Merge pull request #7022 from vrutkovs/sanitize-labels

Automatic merge from submit-queue.

Verify that requested services have schedulable nodes matching the selectors

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1538445

Not sure if I should keep one task per failure or should group them by service (e.g. all logging check in one tasks)

1 files changed, 167 insertions, 160 deletions

diff --git a/roles/openshift_logging_elasticsearch/tasks/main.yaml b/roles/openshift_logging_elasticsearch/tasks/main.yaml
index 9db67ea9b..64e5a3a1f 100644
--- a/roles/openshift_logging_elasticsearch/tasks/main.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/main.yaml
@@ -1,4 +1,11 @@
 ---
+- name: Ensure that ElasticSearch has nodes to run on
+  fail:
+    msg: |-
+      No schedulable nodes found matching node selector for Elasticsearch - '{{ openshift_logging_es_nodeselector }}'
+  when:
+  - openshift_schedulable_node_labels | lib_utils_oo_has_no_matching_selector(openshift_logging_es_nodeselector)
+
 - name: Validate Elasticsearch cluster size
   fail: msg="The openshift_logging_es_cluster_size may only be scaled down manually. Please see official documentation on how to do this."
   when: openshift_logging_facts.elasticsearch.deploymentconfigs | length > openshift_logging_es_cluster_size|int
@@ -18,8 +25,8 @@
 - name: Set default image variables based on openshift_deployment_type
   include_vars: "{{ var_file_name }}"
   with_first_found:
-    - "{{ openshift_deployment_type }}.yml"
-    - "default_images.yml"
+  - "{{ openshift_deployment_type }}.yml"
+  - "default_images.yml"
   loop_control:
     loop_var: var_file_name
 
@@ -35,14 +42,14 @@
 - set_fact:
     full_restart_cluster: True
   when:
-    - _es_installed_version is defined
-    - _es_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
+  - _es_installed_version is defined
+  - _es_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
 
 - set_fact:
     full_restart_cluster: True
   when:
-    - _es_ops_installed_version is defined
-    - _es_ops_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
+  - _es_ops_installed_version is defined
+  - _es_ops_installed_version.split('.')[0] | int < __es_version.split('.')[0] | int
 
 # allow passing in a tempdir
 - name: Create temp directory for doing work in
@@ -78,7 +85,7 @@
     name: "aggregated-logging-elasticsearch"
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
   when:
-    - openshift_logging_image_pull_secret == ''
+  - openshift_logging_image_pull_secret == ''
 
 # rolebinding reader
 - name: Create rolebinding-reader role
@@ -86,9 +93,9 @@
     state: present
     name: rolebinding-reader
     rules:
-      - apiGroups: [""]
-        resources: ["clusterrolebindings"]
-        verbs: ["get"]
+    - apiGroups: [""]
+      resources: ["clusterrolebindings"]
+      verbs: ["get"]
 
 # SA roles
 - name: Set rolebinding-reader permissions for ES
@@ -128,8 +135,8 @@
 - fail:
     msg: "There was an error creating the logging-metrics-role and binding: {{prometheus_out}}"
   when:
-    - "prometheus_out.stderr | length > 0"
-    - "'already exists' not in prometheus_out.stderr"
+  - "prometheus_out.stderr | length > 0"
+  - "'already exists' not in prometheus_out.stderr"
 
 - set_fact:
     _logging_metrics_proxy_passwd: "{{ 16 | lib_utils_oo_random_word | b64encode }}"
@@ -151,8 +158,8 @@
     roleRef:
       name: view
     subjects:
-      - kind: ServiceAccount
-        name: aggregated-logging-elasticsearch
+    - kind: ServiceAccount
+      name: aggregated-logging-elasticsearch
   changed_when: no
 
 - name: Set logging-elasticsearch-view-role role
@@ -162,18 +169,18 @@
     kind: rolebinding
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
     files:
-      - "{{ tempdir }}/logging-elasticsearch-view-role.yaml"
+    - "{{ tempdir }}/logging-elasticsearch-view-role.yaml"
     delete_after: true
 
