os_images changes (#20)

* changes

* Apply suggestions from code review

Co-authored-by: Mark Goddard <[email protected]>

* remove galaxy_info

* linting fixes

* Update roles/os_images/tasks/promote.yml

Co-authored-by: Matt Crees <[email protected]>

* Update README.md

* readability

* readability

* Update roles/os_images/README.md

Co-authored-by: Matt Crees <[email protected]>

* allow images to be retired separately

* linting fix

* openstack_images has changed to images

* still run for only retire

* change display info:

* Update roles/os_images/defaults/main.yml

Co-authored-by: Mark Goddard <[email protected]>

* remove visibility default redundancy

---------

Co-authored-by: Mark Goddard <[email protected]>
Co-authored-by: Matt Crees <[email protected]>

Author: 3 people

roles/os_images/README.md

@@ -66,8 +66,11 @@ mutually exclusive where each contain:
   be built (even if an existing image that name has been built before). The images on glance
   will be replaced if `os_images_upload` is set to `True`. This defaults to
   `os_images_force_rebuild`if left unset.
-* `is_public`: (optional) whether the image should be set as visible to all
-  projects or kept private.
+* `is_public`: (optional) (deprecated - use `visibility`) whether the image should be set as visible to all
+  projects or kept private. Note that if both `is_public` and `visibility` are provided, `is_public` will 
+  be preferred.
+* `visibility`: (optional) Allowed values are 'public', 'private', 'shared'
+or 'community'. Default is 'public'
 * `owner`: (optional) ID of the project that should own the uploaded image.
 
 `os_images_common`: A set of elements to include in every image listed.
@@ -97,13 +100,17 @@ following parameters:
 will be replaced with the newly built image if `os_images_upload` is set to `True`. Defaults to
 `False`.
 
-`os_images_public`: Whether uploaded images are public. Defaults to `True` - note this requires admin permissions.
+`os_images_public`: (Deprecated - use `os_images_visibility`) Whether uploaded images are public. Defaults to `True` - note this requires admin permissions. 
+
+`os_images_visibility`: The visibility of images uploaded. One of `community`,`public` or `private`. If unset, defaults to `os_images_public` (requires admin permissions for anything other than `private`)
 
 `os_images_venv`: Path to virtualenv in which to install python dependencies to upload images.
 
 `os_images_dib_venv`: Path to virtualenv in which to install DIB to build images.
 
-`os_images_promote`: Whether or not to retire old and promote new images. Defaults to `False`.
+`os_images_promote`: Whether or not to promote new images. Defaults to `False`.
+
+`os_images_retire`: Whether or not to retire old images. Defaults to `os_image_promote`. May be necessary to set separately if you are promoting a new candidate image for which there is no existing one to retire, for example. 
 
 `os_images_build`: Whether or not to build the images.
 

roles/os_images/defaults/main.yml

@@ -9,9 +9,6 @@ os_images_dib_venv: "{{ os_images_venv }}"
 # State of python dependencies.
 os_images_package_state: present
 
-# Upper constraints file for installation of python dependencies to upload
-# images.
-#
 # Use Antelope upper constraints as openstacksdk 1.0.1 and openstackclient 6.2.0 are required
 os_images_upper_constraints_file: https://releases.openstack.org/constraints/upper/2023.1
 
@@ -85,13 +82,20 @@ os_images_force_rebuild: false
 # Whether images should be public (requires admin rights)
 os_images_public: true
 
-# Whether or not should old images be retired and new images be promoted
+# Whether or not should new images be promoted
 os_images_promote: false
 
+# Whether or not should old images be retired
+os_images_retire: "{{ os_images_promote }}"
+
 # Whether or not to build the images
 os_images_build: true
 
 # Image suffix which would be removed during image promotion for exmple: -rc, -dev, -test
 os_images_name_suffix:
+
 # Whether or not to hide the images in Glance list
 os_images_hide: false
+
+# Visibility of images ('public' requires admin rights.)
+os_images_visibility: "{{ 'public' if os_images_public | bool else 'private' }}"

roles/os_images/tasks/images.yml

@@ -10,7 +10,7 @@
 # The rpm-distro element executes 'semanage' during its cleanup phase.
 - name: Ensure diskimage-builder SELinux dependencies are installed
   vars:
-    package_name: "python3-policycoreutils"
+    package_name: python3-policycoreutils
   ansible.builtin.package:
     name: "{{ package_name }}"
     state: present

roles/os_images/tasks/main.yml

@@ -17,4 +17,8 @@
   ansible.builtin.import_tasks: promote.yml
   vars:
     ansible_python_interpreter: "{{ os_images_venv ~ '/bin/python' if os_images_venv != None else old_ansible_python_interpreter }}"
-  when: os_images_promote | bool
+  when: >
+    ((os_images_list | selectattr('rename_image', 'defined')) + (os_images_list | selectattr('hide_image', 'defined'))) | list | length > 0
+    or (os_images_promote | bool)
+    or (os_images_retire | bool)
+    or (os_images_hide | bool)

roles/os_images/tasks/promote.yml

@@ -4,58 +4,64 @@
     msg: os_images_name_suffix is empty please provide it.
   when: os_images_name_suffix is defined and os_images_name_suffix | length == 0
 
-- name: Gather retire candidates info
+- name: Gather candidates info
   openstack.cloud.image_info:
     auth_type: "{{ os_images_auth_type }}"
     auth: "{{ os_images_auth }}"
     cacert: "{{ os_images_cacert | default(omit) }}"
     interface: "{{ os_images_interface | default(omit, true) }}"
     region_name: "{{ os_images_region | default(omit) }}"
-  register: retire_list
-  when: item.rename_image | default(os_images_promote) | bool
+  register: retire_or_promote_list
+  when: >
+    (os_images_list | selectattr('rename_image', 'defined') | list | length > 0)
+    or (os_images_promote | bool)
+    or (os_images_retire | bool)
 
 - name: Ensure images for retirement exist
   ansible.builtin.assert:
     that:
-      - item.name in retire_list.openstack_images | map(attribute='name') | list
+      - promotion_name in retire_or_promote_list.images | map(attribute='name') | list
     fail_msg: "The image {{ item.name[: -(os_images_name_suffix | length | int)] }} does not exist."
+  vars:
+    promotion_name: "{{ item.name[: -(os_images_name_suffix | length | int)] }}"
   loop: "{{ os_images_list | list }}"
-  when: item.rename_image | default(os_images_promote) | bool
-
-- name: Gather promote candidates info
-  openstack.cloud.image_info:
-    auth_type: "{{ os_images_auth_type }}"
-    auth: "{{ os_images_auth }}"
-    cacert: "{{ os_images_cacert | default(omit) }}"
-    interface: "{{ os_images_interface | default(omit, true) }}"
-    region_name: "{{ os_images_region | default(omit) }}"
-  register: promote_list
-  when: item.rename_image | default(os_images_promote) | bool
+  when: item.rename_image | default(os_images_retire) | bool
 
 - name: Ensure images for promotion exist
   ansible.builtin.assert:
     that:
-      - item.name in promote_list.images | map(attribute='name') | list
+      - item.name in retire_or_promote_list.images | map(attribute='name') | list
     fail_msg: The image {{ item.name }} does not exist.
   loop: "{{ os_images_list | list }}"
   when: item.rename_image | default(os_images_promote) | bool
 
+- name: Check if image suffix is provided
+  ansible.builtin.set_fact:
+    image_suffix_provided: "{{ os_images_name_suffix is defined and os_images_name_suffix is not none and (os_images_name_suffix | length > 0) }}"
+
+- name: Display info
+  ansible.builtin.debug:
+    msg: |
+      Warning: no image suffix is provided so retired images are not renamed and candidate images are not promoted.
+      Images with the `hide_image` attribute will still be hidden.
+  when: not (image_suffix_provided | bool)
+
 - name: Hide retire candidate images
   ansible.builtin.command: "{{ os_images_venv }}/bin/openstack image set --hidden {{ promotion_name }}"
   vars:
-    promotion_name: "{{ item.name[: -(os_images_name_suffix | length | int)] }}"
+    promotion_name: "{{ item.name[: -(os_images_name_suffix | length | int)] if image_suffix_provided else item.name }}"
   with_items: "{{ os_images_list | list }}"
   changed_when: true
-  when: (item.rename_image | default(os_images_promote) | bool) and (item.hide_image | default(os_images_hide) | bool)
+  when: (item.hide_image | default(os_images_hide) | bool)
 
