Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: replace deploy playbook with role #626

Closed
wants to merge 1 commit into from
Closed

fix: replace deploy playbook with role #626

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
394 changes: 2 additions & 392 deletions playbooks/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,395 +69,5 @@
costcenter: "700"
registry: 172.30.1.1:5000
registry_user: developer
tasks:
- name: Include tasks/project-dir.yml
ansible.builtin.include_tasks: tasks/project-dir.yml
tags:
- always

- name: Include variables
ansible.builtin.include_vars: "{{ project_dir }}/vars/{{ service }}/{{ deployment }}.yml"
tags:
- always

- name: Include tasks/check-up-to-date.yml
ansible.builtin.include_tasks: tasks/check-up-to-date.yml
tags:
- always

- name: Include deployment facts
ansible.builtin.include_tasks: tasks/set-deployment-facts.yml
tags:
- always

- name: Include tasks/set-facts.yml
ansible.builtin.include_tasks: tasks/set-facts.yml
tags:
- always

- name: Include extra secret vars
ansible.builtin.include_vars:
file: "{{ path_to_secrets }}/extra-vars.yml"
name: vault
tags:
- always

- name: Get k8s token and check it
tags:
- always
block:
- name: Get kubeconfig token
ansible.builtin.command: oc whoami -t
register: kubeconfig_token
changed_when: false
- name: Check if tokens match
ansible.builtin.assert:
that:
- kubeconfig_token.stdout == api_key
msg: "OpenShift API token defined in vars/ does not match token from your current environment."

- name: Push dev images to local registry
when: push_dev_images
tags:
- packit-service
- packit-worker
- packit-service-beat
block:
- name: Set tls-verify to false if podman is used
ansible.builtin.set_fact:
tls_verify_false: "{{ '--tls-verify=false' if 'podman' in container_engine else '' }}"
changed_when: false
- name: Login to local cluster
ansible.builtin.shell: "{{ container_engine }} login -u {{ registry_user }} -p $(oc whoami -t) {{ registry }} {{ tls_verify_false }}"
changed_when: false
- name: Inspect service image
ansible.builtin.command: "{{ container_engine }} inspect {{ image }}"
changed_when: false
- name: Tag the image with :dev
ansible.builtin.command: "{{ container_engine }} tag {{ image }} {{ registry }}/myproject/packit-service:dev"
changed_when: true
- name: Push the image
ansible.builtin.command: "{{ container_engine }} push {{ registry }}/myproject/packit-service:dev {{ tls_verify_false }}"
changed_when: true
- name: Inspect worker image
ansible.builtin.command: "{{ container_engine }} inspect {{ image_worker }}"
changed_when: false
- name: Tag the image with :dev
ansible.builtin.command: "{{ container_engine }} tag {{ image_worker }} {{ registry }}/myproject/packit-worker:dev"
changed_when: true
- name: Push the image
ansible.builtin.command: "{{ container_engine }} push {{ registry }}/myproject/packit-worker:dev {{ tls_verify_false }}"
changed_when: true

- name: Deploy secrets
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-packit-ssh.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-packit-secrets.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-packit-config.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-sentry.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-postgres.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-aws.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-splunk.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/secret-centpkg-sig.yml.j2') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/github-app-private-key.yml.j2') }}"
tags:
- secrets

- name: Set up sandbox namespace
when: with_sandbox
block:
- name: Create sandbox namespace
k8s:
resource_definition: "{{ lookup('template', '{{ project_dir }}/openshift/sandbox-namespace.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
- name: Add edit role to service account in sandbox namespace
ansible.builtin.command: oc adm policy add-role-to-user edit system:serviceaccount:{{ project }}:default -n {{ sandbox_namespace }}
register: rolebinding
changed_when: "'added:' in rolebinding.stdout"

- name: Deploy postgres
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/postgres.yml.j2') }}"
tags:
- postgres

- name: Deploy key-value database ({{ kv_database }})
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('file', '{{ project_dir }}/openshift/configmap-redis_like_config.yml') }}"
- "{{ lookup('template', '{{ project_dir }}/openshift/{{ kv_database }}.yml.j2') }}"
when: with_kv_database
tags:
- kv_database

- name: Deploy fluentd image stream and config
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/fluentd.yml.j2') }}"
tags:
- packit-service
- packit-worker
when: with_fluentd_sidecar

- name: Deploy packit-service
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-service.yml.j2') }}"
tags:
- packit-service

- name: Deploy repository cache PVCs for packit-workers that serves both queues
vars:
component: "packit-worker-{{ item }}"
k8s:
namespace: "{{ sandbox_namespace }}"
definition: "{{ lookup('template', '{{ project_dir }}/openshift/sandcastle-volumes-for-cache.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
loop: "{{ range(0, workers_all_tasks) | list }}"
tags:
- packit-worker
when: workers_all_tasks > 0 and with_repository_cache

- name: Deploy packit-worker to serve both queues
vars:
component: packit-worker
queues: "short-running,long-running"
worker_replicas: "{{ workers_all_tasks }}"
worker_requests_memory: "384Mi"
worker_requests_cpu: "100m"
worker_limits_memory: "1024Mi"
worker_limits_cpu: "400m"
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-worker.yml.j2') }}"
tags:
- packit-worker
when: workers_all_tasks > 0

- name: Deploy packit-worker to serve short-running queue
vars:
component: packit-worker-short-running
queues: "short-running"
worker_replicas: "{{ workers_short_running }}"
# Short-running tasks are just interactions with different services.
# They should not require a lot of memory/cpu.
worker_requests_memory: "320Mi"
worker_requests_cpu: "80m"
worker_limits_memory: "640Mi"
worker_limits_cpu: "700m"
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-worker.yml.j2') }}"
tags:
- packit-worker
when: workers_short_running > 0

