OpenShift v1 Deployment Config not idempotent

[chouseknecht]

Testing my new k8s module, using the openshift client, I'm running into the following differences when submitting a Deployment Config multiple times:

        "differences": [
            [
                "change",
                [
                    "spec",
                    "template",
                    "spec",
                    "containers",
                    0,
                    "volume_mounts",
                    0,
                    "read_only"
                ],
                [
                    null,
                    false
                ]
            ],
            [
                "change",
                [
                    "spec",
                    "template",
                    "spec",
                    "containers",
                    0,
                    "security_context"
                ],
                [
                    null,
                    {
                        "capabilities": null,
                        "privileged": null,
                        "read_only_root_filesystem": null,
                        "run_as_non_root": null,
                        "run_as_user": null,
                        "se_linux_options": null
                    }
                ]
            ]

Here's the Deployment Config I'm sending:

           "kind": "DeploymentConfig",
            "metadata": {
                "labels": {
                    "app": "galaxy",
                    "service": "elastic"
                },
                "name": "elastic",
                "namespace": "testing"
            },
            "spec": {
                "replicas": 0,
                "strategy": {
                    "type": "Rolling"
                },
                "template": {
                    "metadata": {
                        "labels": {
                            "app": "galaxy",
                            "service": "elastic"
                        }
                    },
                    "spec": {
                        "containers": [
                            {
                                "command": [
                                    "elasticsearch"
                                ],
                                "image": "ansible/galaxy-elasticsearch:2.4.6",
                                "name": "elastic",
                                "state": "present",
                                "volumeMounts": [
                                    {
                                        "mountPath": "/usr/share/elasticsearch/data",
                                        "name": "elastic-volume"
                                    }
                                ]
                            }
                        ],
                        "volumes": [
                            {
                                "name": "elastic-volume",
                                "persistentVolumeClaim": {
                                    "claimName": "elastic-volume"
                                }
                            }
                        ]
                    }
                }
            }
        }

[awiddersheim]

This may be related to #69.

[chouseknecht]

@awiddersheim

Turns out, I'm actually passing bad parameters. First, the config I was passing, was actually the following:

         apiVersion: v1
          kind: deployment_config
          metadata:
              name: elastic
              labels:
                  app: galaxy
                  service: elastic
              namespace: '{{ openshift_project }}'
          spec:
              template:
                  metadata:
                      labels:
                          app: galaxy
                          service: elastic
                  spec:
                      containers:
                        - name: elastic
                          securityContext: {}
                          state: present
                          volumeMounts:
                            - readOnly: false
                              mountPath: /usr/share/elasticsearch/data
                              name: elastic-volume
                          command: ['elasticsearch']
                          image: 'ansible/galaxy-elasticsearch:2.4.6'
                      volumes:
                        - name: elastic-volume
                          persistentVolumeClaim:
                              claimName: elastic-volume
              replicas: 0
              strategy:
                  type: Rolling

Notice the above explicitly sets the security context to {}, which makes no sense. You either set attributes within the context, or don't do anything. However, setting the whole context to null, isn't valid.

And, in volumeMounts, I explicitly set readOnly to false, which again, makes no sense. It's either True or not set. I explicitly set it to False, which is different than not set or null.

The openshift client did exactly what I told it to:

• Get the existing deployment config.
• Update that existing object with my parameters.
• See if my modified object is different than the original. And since my parameters aren't very thoughtful, the objects end up being different.

Turns out the API is more forgiving than our Python client.

[Sispheor]

I have the same issue with a chained build config.

- name: Angular runner build config
  k8s:
    host: "{{ oc_host }}"
    api_key: "{{ oc_token }}"
    verify_ssl: no
    state: present
    namespace: "{{ project_name }}"
    definition:
      apiVersion: v1
      kind: BuildConfig
      metadata:
        name: "{{ frontend_app_name }}"
        labels:
          app: kermit-frontend
      spec:
        successfulBuildsHistoryLimit: 2
        failedBuildsHistoryLimit: 2
        output:
          to:
            kind: ImageStreamTag
            name: "{{ frontend_app_name }}:latest"
        runPolicy: Serial
        source:
          images:
          - from:
              kind: ImageStreamTag
              name: front-angular-build:latest
            paths:
              - destinationDir: "."
                sourcePath: /app/dist
              - destinationDir: "."
                sourcePath: /app/front-angular-run.dockerfile
              - destinationDir: "."
                sourcePath: /app/nginx.conf
        strategy:
          dockerStrategy:
            dockerfilePath: "./front-angular-run.dockerfile"
        triggers:
          - type: ConfigChange
          - type: ImageChange
            imageChange:
              from:
                kind: "ImageStreamTag"
                name: "front-angular-build:latest"

Every time I run the playbook, the build config is updated, and so my deployment is triggered for nothing...

[fabianvf]

Thanks for reporting this issue! We're currently looking at how we can revamp our diffing logic to make complex resources like this able to be updated idempotently, by addings support for the 3 way merge algorithm used by kubectl apply. You can follow that work in #228.

Unfortunately I don't know of a usable workaround at the moment, since the modules are currently assuming that the server will not act on requests that don't actually change the resource.

[Sispheor]

Thanks for the answer! I'll wait your update then.
Thanks a lot for your support.

[fabianvf]

No problem! Just a warning though, it's a fairly major change so it might not even make it into Ansible 2.8