Add repo_manager for local repository setup, Pulp deployment, and package/image downloads in air-gapped environments

[snarthan]

Existing Features:

• Automated local repository setup and management for air-gapped environments
• Pulp server deployment with HTTP/HTTPS configuration and SSL certificate generation
• Parallel downloading of RPM packages, container images, and Python packages
• software_config.json validation for defining required software packages
• Credential management with Ansible Vault encryption for secure storage
• RHEL subscription validation and repository URL configuration
• Container image mirroring from Docker Hub, Quay.io, and private registries
• Multi-architecture support (x86_64, aarch64) for container images
• Metadata tracking for repository synchronization status
• Cleanup utilities for removing outdated repositories and artifacts
• local_repo_access.yml generation for compute node repository configuration
• NFS-based shared storage for Pulp data persistence
• Comprehensive input validation with detailed error messages
• Custom Ansible callback plugin for formatted output display
• Endpoint configuration for external Pulp server connections
• Repository name migration for version upgrades
• Retry logic and error handling for network operations
• Configurable concurrency for parallel download tasks
• Detailed logging with separate log files for debugging
  Fixes [Feature request] Omnia Modernization #4849

[abhishek-sa1]

Comprehensive PR Review: repo_manager (PR #4886)

PR Summary

PR: dell/omnia#4886 — Add src/repo_manager/ as a self-contained domain for local repository setup, Pulp deployment, and package/image downloads in air-gapped environments.

Author: snarthan | Target: issue-4849-omnia-modernization

---

Architecture Assessment

The new src/repo_manager/ is structured as a self-contained domain with its own ansible.cfg, library/, roles/, vars/, and input/. This is the correct pattern for Omnia domain segregation.

What's Done Right ✅

• Self-contained ansible.cfg — repo_manager/ansible.cfg and repo_manager/playbooks/ansible.cfg point to domain-local library/ and callback_plugins/ instead of ../../common/
• Clean playbook structure — Well-phased playbook (repo_manager.yml) with clear Phase 1→5 workflow
• Credential separation — Dedicated credential/ role with Vault support, separate repo_manager_config_credentials.yml
• Input contract — input/project_default/ with config, credentials, software_config, endpoint config
• Modular role decomposition — validate_input, validate_subscription, credential, common, deploy_pulp, parse_and_download, validation, pulp_validation, cleanup_pulp
• repo_status.yml generation — generate_local_repo_access module produces output for downstream consumers (image_build_manager)
• Environment variables — Python modules use REPO_MANAGER_BASE_DIR, REPO_MANAGER_INPUT_PROJECT_DIR, OMNIA_BASE_DIR for path resolution

---

Issues Found 🔴

CRITICAL — Must Fix Before Merge

1. Old src/playbooks/local_repo/ NOT removed

The old src/playbooks/local_repo/ directory still exists with full roles, playbooks, and ansible.cfg. This creates two competing implementations of the same functionality.

Impact: Other playbooks still import_playbook from the old location:

• upgrade/roles/upgrade_k8s/tasks/sync_local_repo.yml → {{ role_path }}/../../local_repo/local_repo.yml
• upgrade/roles/upgrade_k8s/tasks/prep_sync_all_repos.yml → {{ role_path }}/../../local_repo/local_repo.yml
• prepare_oim/roles/deploy_containers/common/vars/main.yml → user-facing message referencing local_repo/local_repo.yml

Required action:

• Delete src/playbooks/local_repo/ entirely (roles, playbooks, ansible.cfg)
• Update all callers in upgrade/, rollback/, prepare_oim/ to point to src/repo_manager/playbooks/repo_manager.yml
• Update user-facing messages from local_repo.yml → repo_manager.yml

2. Hardcoded /opt/omnia path in input_project_dir

# vars/default.yml line 43
input_project_dir: "/opt/omnia/input/project_default/repo_manager"

This is hardcoded and not derived from repo_manager_base_dir. If the domain is invoked outside the NFS mount (e.g., standalone mode or development), it will fail.

Fix: Use {{ repo_manager_base_dir }}/input/{{ project_default }} or derive from omnia_base_dir.

3. Duplicate metadata file path — inconsistent definition

omnia_metadata_file is defined in three places with different paths:

• vars/default.yml:48 → {{ omnia_base_dir }}/.data/oim_metadata.yml
• roles/parse_and_download/vars/main.yml:19 → /opt/omnia/.data/oim_metadata.yml (hardcoded)
• roles/common/vars/main.yml:17 → /opt/omnia/.data/oim_metadata.yml (hardcoded)

The role-level hardcoded paths will shadow the default.yml variable and break if omnia_base_dir ever changes.

Fix: Remove the hardcoded definitions from role vars; let them inherit from vars/default.yml.

4. repo_manager_input_project_dir hardcoded in roles/common/vars/main.yml

# roles/common/vars/main.yml:48
repo_manager_input_project_dir: "/opt/omnia/input/project_default/repo_manager"

Same hardcoding issue. Should reference {{ omnia_base_dir }}/input/{{ project_default }}/repo_manager or be removed entirely since include_input_dir.yml sets input_project_dir dynamically.

---

HIGH — Should Fix

5. Old local_repo.yml references in user-facing messages

# roles/validation/vars/main.yml:25-32
usage_message: |
  "WARNING:
  ...please run this playbook using:
    ansible-playbook local_repo.yml -e "softwares=<list..."

And:

# roles/parse_and_download/tasks/main.yml:186
'Refer to the localrepo logs for more details. Rerun local_repo.yml.'

These messages tell the user to run a playbook name that no longer exists.

Fix: Update all messages to reference repo_manager.yml.

6. repo_manager_metadata_support: false but metadata still loaded in parse_and_download

vars/default.yml:31 sets repo_manager_metadata_support: false, and include_input_dir.yml guards the metadata include with when: repo_manager_metadata_support. But parse_and_download/tasks/main.yml:22-25 does an unconditional include_vars of omnia_metadata_file:

- name: Include oim metadata vars
  ansible.builtin.include_vars:
    file: "{{ omnia_metadata_file }}"
    name: oim_shared_path_from_metadata

This will fail if the metadata file doesn't exist.

Fix: Add when: repo_manager_metadata_support | default(false) guard or ensure the file always exists.

7. repo_manager.yml Phase 1.1 also loads metadata unconditionally

# repo_manager.yml:71-76
- name: Include metadata vars
  ansible.builtin.include_vars:
    file: "{{ omnia_metadata_file }}"
    name: oim_shared_path_from_metadata

Same issue — no guard.

8. SELinux phase references omnia_share_option from localhost but it's only set via metadata

# repo_manager.yml:187
when: hostvars['localhost']['omnia_share_option'] == 'Local'

If metadata loading fails (issue #6/#7), this will fail with undefined variable.

---

MEDIUM — Recommend Fixing

9. pulp_concurrency: 1 in parse_and_download vars

Fixed at 1 for NFS safety. Consider making this configurable via repo_manager_config.yml since users with local/SAN storage could benefit from higher concurrency. The comments explain this well but it's not user-configurable.

10. Missing repo_config pass-through in completion phase

repo_manager.yml:252 passes repo_config to generate_local_repo_access, but this fact is set in Phase 1.1:

repo_config: "{{ software_config.repo_config }}"

If the playbook is re-run with --start-at-task after Phase 1.1, repo_config will be undefined.

11. No .gitignore for sensitive files

The input/project_default/ contains repo_manager_config_credentials.yml with empty credential fields. While safe now, there's no .gitignore to prevent accidentally committing populated credentials.

12. Copyright year inconsistency

• include_input_dir.yml, create_container_group.yml, get_config_credentials.yml header: Copyright 2025
• repo_manager.yml, deploy_pulp.yml, vars/default.yml header: Copyright 2026

Should be consistent (2026 for new files).

---

LOW — Nice to Have

13. validate_config.yml:60 uses jq command without dependency check

- name: Validate JSON before loading
  ansible.builtin.command: "jq . {{ input_project_dir }}/software_config.json"

If jq is not installed, this fails silently (ignore_errors: true). Consider using Python JSON validation instead.

14. Duplicate base_path and log_dir aliases

vars/default.yml:46-47 defines both log_dir and base_path as aliases for repo_manager_log_dir. This is confusing — one should be removed.

---

Files to Remove / Clean Up

Action	Path	Reason
DELETE	src/playbooks/local_repo/ (entire directory)	Replaced by src/repo_manager/
UPDATE	src/playbooks/upgrade/roles/upgrade_k8s/tasks/sync_local_repo.yml	Points to old local_repo/local_repo.yml
UPDATE	src/playbooks/upgrade/roles/upgrade_k8s/tasks/prep_sync_all_repos.yml	Points to old local_repo/local_repo.yml
UPDATE	src/playbooks/prepare_oim/roles/deploy_containers/common/vars/main.yml	References local_repo/local_repo.yml in user messages
UPDATE	src/playbooks/upgrade/roles/upgrade_k8s/tasks/preflight_checks_pulp.yml	References local_repo/local_repo.yml in error messages
UPDATE	src/playbooks/upgrade/roles/upgrade_k8s/vars/main.yml	References local_repo/local_repo.yml
UPDATE	src/playbooks/upgrade/roles/upgrade_cluster/tasks/main.yml	References local_repo/local_repo.yml in user docs

---

Verdict: Needs Changes

The domain structure is well-designed. The critical blocker is the old playbooks/local_repo/ not being removed and callers not being updated. Fix the 4 critical items, the hardcoded paths, and the stale user messages before merge.