- ee organization can be changed to null (less restrictive)
- if organization is null, cannot be assigned to org (more restrictive)
- if org is assigned, it cannot be set to a different org
- Adds a Metrics() class that can track data such as number of
events the callback receiver inserted into database
- Exposes this metric data at the api/v2/metrics/ endpoint.
This data is prometheus-friendly
- Metric data is stored in memory, then periodically saved to Redis.
- Metric data is periodically broadcast to other nodes in the cluster,
so that each node has a copy of the most recent metric data collected.
Various points (e.g. created, running, processing events), are
structured into json format and output to /var/log/tower/job_lifecycle.log
As part of this work, the DependencyGraph is reworked to return
which job object is doing the blocking, rather than a boolean.
When targeting, ../workflow_job_templates/id#/workflow_nodes/ endpoint,
user could not set all_parents_must_converge to true.
3.7.1 backport for awx issue #7063
kubectl and synchronize are now part of community.kubernetes
and ansible.posix collections, respectively. This change installs
these collections to a local directory to be used in inventory and
isolated management playbooks.
awx issue #6930
With AWX_AUTO_DEPROVISION_INSTANCES on, instances
are registered with an ip address. However, new
instances might try to register before old instances
are deprivisioned. In this case old IPs can conflict with
the new ones. This will check for an ip conflict and unset
the IP of conflicting instance (set to None)
ansible/awx issue 6750
Fixed bug where an org admin was not able to add
an orphaned user to the org, in the case where the
orphan had an ancestor role that matched one of the
roles for of the org admin.
scenario to fix -- sue is member of cred1, where cred1 is
part of org1. org1 admin cannot add sue to org1, because
the cred1 role for sue has an ancestor to org1 role. The org1
admin cannot change or attach sue to org1.
tower issue #4198 and #4197
The commit is intended to speed up the cleanup_jobs command in awx. Old
methods takes 7+ hours to delete 1 million old jobs. New method takes
around 6 minutes.
Leverages a sub-classed Collector, called AWXCollector, that does not
load in objects before deleting them. Instead querysets, which are
lazily evaluated, are used in places where Collector normally keeps a
list of objects.
Finally, a couple of tests to ensure parity between old Collector and
AWXCollector. That is, any object that is updated/removed from the
database using Collector should be have identical operations using
AWXCollector.
tower issue 1103
Scenario - job is launched and spawns inventory update and project update.
If the inventory update fails, then it will fail the job and the project update.
It will fail the project update even if that update already ran and was successful.
This code change will not fail the project update if it has already ran successfully.
In cases where other jobs depend on that project update (but not the failed inventory
update), then we don't want those jobs to fail.
This adds a boolean "dependencies_processed" field to UnifiedJob
model. The default value is False. Once the task manager generates
dependencies for this task, it will not generate them again on
subsequent runs.
The changes also remove .process_dependencies(), as this method repeats
the same code as .process_pending_tasks(), and is not needed. Once
dependencies are generated, they are handled at .process_pending_tasks().
Adds a unit test that should catch regressions for this fix.
Versions selected to be pre-19 pip
due to unresolved issues with the build systems
Upgrade everything, party on
document new process
rotate license files
fix Swagger schema generation target
Remove --ignore-installed flag
A running job that has an inventory source will block
that inventory update from running. This fix removes
the block.
The test creates a job in running state, and an inventory
update in pending state. The test asserts that the
task manager and dependency graph .is_job_blocked method
returns False for the inventory update (i.e. update can
run).
issue #4809
A running job that has a project update will block
that update from running. This fix removes
the block.
Adds a functional test that sets up a job in "running" state, and
starts a project update that is in "pending" state. Assert that
the task manager and dependency graph .is_job_blocked methods both
return False.
issue #5153
Users can specify a list of keys, or a list of key:value pairs under
source variables. e.g. tags: Creator, peanutbutter or tags:
Creator:jmarshall, peanutbutter:jelly. If provided, only hosts that have
all keys or key:value pairs in the list will be returned.
inventory.py sets up the azure_rm.yml that provides
exclude_host_filters. This code adds a line for each key in the list, as
well as an additional line in the case of a key:value pair.
e.g.
exclude_host_filters:
- "'Creator' not in tags.keys()"
- tags['Creator'] != 'jmarshall'
Each line is a conditional, and if any conditionals is true, then the
host is filtered out.
fix for issue # 5044
Add a custom regex to URLField that allows numbers to be present in the
top level domain, e.g. https://towerhost.org42
Set by variable allow_numbers_in_top_level_domain in URLField __init__,
and is set to True by default. If set to False, it will use the regex
specified in the built-in django URLValidator class.
This solution was originally implemented in LDAPServerURIField, but is
now implemented in URLField to support this behavior more generally. The
changes in LDAPServerURIField are longer needed and have been removed in
this commit.
Adds unit testing to make sure URLField changes handle regex input
and settings correctly.
- 500 error occurs when a non-admin user attempts to add an invalid
credential during schedule creation
- This change checks that the user can add the object to
serializer.validated_data, instead of serializer.initial_data
- The invalid credential field is purged in .validated_data, so the
request passes through cleanly
- Fix for awx issue #4147
- When a credential that contains secret lookups (e.g. HashiCorp Vault
Secret Lookup) is copied, the lookup fields are not properly copied
- This change adds the necessary fields to FIELDS_TO_PRESERVE_AT_COPY
for both Credential and CredentialInputSource classes to ensure a
proper copy
Oauth2 settings were initialized early in the awx import stage, and
those settings were not modifiable. This change allows oauth2 to check
for settings in django.conf settings, which are dynamically updated
through api calls at runtime. As a result, oauth2 settings will match
the values in django.conf settings at any point in time.
Grab AUTHORIZATION_CODE_EXPIRE_SECONDS from oauth2_settings
rather than hard code.
Add REFRESH_TOKEN_EXPIRE_SECONDS to valid_key_names
in OAuth2ProviderField class
- Set OAUTH2 REFRESH_TOKEN_EXPIRE_SECONDS to 1 month
(2628000 seconds)
- If not set, awx-manage cleartokens, or cleanup_tokens,
will not work properly
- Once cleartokens is run, this setting is the amount of
time after an access token expires that we keep its
refresh token in the database
- Check that model User object exists with id=user_id
before attempting to save to database
- UserSessionMembership saves to the database using
foreign key, User
- However, User with matching id might not exist if
browser sends request with stale cookies
- Change made in regards to issue #4334
- Bug: API error if LDAPServerURIField contains a number in the top level domain
- Add custom regex in LDAPServerURIField class that is passed to django
URLValidator
- The custom regex allows for numbers to be present in the top level domain
- Unit tests check that valid URIs pass through URLValidator, and that
invalid URIs raise the correct exception
- Related to issue #3646
Seth Foster