Skip to content

NO-ISSUE: restore OSAC-1992 JIT storage extra_vars in 5 AAP playbooks - #192

Merged
openshift-merge-bot[bot] merged 2 commits into
osac-project:mainfrom
wgordon17:fix/restore-aap-jit-storage-tier-definitions
Aug 6, 2026
Merged

NO-ISSUE: restore OSAC-1992 JIT storage extra_vars in 5 AAP playbooks#192
openshift-merge-bot[bot] merged 2 commits into
osac-project:mainfrom
wgordon17:fix/restore-aap-jit-storage-tier-definitions

Conversation

@wgordon17

@wgordon17 wgordon17 commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Summary by CodeRabbit

  • New Features
    • Storage provisioning and teardown now use storage tier settings supplied with the automation event.
    • Optional storage backend connection details are supported during storage creation and removal.
    • VM storage selection now defaults to the local tier.
  • Bug Fixes
    • Added validation for required, non-empty storage tier settings.
    • Improved handling of unavailable storage tiers with clearer warnings and errors.
    • Storage cleanup consistently uses the supplied tier configuration.

PR osac-project#97 (OSAC-3547, ansible_eda -> osac_job_vars rename) branched before PR osac-project#99 (OSAC-1992, STORAGE_TIERS -> storage_tier_definitions/storage_backend_connections) merged, and was itself merged ~8 hours later without rebasing onto the new main. Its mechanical rename carried the pre-PR99 STORAGE_TIERS-based logic underneath, silently discarding PR osac-project#99's functional changes on the 5 files they both touched while correctly renaming everything else.

Restores PR osac-project#99's logic via 3-way merge (base: pre-PR99 commit, theirs: PR osac-project#99's merged content) against current main, then renames the restored ansible_eda.event.* references to osac_job_vars.* to match OSAC-3547. osac-operator already emits osac_job_vars.storage_tier_definitions and osac_job_vars.storage_backend_connections on current main; only the AAP-side consumers were out of sync.

Also drops storage_provider_snapshots_enabled from the ComputeInstance, tenant-cluster-storage, and tenant-storage-backend create playbooks' include_role calls, matching PR osac-project#99's original reviewed decision to rely on the role's own default (true) rather than re-threading a static env var lookup through the dynamic tier-driven path.

Verified: ansible-lint clean, ansible-playbook --syntax-check clean on all 5 files, diff scoped to exactly the 5 regressed files (confirmed via full audit of all 32 files PR osac-project#99 touched -- no other collateral damage).

Generated-By: Claude Code (Anthropic)
Signed-off-by: Will Gordon <wgordon@redhat.com>
@openshift-ci-robot

openshift-ci-robot commented Aug 6, 2026

Copy link
Copy Markdown

@wgordon17: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

Five Ansible playbooks now read storage configuration from osac_job_vars instead of environment variables. They validate storage_tier_definitions, pass optional backend connections, remove snapshot inputs and JSON parsing, and default VM storage to local.

Changes

Storage event migration

Layer / File(s) Summary
Event payload validation
osac-aap/playbook_osac_create_compute_instance.yml, osac-aap/playbook_osac_create_tenant_cluster_storage.yml, osac-aap/playbook_osac_create_tenant_storage_backend.yml, osac-aap/playbook_osac_delete_tenant_cluster_storage.yml, osac-aap/playbook_osac_delete_tenant_storage_backend.yml
The playbooks remove STORAGE_TIERS parsing. They validate storage_tier_definitions as a non-empty array where required.
Storage creation wiring
osac-aap/playbook_osac_create_compute_instance.yml, osac-aap/playbook_osac_create_tenant_cluster_storage.yml, osac-aap/playbook_osac_create_tenant_storage_backend.yml, osac-aap/collections/ansible_collections/osac/templates/roles/ocp_virt_vm/tasks/create_resources.yaml
Creation flows pass event-provided tier definitions and optional storage_backend_connections. VM storage defaults to the local tier.
Storage teardown wiring
osac-aap/playbook_osac_delete_tenant_cluster_storage.yml, osac-aap/playbook_osac_delete_tenant_storage_backend.yml, osac-installer/charts/osac/values.schema.json, osac-installer/charts/osac/values.yaml, osac-installer/values/vmaas-ci/values.yaml
Teardown flows use event-provided tier definitions. Installer configuration no longer defines STORAGE_TIERS.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested labels: storage

Suggested reviewers: tzvatot, eranco74

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed The full PR-range scan found no non-empty credential assignments, private-key material, credential URLs, known token shapes, or >32-character base64/hex literals; remaining secret fields are names...
No-Weak-Crypto ✅ Passed The PR diff adds storage-tier validation and role wiring only; searches of all 9 changed files found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto API, or secret-comparison usage.
No-Injection-Vectors ✅ Passed Diff-scoped scans found no SQL concatenation, shell, eval/exec, pickle, unsafe YAML, os.system, or HTML sink; temporary-file handling uses tempfile.mkstemp and os.fdopen.
Container-Privileges ✅ Passed The full PR diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, root, or securityContext settings.
No-Sensitive-Data-In-Logs ✅ Passed PR-added messages expose only tier names and fixed example data; backend connections and passphrases are not logged, and credential-handling tasks retain no_log protection.
Ai-Attribution ✅ Passed Both PR commits contain Generated-By: Claude Code (Anthropic) trailers, and neither commit contains a Co-Authored-By trailer.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the restoration of JIT storage extra-vars in the five affected AAP playbooks.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@wgordon17
wgordon17 marked this pull request as ready for review August 6, 2026 19:17
@openshift-ci
openshift-ci Bot requested review from eranco74 and tzvatot August 6, 2026 19:17

