Download artifacts

.github/workflows/molecule.yml

@@ -29,6 +29,7 @@ jobs:
         scenario:
           - cluster-api
           - cluster-api-upgrade
+          - download-artifacts
           - helm
           - upload-helm-chart
         distro:

molecule/download-artifacts/converge.yml

@@ -0,0 +1,15 @@
+# Copyright (c) 2023 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- import_playbook: vexxhost.kubernetes.download_artifacts

molecule/download-artifacts/molecule.yml

@@ -0,0 +1,39 @@
+# Copyright (c) 2023 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2004}-ansible:latest
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    privileged: true
+    cgroupns_mode: host
+    pre_build_image: true
+    environment:
+      container: docker
+    security_opts:
+      - apparmor=unconfined
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+      - /lib/modules:/lib/modules:ro
+provisioner:
+  name: ansible
+  config_options:
+    connection:
+      pipelining: true
+verifier:
+  name: ansible

molecule/download-artifacts/prepare.yml

@@ -0,0 +1,33 @@
+# Copyright (c) 2023 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Prepare
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: Wait for systemd to complete initialization
+      ansible.builtin.command: systemctl is-system-running
+      register: systemctl_status
+      until: >
+        'running' in systemctl_status.stdout or
+        'degraded' in systemctl_status.stdout
+      retries: 30
+      delay: 5
+      changed_when: false
+      failed_when: systemctl_status.rc > 1
+  tasks:
+    - name: Run APT update
+      ansible.builtin.apt:
+        update_cache: yes
+      when: ansible_facts['pkg_mgr'] == "apt"

playbooks/download_artifacts.yml

@@ -0,0 +1,54 @@
+- name: Download artifacts for all roles
+  hosts: "{{ target | default('all') }}"
+  gather_facts: false
+  vars:
+    role_location: "{{ playbook_dir }}/../roles"
+
+    # some role defaults use vars only defined in the download_artifact role
+    _download_artifact_goarch_groups:
+      x86_64: amd64
+      aarch64: arm64
+      armv7l: arm
+
+    download_artifact_goarch: >-
+      {%- if ansible_facts['architecture'] in _download_artifact_goarch_groups -%}
+      {{ _download_artifact_goarch_groups[ansible_facts['architecture']] }}
+      {%- else -%}
+      {{ ansible_facts['architecture'] }}
+      {%- endif -%}
+
+    # ansible-lint will not allow these intermediate values on include_role, so place them here instead
+    _archive_checksum: "{{ lookup('vars', item ~ '_archive_checksum', default='') }}"
+    _checksum: "{{ lookup('vars', item ~ '_binary_checksum', default=_archive_checksum) }}"
+    _binary_version: "{{ lookup('vars', item ~ '_version', default='') }}"
+    _download_dest: "{{ lookup('vars', item ~ '_download_dest') }}"
+    _binary_dest: "{{ download_artifact_work_directory ~ '/' ~ item ~ '-' ~ _binary_version ~ '-' ~ download_artifact_goarch }}"
+
+  tasks:
+    - name: Gather minimal facts
+      ansible.builtin.setup:
+        gather_subset: min
+
+    - name: Find all subdirectories in the role location
+      ansible.builtin.find:
+        file_type: directory
+        paths: "{{ role_location }}"
+        recurse: true
+      register: role_paths
+
+    - name: Select only defaults/ directories and load vars
+      ansible.builtin.include_vars:
+        dir: "{{ item.path }}"
+      with_items: "{{ role_paths.files | selectattr('path', 'search', 'defaults') }}"
+
+    - name: Download all artifacts defined by *_download_url
+      ansible.builtin.include_role:
+        name: vexxhost.containers.download_artifact
+      vars:
+        download_artifact_url: "{{ lookup('vars', item ~ '_download_url') }}"
+        download_artifact_dest: "{{ _download_dest | regex_search('/usr/') | ternary(_binary_dest, _download_dest) }}"
+        download_artifact_checksum: "sha256:{{ _checksum }}"
+        download_artifact_owner: root
+        download_artifact_mode: "0755"
+        download_artifact_unarchive: false
+      with_items: "{{ query('varnames', '_download_url$') | map('replace', '_download_url', '') }}"

roles/helm/defaults/main.yml

@@ -23,7 +23,7 @@ helm_checksums:
 
 helm_download_url: "https://get.helm.sh/helm-{{ helm_version }}-{{ ansible_facts['system'] | lower }}-{{ download_artifact_goarch }}.tar.gz"
 helm_download_dest: "{{ download_artifact_work_directory }}/helm-{{ helm_version }}-{{ ansible_facts['system'] | lower }}-{{ download_artifact_goarch }}.tar.gz"
-helm_binary_checksum: "{{ helm_checksums[download_artifact_goarch][helm_version] }}"
+helm_archive_checksum: "{{ helm_checksums[download_artifact_goarch][helm_version] }}"
 
 # NOTE(fitbeard): This is to accomodate for the uninstallation of the old packages
 #               that shipped with the operating system
@@ -38,5 +38,5 @@ helm_diff_checksums:
     v3.8.1: d451e4772a3987710f485de4caed760583c88f8f15864a623b3fbd73be7077ec
 
 helm_diff_download_url: "https://github.com/databus23/helm-diff/releases/download/{{ helm_diff_version }}/helm-diff-{{ ansible_facts['system'] | lower }}-{{ download_artifact_goarch }}.tgz" # noqa: yaml[line-length]
-helm_diff_download_dest: "{{ download_artifact_work_directory }}/helm-diff-{{ ansible_facts['system'] | lower }}-{{ download_artifact_goarch }}.tgz"
-helm_diff_checksum: "{{ helm_diff_checksums[download_artifact_goarch][helm_diff_version] }}"
+helm_diff_download_dest: "{{ download_artifact_work_directory }}/helm-diff-{{ helm_diff_version }}-{{ ansible_facts['system'] | lower }}-{{ download_artifact_goarch }}.tgz" # noqa: yaml[line-length]
+helm_diff_archive_checksum: "{{ helm_diff_checksums[download_artifact_goarch][helm_diff_version] }}"

roles/helm/meta/main.yml

@@ -35,7 +35,7 @@ dependencies:
   - role: vexxhost.containers.download_artifact
     download_artifact_url: "{{ helm_download_url }}"
     download_artifact_dest: "{{ helm_download_dest }}"
-    download_artifact_checksum: "sha256:{{ helm_binary_checksum }}"
+    download_artifact_checksum: "sha256:{{ helm_archive_checksum }}"
     download_artifact_owner: root
     download_artifact_mode: "0755"
     download_artifact_unarchive: true

roles/helm/tasks/main.yml

@@ -50,7 +50,7 @@
       vars:
         download_artifact_url: "{{ helm_diff_download_url }}"
         download_artifact_dest: "{{ helm_diff_download_dest }}"
-        download_artifact_checksum: "sha256:{{ helm_diff_checksum }}"
+        download_artifact_checksum: "sha256:{{ helm_diff_archive_checksum }}"
         download_artifact_owner: root
         download_artifact_mode: "0755"
         download_artifact_unarchive: true

roles/kubeadm/defaults/main.yml

@@ -12,6 +12,9 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+kubeadm_versions: "{{ kubeadm_checksums['amd64'].keys() | list | community.general.version_sort }}"
+kubeadm_version: "{{ kubeadm_versions | last }}"
+
 kubeadm_checksums:
   amd64:
     1.19.16: 08d974f58230a2f5bf52945f6168f4794bf1aa440ad055ba46637edadf97374e

roles/kubectl/defaults/main.yml

@@ -12,6 +12,9 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+kubectl_versions: "{{ kubectl_checksums['amd64'].keys() | list | community.general.version_sort }}"
+kubectl_version: "{{ kubectl_versions | last }}"
+
 kubectl_checksums:
   amd64:
     1.19.16: 6b9d9315877c624097630ac3c9a13f1f7603be39764001da7a080162f85cbc7e

roles/kubelet/defaults/main.yml

@@ -12,6 +12,9 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+kubelet_versions: "{{ kubelet_checksums['amd64'].keys() | list | community.general.version_sort }}"
+kubelet_version: "{{ kubelet_versions | last }}"
+
 kubelet_checksums:
   amd64:
     1.19.16: 26b707d1c38135c72612f5272c30a0a3aeec66b971fb2258a714c687bceb85b5