 # configmap
 - assert:
     that:
-      - openshift_logging_elasticsearch_kibana_index_mode in __kibana_index_modes
+    - openshift_logging_elasticsearch_kibana_index_mode in __kibana_index_modes
     msg: "The openshift_logging_elasticsearch_kibana_index_mode '{{ openshift_logging_elasticsearch_kibana_index_mode  }}' only supports one of: {{ __kibana_index_modes | join(', ') }}"
 
 - assert:
     that:
-      - "{{ openshift_logging_es_log_appenders | length > 0 }}"
+    - "{{ openshift_logging_es_log_appenders | length > 0 }}"
     msg: "The openshift_logging_es_log_appenders '{{ openshift_logging_es_log_appenders }}' has an unrecognized option and only supports the following as a list: {{ __es_log_appenders | join(', ') }}"
 
 - template:
@@ -189,81 +196,81 @@
 # create diff between current configmap files and our current files
 - when: not openshift_logging_es5_techpreview
   block:
-    - template:
-        src: "{{ __base_file_dir }}/elasticsearch-logging.yml.j2"
-        dest: "{{ tempdir }}/elasticsearch-logging.yml"
-      vars:
-        root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
-      changed_when: no
-
-    - include_role:
-        name: openshift_logging
-        tasks_from: patch_configmap_files.yaml
-      vars:
-        configmap_name: "logging-elasticsearch"
-        configmap_namespace: "logging"
-        configmap_file_names:
-          - current_file: "elasticsearch.yml"
-            new_file: "{{ tempdir }}/elasticsearch.yml"
-            protected_lines: ["number_of_shards", "number_of_replicas"]
-          - current_file: "logging.yml"
-            new_file: "{{ tempdir }}/elasticsearch-logging.yml"
-
-    - name: Set ES configmap
-      oc_configmap:
-        state: present
-        name: "{{ elasticsearch_name }}"
-        namespace: "{{ openshift_logging_elasticsearch_namespace }}"
-        from_file:
-          elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
-          logging.yml: "{{ tempdir }}/elasticsearch-logging.yml"
-      register: es_config_creation
-      notify: "restart elasticsearch"
+  - template:
+      src: "{{ __base_file_dir }}/elasticsearch-logging.yml.j2"
+      dest: "{{ tempdir }}/elasticsearch-logging.yml"
+    vars:
+      root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
+    changed_when: no
+
+  - include_role:
+      name: openshift_logging
+      tasks_from: patch_configmap_files.yaml
+    vars:
+      configmap_name: "logging-elasticsearch"
+      configmap_namespace: "logging"
+      configmap_file_names:
+      - current_file: "elasticsearch.yml"
+        new_file: "{{ tempdir }}/elasticsearch.yml"
+        protected_lines: ["number_of_shards", "number_of_replicas"]
+      - current_file: "logging.yml"
+        new_file: "{{ tempdir }}/elasticsearch-logging.yml"
+
+  - name: Set ES configmap
+    oc_configmap:
+      state: present
+      name: "{{ elasticsearch_name }}"
+      namespace: "{{ openshift_logging_elasticsearch_namespace }}"
+      from_file:
+        elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
+        logging.yml: "{{ tempdir }}/elasticsearch-logging.yml"
+    register: es_config_creation
+    notify: "restart elasticsearch"
 
