1. You delete something.
2. A signal is generated to record an activity stream deletion.
3. The process of deleting that activity stream deletion attempts to
look up a related field which has been deleted (in the meantime) via
a cascade.
see: #6721
see: #7022
Running orphaned task cleanup within its own scheduled task via
celery-beat causes a race-y lock contention between the cleanup task and
the task scheduler. Unfortunately, the scheduler and the cleanup task
both run at similar intervals, so this race condition is fairly easy to
hit. At best, it results in situations where the scheduler is
regularly delayed 20s; depending on timing, this can cause situations
where task execution is needlessly delayed a minute+. At worst, it can
result in situations where the scheduler is never able to schedule
tasks.
This change implements the cleanup as a periodic block of code in the
scheduler itself that tracks its "last run" time in memcached (by
default, it performs a cleanup every 60 seconds)
see: #6534
implement a whitelist setting that - if populated - will only allow
specific IPs/hostnames to provide custom REMOTE_HOST_HEADERS header
values (i.e., `HTTP_X_FORWARDED_FOR`)
see: #6538
This change _only_ injects `AWS_TASK_ENV` into `os.environ`; it's up to
underlying libraries to be good citizens and actually respect things
like `HTTPS_PROXY`.
see: #3508
when used as environment variables, boolean credential values are
stringified; when used in extra_vars, they are treated as actual JSON
boolean values (where possible)
see: #6776
* colorize uwsgi and celery logs; DEBUG lines are green, WARN lines
are yellow, ERROR lines (and tracebacks) are red
* pretty-print fact callback receiver JSON
* simplify the uwsgi log format so it's more legible
when a credential is created with `team` in the payload, set the
credential's `organization` *prior* to validation so that we don't miss
organization-oriented validators (like the org + name + kind unique
validation)
see: #3303
modern Tower deployments (both production and dev container-based)
always build ansible and Tower in separate, distinct virtualenvs, not
the global site-packages
This moves the container-based code location and venvs.
The goal here is that the paths of Tower source for isolated
vs normal nodes matches (both in prod and local development) so that we
don't have to add a bunch of additional bwrap argument logic for
<location-of-isolated-tower-venv>.
* set a more reasonable default `AWX_ISOLATED_CHECK_INTERVAL`
* make manual cancellation work for high values of
`AWX_ISOLATED_CHECK_INTERVAL`
* remove the `/tmp/ansible_tower/jobs/` symlink directory
see: #6616
instead of launching isolated tasks via `systemctl`, treat
`awx.main.isolated.run` as an executable that knows how to daemonize
additionally, add `setup.py isolated_build` for isolated Tower source
distribution
almost all of our current credential values are strings, but under the
v1 Credential model, `authorize` is boolean
additionally, if a field is specified with no type, fall back to
`string` as a default (this is almost always what people creating custom
types will want)
see: #6406
this provides error messages keyed by input fields, so that instead of
e.g.,
{
'inputs': ['Invalid certificate or key: u'XYZ']
}
...you get:
{
'inputs': {
'ssh_key_data': ['Invalid certificate or key: u'XYZ']
}
}
Includes /api/v1/ compatability for error message format. Requests to
/api/v1/ will get:
{'ssh_key_data': ['Invalid certificate or key: u'XYZ']}
`clean_ssh_key_data` and `clean_ssh_key_unlock` no longer work because
they're not actual fields on `model.Credential` anymore. This change
refactors/moves their validation to a place that works (and makes more
sense).
* CredentialTypes should not be editable *or* deletable if they're
"managed_by_tower".
* CredentialTypes should not be deletable if they're in use by one or
more Credentials.
* CredentialType.inputs should not be editable if they're in use by one
or more Credentials.
see: #6077
* allow for filtering Jobs and JobTemplates by v1 `cloud_credential` and
`network_credential` fields
* properly validate uniqueness of `extra_credentials` types
see: #5807
The following fields:
* (Job | JobTemplate).cloud_credential
* (Job | JobTemplate).network_credential
...are replaced by M2M relationships:
* Job.extra_credentials
* JobTemplate.extra_credentials
Includes support for task execution with multiple cloud credentials.
see: #5807
Credentials now have a required CredentialType, which defines inputs
(i.e., username, password) and injectors (i.e., assign the username to
SOME_ENV_VARIABLE at job runtime)
This commit only implements the model changes necessary to support the
new inputs model, and includes code for the credential serializer that
allows backwards-compatible support for /api/v1/credentials/; tasks.py
still needs to be updated to actually respect CredentialType injectors.
This change *will* break the UI for credentials (because it needs to be
updated to use the new v2 endpoint).
see: #5877
see: #5876
see: #5805
django-auth-ldap can throw exceptions, like TypeError if it's
misconfigured. If we encounter an exception attempting to log into an
LDAP server, log it and move on (otherwise, an uncaught exception will
cause local login to fail, too).
see: #5933
Ryan Petrello