feat: configure automated deployment with Ansible by JakubDurkac · Pull Request #15 · redhat-openshift-ecosystem/pullsar

JakubDurkac · 2025-10-09T11:10:02Z

Created ansible folder:

Configured vaults/ containing secrets.
Configured inventories/ with basic deployment configuration.
Configured templates/ defining all the main components including database.
Configured roles/ including tasks/ for the deployment of project setup, api, web and worker.
Configured playbooks/ with deploy.yml initializing deployment based on given env (stage/prod) and deployment tags (always, api, web, worker).

Configured .github/workflows/ci-cd.yaml:

Added set-image-suffix job to generate unique image tag suffix accessible by other jobs.
Made build-and-push job create output containing the services we've built images for.
Added set-ansible-tags job to generate a string like "--tags api --tags web --tags always" based on build-and-push output, also checks if ansible config was modified, in which case at least the project-setup is deployed to update secrets/config.
Added deploy-stage and deploy-prod jobs to create deployment in case of PR and push to main respectively.

1. Added set-image-suffix job to generate unique image tag suffix accessible by other jobs. 2. Made build-and-push job create output containing the services we've built images for. 3. Added set-ansible-tags job to generate a string like "--tags api --tags web --tags always" based on build-and-push output, also checks if ansible config was modified, in which case at least the project-setup is deployed to update secrets/config. 4. Added deploy-stage and deploy-prod jobs to create deployment in case of PR and push to main respectively.

1. Added official OpenShift template postgresql-persistent.yml. 2. Added task for creation/update of database based on the template to project_setup. 3. Added template postgresql-migration-job.yml that uses files/migrations/V1__initial_setup.sql to create the base table schema and set the db_start_date if they are not already set. 4. Added task for running the migration job at the end of project_setup.

…put for set-ansible-tags

When using the image resolution within template, it seems that it needs to create some temporary objects in the openshift namespace. To avoid the need for setting up writing permissions, the image is now resolved just by reading the image from the API and passing it down to the template. I have also simplified the template a bit and fixed database migration job behavior - indentation issues, time to live, removal of finished jobs.

Allda · 2025-10-16T07:24:41Z

.github/workflows/ci-cd.yaml

+            ansible/**
+            .github/workflows/**
+
+      - name: Generate Ansible deployment tags


I am not sure why we need this. We should always run a playbook and (re-)deploy a whole application including all subcomponents. For local testing, it is good to have a tags around but it should not be used when deploying app.

The idea behind this is the following: Currently we are building and pushing images of only those services that changed in the PR/push to main. So if we only build images for api and web, after we deploy all 3 apps: api, web and worker, I think that the worker image would also change to a new image tag, while that image wasn't built and doesn't exist. That's why currently only those changed are deployed.

I can refactor this, but I'm not sure what would be preferred. If we should always deploy all apps, should we be also always building and pushing images of all apps, no matter if their code changed? Or else?

I went forward with it. Now always all parts are built and deployed. It made it much more simple. I tried to address all the other comments as well. Thanks for feedback and feel free to check and let me know, if you would still do something differently.

Allda · 2025-10-16T07:26:22Z

.github/workflows/ci-cd.yaml

+      - name: Install required Python libraries
+        run: pip install kubernetes openshift
+
+      - name: Run Ansible deployment for stage


Consider using dawidd6/action-ansible-playbook github action here. You can find our usecase here https://github.com/redhat-openshift-ecosystem/operator-pipelines/blob/main/.github/workflows/deploy.yml#L40C15-L40C46

Allda · 2025-10-16T07:27:08Z

.github/workflows/ci-cd.yaml

+            --vault-password-file <(echo "$ANSIBLE_VAULT_PASSWORD") \
+            ${{ needs.set-ansible-tags.outputs.ansible_tags }} \
+            -e "env=stage" \
+            -e "openshift_server=${{ secrets.OPENSHIFT_SERVER_STAGE }}" \


The server should be configured as part of Ansible inventories.

Allda · 2025-10-16T07:27:26Z

.github/workflows/ci-cd.yaml

+            ${{ needs.set-ansible-tags.outputs.ansible_tags }} \
+            -e "env=stage" \
+            -e "openshift_server=${{ secrets.OPENSHIFT_SERVER_STAGE }}" \
+            -e "openshift_token=${{ secrets.OPENSHIFT_TOKEN_STAGE }}" \


And token should be also part of Ansible vault

Allda · 2025-10-16T07:31:19Z

ansible/inventories/prod.yml

@@ -0,0 +1,21 @@
+pullsar_prod:


This is one way to define inventory, but it is not really scalable or user-friendly. Instead, you should create a inventory file where you describe your hosts and their hierarchy and then create a group vars for each. This will allow you to share common variables and bring many more features.

You can find an example here: https://github.com/redhat-openshift-ecosystem/operator-pipelines/tree/main/ansible/inventory

Allda · 2025-10-16T07:34:25Z

ansible/roles/project_setup/tasks/main.yml

+    namespace: "{{ project_namespace }}"
+    definition:
+      apiVersion: v1
+      kind: Secret


For tasks that work with secrets, please use no_log: true - Ansible can leak secrets when using verbose output.

Allda · 2025-10-16T07:35:40Z

ansible/roles/project_setup/tasks/main.yml

+  kubernetes.core.k8s_info:
+    api_version: image.openshift.io/v1
+    kind: ImageStreamTag
+    name: "postgresql:{{ postgres_version }}"


Where does this image comes from? You should use the image from redhat official registry.

Allda · 2025-10-16T07:38:17Z

ansible/roles/project_setup/templates/postgresql-migration-job.yml

@@ -0,0 +1,51 @@
+apiVersion: batch/v1


The template definition should be stored under a role that is using it.

Allda · 2025-10-16T07:42:11Z

ansible/playbooks/deploy.yml

+    K8S_AUTH_API_KEY: "{{ openshift_token }}"
+    K8S_AUTH_HOST: "{{ openshift_server }}"
+
+  roles:


I think there might be a bit of a misunderstanding about what the roles are used for. The role is independent unit that contains all resources needed for a deployment. I see you define a role as a set of task but all your templates are outside of it.

I also think you don't need to create role for each component. It is unnecesary complicated. Better to split a components as a independet task inside one role.

You can use ansible-galaxy to bootstrap role directory structure to see how the role should look like. Or check our other projects where roles are used.

1. Merged roles api, web and worker into 1 role app. 2. Moved templates and files under the roles. 3. Refactored inventory with group_vars and host_vars.

Allda · 2025-10-20T11:56:07Z

.github/workflows/ci-cd.yaml

+    name: Deploy to stage
+    runs-on: ubuntu-latest
+    needs: [set-image-suffix, build-and-push]
+    if: github.event_name == 'pull_request'


The stage instance won't be deployable after a merge is done?

On what events should I be deploying to stage and to prod? What would be acceptable in my case?

Usually, we deploy both stage and prod after a PR is merged. Since you don't have a dev and qa environment, I would maybe make the stage deployment optional for PRs for testing purposes and after a PR is merged I would deploy both stage and prod.

Allda

The PR looks ok to me, let's just resolve the issue with when to run stage and prod deployment and merge this. Also before merging please run ansible lint to fix all potential issues with ansible configs. It would be also good idea to run ansible lint in the Github CI.

JakubDurkac added 6 commits October 7, 2025 15:01

feat: configure Ansible for the whole app deployment

2917f4d

fix: minor fixes across project to trigger deployment of all apps

dde2aeb

fix: set deployment namespaces to pullsar-stage and pullsar-prod

8c2d1e2

fix: missing checkout repo for set-image-suffix and should_deploy out…

af129b0

…put for set-ansible-tags

JakubDurkac force-pushed the ISV-6364 branch 5 times, most recently from 5735e6f to 995a4ce Compare October 9, 2025 13:14

fix: set deploy job workdir to ./ansible, add ansible.cfg, other fixes

85c1a44

JakubDurkac force-pushed the ISV-6364 branch from 995a4ce to 85c1a44 Compare October 9, 2025 13:48

JakubDurkac added 3 commits October 9, 2025 16:43

fix: wrong format of secrets.yml

efa3831

fix: paths to templates

8e62655

feat: process DB template using community.okd.openshift_process

96b4534

JakubDurkac force-pushed the ISV-6364 branch from cfab1ee to f5e0763 Compare October 9, 2025 18:46

JakubDurkac force-pushed the ISV-6364 branch 2 times, most recently from 9c46465 to 38e77d9 Compare October 10, 2025 07:53

JakubDurkac requested a review from Allda October 10, 2025 08:45

Allda reviewed Oct 16, 2025

View reviewed changes

JakubDurkac added 6 commits October 18, 2025 21:58

refactor: roles, inventory

9800922

1. Merged roles api, web and worker into 1 role app. 2. Moved templates and files under the roles. 3. Refactored inventory with group_vars and host_vars.

fix: set no_log to true for secrets

7016546

refactor: always build and deploy all apps

f168e1d

fix: replace PostgreSQL template for deployment

fbeb3a1

fix: set ansible python interpreter

760bb02

fix: set migration job to use same PostgreSQL image

12ed10a

JakubDurkac force-pushed the ISV-6364 branch from 0248a99 to 12ed10a Compare October 18, 2025 22:22

feat: run one worker cronjob in stage

6cbb4b3

JakubDurkac force-pushed the ISV-6364 branch from e6ac10f to 6cbb4b3 Compare October 19, 2025 08:36

Allda reviewed Oct 20, 2025

View reviewed changes

Allda approved these changes Oct 21, 2025

View reviewed changes

JakubDurkac added 2 commits October 21, 2025 15:58

fix: run deploy-stage for push to main, optionally for PRs

532f408

feat: add ansible-lint to CI/CD

253e32c

JakubDurkac added the deploy-stage Optional label to mark PR changes ready for deployment to stage. label Oct 21, 2025

fix: ansible-lint missing collection

1852c51

JakubDurkac force-pushed the ISV-6364 branch from 487f388 to 1f9f32b Compare October 21, 2025 16:54

JakubDurkac removed the deploy-stage Optional label to mark PR changes ready for deployment to stage. label Oct 21, 2025

JakubDurkac force-pushed the ISV-6364 branch from 1f9f32b to 1852c51 Compare October 21, 2025 17:20

feat: update vault secrets for prod

ffa66d4

JakubDurkac added the deploy-stage Optional label to mark PR changes ready for deployment to stage. label Oct 22, 2025

JakubDurkac merged commit 831e7cc into main Oct 22, 2025
19 of 21 checks passed

JakubDurkac deleted the ISV-6364 branch October 22, 2025 10:24

Conversation

JakubDurkac commented Oct 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JakubDurkac Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JakubDurkac Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Allda left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

JakubDurkac Oct 17, 2025 •

edited

Loading

JakubDurkac Oct 20, 2025 •

edited

Loading