- name: Deploy repository cache PVCs for packit-workers that serves long-running queue
vars:
component: "packit-worker-long-running-{{ item }}"
k8s:
namespace: "{{ sandbox_namespace }}"
definition: "{{ lookup('template', '{{ project_dir }}/openshift/sandcastle-volumes-for-cache.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
loop: "{{ range(0, workers_long_running) | list }}"
tags:
- packit-worker
when: workers_long_running > 0 and with_repository_cache

- name: Deploy packit-worker to serve long-running queue
vars:
component: packit-worker-long-running
queues: "long-running"
worker_replicas: "{{ workers_long_running }}"
# cloning repos is memory intensive: glibc needs 300M+, kernel 600M+
# during cloning, we need to account for git and celery worker processes
worker_requests_memory: "768Mi"
worker_requests_cpu: "100m"
worker_limits_memory: "2048Mi"
worker_limits_cpu: "600m"
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-worker.yml.j2') }}"
tags:
- packit-worker
when: workers_long_running > 0

- name: Deploy packit-service-beat
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-service-beat.yml.j2') }}"
when: with_beat
tags:
- packit-service-beat

- name: Deploy dashboard
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/dashboard.yml.j2') }}"
when: with_dashboard
tags:
- dashboard

- name: Create redis-commander secrets
k8s:
namespace: "{{ project }}"
definition: "{{ lookup('template', '{{ project_dir }}/openshift/secret-redis-commander.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
apply: true
tags:
- redis-commander
notify:
- Restart redis-commander deployment
when: with_redis_commander

- name: Deploy redis-commander
vars:
k8s_apply: true
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/redis-commander.yml.j2') }}"
when: with_redis_commander
tags:
- redis-commander
register: redis_commander

- name: Deploy flower
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/flower.yml.j2') }}"
when: with_flower
tags:
- flower

- name: Deploy packit-service-fedmsg
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/packit-service-fedmsg.yml.j2') }}"
tags:
- fedmsg
when: with_fedmsg

- name: Deploy GitHub App Private Key
k8s:
namespace: "{{ project }}"
resource_definition: "{{ lookup('template', '{{ project_dir }}/openshift/github-app-private-key.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
tags:
- tokman
notify:
- Restart tokman deployment
when: with_tokman

- name: Deploy tokman
k8s:
namespace: "{{ project }}"
definition: "{{ lookup('template', '{{ project_dir }}/openshift/tokman.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
tags:
- tokman
register: tokman
when: with_tokman

- name: Deploy aggregating pushgateway
ansible.builtin.include_tasks: tasks/k8s.yml
loop:
- "{{ lookup('template', '{{ project_dir }}/openshift/pushgateway.yml.j2') }}"
tags:
- pushgateway
when: with_pushgateway

- name: Create htpasswd file and deploy it as a secret
tags:
- flower
when: with_flower
block:
- name: Create htpasswd file
htpasswd:
path: "{{ flower_htpasswd_path }}"
name: "flower-boss"
password: "{{ vault.flower.basic_auth | regex_replace('flower-boss:', '') }}"
mode: 0640
- name: Deploy flower-htpasswd secret
# Don't use tasks/k8s.yml here because the loop item is always evaluated
k8s:
namespace: "{{ project }}"
resource_definition: "{{ lookup('template', '{{ project_dir }}/openshift/secret-flower-htpasswd.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
notify:
- Restart nginx deployment

- name: Deploy nginx to reverse proxy the pushgateway and flower
k8s:
namespace: "{{ project }}"
definition: "{{ lookup('template', '{{ project_dir }}/openshift/nginx.yml.j2') }}"
host: "{{ host }}"
api_key: "{{ api_key }}"
validate_certs: "{{ validate_certs }}"
tags:
- pushgateway
register: nginx
when: with_pushgateway and with_flower

- name: Wait for worker-0 to be running
vars:
pod_name: packit-worker-0
ansible.builtin.include_tasks: tasks/wait_for_pod.yml
when: workers_all_tasks > 0

- name: Wait for worker-short-running-0 to be running
vars:
pod_name: packit-worker-short-running-0
ansible.builtin.include_tasks: tasks/wait_for_pod.yml
when: workers_short_running > 0

- name: Wait for worker-long-running-0 to be running
vars:
pod_name: packit-worker-long-running-0
ansible.builtin.include_tasks: tasks/wait_for_pod.yml
when: workers_long_running > 0

- name: Wait for deploymentconfig rollouts to complete
# timeout 15min to not wait indefinitely in case of a problem
ansible.builtin.command: timeout 15m oc rollout status -w deploy/{{ item }}
register: oc_rollout_status
changed_when: false
failed_when: '"successfully rolled out" not in oc_rollout_status.stdout'
loop: "{{ deploymentconfigs }}"

handlers:
- name: Restart redis-commander deployment
ansible.builtin.command: oc rollout restart deploy/redis-commander
# Restart/rollout deployment as a reaction to config change
# when the deployment hasn't been changed itself.
changed_when: false
when: not redis_commander.changed

- name: Restart tokman deployment
ansible.builtin.command: oc rollout restart deploy/tokman
# Restart/rollout deployment as a reaction to config change
# when the deployment hasn't been changed itself.
changed_when: false
when: not tokman.changed

- name: Restart nginx deployment
ansible.builtin.command: oc rollout restart deploy/nginx
# Restart/rollout deployment as a reaction to config change
# when the deployment hasn't been changed itself.
changed_when: false
when: not nginx.changed
roles:
- role: deploy
Loading