This repository was archived by the owner on Sep 9, 2026. It is now read-only.
Conversation
Ansible role and playbooks for automated tenant StorageClass lifecycle. When triggered by the OSAC operator (via AAP), creates tenant-specific StorageClasses cloned from a reference SC with proper labels. Key changes: - New role: osac.service.tenant_storage_provision (create/delete tasks) - Both osac.openshift.io/tenant and osac.openshift.io/storage-tier labels - Multi-tier support via tenant_storage_provision_tiers parameter - Per-tier provisioner/parameter overrides from reference SC - CSP extension point (configure_backend.yaml) for backend-specific setup - Playbooks: playbook_osac_create_tenant_storage.yml / delete - Config-as-code: job templates, inventory, instance group registration - EDA rulebook entries for tenant events - Test suite: 6 test cases (create, idempotency, delete, multi-tier, multi-tier delete, delete-on-empty) Companion PR: osac-project/osac-operator (controller integration) Signed-off-by: Zoltan Szabo <zszabo@redhat.com> Generated-By: Claude Code (Anthropic) Signed-off-by: Zoltan Szabo <zszabo@redhat.com>
Signed-off-by: Zoltan Szabo <zszabo@redhat.com>
Per Avishay's feedback: align with the tenant → organization rename. - AAP template names: osac-create-tenant → osac-create-org, osac-delete-tenant → osac-delete-org - Playbook files: playbook_osac_create_tenant_storage → playbook_osac_create_org_storage - Rulebook entries updated to match Internal role name (tenant_storage_provision) unchanged — the Ansible role operates on Tenant CRs and the internal naming is an implementation detail. Signed-off-by: Zoltan Szabo <zszabo@redhat.com> Assisted-By: Claude Code (Anthropic)
- tenant-operations-ig: new dedicated Jinja template with minimal permissions (SA token + kube API access only, no fulfillment secrets or remote cluster config) - hostpool-operations-ig: fix secret reference from cluster-fulfillment-ig to hostpool-operations-ig for credential isolation Signed-off-by: Zoltan Szabo <zszabo@redhat.com> Assisted-By: Claude Code (Anthropic)
Backends like VAST need to provision resources (tenant project, VIP pool, credentials secret) before the StorageClass can be created, because SC parameters reference those resources. The previous "after" ordering worked for shared Ceph but is wrong for any backend where the SC depends on hook-created resources. The hook now runs after the reference SC is fetched but before the SC creation loop, so it can modify tenant_storage_provision_tiers via set_fact to dynamically set provisioner and parameters. Cleanup ordering (cleanup_backend → delete SCs) is unchanged — the hook needs access to SC objects to discover what to clean up. Signed-off-by: Zoltan Szabo <zszabo@redhat.com> Assisted-By: Claude Code (Anthropic)
Signed-off-by: Zoltan Szabo <zszabo@redhat.com> Assisted-By: Claude Code (Anthropic)
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
…nd CSI setup Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
…dential cleanup Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
CR-002: add failed_when: false to K8s Secret k8s_info task so error handler is reachable
SEC-005: clear vast_storage_admin_secret after credential extraction
CR-005: add warning when OLM available but no CatalogSources found
SEC-001: replace ansible_failed_result|to_json with static string in rescue block
SEC-002+STRUCT-004: restructure VMS provisioning with always: block for credential clearing
SEC-003: add DNS label validation assert for storage tier variable
CR-004: rename storage_provider_* vars to vast_storage_* throughout configure_backend
CR-006: extract _vast_vms_conn dict and reference it in all 5 VMS module calls
PERF-004: track _vast_tenant_created/_vast_vippool_created; rescue attempts rollback
STRUCT-112: compute vast_storage_snapshot_provisioner protocol-aware at runtime
CR-001: replace ignore_errors+retries with failed_when: false and proper until conditions
QA-003: fix chained b64decode|default via data.get('storage_protocol','') pattern
SEC-004: add tenant name DNS label validation at cleanup_backend entry
STRUCT-007: include VSC deletion result in vast_teardown_vast_clean gate
STRUCT-009: delete view policy unconditionally with failed_when for not-found tolerance
CR-003: use consistent default('', true) for STORAGE_PROVIDER_TYPE in cleanup
STRUCT-103+STRUCT-104: document tenant_namespace as play-level var in dispatcher contracts
Signed-off-by: Will Gordon <wgordon@redhat.com>
- Merges duplicate VolumeSnapshotClass provisioner set_fact into the CSI provisioner task in configure_backend.yaml (both set identical values) - Extracts repeated inline VMS connection dict in cleanup_backend.yaml into a single set_fact with no_log, matching configure_backend.yaml pattern; clears it alongside credentials in the final cleanup task Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
|
Skipping CI for Draft Pull Request. |
|
@wgordon17: This pull request references MGMT-23930 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: wgordon17 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
…aring Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
…ase-sensitive provider check Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
…rd compat, and storage provision tests - Replaces VAST_STORAGE_TIERS single env var approach with safe raw-string parsing: _vast_storage_tiers_raw in defaults, from_json in configure_backend with explicit empty-check assert for actionable error messages (finding osac-project#2) - Adds 5 tier validation tasks: non-empty list, SDR-016 type/mapping check, SDR-009 protocol enum, DNS label names, uniqueness, SDR-010 max_tiers guard - Moves credential resolution before CSI install (fail-fast, SDR-001 outer block/always clears 9 credential facts in all exit paths, SDR-017) - Rewrites ensure_csi_operator.yaml for multi-protocol: per-protocol CSIDriver check, _vast_protocols_needing_install derivation, single OLM Subscription (SDR-002 preserved), per-protocol VastCSIDriver CRs, per-protocol wait - Replaces single View/Quota tasks with per-tier loops (no_log, SDR-008); removes non-functional QoS view policy tasks - Adds Jinja2 comprehension _vast_sc_tiers, replace_default additive override, per-tier VolumeSnapshotClass (vast-snapshot-{tenant}-{tier} naming) - Updates tenant config Secret to store storage_tiers JSON (replaces storage_tier, storage_protocol, storage_path, view_policy_name fields) - Adds two-format reader to cleanup_backend: reads storage_tiers JSON if present, falls back to storage_tier/storage_protocol for pre-hardening Secrets; loops View and VSC deletions over tiers (finding osac-project#3) - Adds storage_provision integration test target: single-tier NFS, dual-tier NFS+block with quota, validation failures, replace_default (finding osac-project#1) - Updates configmap sample to VAST_STORAGE_TIERS JSON format - Updates secret-vast-tenant-config-test fixture to new Secret format Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
…ening Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
…removal Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
…gacy fallback Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
…ial clearing Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
…ype default Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
…LM check consistency Signed-off-by: Will Gordon <wgordon@redhat.com> Generated-By: Claude Code (Anthropic)
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
… true, corrects test comment Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Generated-By: Claude Code (Anthropic) Signed-off-by: Will Gordon <wgordon@redhat.com>
Contributor
Author
|
Closed in favor of #296 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary