install --dry-run not so dry (makes changes)

[scaleoutsean]

According to TFM (https://netapp-trident.readthedocs.io/en/stable-v18.10/kubernetes/deploying.html):

"The --dry-run argument tells the installer to inspect the current environment and checks that everything looks good for a Trident installation, but it makes no changes to the environment and will not install Trident."

./tridentctl install --dry-run -n trident
INFO Created installer service account.            serviceaccount=trident-installer
INFO Created installer cluster role.               clusterrole=trident-installer
INFO Created installer cluster role binding.       clusterrolebinding=trident-installer
INFO Created installer configmap.                  configmap=trident-installer
INFO Created installer pod.                        pod=trident-installer
INFO Waiting for Trident installer pod to start.  
INFO Trident installer pod started.                namespace=trident pod=trident-installer
INFO Starting storage driver.                      backend=/setup/backend.json
ERRO API request failed.                           request=GetAccountByName responseCode=401 responseStatus="401 Unauthorized"
ERRO API request failed.                           request=AddAccount responseCode=401 responseStatus="401 Unauthorized"
ERRO Error detected in AddAccount API response: HTTP error: 401 Unauthorized 
ERRO Failed to initialize SolidFire driver while creating account.  error="device API error" tenantName=trident
FATA Install failed; could not start the storage backend driver; problem initializing storage driver 'solidfire-san': device API error.  Resolve the issue; use 'tridentctl uninstall' to clean up; and try again. 

I had a typo in my backend.json (for solidfire-san.json, concretely).
But why is it saying I should uninstall? I used --dry-run.... Fix the typo and try again:

sean@k8s1:~/trident-installer$ ./tridentctl install --dry-run -n trident
FATA Install failed; trident installer pod 'trident-installer' is already present in namespace trident; please remove it manually and try again.  Resolve the issue; use 'tridentctl uninstall' to clean up; and try again. 

Oops... Okay, uninstall, fix the typo and try another dry run:

 ./tridentctl install --dry-run -n trident
INFO Created installer service account.            serviceaccount=trident-installer
INFO Created installer cluster role.               clusterrole=trident-installer
INFO Created installer cluster role binding.       clusterrolebinding=trident-installer
INFO Created installer configmap.                  configmap=trident-installer
INFO Created installer pod.                        pod=trident-installer
INFO Waiting for Trident installer pod to start.  
INFO Trident installer pod started.                namespace=trident pod=trident-installer
INFO Starting storage driver.                      backend=/setup/backend.json
INFO Please ensure all relevant hosts are added to one of the specified Volume Access Groups.  AccessGroups="[2]" SVIP="10.128.59.84:3260" UseCHAP=false driver=solidfire-san
INFO Storage driver loaded.                        driver=solidfire-san
INFO Dry run completed, no problems found.        
INFO Waiting for Trident installer pod to finish. 
INFO Trident installer pod finished.               namespace=trident pod=trident-installer
INFO Deleted installer pod.                        pod=trident-installer
INFO Deleted installer configmap.                  configmap=trident-installer
INFO In-cluster installation completed.           
INFO Deleted installer cluster role binding.      
INFO Deleted installer cluster role.              
INFO Deleted installer service account. 

Created... and Deleted... look like changes to me.

Perhaps the doco should be changed to say it won't create changes if it can complete without errors... But that may not be how --dry-run is expected to behave, IMHO.

[innergy]

Good catch. This is an artifact of new installer behavior that runs the bulk of the install in the cluster itself. In order to do that it has to create temporary resources in the cluster for the installer itself, even when it's performing a dry run. It should not be leaving those resources behind if the dry run (or even a regular run) fails, however.

[adkerr]

I think we may actually be creating changes in solidfire in successful dry runs as well. Specifically it will create the tenant/account if it doesn’t exist.

[clintonk]

If the install fails, the installer leaves the trident-installer pod around in case any further inspection is warranted. The uninstaller always starts by cleaning up any leftover install pod.

[innergy]

I think that's fine if it's not a dry run. A dry run should always leave both the cluster and the storage in the same state it was in before it started.

[Mundy667]

I stumbled over the same issue today. With the dry-run option it should have same state before it started. If this is not possible, at least the uninstall command should clean everything fully.

[korenaren]

--dry-run is no longer needed with Trident 19.07 (or later), and is no longer in the documentation. The --dry-run feature was only needed to validate that Trident could access the backend to create it's own PV for etcd. Since Trident now uses CRDs for it's persistent storage, you don't need to check for a backend any longer.