 - when: openshift_logging_es5_techpreview | bool
   block:
-    - template:
-        src: "{{ __base_file_dir }}/log4j2.properties.j2"
-        dest: "{{ tempdir }}/log4j2.properties"
-      vars:
-        root_logger: "{{ openshift_logging_es_log_appenders | list }}"
-      changed_when: no
-
-    - include_role:
-        name: openshift_logging
-        tasks_from: patch_configmap_files.yaml
-      vars:
-        configmap_name: "logging-elasticsearch"
-        configmap_namespace: "logging"
-        configmap_file_names:
-          - current_file: "elasticsearch.yml"
-            new_file: "{{ tempdir }}/elasticsearch.yml"
-          - current_file: "log4j2.properties"
-            new_file: "{{ tempdir }}/log4j2.properties"
-
-    - name: Set ES configmap
-      oc_configmap:
-        state: present
-        name: "{{ elasticsearch_name }}"
-        namespace: "{{ openshift_logging_elasticsearch_namespace }}"
-        from_file:
-          elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
-          log4j2.properties: "{{ tempdir }}/log4j2.properties"
-      register: es_config_creation
-      notify: "restart elasticsearch"
+  - template:
+      src: "{{ __base_file_dir }}/log4j2.properties.j2"
+      dest: "{{ tempdir }}/log4j2.properties"
+    vars:
+      root_logger: "{{ openshift_logging_es_log_appenders | list }}"
+    changed_when: no
+
+  - include_role:
+      name: openshift_logging
+      tasks_from: patch_configmap_files.yaml
+    vars:
+      configmap_name: "logging-elasticsearch"
+      configmap_namespace: "logging"
+      configmap_file_names:
+      - current_file: "elasticsearch.yml"
+        new_file: "{{ tempdir }}/elasticsearch.yml"
+      - current_file: "log4j2.properties"
+        new_file: "{{ tempdir }}/log4j2.properties"
+
+  - name: Set ES configmap
+    oc_configmap:
+      state: present
+      name: "{{ elasticsearch_name }}"
+      namespace: "{{ openshift_logging_elasticsearch_namespace }}"
+      from_file:
+        elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
+        log4j2.properties: "{{ tempdir }}/log4j2.properties"
+    register: es_config_creation
+    notify: "restart elasticsearch"
 
 - when: es_config_creation.changed | bool
   block:
-    - set_fact:
-        _restart_logging_components: "{{ _restart_logging_components | default([]) + [es_component] | unique }}"
+  - set_fact:
+      _restart_logging_components: "{{ _restart_logging_components | default([]) + [es_component] | unique }}"
 
-    - shell: >
-        {{ openshift_client_binary }} get dc -l component="{{ es_component }}" -n "{{ openshift_logging_elasticsearch_namespace }}" -o name | cut -d'/' -f2
-      register: _es_dcs
+  - shell: >
+      {{ openshift_client_binary }} get dc -l component="{{ es_component }}" -n "{{ openshift_logging_elasticsearch_namespace }}" -o name | cut -d'/' -f2
+    register: _es_dcs
 
-    - set_fact:
-        _restart_logging_nodes: "{{ _restart_logging_nodes | default([]) + [_es_dcs.stdout] | unique }}"
-      when: _es_dcs.stdout != ""
+  - set_fact:
+      _restart_logging_nodes: "{{ _restart_logging_nodes | default([]) + [_es_dcs.stdout] | unique }}"
+    when: _es_dcs.stdout != ""
 
 # secret
 - name: Set ES secret
@@ -272,24 +279,24 @@
     name: "logging-elasticsearch"
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
     files:
-      - name: key
-        path: "{{ generated_certs_dir }}/logging-es.jks"
-      - name: truststore
-        path: "{{ generated_certs_dir }}/truststore.jks"
-      - name: searchguard.key
-        path: "{{ generated_certs_dir }}/elasticsearch.jks"
-      - name: searchguard.truststore
-        path: "{{ generated_certs_dir }}/truststore.jks"
-      - name: admin-key
-        path: "{{ generated_certs_dir }}/system.admin.key"
-      - name: admin-cert
-        path: "{{ generated_certs_dir }}/system.admin.crt"
-      - name: admin-ca
-        path: "{{ generated_certs_dir }}/ca.crt"
-      - name: admin.jks
-        path: "{{ generated_certs_dir }}/system.admin.jks"
-      - name: passwd.yml
-        path: "{{mktemp.stdout}}/passwd.yml"
+    - name: key
+      path: "{{ generated_certs_dir }}/logging-es.jks"
+    - name: truststore
+      path: "{{ generated_certs_dir }}/truststore.jks"
+    - name: searchguard.key
+      path: "{{ generated_certs_dir }}/elasticsearch.jks"
+    - name: searchguard.truststore
+      path: "{{ generated_certs_dir }}/truststore.jks"
+    - name: admin-key
+      path: "{{ generated_certs_dir }}/system.admin.key"
+    - name: admin-cert
+      path: "{{ generated_certs_dir }}/system.admin.crt"
+    - name: admin-ca
+      path: "{{ generated_certs_dir }}/ca.crt"
+    - name: admin.jks
+      path: "{{ generated_certs_dir }}/system.admin.jks"
+    - name: passwd.yml
+      path: "{{mktemp.stdout}}/passwd.yml"
 
