Add cifmw_registry_pullsecret role for credential extraction#3754
Add cifmw_registry_pullsecret role for credential extraction#3754mnietoji wants to merge 2 commits intoopenstack-k8s-operators:mainfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
mnietoji
force-pushed
the
edpm_pullsecret_sync
branch
3 times, most recently
from
a206f08 to
7438f4b
Compare
…ures II When metal3-dnsmasq pod restarts during a node's DHCP lease renewal on the provisioning network (172.23.0.0/24), NetworkManager fails to renew and sets ipv4.method=disabled. NMState operator then preserves this disabled state, causing permanent loss of provisioning network connectivity on that node. The issue occurs when OpenStackProvisionServer and metal3 pods run on different nodes. If metal3 restarts while a node is attempting DHCP renewal, the temporary unavailability of metal3-dnsmasq causes the renewal to fail. Solution: Automatically detect the node running metal3 pod (via k8s-app=metal3 label) and configure provisionServerNodeSelector in baremetalSetTemplate to schedule OpenStackProvisionServer on the same node. This ensures provisioning network connectivity is maintained because metal3-static-ip-manager maintains a static IP (172.23.0.3) on the metal3 node regardless of dnsmasq restarts. Signed-off-by: Miguel Angel Nieto Jimenez <mnietoji@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
mnietoji
force-pushed
the
edpm_pullsecret_sync
branch
2 times, most recently
from
9424f79 to
401ed23
Compare
|
|
||
| It extracts credentials from the OpenShift pull-secret in the `openshift-config` namespace and updates the `cifmw_registry_token` variable and optionally the registry token file. | ||
|
|
||
| ### Example configuration in ci-framework-jobs |
There was a problem hiding this comment.
Please just "Example configuration which can be used in the zuul jobs
| ```yaml | ||
| vars: | ||
| cifmw_registry_pullsecret_enabled: true | ||
| cifmw_registry_pullsecret_registry_url: registry.stage.redhat.io |
There was a problem hiding this comment.
please make it generic and not use a specific registry as example
| --- | ||
| # | ||
| # NOTE: Playbook migrated to: roles/cifmw_setup/tasks/deploy_architecture.yml | ||
| # DO NOT EDIT THIS PLAYBOOK. IT WILL BE REMOVED IN NEAR FUTURE. |
There was a problem hiding this comment.
change in this file can be skipped, as it is mentioned in L4.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/3065905edb6646c483c1561923a4af89 ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 14m 46s |
mnietoji
force-pushed
the
edpm_pullsecret_sync
branch
6 times, most recently
from
44f85e5 to
c598c95
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5672d047a97549cb897d3bfe373c0d7f ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 16m 10s |
mnietoji
force-pushed
the
edpm_pullsecret_sync
branch
3 times, most recently
from
12e085d to
fd82ae9
Compare
Extracts registry credentials from OpenShift pull-secret during EDPM deployment. Runs after edpm_prepare, before EDPM nodesets are created. New role updates cifmw_registry_token variable and optionally writes credentials to file. Only executes when cifmw_registry_pullsecret_enabled is true (opt-in, backwards compatible). Configuration: - cifmw_registry_pullsecret_enabled: Enable extraction (default: false) - cifmw_registry_pullsecret_registry_url: Registry URL to extract for Modified roles/cifmw_setup/tasks/deploy_edpm.yml to integrate role. Signed-off-by: Miguel Angel Nieto Jimenez <mnietoji@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
mnietoji
force-pushed
the
edpm_pullsecret_sync
branch
from
fd82ae9 to
942fd36
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/23864d530c7e4edf83c9d001b7966586 ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 09m 11s |
3 participants
Extracts registry credentials from OpenShift pull-secret during EDPM deployment.
Runs after edpm_prepare, before EDPM nodesets are created. Updates cifmw_registry_token variable and optionally writes credentials to file.
Configuration:
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com