From a8af7cfd92b3d2a75fa34ef43d63317173798b10 Mon Sep 17 00:00:00 2001 From: Christian Schwarz Date: Mon, 3 Apr 2023 11:18:14 +0200 Subject: [PATCH] ansible: validate eviction_policy overrides are gone in prod To avoid any surprises during rollout. --- .github/ansible/deploy.yaml | 213 ++---------------------------- .github/workflows/deploy-prod.yml | 2 - 2 files changed, 9 insertions(+), 206 deletions(-) diff --git a/.github/ansible/deploy.yaml b/.github/ansible/deploy.yaml index d4c1dec8ea..04d3e10a5d 100644 --- a/.github/ansible/deploy.yaml +++ b/.github/ansible/deploy.yaml @@ -1,211 +1,16 @@ -- name: Upload Neon binaries - hosts: storage - gather_facts: False - remote_user: "{{ remote_user }}" - - tasks: - - - name: get latest version of Neon binaries - register: current_version_file - set_fact: - current_version: "{{ lookup('file', '.neon_current_version') | trim }}" - tags: - - pageserver - - safekeeper - - - name: inform about versions - debug: - msg: "Version to deploy - {{ current_version }}" - tags: - - pageserver - - safekeeper - - - name: upload and extract Neon binaries to /usr/local - ansible.builtin.unarchive: - owner: root - group: root - src: neon_install.tar.gz - dest: /usr/local - become: true - tags: - - pageserver - - safekeeper - - binaries - - putbinaries - -- name: Deploy pageserver +- name: Validate that eviction_policy overrides are gone from all tenant config tomls hosts: pageservers gather_facts: False remote_user: "{{ remote_user }}" tasks: - - name: upload init script - when: console_mgmt_base_url is defined - ansible.builtin.template: - src: scripts/init_pageserver.sh - dest: /tmp/init_pageserver.sh - owner: root - group: root - mode: '0755' - become: true - tags: - - pageserver + - find: + paths: + - "/storage/pageserver/data/tenants" + recurse: yes + patterns: + - "config" + contains: + ".*eviction_policy.*" - - name: init pageserver - shell: - cmd: /tmp/init_pageserver.sh - args: - creates: "/storage/pageserver/data/tenants" - environment: - NEON_REPO_DIR: "/storage/pageserver/data" - LD_LIBRARY_PATH: "/usr/local/v14/lib" - become: true - tags: - - pageserver - - - name: read the existing remote pageserver config - ansible.builtin.slurp: - src: /storage/pageserver/data/pageserver.toml - register: _remote_ps_config - tags: - - pageserver - - - name: parse the existing pageserver configuration - ansible.builtin.set_fact: - _existing_ps_config: "{{ _remote_ps_config['content'] | b64decode | sivel.toiletwater.from_toml }}" - tags: - - pageserver - - - name: construct the final pageserver configuration dict - ansible.builtin.set_fact: - pageserver_config: "{{ pageserver_config_stub | combine({'id': _existing_ps_config.id }) }}" - tags: - - pageserver - - - name: template the pageserver config - template: - src: templates/pageserver.toml.j2 - dest: /storage/pageserver/data/pageserver.toml - become: true - tags: - - pageserver - - # used in `pageserver.service` template - - name: learn current availability_zone - shell: - cmd: "curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone" - register: ec2_availability_zone - - - set_fact: - ec2_availability_zone={{ ec2_availability_zone.stdout }} - - - name: upload systemd service definition - ansible.builtin.template: - src: systemd/pageserver.service - dest: /etc/systemd/system/pageserver.service - owner: root - group: root - mode: '0644' - become: true - tags: - - pageserver - - - name: start systemd service - ansible.builtin.systemd: - daemon_reload: yes - name: pageserver - enabled: yes - state: restarted - become: true - tags: - - pageserver - - - name: post version to console - when: console_mgmt_base_url is defined - shell: - cmd: | - INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id) - curl -sfS -H "Authorization: Bearer {{ CONSOLE_API_TOKEN }}" {{ console_mgmt_base_url }}/management/api/v2/pageservers/$INSTANCE_ID | jq '.version = {{ current_version }}' > /tmp/new_version - curl -sfS -H "Authorization: Bearer {{ CONSOLE_API_TOKEN }}" -H "Content-Type: application/json" -X POST -d@/tmp/new_version {{ console_mgmt_base_url }}/management/api/v2/pageservers - tags: - - pageserver - -- name: Deploy safekeeper - hosts: safekeepers - gather_facts: False - remote_user: "{{ remote_user }}" - - tasks: - - - name: upload init script - when: console_mgmt_base_url is defined - ansible.builtin.template: - src: scripts/init_safekeeper.sh - dest: /tmp/init_safekeeper.sh - owner: root - group: root - mode: '0755' - become: true - tags: - - safekeeper - - - name: init safekeeper - shell: - cmd: /tmp/init_safekeeper.sh - args: - creates: "/storage/safekeeper/data/safekeeper.id" - environment: - NEON_REPO_DIR: "/storage/safekeeper/data" - LD_LIBRARY_PATH: "/usr/local/v14/lib" - become: true - tags: - - safekeeper - - # used in `safekeeper.service` template - - name: learn current availability_zone - shell: - cmd: "curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone" - register: ec2_availability_zone - - - set_fact: - ec2_availability_zone={{ ec2_availability_zone.stdout }} - - # in the future safekeepers should discover pageservers byself - # but currently use first pageserver that was discovered - - name: set first pageserver var for safekeepers - set_fact: - first_pageserver: "{{ hostvars[groups['pageservers'][0]]['inventory_hostname'] }}" - tags: - - safekeeper - - - name: upload systemd service definition - ansible.builtin.template: - src: systemd/safekeeper.service - dest: /etc/systemd/system/safekeeper.service - owner: root - group: root - mode: '0644' - become: true - tags: - - safekeeper - - - name: start systemd service - ansible.builtin.systemd: - daemon_reload: yes - name: safekeeper - enabled: yes - state: restarted - become: true - tags: - - safekeeper - - - name: post version to console - when: console_mgmt_base_url is defined - shell: - cmd: | - INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id) - curl -sfS -H "Authorization: Bearer {{ CONSOLE_API_TOKEN }}" {{ console_mgmt_base_url }}/management/api/v2/safekeepers/$INSTANCE_ID | jq '.version = {{ current_version }}' > /tmp/new_version - curl -sfS -H "Authorization: Bearer {{ CONSOLE_API_TOKEN }}" -H "Content-Type: application/json" -X POST -d@/tmp/new_version {{ console_mgmt_base_url }}/management/api/v2/safekeepers - tags: - - safekeeper diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml index 6096ac8ab9..74034e291b 100644 --- a/.github/workflows/deploy-prod.yml +++ b/.github/workflows/deploy-prod.yml @@ -65,8 +65,6 @@ jobs: export DOCKER_TAG=${{ inputs.dockerTag }} cd "$(pwd)/.github/ansible" - ./get_binaries.sh - ansible-galaxy collection install sivel.toiletwater ansible-playbook -v deploy.yaml -i prod.${{ matrix.target_region }}.hosts.yaml -e @ssm_config -e CONSOLE_API_TOKEN=${{ secrets.NEON_PRODUCTION_API_KEY }} -e SENTRY_URL_PAGESERVER=${{ secrets.SENTRY_URL_PAGESERVER }} -e SENTRY_URL_SAFEKEEPER=${{ secrets.SENTRY_URL_SAFEKEEPER }} rm -f neon_install.tar.gz .neon_current_version