Openshift-ansible: CentOS Origin repo template for 3.10 is broken

[leoluk]

On a clean CentOS 7 install, with centos-release-openshift-origin39 installed, prerequisites.yaml creates a second repository file at /etc/yum.repos.d/CentOS-OpenShift-Origin.repo in addition to the existing /etc/yum.repos.d/CentOS-OpenShift-Origin39.repo.

The fallback behavior is using the latest upstream repo (CentOS-OpenShift-Origin.repo), which is almost never intended. This should just outright fail vs. doing something unexpected:

https://github.com/openshift/openshift-ansible/blob/169031534be2ac34e35a99214d66f381cbbbbc29/roles/openshift_repos/tasks/centos_repos.yml#L17

[DanyC97]

@leoluk which openshift-ansible release are you using ? i'm interested in the release version - ie openshift-ansible-3.9.47-1 or openshift-ansible-3.10.57-1

[DanyC97]

i also suspect by centos-release-openshift-origin39 you mean the rpm which is in CentOS extras repo, is that correct ?

[leoluk]

i also suspect by centos-release-openshift-origin39 you mean the rpm which is in CentOS extras repo, is that correct ?

Yep.

It's not working with 3.10 either, regardless of whether the CentOS release package is installed.

Inventory config:

openshift_deployment_type: origin
openshift_release: 3.10

Ansible repo at fe0f49ccc745e3f62d1b396b75f10776c475a2fb.

Debug statement added at https://github.com/openshift/openshift-ansible/blob/ade3f09d9e1fa22643fc0b05c9bd9ecc26305791/roles/openshift_repos/tasks/centos_repos.yml#L17:

 - name: Configure correct origin release repository
   template:
     src: "{{ item }}"
     dest: "/etc/yum.repos.d/{{ (item | basename | splitext)[0] }}"
   with_first_found:
     - "CentOS-OpenShift-Origin{{ ((openshift_version | default('')).split('.') | join(''))[0:2] }}.repo.j2"
     - "CentOS-OpenShift-Origin.repo.j2"
   notify: refresh cache

+ - debug: msg="CentOS-OpenShift-Origin{{ ((openshift_version | default('')).split('.') | join(''))[0:2] }}.repo.j2"

TASK [openshift_repos : Configure origin gpg keys] ****************************************************************************
Thursday 01 November 2018  11:22:18 +0100 (0:00:00.098)       0:00:05.335 ***** 
ok: [master01.de-ocp01.nitrado.net]

TASK [openshift_repos : Configure correct origin release repository] **********************************************************
Thursday 01 November 2018  11:22:18 +0100 (0:00:00.303)       0:00:05.638 ***** 
ok: [master01.de-ocp01.nitrado.net] => (item=/opt/openshift/roles/openshift_repos/templates/CentOS-OpenShift-Origin.repo.j2)

It appears openshift_version is undefined in this context. Looks like it's included too late?

[leoluk]

After manually setting openshift_version to "3.10", it templates to CentOS-OpenShift-Origin31.repo.j2, because the result is being truncated to two digits, but 3.10 is three digits.

Safe to say it's broken in 3.10 :-)

Works properly with this quick fix:

  - name: Configure correct origin release repository
    template:
      src: "{{ item }}"
      dest: "/etc/yum.repos.d/{{ (item | basename | splitext)[0] }}"
    with_first_found:
-     - "CentOS-OpenShift-Origin{{ ((openshift_version | default('')).split('.') | join(''))[0:2] }}.repo.j2"
+     - "CentOS-OpenShift-Origin{{ ((openshift_version | default('')).split('.') | join(''))[0:3] }}.repo.j2"
      - "CentOS-OpenShift-Origin.repo.j2"
    notify: refresh cache

[DanyC97]

@leoluk if you look here that is what the Pr tried to do however we reverted back.

Are you planning to send a PR out or should i take care of that with OpenShift developers ?

[eliu]

I noticed this issue as well when trying to deploying openshift origin 3.11 using ansible. it failed because there's no 3.11 rpms within fallback repo CentOS-OpenShift-Origin.repo.j2 and the following script in roles/openshift_repos/tasks/centos_repos.yml will not handle version correctly when the minor version has two digits ( 3.10, 3.11 )
https://github.com/openshift/openshift-ansible/blob/b610dcbae9f0a7d1e9fa10f0c19984dc9f1990fb/roles/openshift_repos/tasks/centos_repos.yml#L22

Therefore, repo template like CentOS-OpenShift-Origin310.repo.j2 will never be used.

[leoluk]

@DanyC97 @michaelgugino Why was it reverted? I suggest something slightly more robust:

CentOS-OpenShift-Origin{{ (openshift_version.split('.')[0:2] | join('')) }}.repo.j2

IMHO, we should remove the fallback and "fail hard" when there's no matching template. We also need to fix the order of execution in the playbook to run the openshift_version role earlier.

[michaelgugino]

@leoluk @DanyC97 correct fix here: https://github.com/openshift/openshift-ansible/pull/10619

[DanyC97]

okay @michaelgugino thanks !. @camabeh beat me on that ;)

[leoluk]

@michaelgugino Are you sure that this is fixed? I tried #10639 and it didn't work.

Debug statement added below "Configure correct origin release repository":

- debug: msg="CentOS-OpenShift-Origin{{ ((openshift_version | default('')).split('.')[0:2] | join('')) }}.repo.j2"

TASK [openshift_repos : debug] *****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************
Thursday 08 November 2018  15:36:23 +0100 (0:00:00.870)       0:00:29.913 ***** 
ok: [oc-dev.marbis.net] => {
    "msg": "CentOS-OpenShift-Origin.repo.j2"
}

$ cat /etc/yum.repos.d/CentOS-OpenShift-Origin.repo:

[centos-openshift-origin]
name=CentOS OpenShift Origin
baseurl=http://mirror.centos.org/centos/7/paas/x86_64/openshift-origin/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-PaaS

[centos-openshift-origin-testing]
name=CentOS OpenShift Origin Testing
baseurl=http://buildlogs.centos.org/centos/7/paas/x86_64/openshift-origin/
enabled=0
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/openshift-ansible-CentOS-SIG-PaaS

[centos-openshift-origin-debuginfo]
name=CentOS OpenShift Origin DebugInfo
baseurl=http://debuginfo.centos.org/centos/7/paas/x86_64/
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/openshift-ansible-CentOS-SIG-PaaS

[centos-openshift-origin-source]
name=CentOS OpenShift Origin Source
baseurl=http://vault.centos.org/centos/7/paas/Source/openshift-origin/
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/openshift-ansible-CentOS-SIG-PaaS

As stated above, it looks like openshift_version is included too late.

[camabeh]

As a workaround, you can specify openshift_version in inventory manually before https://github.com/leoluk/openshift-ansible/commit/df0147f68e05e3d961b4474262bf0365119e0980 is merged.

[michaelgugino]

Yeah, this is a chicken and egg problem as I noted in: https://github.com/openshift/openshift-ansible/pull/10640

Let's just hard-code the version in 3.11, 3.10, and 3.9. No need to fuss with trying to detect it.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[openshift-ci-robot]

@openshift-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.