 # services
 - name: Set logging-{{ es_component }}-cluster service
@@ -303,7 +310,7 @@
     labels:
       logging-infra: 'support'
     ports:
-      - port: 9300
+    - port: 9300
 
 - name: Set logging-{{ es_component }} service
   oc_service:
@@ -316,8 +323,8 @@
     labels:
       logging-infra: 'support'
     ports:
-      - port: 9200
-        targetPort: "restapi"
+    - port: 9200
+      targetPort: "restapi"
 
 - name: Set logging-{{ es_component}}-prometheus service
   oc_service:
@@ -327,9 +334,9 @@
     labels:
       logging-infra: 'support'
     ports:
-      - name: proxy
-        port: 443
-        targetPort: 4443
+    - name: proxy
+      port: 443
+      targetPort: 4443
     selector:
       component: "{{ es_component }}"
       provider: openshift
@@ -357,46 +364,46 @@
 # so we check for the presence of 'stderr' to determine if the obj exists or not
 # the RC for existing and not existing is both 0
 - when:
-    - logging_elasticsearch_pvc.results.stderr is defined
-    - openshift_logging_elasticsearch_storage_type == "pvc"
+  - logging_elasticsearch_pvc.results.stderr is defined
+  - openshift_logging_elasticsearch_storage_type == "pvc"
   block:
-    # storageclasses are used by default but if static then disable
-    # storageclasses with the storageClassName set to "" in pvc.j2
-    - name: Creating ES storage template - static
-      template:
-        src: "{{ __base_file_dir }}/pvc.j2"
-        dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
-      vars:
-        obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
-        size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
-        access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
-        pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
-        storage_class_name: "{{ openshift_logging_elasticsearch_pvc_storage_class_name | default('', true) }}"
-      when:
-        - not openshift_logging_elasticsearch_pvc_dynamic | bool
-
-    # Storageclasses are used by default if configured
-    - name: Creating ES storage template - dynamic
-      template:
-        src: "{{ __base_file_dir }}/pvc.j2"
-        dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
-      vars:
-        obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
-        size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
-        access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
-        pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
-      when:
-        - openshift_logging_elasticsearch_pvc_dynamic | bool
-
-    - name: Set ES storage
-      oc_obj:
-        state: present
-        kind: pvc
-        name: "{{ openshift_logging_elasticsearch_pvc_name }}"
-        namespace: "{{ openshift_logging_elasticsearch_namespace }}"
-        files:
-          - "{{ tempdir }}/templates/logging-es-pvc.yml"
-        delete_after: true
+  # storageclasses are used by default but if static then disable
+  # storageclasses with the storageClassName set to "" in pvc.j2
+  - name: Creating ES storage template - static
+    template:
+      src: "{{ __base_file_dir }}/pvc.j2"
+      dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
+    vars:
+      obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
+      size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
+      access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
+      pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
+      storage_class_name: "{{ openshift_logging_elasticsearch_pvc_storage_class_name | default('', true) }}"
+    when:
+    - not openshift_logging_elasticsearch_pvc_dynamic | bool
+
+  # Storageclasses are used by default if configured
+  - name: Creating ES storage template - dynamic
+    template:
+      src: "{{ __base_file_dir }}/pvc.j2"
+      dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
+    vars:
+      obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
+      size: "{{ (openshift_logging_elasticsearch_pvc_size | trim | length == 0) | ternary('10Gi', openshift_logging_elasticsearch_pvc_size) }}"
+      access_modes: "{{ openshift_logging_elasticsearch_pvc_access_modes | list }}"
+      pv_selector: "{{ openshift_logging_elasticsearch_pvc_pv_selector }}"
+    when:
+    - openshift_logging_elasticsearch_pvc_dynamic | bool
+
+  - name: Set ES storage
+    oc_obj:
+      state: present
+      kind: pvc
+      name: "{{ openshift_logging_elasticsearch_pvc_name }}"
+      namespace: "{{ openshift_logging_elasticsearch_namespace }}"
+      files:
+      - "{{ tempdir }}/templates/logging-es-pvc.yml"
+      delete_after: true
 
 - set_fact:
     es_deploy_name: "logging-{{ es_component }}-{{ openshift_logging_elasticsearch_deployment_type }}-{{ 8 | lib_utils_oo_random_word('abcdefghijklmnopqrstuvwxyz0123456789') }}"
@@ -437,7 +444,7 @@
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
     kind: dc
     files:
-      - "{{ tempdir }}/templates/logging-es-dc.yml"
+    - "{{ tempdir }}/templates/logging-es-dc.yml"
     delete_after: true
   register: es_dc_creation
   notify: "restart elasticsearch"
@@ -452,37 +459,37 @@
     src: "{{ generated_certs_dir }}/{{ item.file }}"
   register: key_pairs
   with_items:
-    - { name: "ca_file", file: "ca.crt" }
-    - { name: "es_key", file: "system.logging.es.key" }
-    - { name: "es_cert", file: "system.logging.es.crt" }
+  - { name: "ca_file", file: "ca.crt" }
+  - { name: "es_key", file: "system.logging.es.key" }
+  - { name: "es_cert", file: "system.logging.es.crt" }
   when: openshift_logging_es_allow_external | bool
 
 - set_fact:
     es_key: "{{ lookup('file', openshift_logging_es_key) | b64encode }}"
   when:
-    - openshift_logging_es_key | trim | length > 0
-    - openshift_logging_es_allow_external | bool
+  - openshift_logging_es_key | trim | length > 0
+  - openshift_logging_es_allow_external | bool
   changed_when: false
 
 - set_fact:
     es_cert: "{{ lookup('file', openshift_logging_es_cert) | b64encode  }}"
   when:
-    - openshift_logging_es_cert | trim | length > 0
-    - openshift_logging_es_allow_external | bool
+  - openshift_logging_es_cert | trim | length > 0
+  - openshift_logging_es_allow_external | bool
   changed_when: false
 
 - set_fact:
     es_ca: "{{ lookup('file', openshift_logging_es_ca_ext) | b64encode  }}"
   when:
-    - openshift_logging_es_ca_ext | trim | length > 0
-    - openshift_logging_es_allow_external | bool
+  - openshift_logging_es_ca_ext | trim | length > 0
+  - openshift_logging_es_allow_external | bool
   changed_when: false
 
 - set_fact:
     es_ca: "{{ key_pairs | entry_from_named_pair('ca_file') }}"
   when:
-    - es_ca is not defined
-    - openshift_logging_es_allow_external | bool
+  - es_ca is not defined
+  - openshift_logging_es_allow_external | bool
   changed_when: false
 
 - name: Generating Elasticsearch {{ es_component }} route template
@@ -513,7 +520,7 @@
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
     kind: route
     files:
-      - "{{ tempdir }}/templates/logging-{{ es_component }}-route.yaml"
+    - "{{ tempdir }}/templates/logging-{{ es_component }}-route.yaml"
   when: openshift_logging_es_allow_external | bool
 
 ## Placeholder for migration when necessary ##