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@osac-aap/playbook_osac_delete_tenant_cluster_storage.yml`:
- Around line 73-78: Update the “Clean up cluster-side tenant storage resources”
include_role task to pass osac_job_vars.storage_backend_connections alongside
storage_provider_tiers when invoking osac.service.storage_provider with
storage_provider_action set to teardown_cluster_storage, matching the other
storage-provider calls.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8fac7664-025e-475b-b3a4-477430a83593

📥 Commits

Reviewing files that changed from the base of the PR and between 17541f7 and 2ff6cba.

📒 Files selected for processing (5)
  • osac-aap/playbook_osac_create_compute_instance.yml
  • osac-aap/playbook_osac_create_tenant_cluster_storage.yml
  • osac-aap/playbook_osac_create_tenant_storage_backend.yml
  • osac-aap/playbook_osac_delete_tenant_cluster_storage.yml
  • osac-aap/playbook_osac_delete_tenant_storage_backend.yml

Comment on lines 73 to +78
- name: Clean up cluster-side tenant storage resources
when: _storage_tiers_raw | length > 0
ansible.builtin.include_role:
name: osac.service.storage_provider
vars:
storage_provider_action: teardown_cluster_storage
storage_provider_tiers: "{{ _storage_tiers }}"
storage_provider_tiers: "{{ osac_job_vars.storage_tier_definitions }}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Pass backend connections to cluster teardown.

Line 78 forwards tier definitions but not osac_job_vars.storage_backend_connections. The other storage-provider calls forward this event field. Cluster teardown can run without its required backend configuration.

Proposed fix
         storage_provider_action: teardown_cluster_storage
         storage_provider_tiers: "{{ osac_job_vars.storage_tier_definitions }}"
+        storage_provider_backend_connections: "{{ osac_job_vars.storage_backend_connections | default({}) }}"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Clean up cluster-side tenant storage resources
when: _storage_tiers_raw | length > 0
ansible.builtin.include_role:
name: osac.service.storage_provider
vars:
storage_provider_action: teardown_cluster_storage
storage_provider_tiers: "{{ _storage_tiers }}"
storage_provider_tiers: "{{ osac_job_vars.storage_tier_definitions }}"
- name: Clean up cluster-side tenant storage resources
ansible.builtin.include_role:
name: osac.service.storage_provider
vars:
storage_provider_action: teardown_cluster_storage
storage_provider_tiers: "{{ osac_job_vars.storage_tier_definitions }}"
storage_provider_backend_connections: "{{ osac_job_vars.storage_backend_connections | default({}) }}"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@osac-aap/playbook_osac_delete_tenant_cluster_storage.yml` around lines 73 -
78, Update the “Clean up cluster-side tenant storage resources” include_role
task to pass osac_job_vars.storage_backend_connections alongside
storage_provider_tiers when invoking osac.service.storage_provider with
storage_provider_action set to teardown_cluster_storage, matching the other
storage-provider calls.

Every current environment that registers a storage tier via the Tier API (register-local-storage.yaml, gated on lvms.enabled) or the now-removed static STORAGE_TIERS config names it 'local', never 'default'. No environment defines a tier literally named 'default' -- that name only ever appeared in storage_provider's own VAST-oriented unit test fixtures and the sample payload, not in any deployed config.

Changes the two independent hardcoded tier-name fallbacks to 'local' to match: playbook_osac_create_compute_instance.yml's _requested_storage_tier (used when STORAGE_REQUESTED_TIER is unset, which it always is today), and ocp_virt_vm/create_resources.yaml's tenant_storage_class_storage_tier fallback (used when _requested_storage_tier is entirely undefined, i.e. when the role is reached via osac.workflows.compute_instance.create instead of the real top-level playbook).

Also finishes OSAC-1992's stated goal of eliminating STORAGE_TIERS: removes it from osac-installer's chart default (values.yaml), schema (values.schema.json), and the vmaas-ci CI override -- the only environment that runs the ComputeInstance controller (caas-ci and bmaas-ci both have computeInstance: false). Confirmed via helm template rendering: the storage-operations-ig ConfigMap previously rendered STORAGE_TIERS with the 'local' LVMS tier; after this change that key is gone entirely and the Tier-API-backed register-local-storage.yaml hook (already registering the same 'local' tier/backend) is the only source of truth.

Generated-By: Claude Code (Anthropic)
Signed-off-by: Will Gordon <wgordon@redhat.com>

@akshaynadkarni akshaynadkarni left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akshaynadkarni, wgordon17

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit aac2b52 into osac-project:main Aug 6, 2026
2 checks passed
@wgordon17
wgordon17 deleted the fix/restore-aap-jit-storage-tier-definitions branch August 6, 2026 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants