Add execution_role_arn parameter #41849

mjmayer · 2018-06-22T17:43:57Z

SUMMARY

Fargate support requires containers to have the executionRoleArn defined. This PR adds that parameter.
Fixes #41848

ISSUE TYPE

Feature Pull Request

COMPONENT NAME

ecs_taskdefinition

ANSIBLE VERSION

ansible 2.7.0.dev0 (devel 46dbb3e1e8) last updated 2018/06/22 10:32:41 (GMT -700)
  config file = None
  configured module search path = [u'/home/mjmayer/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/mjmayer/ansible/lib/ansible
  executable location = /home/mjmayer/ansible/bin/ansible
  python version = 2.7.5 (default, Apr 11 2018, 17:41:36) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28.0.1)]

ansibot · 2018-06-22T18:11:30Z

The test ansible-test sanity --test pylint [explain] failed with 1 error:

lib/ansible/modules/cloud/amazon/ecs_taskdefinition.py:306:0: trailing-whitespace Trailing whitespace

The test ansible-test sanity --test pep8 [explain] failed with 1 error:

lib/ansible/modules/cloud/amazon/ecs_taskdefinition.py:306:73: W291 trailing whitespace

click here for bot help

ansibot · 2018-06-22T18:11:30Z

cc @Java1Guy @willthames
click here for bot help

Botocore version checking is becomming more common. Changing the ecs_taskdefinition to use AnsibleAWSmodule allows more easily for this.

s-hertel · 2018-06-22T20:05:56Z

lib/ansible/modules/cloud/amazon/ecs_taskdefinition.py

@@ -319,6 +326,10 @@ def main():
        if not task_mgr.ecs_api_supports_requirescompatibilities():
            module.fail_json(msg='botocore needs to be version 1.8.4 or higher to use launch_type')

+    if module.params['task_role_arn']:
+        if not module.botocore_at_least('1.10.44'):


Thanks for adding this! Do you mind doing the same for launch_type above by replacing if not task_mgr.ecs_api_supports_requirescompatibilities(): with if not module.botocore_at_least('1.8.4'):?

willthames · 2018-06-24T07:43:41Z

lib/ansible/modules/cloud/amazon/ecs_taskdefinition.py

@@ -225,6 +230,7 @@ def register_task(self, family, task_role_arn, network_mode, container_definitio
        params = dict(
            family=family,
            taskRoleArn=task_role_arn,
+            executionRoleArn=execution_role_arn,


executionRoleArn must not be set if it's not required, otherwise anyone relying on this module will need to upgrade to a very recent botocore.

willthames · 2018-06-25T11:34:12Z

It's worth noting that this fails the existing test suite.

<127.0.0.1> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1529926266.6214693-137085483742155/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py", line 488, in <module>
    main()
  File "/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py", line 456, in main
    module.params['memory'])
  File "/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py", line 246, in register_task
    response = self.ecs.register_task_definition(**params)
  File "/usr/lib/python3.6/site-packages/botocore/client.py", line 312, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/lib/python3.6/site-packages/botocore/client.py", line 579, in _make_api_call
    api_params, operation_model, context=request_context)
  File "/usr/lib/python3.6/site-packages/botocore/client.py", line 634, in _convert_to_request_dict
    api_params, operation_model)
  File "/usr/lib/python3.6/site-packages/botocore/validate.py", line 291, in serialize_to_request
    raise ParamValidationError(report=report.generate_report())
botocore.exceptions.ParamValidationError: Parameter validation failed:
Unknown parameter in input: "executionRoleArn", must be one of: family, taskRoleArn, networkMode, containerDefinitions, volumes, placementConstraints

fatal: [localhost]: FAILED! => {
    "changed": false,
    "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py\", line 488, in <module>\n    main()\n  File \"/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py\", line 456, in main\n    module.params['memory'])\n  File \"/tmp/ansible_e53r2y2w/ansible_module_ecs_taskdefinition.py\", line 246, in register_task\n    response = self.ecs.register_task_definition(**params)\n  File \"/usr/lib/python3.6/site-packages/botocore/client.py\", line 312, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n  File \"/usr/lib/python3.6/site-packages/botocore/client.py\", line 579, in _make_api_call\n    api_params, operation_model, context=request_context)\n  File \"/usr/lib/python3.6/site-packages/botocore/client.py\", line 634, in _convert_to_request_dict\n    api_params, operation_model)\n  File \"/usr/lib/python3.6/site-packages/botocore/validate.py\", line 291, in serialize_to_request\n    raise ParamValidationError(report=report.generate_report())\nbotocore.exceptions.ParamValidationError: Parameter validation failed:\nUnknown parameter in input: \"executionRoleArn\", must be one of: family, taskRoleArn, networkMode, containerDefinitions, volumes, placementConstraints\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE",
    "rc": 1
}

willthames · 2018-06-25T22:50:45Z

Could we have a test for this change?

willthames · 2018-06-27T00:16:09Z

test/integration/targets/ecs_cluster/playbooks/roles/ecs_cluster/tasks/main.yml

+        - AmazonEC2ContainerServiceRole
+        <<: *aws_connection_info
+
+    - name: gather facts for the ecsTaskExecutionRole


Should be able to access this from registering the results of the previous task

I registered the output from iam_role task and reran the tests. The tests passed.

Task was unecessary. The same information could be gathered by registering the iam_role task.

willthames · 2018-07-04T04:34:30Z

Merged, thanks @mjmayer

Add execution_role_arn parameter

6c3f32d

Change ecs_taskdefinition to use AnsibleAWSmodule

c6d1f23

Botocore version checking is becomming more common. Changing the ecs_taskdefinition to use AnsibleAWSmodule allows more easily for this.

ansibot added community_review In order to be merged, this PR must follow the community review workflow. and removed ci_verified Changes made in this PR are causing tests to fail. needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. labels Jun 22, 2018

s-hertel removed the needs_triage Needs a first human triage before being processed. label Jun 22, 2018

s-hertel reviewed Jun 22, 2018

View reviewed changes

mjmayer and others added 2 commits June 22, 2018 13:32

Change launch type check to use botocore_at_least function

22e7e5c

Remove execution_role_arn param from params dict

4024da6

willthames suggested changes Jun 24, 2018

View reviewed changes

ansibot added needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. and removed community_review In order to be merged, this PR must follow the community review workflow. labels Jun 24, 2018

mjmayer added 4 commits June 26, 2018 20:23

Change check to use parameter

c5d42da

Fix typo

7f09f77

Add test for old botocore version

29fedb3

Add test for execution role parameter

08ea4e9

ansibot added the test This PR relates to tests. label Jun 26, 2018

willthames reviewed Jun 27, 2018

View reviewed changes

Remove iam_role_facts task

e500efd

Task was unecessary. The same information could be gathered by registering the iam_role task.

willthames approved these changes Jun 27, 2018

View reviewed changes

ansibot added community_review In order to be merged, this PR must follow the community review workflow. and removed needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. labels Jun 27, 2018

willthames merged commit b60fc33 into ansible:devel Jul 4, 2018

ansible locked and limited conversation to collaborators Jul 5, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add execution_role_arn parameter #41849

Add execution_role_arn parameter #41849

mjmayer commented Jun 22, 2018

ansibot commented Jun 22, 2018

ansibot commented Jun 22, 2018

s-hertel Jun 22, 2018

willthames Jun 24, 2018

willthames commented Jun 25, 2018

willthames commented Jun 25, 2018

willthames Jun 27, 2018

mjmayer Jun 27, 2018

willthames commented Jul 4, 2018

Add execution_role_arn parameter #41849

Add execution_role_arn parameter #41849

Conversation

mjmayer commented Jun 22, 2018

SUMMARY

ISSUE TYPE

COMPONENT NAME

ANSIBLE VERSION

ansibot commented Jun 22, 2018

ansibot commented Jun 22, 2018

s-hertel Jun 22, 2018

Choose a reason for hiding this comment

willthames Jun 24, 2018

Choose a reason for hiding this comment

willthames commented Jun 25, 2018

willthames commented Jun 25, 2018

willthames Jun 27, 2018

Choose a reason for hiding this comment

mjmayer Jun 27, 2018

Choose a reason for hiding this comment

willthames commented Jul 4, 2018