From 484803a4c0006aa3e2b03aeac6dd8ca8c1d44270 Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Thu, 2 Jul 2026 21:27:40 +0200 Subject: [PATCH 1/3] Improve the vault pod check The "Check if the vault pod is present" task (line 19-34) only checks that the Pod resource exists, not that the container is actually running. When the vault container is still in ContainerCreating, the subsequent k8s_exec crashes with a Python ValueError in the k8s_exec module (not a normal ansible failure), which prevents the until retry loop from working. The issue was seen while testing the UI in the secret injection pod Tested on mcg --- roles/vault_utils/tasks/vault_status.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/roles/vault_utils/tasks/vault_status.yaml b/roles/vault_utils/tasks/vault_status.yaml index 5c70563..7e924ad 100644 --- a/roles/vault_utils/tasks/vault_status.yaml +++ b/roles/vault_utils/tasks/vault_status.yaml @@ -16,7 +16,7 @@ vault_ns_rc is not defined or 'resources' not in vault_ns_rc -- name: Check if the vault pod is present +- name: Check if the vault pod is present and running kubernetes.core.k8s_info: kind: Pod namespace: "{{ vault_ns }}" @@ -26,7 +26,10 @@ vault_pod_rc is defined and 'resources' in vault_pod_rc and vault_pod_rc.resources is defined and - vault_pod_rc.resources | length > 0 + vault_pod_rc.resources | length > 0 and + vault_pod_rc.resources[0].status.containerStatuses is defined and + vault_pod_rc.resources[0].status.containerStatuses | length > 0 and + vault_pod_rc.resources[0].status.containerStatuses[0].started | default(false) retries: 20 delay: 45 failed_when: >- From c740beb7e93f776a9ef8b9da4d9eb2310135ae3d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 09:43:02 +0000 Subject: [PATCH 2/3] Bump actions/setup-python from 6.2.0 to 6.3.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ansible-lint.yml | 2 +- .github/workflows/ansible-sanitytest.yml | 2 +- .github/workflows/ansible-unittest.yml | 2 +- .github/workflows/jsonschema.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index 3d9fd32..72b4f82 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -18,7 +18,7 @@ jobs: # ansible-core; ansible-galaxy collection install then hits Galaxy KeyError: 'results' # on some 2.19+/2.20 clients. Pin ansible-core to the 2.18 series for a stable Galaxy client. - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" diff --git a/.github/workflows/ansible-sanitytest.yml b/.github/workflows/ansible-sanitytest.yml index 178ec14..fafcc94 100644 --- a/.github/workflows/ansible-sanitytest.yml +++ b/.github/workflows/ansible-sanitytest.yml @@ -22,7 +22,7 @@ jobs: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/ansible-unittest.yml b/.github/workflows/ansible-unittest.yml index 802d128..6e02cae 100644 --- a/.github/workflows/ansible-unittest.yml +++ b/.github/workflows/ansible-unittest.yml @@ -22,7 +22,7 @@ jobs: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/jsonschema.yaml b/.github/workflows/jsonschema.yaml index 2f520ab..d272797 100644 --- a/.github/workflows/jsonschema.yaml +++ b/.github/workflows/jsonschema.yaml @@ -20,7 +20,7 @@ jobs: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} From c8c1d891ae6a0087c0318edf1789930817dfc21b Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Tue, 7 Jul 2026 12:05:13 +0200 Subject: [PATCH 3/3] Add support for .main.variant and TARGET_VARIANT Now that the pattern-operator supports "variant" in place of clusterGroupName we need to add support here as well. Tested as follows: 1. Deployment with .main.clusterGroupName set in values-global.yaml -> OK 1. Deployment with .main.clusterGroupName and .main.variant set in values-global.yaml -> Error (expected) 1. Deployment with .main.variant set in values-global.yaml -> OK 1. Deployed with TARGET_CLUSTERGROUPNAME env set -> OK 1. Deployed with TARGET_VARIANT env set (this requires a patch to pattern.sh) -> OK 1. Deployed with both TARGET_CLUSTERGROUPNAME and TARGET_VARIANT -> Error (expected) --- roles/install_settings/tasks/main.yml | 5 +-- .../tasks/resolve_overrides.yml | 33 +++++++++++++++++-- roles/pattern_settings/tasks/main.yml | 20 +++++++---- roles/validate_prereq/tasks/main.yml | 4 +-- 4 files changed, 49 insertions(+), 13 deletions(-) diff --git a/roles/install_settings/tasks/main.yml b/roles/install_settings/tasks/main.yml index ba396fc..306f3a9 100644 --- a/roles/install_settings/tasks/main.yml +++ b/roles/install_settings/tasks/main.yml @@ -44,8 +44,9 @@ ansible.builtin.set_fact: clustergroup_opt: >- {{ - "" if (target_clustergroup | default("") | trim == "") - else "--set main.clusterGroupName=%s" | format(target_clustergroup) + "--set main.clusterGroupName=%s --set main.variant=null" | format(target_variant) if (_target_clustergroup_override | default("") | trim != "") + else "--set main.variant=%s --set main.clusterGroupName=null" | format(target_variant) if (_target_variant_override | default("") | trim != "") + else "" }} - name: Build include_crds_opt diff --git a/roles/install_settings/tasks/resolve_overrides.yml b/roles/install_settings/tasks/resolve_overrides.yml index baffecb..c67d31b 100644 --- a/roles/install_settings/tasks/resolve_overrides.yml +++ b/roles/install_settings/tasks/resolve_overrides.yml @@ -77,16 +77,43 @@ Alternatively, pass the remote explicitly via the 'target_origin' variable or 'TARGET_ORIGIN' environment variable. -- name: Resolve target_clustergroup +- name: Resolve TARGET_CLUSTERGROUP override ansible.builtin.set_fact: - target_clustergroup: >- + _target_clustergroup_override: >- {{ target_clustergroup | default(lookup("env", "TARGET_CLUSTERGROUP"), true) - | default(main_clustergroup, true) + | default("", true) | trim }} +- name: Resolve TARGET_VARIANT override + ansible.builtin.set_fact: + _target_variant_override: >- + {{ + target_variant + | default(lookup("env", "TARGET_VARIANT"), true) + | default("", false) + | trim + }} + +- name: Ensure TARGET_CLUSTERGROUP and TARGET_VARIANT are not both set + ansible.builtin.assert: + that: _target_clustergroup_override == "" or _target_variant_override == "" + fail_msg: | + Both target_clustergroup/TARGET_CLUSTERGROUP and target_variant/TARGET_VARIANT are set. + Please use only one of these to specify the cluster group name. + +- name: Resolve target_variant + ansible.builtin.set_fact: + target_variant: >- + {{ + (_target_clustergroup_override if _target_clustergroup_override != "" + else _target_variant_override if _target_variant_override != "" + else main_variant) + | trim + }} + - name: Resolve token_secret ansible.builtin.set_fact: token_secret: >- diff --git a/roles/pattern_settings/tasks/main.yml b/roles/pattern_settings/tasks/main.yml index 211d51d..941f2c9 100644 --- a/roles/pattern_settings/tasks/main.yml +++ b/roles/pattern_settings/tasks/main.yml @@ -22,13 +22,21 @@ | default((values_global.global.pattern | string | trim), true) }} -- name: Ensure main.clusterGroupName is set +- name: Set helper booleans for main.clusterGroupName and main.variant + ansible.builtin.set_fact: + _has_clustergroupname: "{{ (values_global.main.clusterGroupName | default('') | string | trim) != '' }}" + _has_variant: "{{ (values_global.main.variant | default('') | string | trim) != '' }}" + +- name: Ensure exactly one of main.clusterGroupName or main.variant is set ansible.builtin.assert: - that: (values_global.main.clusterGroupName | default('') | string | trim) != "" + that: + - _has_clustergroupname or _has_variant + - not (_has_clustergroupname and _has_variant) fail_msg: | - values-global.yaml does not define .main.clusterGroupName. - Please set a value for clusterGroupName under the 'main' key. + values-global.yaml must define exactly one of .main.clusterGroupName or .main.variant (not both). + Please set one of these values under the 'main' key. -- name: Set fact for main clustergroup +- name: Set fact for main variant ansible.builtin.set_fact: - main_clustergroup: "{{ values_global.main.clusterGroupName | string | trim }}" + main_variant: >- + {{ (values_global.main.clusterGroupName if _has_clustergroupname else values_global.main.variant) | string | trim }} diff --git a/roles/validate_prereq/tasks/main.yml b/roles/validate_prereq/tasks/main.yml index 255ded6..0f4a09d 100644 --- a/roles/validate_prereq/tasks/main.yml +++ b/roles/validate_prereq/tasks/main.yml @@ -7,7 +7,7 @@ - name: Get length of target clustergroup ansible.builtin.set_fact: - _clustergroup_name_len: "{{ target_clustergroup | length }}" + _clustergroup_name_len: "{{ target_variant | length }}" - name: Ensure ArgoCD will have valid DNS hostname based on pattern name and clustergroup lengths ansible.builtin.assert: @@ -17,7 +17,7 @@ -> {%raw%}{{ .Values.clusterGroup.name }}-gitops-server-{{ .Values.global.pattern }}-{{ .Values.clusterGroup.name }}{%endraw%} To stay under the 63-character DNS limit, the variable part of the name must be less than 47 characters: (2 * length of 'clusterGroup.name') + length of 'global.pattern' < 47 - With your current values this DNS part is '{{ target_clustergroup }}-gitops-server-{{ pattern_name }}-{{ target_clustergroup }}' and exceeds the 63 character limit. + With your current values this DNS part is '{{ target_variant }}-gitops-server-{{ pattern_name }}-{{ target_variant }}' and exceeds the 63 character limit. - name: Ensure kubernetes python module is installed ansible.builtin.pip: