Skip to content

Commit 08a2b2b

Browse files
mnietojiclaude
mnietoji
and
claude
committed
[multiple] Co-locate provisionserver with metal3 to prevent DHCP failures II
When metal3-dnsmasq pod restarts during a node's DHCP lease renewal on the provisioning network (172.23.0.0/24), NetworkManager fails to renew and sets ipv4.method=disabled. NMState operator then preserves this disabled state, causing permanent loss of provisioning network connectivity on that node. The issue occurs when OpenStackProvisionServer and metal3 pods run on different nodes. If metal3 restarts while a node is attempting DHCP renewal, the temporary unavailability of metal3-dnsmasq causes the renewal to fail. Solution: Automatically detect the node running metal3 pod (via k8s-app=metal3 label) and configure provisionServerNodeSelector in baremetalSetTemplate to schedule OpenStackProvisionServer on the same node. This ensures provisioning network connectivity is maintained because metal3-static-ip-manager maintains a static IP (172.23.0.3) on the metal3 node regardless of dnsmasq restarts. Signed-off-by: Miguel Angel Nieto Jimenez <mnietoji@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent c4bd800 commit 08a2b2b

23 files changed

Lines changed: 599 additions & 0 deletions

File tree

‎playbooks/06-deploy-architecture.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,43 @@
163163
msg: >-
164164
Error detected. Check debugging output above.
165165
166+
- name: Extract registry credentials from OpenShift pull-secret
167+
tags:
168+
- always
169+
when:
170+
- cifmw_sync_pullsecret_credentials | default(true) | bool
171+
block:
172+
- name: Extract credentials for each configured registry
173+
loop: "{{ cifmw_reproducer_registry_list | default(['registry.stage.redhat.io']) }}"
174+
loop_control:
175+
loop_var: registry
176+
ansible.builtin.include_role:
177+
name: edpm_pullsecret_sync
178+
vars:
179+
cifmw_edpm_pullsecret_sync_registry: "{{ registry }}"
180+
cifmw_edpm_pullsecret_sync_fact_name: "cifmw_reproducer_registry_{{ registry | replace('.', '_') | replace('-', '_') }}_creds"
181+
182+
- name: Build registry credentials dictionary for templates
183+
ansible.builtin.set_fact:
184+
cifmw_ci_gen_kustomize_values_registry_logins: >-
185+
{%- set result = {} -%}
186+
{%- for registry in (cifmw_reproducer_registry_list | default(['registry.stage.redhat.io'])) -%}
187+
{%- set fact_name = 'cifmw_reproducer_registry_' + (registry | replace('.', '_') | replace('-', '_')) + '_creds_dict' -%}
188+
{%- if vars[fact_name] is defined -%}
189+
{%- set _ = result.update({registry: vars[fact_name]}) -%}
190+
{%- endif -%}
191+
{%- endfor -%}
192+
{{ result }}
193+
194+
- name: Log extracted registry credentials
195+
ansible.builtin.debug:
196+
msg: "Registry credentials extracted for: {{ cifmw_ci_gen_kustomize_values_registry_logins.keys() | list }}"
197+
198+
rescue:
199+
- name: Log pull-secret extraction failure
200+
ansible.builtin.debug:
201+
msg: "Failed to extract credentials from pull-secret, templates will not include registry credentials"
202+
166203
- name: Set cifmw_architecture_automation_file if not set before
167204
when: cifmw_architecture_automation_file is not defined
168205
ansible.builtin.set_fact:

‎roles/ci_gen_kustomize_values/templates/common/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,28 @@ data:
4343
- "{{ range }}"
4444
{% endfor %}
4545
{% endif %}
46+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
47+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
48+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
49+
{% if _needs_policy_json or _original_bootstrap %}
50+
edpm_bootstrap_command: |
51+
{% if _original_bootstrap %}
52+
{{ _original_bootstrap }}
53+
54+
{% endif %}
55+
{% if _needs_policy_json %}
56+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
57+
{% endif %}
58+
{% endif %}
59+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
60+
edpm_container_registry_logins:
61+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
62+
{{ registry }}:
63+
{% for username, password in creds.items() %}
64+
{{ username }}: {{ password }}
65+
{% endfor %}
66+
{% endfor %}
67+
{% endif %}
4668
nodes:
4769
{% for instance in instances_names %}
4870
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/multi-namespace/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,28 @@ data:
3737
- "{{ range }}"
3838
{% endfor %}
3939
{% endif %}
40+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
41+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
42+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
43+
{% if _needs_policy_json or _original_bootstrap %}
44+
edpm_bootstrap_command: |
45+
{% if _original_bootstrap %}
46+
{{ _original_bootstrap }}
47+
48+
{% endif %}
49+
{% if _needs_policy_json %}
50+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
51+
{% endif %}
52+
{% endif %}
53+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
54+
edpm_container_registry_logins:
55+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
56+
{{ registry }}:
57+
{% for username, password in creds.items() %}
58+
{{ username }}: {{ password }}
59+
{% endfor %}
60+
{% endfor %}
61+
{% endif %}
4062
nodes:
4163
{% for instance in instances_names %}
4264
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/multi-namespace/edpm-nodeset2-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,28 @@ data:
3939
- "{{ range }}"
4040
{% endfor %}
4141
{% endif %}
42+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
43+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
44+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
45+
{% if _needs_policy_json or _original_bootstrap %}
46+
edpm_bootstrap_command: |
47+
{% if _original_bootstrap %}
48+
{{ _original_bootstrap }}
49+
50+
{% endif %}
51+
{% if _needs_policy_json %}
52+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
53+
{% endif %}
54+
{% endif %}
55+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
56+
edpm_container_registry_logins:
57+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
58+
{{ registry }}:
59+
{% for username, password in creds.items() %}
60+
{{ username }}: {{ password }}
61+
{% endfor %}
62+
{% endfor %}
63+
{% endif %}
4264
nodes:
4365
{% for instance in instances_names %}
4466
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/nfv-ovs-dpdk-sriov-hci/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
{% set _original_nodeset = (original_content.data | default({})).nodeset | default({}) %}
55
{% set _original_nodes = _original_nodeset.nodes | default({}) %}
66
{% set _original_services = _original_nodeset['services'] | default([]) %}
7+
{% set _original_baremetal_template = (original_content.data | default({})).baremetalSetTemplate | default({}) %}
78
{% for _inst in cifmw_baremetal_hosts.keys() %}
89
{% set _ = instances_names.append(_inst) %}
910
{% endfor %}
@@ -29,6 +30,28 @@ data:
2930
- "{{ range }}"
3031
{% endfor %}
3132
{% endif %}
33+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
34+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
35+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
36+
{% if _needs_policy_json or _original_bootstrap %}
37+
edpm_bootstrap_command: |
38+
{% if _original_bootstrap %}
39+
{{ _original_bootstrap }}
40+
41+
{% endif %}
42+
{% if _needs_policy_json %}
43+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
44+
{% endif %}
45+
{% endif %}
46+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
47+
edpm_container_registry_logins:
48+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
49+
{{ registry }}:
50+
{% for username, password in creds.items() %}
51+
{{ username }}: {{ password }}
52+
{% endfor %}
53+
{% endfor %}
54+
{% endif %}
3255
nodes:
3356
{% for instance in instances_names %}
3457
edpm-{{ instance }}:
@@ -43,3 +66,11 @@ data:
4366
- "{{ svc }}"
4467
{% endfor %}
4568
{% endif %}
69+
{% if cifmw_kustomize_deploy_metal3_node is defined %}
70+
baremetalSetTemplate:
71+
{% for key, value in _original_baremetal_template.items() %}
72+
{{ key }}: {{ value }}
73+
{% endfor %}
74+
provisionServerNodeSelector:
75+
kubernetes.io/hostname: "{{ cifmw_kustomize_deploy_metal3_node }}"
76+
{% endif %}

‎roles/ci_gen_kustomize_values/templates/nova-three-cells/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,28 @@ data:
4343
- "{{ range }}"
4444
{% endfor %}
4545
{% endif %}
46+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
47+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
48+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
49+
{% if _needs_policy_json or _original_bootstrap %}
50+
edpm_bootstrap_command: |
51+
{% if _original_bootstrap %}
52+
{{ _original_bootstrap }}
53+
54+
{% endif %}
55+
{% if _needs_policy_json %}
56+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
57+
{% endif %}
58+
{% endif %}
59+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
60+
edpm_container_registry_logins:
61+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
62+
{{ registry }}:
63+
{% for username, password in creds.items() %}
64+
{{ username }}: {{ password }}
65+
{% endfor %}
66+
{% endfor %}
67+
{% endif %}
4668
nodes:
4769
{% for instance in nodeset_one_instances %}
4870
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/nova-three-cells/edpm-nodeset2-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,28 @@ data:
4343
- "{{ range }}"
4444
{% endfor %}
4545
{% endif %}
46+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
47+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
48+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
49+
{% if _needs_policy_json or _original_bootstrap %}
50+
edpm_bootstrap_command: |
51+
{% if _original_bootstrap %}
52+
{{ _original_bootstrap }}
53+
54+
{% endif %}
55+
{% if _needs_policy_json %}
56+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
57+
{% endif %}
58+
{% endif %}
59+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
60+
edpm_container_registry_logins:
61+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
62+
{{ registry }}:
63+
{% for username, password in creds.items() %}
64+
{{ username }}: {{ password }}
65+
{% endfor %}
66+
{% endfor %}
67+
{% endif %}
4668
nodes:
4769
{% for instance in nodeset_two_instances %}
4870
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/nova02beta/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,28 @@ data:
4343
- "{{ range }}"
4444
{% endfor %}
4545
{% endif %}
46+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
47+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
48+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
49+
{% if _needs_policy_json or _original_bootstrap %}
50+
edpm_bootstrap_command: |
51+
{% if _original_bootstrap %}
52+
{{ _original_bootstrap }}
53+
54+
{% endif %}
55+
{% if _needs_policy_json %}
56+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
57+
{% endif %}
58+
{% endif %}
59+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
60+
edpm_container_registry_logins:
61+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
62+
{{ registry }}:
63+
{% for username, password in creds.items() %}
64+
{{ username }}: {{ password }}
65+
{% endfor %}
66+
{% endfor %}
67+
{% endif %}
4668
nodes:
4769
{% for instance in nodeset_one_instances %}
4870
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/nova02beta/edpm-nodeset2-values/values.yaml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,28 @@ data:
4343
- "{{ range }}"
4444
{% endfor %}
4545
{% endif %}
46+
{% set _original_ansible_vars = (_original_nodeset.ansible | default({})).ansibleVars | default({}) %}
47+
{% set _original_bootstrap = _original_ansible_vars.edpm_bootstrap_command | default('') %}
48+
{% set _needs_policy_json = cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool and 'policy.json' not in _original_bootstrap %}
49+
{% if _needs_policy_json or _original_bootstrap %}
50+
edpm_bootstrap_command: |
51+
{% if _original_bootstrap %}
52+
{{ _original_bootstrap }}
53+
54+
{% endif %}
55+
{% if _needs_policy_json %}
56+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
57+
{% endif %}
58+
{% endif %}
59+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
60+
edpm_container_registry_logins:
61+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
62+
{{ registry }}:
63+
{% for username, password in creds.items() %}
64+
{{ username }}: {{ password }}
65+
{% endfor %}
66+
{% endfor %}
67+
{% endif %}
4668
nodes:
4769
{% for instance in nodeset_two_instances %}
4870
edpm-{{ instance }}:

‎roles/ci_gen_kustomize_values/templates/nova04delta/edpm-nodeset-values/values.yaml.j2‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,26 @@ data:
3838

3939
# see https://access.redhat.com/solutions/253273
4040
dnf -y install conntrack-tools
41+
{% if cifmw_ci_gen_kustomize_values_add_policy_json | default(true) | bool %}
42+
43+
# Container policy.json
44+
mkdir -p /root/.config/containers/ && echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /root/.config/containers/policy.json
45+
{% endif %}
4146
{% if cifmw_ci_gen_kustomize_values_sshd_ranges | default([]) | length > 0 %}
4247
edpm_sshd_allowed_ranges:
4348
{% for range in cifmw_ci_gen_kustomize_values_sshd_ranges %}
4449
- "{{ range }}"
4550
{% endfor %}
4651
{% endif %}
52+
{% if cifmw_ci_gen_kustomize_values_registry_logins is defined and cifmw_ci_gen_kustomize_values_registry_logins | length > 0 %}
53+
edpm_container_registry_logins:
54+
{% for registry, creds in cifmw_ci_gen_kustomize_values_registry_logins.items() %}
55+
{{ registry }}:
56+
{% for username, password in creds.items() %}
57+
{{ username }}: {{ password }}
58+
{% endfor %}
59+
{% endfor %}
60+
{% endif %}
4761

4862
{% if cifmw_baremetal_hosts | default({}) | length > 0 %}
4963
# source roles/deploy_bmh/template/bmh.yml.j2, but it patches kustomize built outputs

0 commit comments

Comments
 (0)