Merge pull request #3261 from sdodson/excluder

Manage the excluder functionality

playbooks/byo/openshift-cluster/upgrades/v3_3/upgrade.yml

@@ -46,6 +46,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_3/upgrade_control_plane.yml

@@ -51,6 +51,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_3/upgrade_nodes.yml

@@ -47,6 +47,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_4/upgrade.yml

@@ -46,6 +46,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_4/upgrade_control_plane.yml

@@ -51,6 +51,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_4/upgrade_nodes.yml

@@ -47,6 +47,10 @@
   tags:
   - pre_upgrade
 
+- include: ../disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_5/upgrade.yml

@@ -46,6 +46,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_5/upgrade_control_plane.yml

@@ -51,6 +51,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/byo/openshift-cluster/upgrades/v3_5/upgrade_nodes.yml

@@ -47,6 +47,10 @@
   tags:
   - pre_upgrade
 
+- include: ../../../../common/openshift-cluster/disable_excluder.yml
+  tags:
+  - pre_upgrade
+
 - include: ../../../../common/openshift-cluster/initialize_openshift_version.yml
   tags:
   - pre_upgrade

playbooks/common/openshift-cluster/config.yml

@@ -26,6 +26,10 @@
       openshift_docker_selinux_enabled: "{{ lookup('oo_option', 'docker_selinux_enabled') }}"
     when: openshift_docker_selinux_enabled is not defined
 
+- include: disable_excluder.yml
+  tags:
+  - always
+
 - include: ../openshift-etcd/config.yml
   tags:
   - etcd

playbooks/common/openshift-cluster/disable_excluder.yml

@@ -0,0 +1,11 @@
+---
+- name: Record excluder state and disable
+  hosts: l_oo_all_hosts
+  gather_facts: no
+  tasks:
+  - include_role:
+      name: openshift_excluder
+      tasks_from: status
+  - include_role:
+      name: openshift_excluder
+      tasks_from: unexclude

playbooks/common/openshift-cluster/reset_excluder.yml

@@ -0,0 +1,8 @@
+---
+- name: Re-enable excluder if it was previously enabled
+  hosts: l_oo_all_hosts
+  gather_facts: no
+  tasks:
+  - include_role:
+      name: openshift_excluder
+      tasks_from: reset

playbooks/common/openshift-cluster/upgrades/post_control_plane.yml

@@ -80,3 +80,7 @@
   - name: Warn if pluginOrderOverride is in use in master-config.yaml
     debug: msg="WARNING pluginOrderOverride is being deprecated in master-config.yaml, please see https://docs.openshift.com/enterprise/latest/architecture/additional_concepts/admission_controllers.html for more information."
     when: not grep_plugin_order_override | skipped and grep_plugin_order_override.rc == 0
+
+- include: ../reset_excluder.yml
+  tags:
+  - always

playbooks/common/openshift-cluster/upgrades/upgrade_nodes.yml

@@ -51,3 +51,7 @@
     until: node_sched.rc == 0
     retries: 3
     delay: 1
+
+- include: ../reset_excluder.yml
+  tags:
+  - always

roles/openshift_excluder/README.md

@@ -0,0 +1,44 @@
+OpenShift Excluder
+================
+
+Manages the excluder packages which add yum and dnf exclusions ensuring that
+the packages we care about are not inadvertantly updated. See
+https://github.com/openshift/origin/tree/master/contrib/excluder
+
+Requirements
+------------
+openshift_facts
+
+
+Facts
+-----
+
+| Name                       | Default Value | Description                            |
+-----------------------------|---------------|----------------------------------------|
+| docker_excluder_enabled | none          | Records the status of docker excluder |
+| openshift_excluder_enabled | none | Records the status of the openshift excluder |
+
+Role Variables
+--------------
+None
+
+Dependencies
+------------
+
+Example Playbook
+----------------
+
+
+TODO
+----
+It should be possible to manage the two excluders independently though that's not a hard requirement. However it should be done to manage docker on RHEL Containerized hosts.
+
+License
+-------
+
+Apache License, Version 2.0
+
+Author Information
+------------------
+
+Scott Dodson (sdodson@redhat.com)

roles/openshift_excluder/meta/main.yml

@@ -0,0 +1,15 @@
+---
+galaxy_info:
+  author: Scott Dodson
+  description: OpenShift Examples
+  company: Red Hat, Inc.
+  license: Apache License, Version 2.0
+  min_ansible_version: 2.2
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+dependencies:
+- { role: openshift_facts }