 - name: Ensure old images are retired
   ansible.builtin.command: "{{ os_images_venv }}/bin/openstack image set {{ promotion_name }} --name {{ promotion_name }}.{{ date_suffix }}"
   vars:
     date_suffix: "{{ ansible_date_time.date }}"
     promotion_name: "{{ item.name[: -(os_images_name_suffix | length | int)] }}"
   loop: "{{ os_images_list | list }}"
-  when: item.rename_image | default(os_images_promote) | bool
   changed_when: true
+  when: image_suffix_provided and (item.rename_image | default(os_images_retire) | bool)
   environment: "{{ os_images_venv }}"
 
 - name: Ensure new images are promoted
@@ -64,5 +70,37 @@
     promotion_name: "{{ item.name[: -(os_images_name_suffix | length | int)] }}"
   loop: "{{ os_images_list | list }}"
   changed_when: true
-  when: item.rename_image | default(os_images_promote) | bool
+  when: image_suffix_provided and (item.rename_image | default(os_images_promote) | bool)
   environment: "{{ os_images_venv }}"
+
+- name: Discover retired images
+  ansible.builtin.set_fact:
+    retire_message: |
+      The following images have been retired:
+      {% for item in images %}
+      {{ item.name[: -(os_images_name_suffix | length | int)] }} > {{ item.name[: -(os_images_name_suffix | length | int)] }}.{{ ansible_date_time.date }}
+      {% endfor %}
+  vars:
+    images: "{{ os_images_list | list }}"
+  when: image_suffix_provided and (item.rename_image | default(os_images_retire) | bool)
+
+- name: Display info
+  ansible.builtin.debug:
+    var: retire_message
+  when: image_suffix_provided and (item.rename_image | default(os_images_retire) | bool)
+
+- name: Discover promoted images
+  ansible.builtin.set_fact:
+    promote_message: |
+      The following images have been promoted:
+      {% for item in images %}
+      {{ item.name }} > {{ item.name[: -(os_images_name_suffix | length | int)] }}
+      {% endfor %}
+  vars:
+    images: "{{ os_images_list | list }}"
+  when: image_suffix_provided and (item.rename_image | default(os_images_promote) | bool)
+
+- name: Display info
+  ansible.builtin.debug:
+    var: promote_message
+  when: image_suffix_provided and (item.rename_image | default(os_images_promote) | bool)

roles/os_images/tasks/upload.yml

@@ -26,11 +26,13 @@
     region_name: "{{ os_images_region | default(omit) }}"
     name: "{{ item.name ~ '-kernel' }}"
     state: present
-    is_public: "{{ item.is_public | default(os_images_public) | bool }}"
+    visibility: "{{ visibility }}"
     container_format: aki
     disk_format: aki
     filename: "{{ os_images_cache }}/{{ item.name }}/{{ item.name }}.vmlinuz"
   with_items: "{{ os_images_list | list }}"
+  vars:
+    visibility: "{{ item.visibility | default(item.is_public | ternary('public', 'private') if item.is_public is defined else os_images_visibility) }}"
   loop_control:
     label: "{{ item.name }}"
   when:
@@ -65,11 +67,13 @@
     region_name: "{{ os_images_region | default(omit) }}"
     name: "{{ item.name ~ '-ramdisk' }}"
     state: present
-    is_public: "{{ item.is_public | default(os_images_public) | bool }}"
+    visibility: "{{ visibility }}"
     container_format: ari
     disk_format: ari
     filename: "{{ os_images_cache }}/{{ item.name }}/{{ item.name }}.initrd"
   with_items: "{{ os_images_list | list }}"
+  vars:
+    visibility: "{{ item.visibility | default(item.is_public | ternary('public', 'private') if item.is_public is defined else os_images_visibility) }}"
   loop_control:
     label: "{{ item.name }}"
   when:
@@ -101,7 +105,7 @@
     region_name: "{{ os_images_region | default(omit) }}"
     name: "{{ item.0.name }}"
     state: present
-    is_public: "{{ item.0.is_public | default(os_images_public) | bool }}"
+    visibility: "{{ visibility }}"
     owner: "{{ item.0.owner | default(omit) }}"
     container_format: bare
     disk_format: "{{ item.0.type | default('qcow2') }}"
@@ -111,6 +115,7 @@
     ramdisk: "{{ item.2.id if is_baremetal else omit }}"
   vars:
     is_baremetal: "{{ item.0.elements is defined and 'baremetal' in item.0.elements }}"
+    visibility: "{{ item.0.visibility | default(item.0.is_public | ternary('public', 'private') if item.0.is_public is defined else os_images_visibility) }}"
   with_together:
     - "{{ os_images_list | list }}"
     - "{{ kernel_result.results }}"