Overcloud IPA image copied to a shared directory on Ansible control host

[Mark Goddard]

When using overcloud Ironic, IPA images for Ironic inspector are downloaded to the Ansible control host to a cache directory, by default /opt/kayobe/images/ipa/. They are later copied into the local Kolla Ansible configuration under etc/kolla/config/ironic/ironic-agent.{initramfs,kernel}.

The use of a shared cache directory results in problems when multiple users share a single Ansible control host. For example, we may see the following failure:

TASK [Check whether the image cache directory exists] ***************************************************************************************
Tuesday 18 June 2024 08:47:27 +0100 (0:00:00.058) 0:00:01.847 **********
ok: [controller0 -> localhost]

TASK [Ensure the image cache directory exists] ***************************************************************************************
Tuesday 18 June 2024 08:47:27 +0100 (0:00:00.187) 0:00:02.034 **********
skipping: [controller0]

TASK [Ensure Ironic Python Agent images are copied onto the local machine] ***************************************************************************************
Tuesday 18 June 2024 08:47:27 +0100 (0:00:00.035) 0:00:02.069 **********
fatal: [controller0]: FAILED! =>
  msg: 'error while accessing the file /opt/kayobe/images/ipa/ipa.kernel, error was: [Errno 13] Permission denied: b''/opt/kayobe/images/ipa/ipa.kernel'''

We may also see issues if multiple Kayobe environments are deployed from one Ansible control host.

The cache is not strictly necessary, since we can download the images directly to the kayobe-config repo.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kayobe/+/922371

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/kayobe/+/922371
Committed: https://opendev.org/openstack/kayobe/commit/8de02b82b4fb9cd4912d31fa3c9359820545b384
Submitter: "Zuul (22348)"
Branch: master

commit 8de02b82b4fb9cd4912d31fa3c9359820545b384
Author: Mark Goddard <email address hidden>
Date: Wed Jun 19 17:24:37 2024 +0100

    Avoid shared IPA image cache on Ansible control host

    When using overcloud Ironic, IPA images for Ironic inspector are
    downloaded to the Ansible control host to a cache directory, by default
    /opt/kayobe/images/ipa/. They are later copied into the local Kolla
    Ansible configuration under
    etc/kolla/config/ironic/ironic-agent.{initramfs,kernel}.

    The use of a shared cache directory results in problems when multiple
    users share a single Ansible control host, since the cache is created as
    writeable only for the user that created it. Other users sharing the
    same Ansible control host will be unable to write to the cache.

    We may also see issues if multiple Kayobe environments using different
    IPA images are deployed from one Ansible control host.

    The cache is not strictly necessary, since we can download the images
    directly to the kayobe-config repo. This change avoids the use of the
    cache. The performance impact should be minimal, only requiring an
    additional download when a fresh kayobe-config is used.

    Change-Id: I022c53afc0f64ccc79eeff4a220ade4c9216edfc
    Closes-Bug: #2069845

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2024.1
Review: https://review.opendev.org/c/openstack/kayobe/+/929637