Add destroy handling to all showroom roles - #71
Merged
Conversation
andrew-jones
force-pushed
the
remove-workload
branch
from
May 20, 2026 02:48
8429348 to
77007e3
Compare
Cover the healthz endpoint (200/503), unknown paths (404), valid admission requests, oversized body rejection (413), malformed JSON fallback to allow, missing UID handling, and exception-in-handler fail-open behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Add all 16 configurable variables from defaults/main.yml to the README, organized into required and optional sections. Add prerequisites (OCP 4.x, kubernetes.core collection) and note that the IngressController patch affects all default-ingress routes. Co-authored-by: Cursor <cursoragent@cursor.com>
andrew-jones
force-pushed
the
remove-workload
branch
from
August 3, 2026 05:37
77007e3 to
e208520
Compare
andrew-jones
changed the title
…estroy no-op
Both roles ran their full provision flow unconditionally, including
when called with ACTION == "destroy". This caused failures that blocked
cluster teardown in dedicated cluster CIs.
Wrap provision tasks in ACTION | default("provision") == "provision"
and add a debug no-op for destroy. The default("provision") preserves
backward compatibility for callers that don't set ACTION.
Ref: GPTEINFRA-16638
Co-authored-by: Cursor <cursoragent@cursor.com>
…ardown - Replace prepare_variables.yaml include with inline user_data lookup that cannot fail (the assert on guid and content_git_repo is only needed during provision, not destroy) - Switch from ignore_errors: true to failed_when: false (cleaner output, consistent with ocp_console_embed destroy) - Add namespace-removal wait loops so destroy confirms namespaces are fully gone before returning - Align retry windows to retries: 30, delay: 10 (300s total) to handle large multi-user deployments Ref: GPTEINFRA-16638 Co-authored-by: Cursor <cursoragent@cursor.com>
andrew-jones
force-pushed
the
remove-workload
branch
from
August 3, 2026 06:54
216a244 to
b426f4b
Compare
The destroy path attempted to cleanly revert IngressController headers, remove the webhook, delete RBAC, and wait for router rollout. In practice the cluster DNS is already torn down by the time this runs, causing a 20-minute retry loop before the job fails. All resources created by this role are cluster-scoped and disappear with the cluster itself — no external state (S3, DNS, etc.) to clean. Replace with a debug no-op. Co-authored-by: Cursor <cursoragent@cursor.com>
andrew-jones
force-pushed
the
remove-workload
branch
from
August 3, 2026 07:19
b426f4b to
aa920ad
Compare
- Add warning when user_data lookup fails (prevents silent namespace orphaning) - Use `| default([])` on k8s_info until conditions to survive API errors - Replace unsafe `is defined` checks with `| default(none) is none` pattern Co-authored-by: Cursor <cursoragent@cursor.com>
Use plain hyphen for CI/log parser compatibility. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds destroy handling to all showroom roles so that
ACTION == "destroy"never causes failures that block cluster teardown.Ref: GPTEINFRA-16638
Changes
ocp4_workload_ocp_console_embed-- destroy no-optasks/main.ymlinto the standardACTION-based dispatcher (provision/destroy)tasks/workload.ymldo_GET(healthz 200/503, unknown path 404) anddo_POST(valid request, oversized body, malformed JSON, missing UID, exception fail-open)ocp4_workload_showroom-- hardened destroyprepare_variables.yamlinclude with inlineagnosticd_user_datalookup that cannot fail (the assert onguidandcontent_git_repois only needed during provision)ignore_errors: truetofailed_when: false(cleaner output, consistent with the embed role)retries: 30, delay: 10(300s total) to handle large multi-user deploymentsvm_workload_showroom-- destroy no-opACTION | default("provision") == "provision"default("provision")preserves backward compatibility for callers that don't set ACTIONocp4_workload_showroom_user_data_seed-- destroy no-opACTION | default("provision") == "provision"Already handled
ocp4_workload_showroomalready had the ACTION dispatch pattern -- this PR hardens itsremove_workload.ymlas described above.