roles/openshift_excluder/tasks/exclude.yml

@@ -0,0 +1,11 @@
+---
+- include: install.yml
+  when: not openshift.common.is_containerized | bool
+
+- name: Enable docker excluder
+  command: "{{ openshift.common.service_type }}-docker-excluder exclude"
+  when: not openshift.common.is_containerized | bool
+
+- name: Enable excluder
+  command: "{{ openshift.common.service_type }}-excluder exclude"
+  when: not openshift.common.is_containerized | bool

roles/openshift_excluder/tasks/install.yml

@@ -0,0 +1,16 @@
+---
+- name: Install latest excluder
+  package:
+    name: "{{ openshift.common.service_type }}-excluder"
+    state: latest
+  when:
+  - openshift_excluder_enabled | default(false) | bool
+  - not openshift.common.is_containerized | bool
+
+- name: Install latest docker excluder
+  package:
+    name: "{{ openshift.common.service_type }}-excluder"
+    state: latest
+  when:
+  - docker_excluder_enabled | default(false) | bool
+  - not openshift.common.is_containerized | bool

roles/openshift_excluder/tasks/main.yml

@@ -0,0 +1,2 @@
+---
+include: status.yml

roles/openshift_excluder/tasks/reset.yml

@@ -0,0 +1,12 @@
+---
+- name: Enable docker excluder
+  command: "{{ openshift.common.service_type }}-docker-excluder exclude"
+  when:
+  - docker_excluder_enabled | default(false) | bool
+  - not openshift.common.is_containerized | bool
+
+- name: Enable excluder
+  command: "{{ openshift.common.service_type }}-excluder exclude"
+  when:
+  - openshift_excluder_enabled | default(false) | bool
+  - not openshift.common.is_containerized | bool

roles/openshift_excluder/tasks/status.yml

@@ -0,0 +1,56 @@
+---
+# Latest versions of the excluders include a status function, old packages dont
+# So, if packages are installed, upgrade them to the latest so we get the status
+# If they're not installed when we should assume they're disabled
+
+- name: Determine if excluder packages are installed
+  rpm_q:
+    name: "{{ openshift.common.service_type }}-excluder"
+    state: present
+  register: openshift_excluder_installed
+  failed_when: false
+
+- name: Determine if docker packages are installed
+  rpm_q:
+    name: "{{ openshift.common.service_type }}-excluder"
+    state: present
+  register: docker_excluder_installed
+  failed_when: false
+
+- name: Update to latest excluder packages
+  package:
+    name: "{{ openshift.common.service_type }}-excluder"
+  when:
+  - "{{ openshift_excluder_installed.installed_versions | default([]) | length > 0 }}"
+  - not openshift.common.is_containerized | bool
+
+- name: Update to the latest docker-excluder packages
+  package:
+    name: "{{ openshift.common.service_type }}-docker-excluder"
+  when:
+  - "{{ docker_excluder_installed.installed_versions | default([]) | length > 0 }}"
+  - not openshift.common.is_containerized | bool
+
+- name: Record excluder status
+  command: "{{ openshift.common.service_type }}-excluder"
+  register: excluder_status
+  when:
+  - "{{ openshift_excluder_installed.installed_versions | default([]) | length > 0 }}"
+  - not openshift.common.is_containerized | bool
+  failed_when: false
+
+- name: Record docker excluder status
+  command: "{{ openshift.common.service_type }}-docker-excluder"
+  register: docker_excluder_status
+  when:
+  - "{{ docker_excluder_installed.installed_versions | default([]) | length > 0 }}"
+  - not openshift.common.is_containerized | bool
+  failed_when: false
+
+- name: Set excluder status facts
+  set_fact:
+    docker_excluder_enabled: "{{ 'false' if docker_excluder_status.rc | default(0) == 0 or docker_excluder_installed.installed_versions | default(0) | length == 0 else 'true' }}"
+    openshift_excluder_enabled: "{{ 'false' if docker_excluder_status.rc | default(0) == 0 or openshift_excluder_installed.installed_versions | default(0) | length == 0 else 'true' }}"
+
+- debug: var=docker_excluder_enabled
+- debug: var=openshift_excluder_enabled

roles/openshift_excluder/tasks/unexclude.yml

@@ -0,0 +1,12 @@
+---
+- name: disable docker excluder
+  command: "{{ openshift.common.service_type }}-docker-excluder unexclude"
+  when:
+  - docker_excluder_enabled | bool
+  - not openshift.common.is_containerized | bool
+
+- name: disable excluder
+  command: "{{ openshift.common.service_type }}-excluder unexclude"
+  when:
+  - openshift_excluder_enabled | bool
+  - not openshift.common.is_containerized | bool