[operator] variable corruption between roles when upgrading spec.version

[jmazzitelli]

When you upgrade a Kiali CR from one spec.version to another, the remove role is called and then the deploy role. If the remove role changes its kiali_vars, because facts are global, this will corrupt the kiali_vars expected in the deploy role.

I think the solution is to have a different global fact name in the remove role so it doesn't have the same name as the deploy role (this means rename kiali_vars in the remove role to something like kiali_vars_remove).

see https://issues.redhat.com/browse/OSSM-4009

• PR: rename kiali_vars to kiali_vars_remove so it is unique to the remove role kiali-operator#652
• backport PR 1.65: [v1.65] rename kiali_vars to kiali_vars_remove so it is unique to the remove role kiali-operator#653

[jmazzitelli]

Here's a simple ansible test I used to illustrate what I believe is happening.

playbooks-and-roles.zip

This follows the basic layout of the kiali operator with a main playbook and two roles (role-one and role-two are analgous to kiali-remove and kiali-deploy roles in the operator).

Run this:

$ ansible-playbook -e doit=false playbooks/run.yml

results in:

TASK [VARIABLES AFTER role-one] ***************************************************************************************
ok: [localhost] => {
    "msg": "UNSET"
}
...
TASK [VARIABLES AFTER role-two] ***************************************************************************************
ok: [localhost] => {
    "msg": {
        "deployment": {
            "image_name": "image_name DEFAULT FROM role-two"
        },
        "external_services": {
            "prometheus": "prometheus DEFAULT FROM role-two"
        },
        "istio_namespace": "from role-two"
    }
}
...

And you see the kiali_vars from role-one does not corrupt the kiali_vars from role-two - that's because role-one doesn't set a fact called kiali_vars due to doit=false.

But now run this:

ansible-playbook -e doit=true playbooks/run.yml 

results in:

...
TASK [VARIABLES AFTER role-one] ***************************************************************************************
ok: [localhost] => {
    "msg": {
        "deployment": {
            "image_name": "role-one-image-name"
        }
    }
}
...
TASK [VARIABLES AFTER role-two] ***************************************************************************************
ok: [localhost] => {
    "msg": {
        "deployment": {
            "image_name": "role-one-image-name"
        },
        "istio_namespace": "from role-two"
    }
}
...

Notice role-two lost external_services from kiali_vars and image_name came from role-one. This means role-one kiali_vars made it over to role-two, which is not what we want. Facts are global and exist across role invocations. So we need to make sure the one role doesn't set facts that corrupt facts in another role.