+      namespace: "{{ test_ns }}"
+      name: pause
+    register: pause
+
+  - name: assert that ibmcom/pause has multiple tags
+    assert:
+      that:
+        - pause.resources | length == 1
+        - pause.resources.0.status.tags | length > 1
+
+  - name: Read redhat/ubi8-micro ImageStream
+    kubernetes.core.k8s_info:
+      version: image.openshift.io/v1
+      kind: ImageStream
+      namespace: "{{ test_ns }}"
+      name: ubi8-micro
+    register: resource
+
+  - name: assert that redhat/ubi8-micro has only one tag
+    assert:
+      that:
+        - resource.resources | length == 1
+        - resource.resources.0.status.tags | length == 1
+        - 'resource.resources.0.status.tags.0.tag == "8.5-437"'
+
+  always:
+    - name: Delete testing namespace
+      community.okd.k8s:
+        state: absent
+        kind: Namespace
+        name: "{{ test_ns }}"
+      ignore_errors: yes

molecule/default/tasks/openshift_prune_images.yml

@@ -0,0 +1,230 @@
+---
+- name: Read registry information
+  community.okd.openshift_registry_info:
+    check: yes
+  register: registry
+
+- name: Display registry information
+  debug: var=registry
+
+- block:
+    - set_fact:
+        prune_ns: "prune-images"
+        prune_registry: "{{ registry.public_hostname }}"
+        container:
+          name: "httpd"
+          from: "centos/python-38-centos7:20210629-304c7c8"
+        pod_name: "test-pod"
+
+    - name: Ensure namespace is created
+      community.okd.k8s:
+        kind: Namespace
+        name: "{{ prune_ns }}"
+
+    - name: Import image into internal registry
+      community.okd.openshift_import_image:
+        namespace: "{{ prune_ns }}"
+        name: "{{ container.name }}"
+        source: "{{ container.from }}"
+
+    - name: Create simple Pod
+      community.okd.k8s:
+        namespace: "{{ prune_ns }}"
+        wait: yes
+        definition:
+          apiVersion: v1
+          kind: Pod
+          metadata:
+            name: "{{ pod_name }}"
+          spec:
+            containers:
+            - name: test-container
+              image: "{{ prune_registry }}/{{ prune_ns }}/{{ container.name }}:latest"
+              command:
+                - /bin/sh
+                - -c
+                - while true;do date;sleep 5; done
+
+    - name: Create limit range for images size
+      community.okd.k8s:
+        namespace: "{{ prune_ns }}"
+        definition:
+          kind: "LimitRange"
+          metadata:
+            name: "image-resource-limits"
+          spec:
+            limits:
+              - type: openshift.io/Image
+                max:
+                  storage: 1Gi
+        
+    - name: Prune images from namespace
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+      check_mode: yes
+      register: prune
+
+    - name: Assert that nothing to prune as image is in used
+      assert:
+        that:
+          - prune is not changed
+          - prune is successful
+          - prune.deleted_images == []
+          - prune.updated_image_streams == []
+
+    - name: Delete Pod created before
+      community.okd.k8s:
+        state: absent
+        name: "{{ pod_name }}"
+        kind: Pod
+        namespace: "{{ prune_ns }}"
+        wait: yes
+
+    - name: Prune images from namespace
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+      check_mode: yes
+      register: prune
+
+    - name: Read ImageStream
+      kubernetes.core.k8s_info:
+        version: image.openshift.io/v1
+        kind: ImageStream
+        namespace: "{{ prune_ns }}"
+        name: "{{ container.name }}"
+      register: isinfo
+
+    - set_fact:
+        is_image_name: "{{ isinfo.resources.0.status.tags[0]['items'].0.image }}"
+
+    - name: Assert that corresponding Image and ImageStream were candidate for pruning
+      assert:
+        that:
+          - prune is changed
+          - prune.deleted_images | length == 1
+          - prune.deleted_images.0.metadata.name == is_image_name
+          - prune.updated_image_streams | length == 1
+          - prune.updated_image_streams.0.metadata.name == container.name
+          - prune.updated_image_streams.0.metadata.namespace == prune_ns
+          - prune.updated_image_streams.0.status.tags == []
+
+    - name: Prune images from namespace keeping images and referrer younger than 60minutes
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+        keep_younger_than: 60
+      check_mode: yes
+      register: younger
+
+    - assert:
+        that:
+          - younger is not changed
+          - younger is successful
+          - younger.deleted_images == []
+          - younger.updated_image_streams == []
+
+    - name: Prune images over size limit
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+        prune_over_size_limit: yes
+      check_mode: yes
+      register: prune_over_size
+
+    - assert:
+        that:
+          - prune_over_size is not changed
+          - prune_over_size is successful
+          - prune_over_size.deleted_images == []
+          - prune_over_size.updated_image_streams == []
+
+    - name: Update limit range for images size
+      community.okd.k8s:
+        namespace: "{{ prune_ns }}"
+        definition:
+          kind: "LimitRange"
+          metadata:
+            name: "image-resource-limits"
+          spec:
+            limits:
+              - type: openshift.io/Image
+                max:
+                  storage: 1Ki
+
+    - name: Prune images over size limit (check_mode=yes)
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+        prune_over_size_limit: yes
+      check_mode: yes
+      register: prune
+
+    - name: Assert Images and ImageStream were candidate for prune
+      assert:
+        that:
+          - prune is changed
+          - prune.deleted_images | length == 1
+          - prune.deleted_images.0.metadata.name == is_image_name
+          - prune.updated_image_streams | length == 1
+          - prune.updated_image_streams.0.metadata.name == container.name
+          - prune.updated_image_streams.0.metadata.namespace == prune_ns
+          - prune.updated_image_streams.0.status.tags == []
+
+    - name: Prune images over size limit
+      community.okd.openshift_adm_prune_images:
+        registry_url: "{{ prune_registry }}"
+        namespace: "{{ prune_ns }}"
+        prune_over_size_limit: yes
+      register: prune
+
+    - name: Assert that Images and ImageStream were candidate for prune
+      assert:
+        that:
+          - prune is changed
+          - prune.deleted_images | length == 1
+          - prune.deleted_images.0.details.name == is_image_name
+          - prune.updated_image_streams | length == 1
+          - prune.updated_image_streams.0.metadata.name == container.name
+          - prune.updated_image_streams.0.metadata.namespace == prune_ns
+          - '"tags" not in prune.updated_image_streams.0.status'
+
+    - name: Validate that ImageStream was updated
+      kubernetes.core.k8s_info:
+        version: image.openshift.io/v1
+        kind: ImageStream
+        namespace: "{{ prune_ns }}"
+        name: "{{ container.name }}"
+      register: stream
+
+    - name: Assert that ImageStream was updated
+      assert:
+        that:
+          - stream.resources | length == 1
+          - '"tags" not in stream.resources.0.status'
+
+    - name: Validate that Image was deleted
+      kubernetes.core.k8s_info:
+        version: image.openshift.io/v1
+        kind: Image
+        name: "{{ is_image_name }}"
+      register: image
+
+    - name: Assert that image was deleted
+      assert:
+        that:
+          - image.resources | length == 0
+
+  always:
+    - name: Delete namespace
+      community.okd.k8s:
+        name: "{{ prune_ns }}"
+        kind: Namespace
+        state: absent
+        wait: yes
+      ignore_errors: true
+
+  when:
+    - registry.public_hostname
+    - registry.check.reached

molecule/default/verify.yml

@@ -65,6 +65,8 @@
     - import_tasks: tasks/openshift_adm_prune_auth_roles.yml
     - import_tasks: tasks/openshift_adm_prune_deployments.yml
     - import_tasks: tasks/openshift_route.yml
+    - import_tasks: tasks/openshift_import_images.yml
+    - import_tasks: tasks/openshift_prune_images.yml
     - block:
         - name: Create namespace
           community.okd.k8s: