Stale action for prs/issues

.github/actions/awx_devel_image/action.yml

@@ -11,12 +11,6 @@ runs:
       shell: bash
       run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
-    - name: Set lower case owner name
-      shell: bash
-      run: echo "OWNER_LC=${OWNER,,}" >> $GITHUB_ENV
-      env:
-        OWNER: '${{ github.repository_owner }}'
-
     - name: Log in to registry
       shell: bash
       run: |
@@ -24,11 +18,11 @@ runs:
 
     - name: Pre-pull latest devel image to warm cache
       shell: bash
-      run: docker pull ghcr.io/${OWNER_LC}/awx_devel:${{ github.base_ref }}
+      run: docker pull ghcr.io/${{ github.repository_owner }}/awx_devel:${{ github.base_ref }}
 
     - name: Build image for current source checkout
       shell: bash
       run: |
-        DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} \
+        DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} \
         COMPOSE_TAG=${{ github.base_ref }} \
         make docker-compose-build

.github/actions/run_awx_devel/action.yml

@@ -35,7 +35,7 @@ runs:
     - name: Start AWX
       shell: bash
       run: |
-        DEV_DOCKER_OWNER=${{ github.repository_owner }} \
+        DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} \
         COMPOSE_TAG=${{ github.base_ref }} \
         COMPOSE_UP_OPTS="-d" \
         make docker-compose
@@ -71,7 +71,7 @@ runs:
       id: data
       shell: bash
       run: |
-        AWX_IP=$(docker inspect -f '{{.NetworkSettings.Networks.awx.IPAddress}}' tools_awx_1)
+        AWX_IP=$(docker inspect -f '{{.NetworkSettings.Networks._sources_awx.IPAddress}}' tools_awx_1)
         ADMIN_TOKEN=$(docker exec -i tools_awx_1 awx-manage create_oauth2_token --user admin)
         echo "ip=$AWX_IP" >> $GITHUB_OUTPUT
         echo "admin_token=$ADMIN_TOKEN" >> $GITHUB_OUTPUT

.github/actions/stale/stale.yml

@@ -0,0 +1,31 @@
+name: 'Close stale issues and PRs'
+on:
+  schedule:
+    - cron: '30 1 * * *'
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9
+        with:
+
+          debug-only: true
+          operations-per-run: 30
+
+          days-before-stale: 30
+          days-before-close: 5
+
+          days-before-issue-stale: 180
+          days-before-issue-close: 14
+          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
+          close-issue-message: 'This issue was closed because it has been stalled for 5 days with no activity.'
+          exempt-issue-labels: 'needs_triage'
+          stale-issue-label: 'no_issue_activity'
+
+          days-before-pr-stale: 90
+          days-before-pr-close: 14
+          stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
+          close-pr-message: 'This PR was closed because it has been stalled for 10 days with no activity.'
+          exempt-pr-labels: 'needs_triage'
+          stale-pr-label: 'no_pr_activity'

.github/pr_labeler.yml

@@ -15,4 +15,5 @@
 
 "dependencies":
   - any: ["awx/ui/package.json"]
-  - any: ["requirements/*"]
+  - any: ["requirements/*.txt"]
+  - any: ["requirements/requirements.in"]

.github/workflows/ci.yml

@@ -66,8 +66,6 @@ jobs:
   awx-operator:
     runs-on: ubuntu-latest
     timeout-minutes: 60
-    env:
-      DEBUG_OUTPUT_DIR: /tmp/awx_operator_molecule_test
     steps:
       - name: Checkout awx
         uses: actions/checkout@v3
@@ -96,11 +94,11 @@ jobs:
       - name: Build AWX image
         working-directory: awx
         run: |
-          VERSION=`make version-for-buildyml` make awx-kube-build
-        env:
-          COMPOSE_TAG: ci
-          DEV_DOCKER_TAG_BASE: local
-          HEADLESS: yes
+          ansible-playbook -v tools/ansible/build.yml \
+            -e headless=yes \
+            -e awx_image=awx \
+            -e awx_image_tag=ci \
+            -e ansible_python_interpreter=$(which python3)
 
       - name: Run test deployment with awx-operator
         working-directory: awx-operator
@@ -109,19 +107,10 @@ jobs:
           ansible-galaxy collection install -r molecule/requirements.yml
           sudo rm -f $(which kustomize)
           make kustomize
-          KUSTOMIZE_PATH=$(readlink -f bin/kustomize) molecule -v test -s kind -- --skip-tags=replicas
+          KUSTOMIZE_PATH=$(readlink -f bin/kustomize) molecule -v test -s kind
         env:
-          AWX_TEST_IMAGE: local/awx
+          AWX_TEST_IMAGE: awx
           AWX_TEST_VERSION: ci
-          AWX_EE_TEST_IMAGE: quay.io/ansible/awx-ee:latest
-          STORE_DEBUG_OUTPUT: true
-
-      - name: Upload debug output
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: awx-operator-debug-output
-          path: ${{ env.DEBUG_OUTPUT_DIR }}
 
   collection-sanity:
     name: awx_collection sanity
@@ -138,6 +127,10 @@ jobs:
 
       - name: Run sanity tests
         run: make test_collection_sanity
+        env:
+          # needed due to cgroupsv2. This is fixed, but a stable release
+          # with the fix has not been made yet.
+          ANSIBLE_TEST_PREFER_PODMAN: 1
 
   collection-integration:
     name: awx_collection integration

.github/workflows/devel_images.yml

@@ -3,50 +3,28 @@ name: Build/Push Development Images
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
 on:
-  workflow_dispatch:
   push:
     branches:
       - devel
       - release_*
       - feature_*
 jobs:
-  push-development-images:
+  push:
+    if: endsWith(github.repository, '/awx') || startsWith(github.ref, 'refs/heads/release_')
     runs-on: ubuntu-latest
-    timeout-minutes: 120
+    timeout-minutes: 60
     permissions:
       packages: write
       contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        build-targets:
-          - image-name: awx_devel
-            make-target: docker-compose-buildx
-          - image-name: awx_kube_devel
-            make-target: awx-kube-dev-buildx
-          - image-name: awx
-            make-target: awx-kube-buildx
     steps:
-
-      - name: Skipping build of awx image for non-awx repository
-        run: |
-          echo "Skipping build of awx image for non-awx repository"
-          exit 0
-        if: matrix.build-targets.image-name == 'awx' && !endsWith(github.repository, '/awx')
-
       - uses: actions/checkout@v3
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Get python version from Makefile
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set GITHUB_ENV variables
+      - name: Set lower case owner name
         run: |
-          echo "DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER,,}" >> $GITHUB_ENV
-          echo "COMPOSE_TAG=${GITHUB_REF##*/}" >> $GITHUB_ENV
-          echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+          echo "OWNER_LC=${OWNER,,}" >>${GITHUB_ENV}
         env:
           OWNER: '${{ github.repository_owner }}'
 
@@ -59,19 +37,23 @@ jobs:
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - name: Setup node and npm
-        uses: actions/setup-node@v2
-        with:
-          node-version: '16.13.1'
-        if: matrix.build-targets.image-name == 'awx'
-
-      - name: Prebuild UI for awx image (to speed up build process)
+      - name: Pre-pull image to warm build cache
         run: |
-          sudo apt-get install gettext
-          make ui-release
-          make ui-next
-        if: matrix.build-targets.image-name == 'awx'
+          docker pull ghcr.io/${OWNER_LC}/awx_devel:${GITHUB_REF##*/} || :
+          docker pull ghcr.io/${OWNER_LC}/awx_kube_devel:${GITHUB_REF##*/} || :
+          docker pull ghcr.io/${OWNER_LC}/awx:${GITHUB_REF##*/} || :
 
-      - name: Build and push AWX devel images
+      - name: Build images
         run: |
-          make ${{ matrix.build-targets.make-target }}
+          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make docker-compose-build
+          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make awx-kube-dev-build
+          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make awx-kube-build
+
+      - name: Push development images
+        run: |
+          docker push ghcr.io/${OWNER_LC}/awx_devel:${GITHUB_REF##*/}
+          docker push ghcr.io/${OWNER_LC}/awx_kube_devel:${GITHUB_REF##*/}
+
+      - name: Push AWX k8s image, only for upstream and feature branches
+        run: docker push ghcr.io/${OWNER_LC}/awx:${GITHUB_REF##*/}
+        if: endsWith(github.repository, '/awx')

.github/workflows/e2e_test.yml

@@ -0,0 +1,75 @@
+---
+name: E2E Tests
+env:
+  LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
+
+on:
+  pull_request_target:
+    types: [labeled]
+jobs:
+  e2e-test:
+    if: contains(github.event.pull_request.labels.*.name, 'qe:e2e')
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      packages: write
+      contents: read
+    strategy:
+      matrix:
+        job: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24]
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/run_awx_devel
+        id: awx
+        with:
+          build-ui: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Pull awx_cypress_base image
+        run: |
+          docker pull quay.io/awx/awx_cypress_base:latest
+
+      - name: Checkout test project
+        uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/tower-qa
+          ssh-key: ${{ secrets.QA_REPO_KEY }}
+          path: tower-qa
+          ref: devel
+
+      - name: Build cypress
+        run: |
+          cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
+          docker build -t awx-pf-tests .
+
+      - name: Run E2E tests
+        env:
+          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
+        run: |
+          export COMMIT_INFO_BRANCH=$GITHUB_HEAD_REF
+          export COMMIT_INFO_AUTHOR=$GITHUB_ACTOR
+          export COMMIT_INFO_SHA=$GITHUB_SHA
+          export COMMIT_INFO_REMOTE=$GITHUB_REPOSITORY_OWNER
+          cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
+          AWX_IP=${{ steps.awx.outputs.ip }}
+          printenv > .env
+          echo "Executing tests:"
+          docker run \
+          --network '_sources_default' \
+          --ipc=host \
+          --env-file=.env \
+          -e CYPRESS_baseUrl="https://$AWX_IP:8043" \
+          -e CYPRESS_AWX_E2E_USERNAME=admin \
+          -e CYPRESS_AWX_E2E_PASSWORD='password' \
+          -e COMMAND="npm run cypress-concurrently-gha" \
+          -v /dev/shm:/dev/shm \
+          -v $PWD:/e2e \
+          -w /e2e \
+          awx-pf-tests run --project .
+
+      - uses: ./.github/actions/upload_awx_devel_logs
+        if: always()
+        with:
+          log-filename: e2e-${{ matrix.job }}.log

.github/workflows/feature_branch_deletion.yml

@@ -2,10 +2,12 @@
 name: Feature branch deletion cleanup
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
-on: delete
+on:
+  delete:
+    branches:
+      - feature_**
 jobs:
-  branch_delete:
-    if: ${{ github.event.ref_type == 'branch' && startsWith(github.event.ref, 'feature_') }}
+  push:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -20,4 +22,6 @@ jobs:
         run: |
           ansible localhost -c local, -m command -a "{{ ansible_python_interpreter + ' -m pip install boto3'}}"
           ansible localhost -c local -m aws_s3 \
-            -a "bucket=awx-public-ci-files object=${GITHUB_REF##*/}/schema.json mode=delobj permission=public-read"
+            -a "bucket=awx-public-ci-files object=${GITHUB_REF##*/}/schema.json mode=delete permission=public-read"
+
+

.github/workflows/promote.yml

@@ -7,11 +7,7 @@ env:
 on:
   release:
     types: [published]
-  workflow_dispatch:
-    inputs:
-      tag_name:
-        description: 'Name for the tag of the release.'
-        required: true
+
 permissions:
   contents: read # to fetch code (actions/checkout)
 
@@ -21,16 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Set GitHub Env vars for workflow_dispatch event
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        run: |
-          echo "TAG_NAME=${{ github.event.inputs.tag_name }}" >> $GITHUB_ENV
-
-      - name: Set GitHub Env vars if release event
-        if: ${{ github.event_name == 'release' }}
-        run: |
-          echo "TAG_NAME=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
-
       - name: Checkout awx
         uses: actions/checkout@v3
 
@@ -57,21 +43,16 @@ jobs:
       - name: Build collection and publish to galaxy
         env:
           COLLECTION_NAMESPACE: ${{ env.collection_namespace }}
-          COLLECTION_VERSION: ${{ env.TAG_NAME }}
+          COLLECTION_VERSION: ${{ github.event.release.tag_name }}
           COLLECTION_TEMPLATE_VERSION: true
         run: |
-          sudo apt-get install jq
           make build_collection
-          count=$(curl -s https://galaxy.ansible.com/api/v3/plugin/ansible/search/collection-versions/\?namespace\=${COLLECTION_NAMESPACE}\&name\=awx\&version\=${COLLECTION_VERSION} | jq .meta.count)
-          if [[ "$count" == "1" ]]; then
-              echo "Galaxy release already done";
-          elif [[ "$count" == "0" ]]; then
+          if [ "$(curl -L --head -sw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz | tail -1)" == "302" ] ; then \
+              echo "Galaxy release already done"; \
+          else \
               ansible-galaxy collection publish \
                 --token=${{ secrets.GALAXY_TOKEN }} \
-                awx_collection_build/${COLLECTION_NAMESPACE}-awx-${COLLECTION_VERSION}.tar.gz;
-          else
-              echo "Unexpected count from galaxy search: $count";
-              exit 1;
+                awx_collection_build/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz; \
           fi
 
       - name: Set official pypi info
@@ -83,8 +64,6 @@ jobs:
         if: ${{ github.repository_owner != 'ansible' }}
 
       - name: Build awxkit and upload to pypi
-        env:
-          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ env.TAG_NAME }}
         run: |
           git reset --hard
           cd awxkit && python3 setup.py sdist bdist_wheel
@@ -104,15 +83,11 @@ jobs:
 
       - name: Re-tag and promote awx image
         run: |
-          docker buildx imagetools create \
-            ghcr.io/${{ github.repository }}:${{ env.TAG_NAME }} \
-            --tag quay.io/${{ github.repository }}:${{ env.TAG_NAME }}
-          docker buildx imagetools create \
-            ghcr.io/${{ github.repository }}:${{ env.TAG_NAME }} \
-            --tag quay.io/${{ github.repository }}:latest
-
-      - name: Re-tag and promote awx-ee image
-        run: |
-          docker buildx imagetools create \
-            ghcr.io/${{ github.repository_owner }}/awx-ee:${{ env.TAG_NAME }} \
-            --tag quay.io/${{ github.repository_owner }}/awx-ee:${{ env.TAG_NAME }}
+          docker pull ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }}
+          docker tag ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }} quay.io/${{ github.repository }}:${{ github.event.release.tag_name }}
+          docker tag ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }} quay.io/${{ github.repository }}:latest
+          docker push quay.io/${{ github.repository }}:${{ github.event.release.tag_name }}
+          docker push quay.io/${{ github.repository }}:latest
+          docker pull ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }}
+          docker tag ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }} quay.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }}
+          docker push quay.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }}

.github/workflows/stage.yml

@@ -49,20 +49,7 @@ jobs:
         with:
           path: awx
 
-      - name: Checkout awx-operator
-        uses: actions/checkout@v3
-        with:
-          repository: ${{ github.repository_owner }}/awx-operator
-          path: awx-operator
-
-      - name: Checkout awx-logos
-        uses: actions/checkout@v3
-        with:
-          repository: ansible/awx-logos
-          path: awx-logos
-
       - name: Get python version from Makefile
-        working-directory: awx
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
@@ -70,75 +57,56 @@ jobs:
         with:
           python-version: ${{ env.py_version }}
 
+      - name: Checkout awx-logos
+        uses: actions/checkout@v3
+        with:
+          repository: ansible/awx-logos
+          path: awx-logos
+
+      - name: Checkout awx-operator
+        uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/awx-operator
+          path: awx-operator
+
       - name: Install playbook dependencies
         run: |
           python3 -m pip install docker
 
-      - name: Log into registry ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Copy logos for inclusion in sdist for official build
-        working-directory: awx
-        run: |
-          cp ../awx-logos/awx/ui/client/assets/* awx/ui/public/static/media/
-
-      - name: Setup node and npm
-        uses: actions/setup-node@v2
-        with:
-          node-version: '16.13.1'
-
-      - name: Prebuild UI for awx image (to speed up build process)
-        working-directory: awx
-        run: |
-          sudo apt-get install gettext
-          make ui-release
-          make ui-next
-
-      - name: Set build env variables
-        run: |
-          echo "DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER,,}" >> $GITHUB_ENV
-          echo "COMPOSE_TAG=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_TEST_VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_TEST_IMAGE=ghcr.io/${OWNER,,}/awx" >> $GITHUB_ENV
-          echo "AWX_EE_TEST_IMAGE=ghcr.io/${OWNER,,}/awx-ee:${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_OPERATOR_TEST_IMAGE=ghcr.io/${OWNER,,}/awx-operator:${{ github.event.inputs.operator_version }}" >> $GITHUB_ENV
-        env:
-          OWNER: ${{ github.repository_owner }}
-
       - name: Build and stage AWX
         working-directory: awx
-        env:
-          DOCKER_BUILDX_PUSH: true
-          HEADLESS: false
-          PLATFORMS: linux/amd64,linux/arm64
         run: |
-          make awx-kube-buildx
+          ansible-playbook -v tools/ansible/build.yml \
+            -e registry=ghcr.io \
+            -e registry_username=${{ github.actor }} \
+            -e registry_password=${{ secrets.GITHUB_TOKEN }} \
+            -e awx_image=${{ github.repository }} \
+            -e awx_version=${{ github.event.inputs.version }} \
+            -e ansible_python_interpreter=$(which python3) \
+            -e push=yes \
+            -e awx_official=yes
+
+      - name: Log in to GHCR
+        run: |
+          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Log in to Quay
+        run: |
+          echo ${{ secrets.QUAY_TOKEN }} | docker login quay.io -u ${{ secrets.QUAY_USER }} --password-stdin
 
       - name: tag awx-ee:latest with version input
         run: |
-          docker buildx imagetools create \
-            quay.io/ansible/awx-ee:latest \
-            --tag ${AWX_EE_TEST_IMAGE}
+          docker pull quay.io/ansible/awx-ee:latest
+          docker tag quay.io/ansible/awx-ee:latest ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
+          docker push ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
 
-      - name: Stage awx-operator image
+      - name: Build and stage awx-operator
         working-directory: awx-operator
         run: |
-          BUILD_ARGS="--build-arg DEFAULT_AWX_VERSION=${{ github.event.inputs.version}} \
-              --build-arg OPERATOR_VERSION=${{ github.event.inputs.operator_version }}" \
-          IMG=${AWX_OPERATOR_TEST_IMAGE} \
-          make docker-buildx
-
-      - name: Pulling images for test deployment with awx-operator
-        # awx operator molecue test expect to kind load image and buildx exports image to registry and not local
-        run: |
-          docker pull ${AWX_OPERATOR_TEST_IMAGE}
-          docker pull ${AWX_EE_TEST_IMAGE}
-          docker pull ${AWX_TEST_IMAGE}:${AWX_TEST_VERSION}
+          BUILD_ARGS="--build-arg DEFAULT_AWX_VERSION=${{ github.event.inputs.version }} \
+                      --build-arg OPERATOR_VERSION=${{ github.event.inputs.operator_version }}" \
+          IMAGE_TAG_BASE=ghcr.io/${{ github.repository_owner }}/awx-operator \
+          VERSION=${{ github.event.inputs.operator_version }} make docker-build docker-push
 
       - name: Run test deployment with awx-operator
         working-directory: awx-operator
@@ -148,6 +116,10 @@ jobs:
           sudo rm -f $(which kustomize)
           make kustomize
           KUSTOMIZE_PATH=$(readlink -f bin/kustomize) molecule test -s kind
+        env:
+          AWX_TEST_IMAGE: ${{ github.repository }}
+          AWX_TEST_VERSION: ${{ github.event.inputs.version }}
+          AWX_EE_TEST_IMAGE: ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
 
       - name: Create draft release for AWX
         working-directory: awx

.gitignore

@@ -46,11 +46,6 @@ tools/docker-compose/overrides/
 tools/docker-compose-minikube/_sources
 tools/docker-compose/keycloak.awx.realm.json
 
-!tools/docker-compose/editable_dependencies
-tools/docker-compose/editable_dependencies/*
-!tools/docker-compose/editable_dependencies/README.md
-!tools/docker-compose/editable_dependencies/install.sh
-
 # Tower setup playbook testing
 setup/test/roles/postgresql
 **/provision_docker
@@ -174,6 +169,3 @@ awx/ui_next/build
 # Docs build stuff
 docs/docsite/build/
 _readthedocs/
-
-# Pyenv
-.python-version

.vscode/launch.json

@@ -1,113 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "run_ws_heartbeat",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_ws_heartbeat"],
-      "django": true,
-      "preLaunchTask": "stop awx-ws-heartbeat",
-      "postDebugTask": "start awx-ws-heartbeat"
-    },
-    {
-      "name": "run_cache_clear",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_cache_clear"],
-      "django": true,
-      "preLaunchTask": "stop awx-cache-clear",
-      "postDebugTask": "start awx-cache-clear"
-    },
-    {
-      "name": "run_callback_receiver",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_callback_receiver"],
-      "django": true,
-      "preLaunchTask": "stop awx-receiver",
-      "postDebugTask": "start awx-receiver"
-    },
-    {
-      "name": "run_dispatcher",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_dispatcher"],
-      "django": true,
-      "preLaunchTask": "stop awx-dispatcher",
-      "postDebugTask": "start awx-dispatcher"
-    },
-    {
-      "name": "run_rsyslog_configurer",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_rsyslog_configurer"],
-      "django": true,
-      "preLaunchTask": "stop awx-rsyslog-configurer",
-      "postDebugTask": "start awx-rsyslog-configurer"
-    },
-    {
-      "name": "run_cache_clear",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_cache_clear"],
-      "django": true,
-      "preLaunchTask": "stop awx-cache-clear",
-      "postDebugTask": "start awx-cache-clear"
-    },
-    {
-      "name": "run_wsrelay",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["run_wsrelay"],
-      "django": true,
-      "preLaunchTask": "stop awx-wsrelay",
-      "postDebugTask": "start awx-wsrelay"
-    },
-    {
-      "name": "daphne",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "/var/lib/awx/venv/awx/bin/daphne",
-      "args": ["-b", "127.0.0.1", "-p", "8051", "awx.asgi:channel_layer"],
-      "django": true,
-      "preLaunchTask": "stop awx-daphne",
-      "postDebugTask": "start awx-daphne"
-    },
-    {
-      "name": "runserver(uwsgi alternative)",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["runserver", "127.0.0.1:8052"],
-      "django": true,
-      "preLaunchTask": "stop awx-uwsgi",
-      "postDebugTask": "start awx-uwsgi"
-    },
-    {
-      "name": "runserver_plus(uwsgi alternative)",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["runserver_plus", "127.0.0.1:8052"],
-      "django": true,
-      "preLaunchTask": "stop awx-uwsgi and install Werkzeug",
-      "postDebugTask": "start awx-uwsgi"
-    },
-    {
-      "name": "shell_plus",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "manage.py",
-      "args": ["shell_plus"],
-      "django": true,
-    },
-  ]
-}

.vscode/tasks.json

@@ -1,100 +0,0 @@
-{
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "start awx-cache-clear",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-cache-clear"
-        },
-        {
-            "label": "stop awx-cache-clear",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-cache-clear"
-        },
-        {
-            "label": "start awx-daphne",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-daphne"
-        },
-        {
-            "label": "stop awx-daphne",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-daphne"
-        },
-        {
-            "label": "start awx-dispatcher",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-dispatcher"
-        },
-        {
-            "label": "stop awx-dispatcher",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-dispatcher"
-        },
-        {
-            "label": "start awx-receiver",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-receiver"
-        },
-        {
-            "label": "stop awx-receiver",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-receiver"
-        },
-        {
-            "label": "start awx-rsyslog-configurer",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-rsyslog-configurer"
-        },
-        {
-            "label": "stop awx-rsyslog-configurer",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-rsyslog-configurer"
-        },
-        {
-            "label": "start awx-rsyslogd",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-rsyslogd"
-        },
-        {
-            "label": "stop awx-rsyslogd",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-rsyslogd"
-        },
-        {
-            "label": "start awx-uwsgi",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-uwsgi"
-        },
-        {
-            "label": "stop awx-uwsgi",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-uwsgi"
-        },
-        {
-            "label": "stop awx-uwsgi and install Werkzeug",
-            "type": "shell",
-            "command": "pip install Werkzeug; supervisorctl stop tower-processes:awx-uwsgi"
-        },
-        {
-            "label": "start awx-ws-heartbeat",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-ws-heartbeat"
-        },
-        {
-            "label": "stop awx-ws-heartbeat",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-ws-heartbeat"
-        },
-        {
-            "label": "start awx-wsrelay",
-            "type": "shell",
-            "command": "supervisorctl start tower-processes:awx-wsrelay"
-        },
-        {
-            "label": "stop awx-wsrelay",
-            "type": "shell",
-            "command": "supervisorctl stop tower-processes:awx-wsrelay"
-        }
-    ]
-}

.yamllint

@@ -11,8 +11,6 @@ ignore: |
   # django template files
   awx/api/templates/instance_install_bundle/**
   .readthedocs.yaml
-  tools/loki
-  tools/otel
 
 extends: default
 

ISSUES.md

@@ -80,7 +80,7 @@ If any of those items are missing your pull request will still get the `needs_tr
 Currently you can expect awxbot to add common labels such as `state:needs_triage`, `type:bug`, `component:docs`, etc...
 These labels are determined by the template data. Please use the template and fill it out as accurately as possible.
 
-The `state:needs_triage` label will remain on your pull request until a person has looked at it.
+The `state:needs_triage` label will will remain on your pull request until a person has looked at it.
 
 You can also expect the bot to CC maintainers of specific areas of the code, this will notify them that there is a pull request by placing a comment on the pull request.
 The comment will look something like `CC @matburt @wwitzel3 ...`.

Makefile

@@ -1,8 +1,8 @@
 -include awx/ui_next/Makefile
 
-PYTHON := $(notdir $(shell for i in python3.11 python3; do command -v $$i; done|sed 1q))
+PYTHON := $(notdir $(shell for i in python3.9 python3; do command -v $$i; done|sed 1q))
 SHELL := bash
-DOCKER_COMPOSE ?= docker compose
+DOCKER_COMPOSE ?= docker-compose
 OFFICIAL ?= no
 NODE ?= node
 NPM_BIN ?= npm
@@ -10,7 +10,7 @@ KIND_BIN ?= $(shell which kind)
 CHROMIUM_BIN=/tmp/chrome-linux/chrome
 GIT_BRANCH ?= $(shell git rev-parse --abbrev-ref HEAD)
 MANAGEMENT_COMMAND ?= awx-manage
-VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py 2> /dev/null)
+VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py)
 
 # ansible-test requires semver compatable version, so we allow overrides to hack it
 COLLECTION_VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py | cut -d . -f 1-3)
@@ -47,12 +47,6 @@ VAULT ?= false
 VAULT_TLS ?= false
 # If set to true docker-compose will also start a tacacs+ instance
 TACACS ?= false
-# If set to true docker-compose will also start an OpenTelemetry Collector instance
-OTEL ?= false
-# If set to true docker-compose will also start a Loki instance
-LOKI ?= false
-# If set to true docker-compose will install editable dependencies
-EDITABLE_DEPENDENCIES ?= false
 
 VENV_BASE ?= /var/lib/awx/venv
 
@@ -69,7 +63,7 @@ RECEPTOR_IMAGE ?= quay.io/ansible/receptor:devel
 SRC_ONLY_PKGS ?= cffi,pycparser,psycopg,twilio
 # These should be upgraded in the AWX and Ansible venv before attempting
 # to install the actual requirements
-VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==69.0.2 setuptools_scm[toml]==8.0.4 wheel==0.42.0
+VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==65.6.3 setuptools_scm[toml]==8.0.4 wheel==0.38.4
 
 NAME ?= awx
 
@@ -81,9 +75,6 @@ SDIST_TAR_FILE ?= $(SDIST_TAR_NAME).tar.gz
 
 I18N_FLAG_FILE = .i18n_built
 
-## PLATFORMS defines the target platforms for  the manager image be build to provide support to multiple
-PLATFORMS ?= linux/amd64,linux/arm64  # linux/ppc64le,linux/s390x
-
 .PHONY: awx-link clean clean-tmp clean-venv requirements requirements_dev \
 	develop refresh adduser migrate dbchange \
 	receiver test test_unit test_coverage coverage_html \
@@ -222,6 +213,8 @@ collectstatic:
 	fi; \
 	$(PYTHON) manage.py collectstatic --clear --noinput > /dev/null 2>&1
 
+DEV_RELOAD_COMMAND ?= supervisorctl restart tower-processes:*
+
 uwsgi: collectstatic
 	@if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
@@ -229,7 +222,7 @@ uwsgi: collectstatic
 	uwsgi /etc/tower/uwsgi.ini
 
 awx-autoreload:
-	@/awx_devel/tools/docker-compose/awx-autoreload /awx_devel/awx
+	@/awx_devel/tools/docker-compose/awx-autoreload /awx_devel/awx "$(DEV_RELOAD_COMMAND)"
 
 daphne:
 	@if [ "$(VENV_BASE)" ]; then \
@@ -309,7 +302,7 @@ swagger: reports
 	@if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi; \
-	(set -o pipefail && py.test $(PYTEST_ARGS) awx/conf/tests/functional awx/main/tests/functional/api awx/main/tests/docs | tee reports/$@.report)
+	(set -o pipefail && py.test $(PYTEST_ARGS) awx/conf/tests/functional awx/main/tests/functional/api awx/main/tests/docs --release=$(VERSION_TARGET) | tee reports/$@.report)
 
 check: black
 
@@ -539,25 +532,15 @@ docker-compose-sources: .git/hooks/pre-commit
 	    -e enable_vault=$(VAULT) \
 	    -e vault_tls=$(VAULT_TLS) \
 	    -e enable_tacacs=$(TACACS) \
-	    -e enable_otel=$(OTEL) \
-	    -e enable_loki=$(LOKI) \
-	    -e install_editable_dependencies=$(EDITABLE_DEPENDENCIES) \
-	    $(EXTRA_SOURCES_ANSIBLE_OPTS)
+            $(EXTRA_SOURCES_ANSIBLE_OPTS)
 
 docker-compose: awx/projects docker-compose-sources
 	ansible-galaxy install --ignore-certs -r tools/docker-compose/ansible/requirements.yml;
 	ansible-playbook -i tools/docker-compose/inventory tools/docker-compose/ansible/initialize_containers.yml \
 	    -e enable_vault=$(VAULT) \
-	    -e vault_tls=$(VAULT_TLS) \
-	    -e enable_ldap=$(LDAP); \
-	$(MAKE) docker-compose-up
-
-docker-compose-up:
+	    -e vault_tls=$(VAULT_TLS);
 	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml $(COMPOSE_OPTS) up $(COMPOSE_UP_OPTS) --remove-orphans
 
-docker-compose-down:
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml $(COMPOSE_OPTS) down --remove-orphans
-
 docker-compose-credential-plugins: awx/projects docker-compose-sources
 	echo -e "\033[0;31mTo generate a CyberArk Conjur API key: docker exec -it tools_conjur_1 conjurctl account create quick-start\033[0m"
 	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml -f tools/docker-credential-plugins-override.yml up --no-recreate awx_1 --remove-orphans
@@ -602,27 +585,12 @@ docker-compose-build: Dockerfile.dev
 		--build-arg BUILDKIT_INLINE_CACHE=1 \
 		--cache-from=$(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG) .
 
-
-.PHONY: docker-compose-buildx
-## Build awx_devel image for docker compose development environment for multiple architectures
-docker-compose-buildx: Dockerfile.dev
-	- docker buildx create --name docker-compose-buildx
-	docker buildx use docker-compose-buildx
-	- docker buildx build \
-		--push \
-		--build-arg BUILDKIT_INLINE_CACHE=1 \
-		--cache-from=$(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG) \
-		--platform=$(PLATFORMS) \
-		--tag $(DEVEL_IMAGE_NAME) \
-		-f Dockerfile.dev .
-	- docker buildx rm docker-compose-buildx
-
 docker-clean:
 	-$(foreach container_id,$(shell docker ps -f name=tools_awx -aq && docker ps -f name=tools_receptor -aq),docker stop $(container_id); docker rm -f $(container_id);)
 	-$(foreach image_id,$(shell docker images --filter=reference='*/*/*awx_devel*' --filter=reference='*/*awx_devel*' --filter=reference='*awx_devel*' -aq),docker rmi --force $(image_id);)
 
 docker-clean-volumes: docker-compose-clean docker-compose-container-group-clean
-	docker volume rm -f tools_var_lib_awx tools_awx_db tools_awx_db_15 tools_vault_1 tools_ldap_1 tools_grafana_storage tools_prometheus_storage $(shell docker volume ls --filter name=tools_redis_socket_ -q)
+	docker volume rm -f tools_awx_db tools_vault_1 tools_grafana_storage tools_prometheus_storage $(docker volume ls --filter name=tools_redis_socket_ -q)
 
 docker-refresh: docker-clean docker-compose
 
@@ -644,6 +612,9 @@ clean-elk:
 	docker rm tools_elasticsearch_1
 	docker rm tools_kibana_1
 
+psql-container:
+	docker run -it --net tools_default --rm postgres:12 sh -c 'exec psql -h "postgres" -p "5432" -U postgres'
+
 VERSION:
 	@echo "awx: $(VERSION)"
 
@@ -676,21 +647,6 @@ awx-kube-build: Dockerfile
 		--build-arg HEADLESS=$(HEADLESS) \
 		-t $(DEV_DOCKER_TAG_BASE)/awx:$(COMPOSE_TAG) .
 
-## Build multi-arch awx image for deployment on Kubernetes environment.
-awx-kube-buildx: Dockerfile
-	- docker buildx create --name awx-kube-buildx
-	docker buildx use awx-kube-buildx
-	- docker buildx build \
-		--push \
-		--build-arg VERSION=$(VERSION) \
-		--build-arg SETUPTOOLS_SCM_PRETEND_VERSION=$(VERSION) \
-		--build-arg HEADLESS=$(HEADLESS) \
-		--platform=$(PLATFORMS) \
-		--tag $(DEV_DOCKER_TAG_BASE)/awx:$(COMPOSE_TAG) \
-		-f Dockerfile .
-	- docker buildx rm awx-kube-buildx
-
-
 .PHONY: Dockerfile.kube-dev
 ## Generate Docker.kube-dev for awx_kube_devel image
 Dockerfile.kube-dev: tools/ansible/roles/dockerfile/templates/Dockerfile.j2
@@ -707,18 +663,6 @@ awx-kube-dev-build: Dockerfile.kube-dev
 	    --cache-from=$(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) \
 	    -t $(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) .
 
-## Build and push multi-arch awx_kube_devel image for development on local Kubernetes environment.
-awx-kube-dev-buildx: Dockerfile.kube-dev
-	- docker buildx create --name awx-kube-dev-buildx
-	docker buildx use awx-kube-dev-buildx
-	- docker buildx build \
-		--push \
-		--build-arg BUILDKIT_INLINE_CACHE=1 \
-		--cache-from=$(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) \
-		--platform=$(PLATFORMS) \
-		--tag $(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) \
-		-f Dockerfile.kube-dev .
-	- docker buildx rm awx-kube-dev-buildx
 
 kind-dev-load: awx-kube-dev-build
 	$(KIND_BIN) load docker-image $(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG)

awx/__init__.py

@@ -154,12 +154,10 @@ def manage():
     from django.conf import settings
     from django.core.management import execute_from_command_line
 
-    # enforce the postgres version is a minimum of 12 (we need this for partitioning); if not, then terminate program with exit code of 1
-    # In the future if we require a feature of a version of postgres > 12 this should be updated to reflect that.
-    # The return of connection.pg_version is something like 12013
+    # enforce the postgres version is equal to 12. if not, then terminate program with exit code of 1
     if not os.getenv('SKIP_PG_VERSION_CHECK', False) and not MODE == 'development':
         if (connection.pg_version // 10000) < 12:
-            sys.stderr.write("At a minimum, postgres version 12 is required\n")
+            sys.stderr.write("Postgres version 12 is required\n")
             sys.exit(1)
 
     if len(sys.argv) >= 2 and sys.argv[1] in ('version', '--version'):  # pragma: no cover

awx/api/conf.py

@@ -93,7 +93,6 @@ register(
     default='',
     label=_('Login redirect override URL'),
     help_text=_('URL to which unauthorized users will be redirected to log in.  If blank, users will be sent to the login page.'),
-    warning_text=_('Changing the redirect URL could impact the ability to login if local authentication is also disabled.'),
     category=_('Authentication'),
     category_slug='authentication',
 )

awx/api/generics.py

@@ -30,15 +30,11 @@ from rest_framework.permissions import IsAuthenticated
 from rest_framework.renderers import StaticHTMLRenderer
 from rest_framework.negotiation import DefaultContentNegotiation
 
-# django-ansible-base
 from ansible_base.rest_filters.rest_framework.field_lookup_backend import FieldLookupBackend
 from ansible_base.lib.utils.models import get_all_field_names
-from ansible_base.rbac.models import RoleEvaluation, RoleDefinition
-from ansible_base.rbac.permission_registry import permission_registry
 
 # AWX
 from awx.main.models import UnifiedJob, UnifiedJobTemplate, User, Role, Credential, WorkflowJobTemplateNode, WorkflowApprovalTemplate
-from awx.main.models.rbac import give_creator_permissions
 from awx.main.access import optimize_queryset
 from awx.main.utils import camelcase_to_underscore, get_search_fields, getattrd, get_object_or_400, decrypt_field, get_awx_version
 from awx.main.utils.licensing import server_product_name
@@ -95,9 +91,7 @@ class LoggedLoginView(auth_views.LoginView):
         ret = super(LoggedLoginView, self).post(request, *args, **kwargs)
         if request.user.is_authenticated:
             logger.info(smart_str(u"User {} logged in from {}".format(self.request.user.username, request.META.get('REMOTE_ADDR', None))))
-            ret.set_cookie(
-                'userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False), samesite=getattr(settings, 'USER_COOKIE_SAMESITE', 'Lax')
-            )
+            ret.set_cookie('userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False))
             ret.setdefault('X-API-Session-Cookie-Name', getattr(settings, 'SESSION_COOKIE_NAME', 'awx_sessionid'))
 
             return ret
@@ -109,9 +103,6 @@ class LoggedLoginView(auth_views.LoginView):
 
 
 class LoggedLogoutView(auth_views.LogoutView):
-
-    success_url_allowed_hosts = set(settings.LOGOUT_ALLOWED_HOSTS.split(",")) if settings.LOGOUT_ALLOWED_HOSTS else set()
-
     def dispatch(self, request, *args, **kwargs):
         original_user = getattr(request, 'user', None)
         ret = super(LoggedLogoutView, self).dispatch(request, *args, **kwargs)
@@ -481,11 +472,7 @@ class ListAPIView(generics.ListAPIView, GenericAPIView):
 
 class ListCreateAPIView(ListAPIView, generics.ListCreateAPIView):
     # Base class for a list view that allows creating new objects.
-    def perform_create(self, serializer):
-        super().perform_create(serializer)
-        if serializer.Meta.model in permission_registry.all_registered_models:
-            if self.request and self.request.user:
-                give_creator_permissions(self.request.user, serializer.instance)
+    pass
 
 
 class ParentMixin(object):
@@ -805,7 +792,6 @@ class RetrieveUpdateDestroyAPIView(RetrieveUpdateAPIView, DestroyAPIView):
 
 
 class ResourceAccessList(ParentMixin, ListAPIView):
-    deprecated = True
     serializer_class = ResourceAccessListElementSerializer
     ordering = ('username',)
 
@@ -813,15 +799,6 @@ class ResourceAccessList(ParentMixin, ListAPIView):
         obj = self.get_parent_object()
 
         content_type = ContentType.objects.get_for_model(obj)
-
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            ancestors = set(RoleEvaluation.objects.filter(content_type_id=content_type.id, object_id=obj.id).values_list('role_id', flat=True))
-            qs = User.objects.filter(has_roles__in=ancestors) | User.objects.filter(is_superuser=True)
-            auditor_role = RoleDefinition.objects.filter(name="System Auditor").first()
-            if auditor_role:
-                qs |= User.objects.filter(role_assignments__role_definition=auditor_role)
-            return qs.distinct()
-
         roles = set(Role.objects.filter(content_type=content_type, object_id=obj.id))
 
         ancestors = set()
@@ -981,7 +958,7 @@ class CopyAPIView(GenericAPIView):
             None, None, self.model, obj, request.user, create_kwargs=create_kwargs, copy_name=serializer.validated_data.get('name', '')
         )
         if hasattr(new_obj, 'admin_role') and request.user not in new_obj.admin_role.members.all():
-            give_creator_permissions(request.user, new_obj)
+            new_obj.admin_role.members.add(request.user)
         if sub_objs:
             permission_check_func = None
             if hasattr(type(self), 'deep_copy_permission_check_func'):

awx/api/metadata.py

@@ -36,13 +36,11 @@ class Metadata(metadata.SimpleMetadata):
         field_info = OrderedDict()
         field_info['type'] = self.label_lookup[field]
         field_info['required'] = getattr(field, 'required', False)
-        field_info['hidden'] = getattr(field, 'hidden', False)
 
         text_attrs = [
             'read_only',
             'label',
             'help_text',
-            'warning_text',
             'min_length',
             'max_length',
             'min_value',

awx/api/serializers.py

@@ -6,7 +6,7 @@ import copy
 import json
 import logging
 import re
-from collections import Counter, OrderedDict
+from collections import OrderedDict
 from datetime import timedelta
 from uuid import uuid4
 
@@ -43,14 +43,11 @@ from rest_framework.utils.serializer_helpers import ReturnList
 # Django-Polymorphic
 from polymorphic.models import PolymorphicModel
 
-# django-ansible-base
 from ansible_base.lib.utils.models import get_type_for_model
-from ansible_base.rbac.models import RoleEvaluation, ObjectRole
-from ansible_base.rbac import permission_registry
 
 # AWX
 from awx.main.access import get_user_capabilities
-from awx.main.constants import ACTIVE_STATES, CENSOR_VALUE, org_role_to_permission
+from awx.main.constants import ACTIVE_STATES, CENSOR_VALUE
 from awx.main.models import (
     ActivityStream,
     AdHocCommand,
@@ -85,7 +82,6 @@ from awx.main.models import (
     Project,
     ProjectUpdate,
     ProjectUpdateEvent,
-    ReceptorAddress,
     RefreshToken,
     Role,
     Schedule,
@@ -105,7 +101,7 @@ from awx.main.models import (
     CLOUD_INVENTORY_SOURCES,
 )
 from awx.main.models.base import VERBOSITY_CHOICES, NEW_JOB_TYPE_CHOICES
-from awx.main.models.rbac import role_summary_fields_generator, give_creator_permissions, get_role_codenames, to_permissions, get_role_from_object_role
+from awx.main.models.rbac import role_summary_fields_generator, RoleAncestorEntry
 from awx.main.fields import ImplicitRoleField
 from awx.main.utils import (
     get_model_for_type,
@@ -194,7 +190,6 @@ SUMMARIZABLE_FK_FIELDS = {
     'webhook_credential': DEFAULT_SUMMARY_FIELDS + ('kind', 'cloud', 'credential_type_id'),
     'approved_or_denied_by': ('id', 'username', 'first_name', 'last_name'),
     'credential_type': DEFAULT_SUMMARY_FIELDS,
-    'resource': ('ansible_id', 'resource_type'),
 }
 
 
@@ -641,7 +636,7 @@ class BaseSerializer(serializers.ModelSerializer, metaclass=BaseSerializerMetacl
             exclusions = self.get_validation_exclusions(self.instance)
             obj = self.instance or self.Meta.model()
             for k, v in attrs.items():
-                if k not in exclusions and k != 'canonical_address_port':
+                if k not in exclusions:
                     setattr(obj, k, v)
             obj.full_clean(exclude=exclusions)
             # full_clean may modify values on the instance; copy those changes
@@ -2766,26 +2761,13 @@ class ResourceAccessListElementSerializer(UserSerializer):
         team_content_type = ContentType.objects.get_for_model(Team)
         content_type = ContentType.objects.get_for_model(obj)
 
-        reversed_org_map = {}
-        for k, v in org_role_to_permission.items():
-            reversed_org_map[v] = k
-        reversed_role_map = {}
-        for k, v in to_permissions.items():
-            reversed_role_map[v] = k
-
-        def get_roles_from_perms(perm_list):
-            """given a list of permission codenames return a list of role names"""
-            role_names = set()
-            for codename in perm_list:
-                action = codename.split('_', 1)[0]
-                if action in reversed_role_map:
-                    role_names.add(reversed_role_map[action])
-                elif codename in reversed_org_map:
-                    if isinstance(obj, Organization):
-                        role_names.add(reversed_org_map[codename])
-                        if 'view_organization' not in role_names:
-                            role_names.add('read_role')
-            return list(role_names)
+        def get_roles_on_resource(parent_role):
+            "Returns a string list of the roles a parent_role has for current obj."
+            return list(
+                RoleAncestorEntry.objects.filter(ancestor=parent_role, content_type_id=content_type.id, object_id=obj.id)
+                .values_list('role_field', flat=True)
+                .distinct()
+            )
 
         def format_role_perm(role):
             role_dict = {'id': role.id, 'name': role.name, 'description': role.description}
@@ -2802,21 +2784,13 @@ class ResourceAccessListElementSerializer(UserSerializer):
             else:
                 # Singleton roles should not be managed from this view, as per copy/edit rework spec
                 role_dict['user_capabilities'] = {'unattach': False}
-
-            model_name = content_type.model
-            if isinstance(obj, Organization):
-                descendant_perms = [codename for codename in get_role_codenames(role) if codename.endswith(model_name) or codename.startswith('add_')]
-            else:
-                descendant_perms = [codename for codename in get_role_codenames(role) if codename.endswith(model_name)]
-
-            return {'role': role_dict, 'descendant_roles': get_roles_from_perms(descendant_perms)}
+            return {'role': role_dict, 'descendant_roles': get_roles_on_resource(role)}
 
         def format_team_role_perm(naive_team_role, permissive_role_ids):
             ret = []
-            team = naive_team_role.content_object
             team_role = naive_team_role
             if naive_team_role.role_field == 'admin_role':
-                team_role = team.member_role
+                team_role = naive_team_role.content_object.member_role
             for role in team_role.children.filter(id__in=permissive_role_ids).all():
                 role_dict = {
                     'id': role.id,
@@ -2836,87 +2810,10 @@ class ResourceAccessListElementSerializer(UserSerializer):
                 else:
                     # Singleton roles should not be managed from this view, as per copy/edit rework spec
                     role_dict['user_capabilities'] = {'unattach': False}
-
-                descendant_perms = list(
-                    RoleEvaluation.objects.filter(role__in=team.has_roles.all(), object_id=obj.id, content_type_id=content_type.id)
-                    .values_list('codename', flat=True)
-                    .distinct()
-                )
-
-                ret.append({'role': role_dict, 'descendant_roles': get_roles_from_perms(descendant_perms)})
-            return ret
-
-        gfk_kwargs = dict(content_type_id=content_type.id, object_id=obj.id)
-        direct_permissive_role_ids = Role.objects.filter(**gfk_kwargs).values_list('id', flat=True)
-
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            ret['summary_fields']['direct_access'] = []
-            ret['summary_fields']['indirect_access'] = []
-
-            new_roles_seen = set()
-            all_team_roles = set()
-            all_permissive_role_ids = set()
-            for evaluation in RoleEvaluation.objects.filter(role__in=user.has_roles.all(), **gfk_kwargs).prefetch_related('role'):
-                new_role = evaluation.role
-                if new_role.id in new_roles_seen:
-                    continue
-                new_roles_seen.add(new_role.id)
-                old_role = get_role_from_object_role(new_role)
-                all_permissive_role_ids.add(old_role.id)
-
-                if int(new_role.object_id) == obj.id and new_role.content_type_id == content_type.id:
-                    ret['summary_fields']['direct_access'].append(format_role_perm(old_role))
-                elif new_role.content_type_id == team_content_type.id:
-                    all_team_roles.add(old_role)
-                else:
-                    ret['summary_fields']['indirect_access'].append(format_role_perm(old_role))
-
-            # Lazy role creation gives us a big problem, where some intermediate roles are not easy to find
-            # like when a team has indirect permission, so here we get all roles the users teams have
-            # these contribute to all potential permission-granting roles of the object
-            user_teams_qs = permission_registry.team_model.objects.filter(member_roles__in=ObjectRole.objects.filter(users=user))
-            team_obj_roles = ObjectRole.objects.filter(teams__in=user_teams_qs)
-            for evaluation in RoleEvaluation.objects.filter(role__in=team_obj_roles, **gfk_kwargs).prefetch_related('role'):
-                new_role = evaluation.role
-                if new_role.id in new_roles_seen:
-                    continue
-                new_roles_seen.add(new_role.id)
-                old_role = get_role_from_object_role(new_role)
-                all_permissive_role_ids.add(old_role.id)
-
-            # In DAB RBAC, superuser is strictly a user flag, and global roles are not in the RoleEvaluation table
-            if user.is_superuser:
-                ret['summary_fields'].setdefault('indirect_access', [])
-                all_role_names = [field.name for field in obj._meta.get_fields() if isinstance(field, ImplicitRoleField)]
-                ret['summary_fields']['indirect_access'].append(
-                    {
-                        "role": {
-                            "id": None,
-                            "name": _("System Administrator"),
-                            "description": _("Can manage all aspects of the system"),
-                            "user_capabilities": {"unattach": False},
-                        },
-                        "descendant_roles": all_role_names,
-                    }
-                )
-            elif user.is_system_auditor:
-                ret['summary_fields'].setdefault('indirect_access', [])
-                ret['summary_fields']['indirect_access'].append(
-                    {
-                        "role": {
-                            "id": None,
-                            "name": _("System Auditor"),
-                            "description": _("Can view all aspects of the system"),
-                            "user_capabilities": {"unattach": False},
-                        },
-                        "descendant_roles": ["read_role"],
-                    }
-                )
-
-            ret['summary_fields']['direct_access'].extend([y for x in (format_team_role_perm(r, all_permissive_role_ids) for r in all_team_roles) for y in x])
-
+                ret.append({'role': role_dict, 'descendant_roles': get_roles_on_resource(team_role)})
             return ret
 
+        direct_permissive_role_ids = Role.objects.filter(content_type=content_type, object_id=obj.id).values_list('id', flat=True)
         all_permissive_role_ids = Role.objects.filter(content_type=content_type, object_id=obj.id).values_list('ancestors__id', flat=True)
 
         direct_access_roles = user.roles.filter(id__in=direct_permissive_role_ids).all()
@@ -3185,7 +3082,7 @@ class CredentialSerializerCreate(CredentialSerializer):
         credential = super(CredentialSerializerCreate, self).create(validated_data)
 
         if user:
-            give_creator_permissions(user, credential)
+            credential.admin_role.members.add(user)
         if team:
             if not credential.organization or team.organization.id != credential.organization.id:
                 raise serializers.ValidationError({"detail": _("Credential organization must be set and match before assigning to a team")})
@@ -5279,21 +5176,16 @@ class NotificationTemplateSerializer(BaseSerializer):
                 body = messages[event].get('body', {})
                 if body:
                     try:
-                        sandbox.ImmutableSandboxedEnvironment(undefined=DescriptiveUndefined).from_string(body).render(JobNotificationMixin.context_stub())
-
-                        # https://github.com/ansible/awx/issues/14410
-
-                        # When rendering something such as "{{ job.id }}"
-                        # the return type is not a dict, unlike "{{ job_metadata }}" which is a dict
-
-                        # potential_body = json.loads(rendered_body)
-
-                        # if not isinstance(potential_body, dict):
-                        #     error_list.append(
-                        #         _("Webhook body for '{}' should be a json dictionary. Found type '{}'.".format(event, type(potential_body).__name__))
-                        #     )
-                    except Exception as exc:
-                        error_list.append(_("Webhook body for '{}' is not valid. The following gave an error ({}).".format(event, exc)))
+                        rendered_body = (
+                            sandbox.ImmutableSandboxedEnvironment(undefined=DescriptiveUndefined).from_string(body).render(JobNotificationMixin.context_stub())
+                        )
+                        potential_body = json.loads(rendered_body)
+                        if not isinstance(potential_body, dict):
+                            error_list.append(
+                                _("Webhook body for '{}' should be a json dictionary. Found type '{}'.".format(event, type(potential_body).__name__))
+                            )
+                    except json.JSONDecodeError as exc:
+                        error_list.append(_("Webhook body for '{}' is not a valid json dictionary ({}).".format(event, exc)))
 
         if error_list:
             raise serializers.ValidationError(error_list)
@@ -5381,7 +5273,7 @@ class NotificationSerializer(BaseSerializer):
         )
 
     def get_body(self, obj):
-        if obj.notification_type in ('webhook', 'pagerduty', 'awssns'):
+        if obj.notification_type in ('webhook', 'pagerduty'):
             if isinstance(obj.body, dict):
                 if 'body' in obj.body:
                     return obj.body['body']
@@ -5403,9 +5295,9 @@ class NotificationSerializer(BaseSerializer):
     def to_representation(self, obj):
         ret = super(NotificationSerializer, self).to_representation(obj)
 
-        if obj.notification_type in ('webhook', 'awssns'):
+        if obj.notification_type == 'webhook':
             ret.pop('subject')
-        if obj.notification_type not in ('email', 'webhook', 'pagerduty', 'awssns'):
+        if obj.notification_type not in ('email', 'webhook', 'pagerduty'):
             ret.pop('body')
         return ret
 
@@ -5566,25 +5458,17 @@ class ScheduleSerializer(LaunchConfigurationBaseSerializer, SchedulePreviewSeria
 class InstanceLinkSerializer(BaseSerializer):
     class Meta:
         model = InstanceLink
-        fields = ('id', 'related', 'source', 'target', 'target_full_address', 'link_state')
+        fields = ('id', 'url', 'related', 'source', 'target', 'link_state')
 
     source = serializers.SlugRelatedField(slug_field="hostname", queryset=Instance.objects.all())
-
-    target = serializers.SerializerMethodField()
-    target_full_address = serializers.SerializerMethodField()
+    target = serializers.SlugRelatedField(slug_field="hostname", queryset=Instance.objects.all())
 
     def get_related(self, obj):
         res = super(InstanceLinkSerializer, self).get_related(obj)
         res['source_instance'] = self.reverse('api:instance_detail', kwargs={'pk': obj.source.id})
-        res['target_address'] = self.reverse('api:receptor_address_detail', kwargs={'pk': obj.target.id})
+        res['target_instance'] = self.reverse('api:instance_detail', kwargs={'pk': obj.target.id})
         return res
 
-    def get_target(self, obj):
-        return obj.target.instance.hostname
-
-    def get_target_full_address(self, obj):
-        return obj.target.get_full_address()
-
 
 class InstanceNodeSerializer(BaseSerializer):
     class Meta:
@@ -5592,29 +5476,6 @@ class InstanceNodeSerializer(BaseSerializer):
         fields = ('id', 'hostname', 'node_type', 'node_state', 'enabled')
 
 
-class ReceptorAddressSerializer(BaseSerializer):
-    full_address = serializers.SerializerMethodField()
-
-    class Meta:
-        model = ReceptorAddress
-        fields = (
-            'id',
-            'url',
-            'address',
-            'port',
-            'protocol',
-            'websocket_path',
-            'is_internal',
-            'canonical',
-            'instance',
-            'peers_from_control_nodes',
-            'full_address',
-        )
-
-    def get_full_address(self, obj):
-        return obj.get_full_address()
-
-
 class InstanceSerializer(BaseSerializer):
     show_capabilities = ['edit']
 
@@ -5623,17 +5484,11 @@ class InstanceSerializer(BaseSerializer):
     jobs_running = serializers.IntegerField(help_text=_('Count of jobs in the running or waiting state that are targeted for this instance'), read_only=True)
     jobs_total = serializers.IntegerField(help_text=_('Count of all jobs that target this instance'), read_only=True)
     health_check_pending = serializers.SerializerMethodField()
-    peers = serializers.PrimaryKeyRelatedField(
-        help_text=_('Primary keys of receptor addresses to peer to.'), many=True, required=False, queryset=ReceptorAddress.objects.all()
-    )
-    reverse_peers = serializers.SerializerMethodField()
-    listener_port = serializers.IntegerField(source='canonical_address_port', required=False, allow_null=True)
-    peers_from_control_nodes = serializers.BooleanField(source='canonical_address_peers_from_control_nodes', required=False)
-    protocol = serializers.SerializerMethodField()
+    peers = serializers.SlugRelatedField(many=True, required=False, slug_field="hostname", queryset=Instance.objects.all())
 
     class Meta:
         model = Instance
-        read_only_fields = ('ip_address', 'uuid', 'version', 'managed', 'reverse_peers')
+        read_only_fields = ('ip_address', 'uuid', 'version')
         fields = (
             'id',
             'hostname',
@@ -5664,13 +5519,10 @@ class InstanceSerializer(BaseSerializer):
             'managed_by_policy',
             'node_type',
             'node_state',
-            'managed',
             'ip_address',
-            'peers',
-            'reverse_peers',
             'listener_port',
+            'peers',
             'peers_from_control_nodes',
-            'protocol',
         )
         extra_kwargs = {
             'node_type': {'initial': Instance.Types.EXECUTION, 'default': Instance.Types.EXECUTION},
@@ -5692,54 +5544,16 @@ class InstanceSerializer(BaseSerializer):
 
     def get_related(self, obj):
         res = super(InstanceSerializer, self).get_related(obj)
-        res['receptor_addresses'] = self.reverse('api:instance_receptor_addresses_list', kwargs={'pk': obj.pk})
         res['jobs'] = self.reverse('api:instance_unified_jobs_list', kwargs={'pk': obj.pk})
-        res['peers'] = self.reverse('api:instance_peers_list', kwargs={"pk": obj.pk})
         res['instance_groups'] = self.reverse('api:instance_instance_groups_list', kwargs={'pk': obj.pk})
-        if obj.node_type in [Instance.Types.EXECUTION, Instance.Types.HOP] and not obj.managed:
+        if obj.node_type in [Instance.Types.EXECUTION, Instance.Types.HOP]:
             res['install_bundle'] = self.reverse('api:instance_install_bundle', kwargs={'pk': obj.pk})
+        res['peers'] = self.reverse('api:instance_peers_list', kwargs={"pk": obj.pk})
         if self.context['request'].user.is_superuser or self.context['request'].user.is_system_auditor:
             if obj.node_type == 'execution':
                 res['health_check'] = self.reverse('api:instance_health_check', kwargs={'pk': obj.pk})
         return res
 
-    def create_or_update(self, validated_data, obj=None, create=True):
-        # create a managed receptor address if listener port is defined
-        port = validated_data.pop('listener_port', -1)
-        peers_from_control_nodes = validated_data.pop('peers_from_control_nodes', -1)
-
-        # delete the receptor address if the port is explicitly set to None
-        if obj and port == None:
-            obj.receptor_addresses.filter(address=obj.hostname).delete()
-
-        if create:
-            instance = super(InstanceSerializer, self).create(validated_data)
-        else:
-            instance = super(InstanceSerializer, self).update(obj, validated_data)
-            instance.refresh_from_db()  # instance canonical address lookup is deferred, so needs to be reloaded
-
-        # only create or update if port is defined in validated_data or already exists in the
-        # canonical address
-        # this prevents creating a receptor address if peers_from_control_nodes is in
-        # validated_data but a port is not set
-        if (port != None and port != -1) or instance.canonical_address_port:
-            kwargs = {}
-            if port != -1:
-                kwargs['port'] = port
-            if peers_from_control_nodes != -1:
-                kwargs['peers_from_control_nodes'] = peers_from_control_nodes
-            if kwargs:
-                kwargs['canonical'] = True
-                instance.receptor_addresses.update_or_create(address=instance.hostname, defaults=kwargs)
-
-        return instance
-
-    def create(self, validated_data):
-        return self.create_or_update(validated_data, create=True)
-
-    def update(self, obj, validated_data):
-        return self.create_or_update(validated_data, obj, create=False)
-
     def get_summary_fields(self, obj):
         summary = super().get_summary_fields(obj)
 
@@ -5749,16 +5563,6 @@ class InstanceSerializer(BaseSerializer):
 
         return summary
 
-    def get_reverse_peers(self, obj):
-        return Instance.objects.prefetch_related('peers').filter(peers__in=obj.receptor_addresses.all()).values_list('id', flat=True)
-
-    def get_protocol(self, obj):
-        # note: don't create a different query for receptor addresses, as this is prefetched on the View for optimization
-        for addr in obj.receptor_addresses.all():
-            if addr.canonical:
-                return addr.protocol
-        return ""
-
     def get_consumed_capacity(self, obj):
         return obj.consumed_capacity
 
@@ -5772,20 +5576,47 @@ class InstanceSerializer(BaseSerializer):
         return obj.health_check_pending
 
     def validate(self, attrs):
-        # Oddly, using 'source' on a DRF field populates attrs with the source name, so we should rename it back
-        if 'canonical_address_port' in attrs:
-            attrs['listener_port'] = attrs.pop('canonical_address_port')
-        if 'canonical_address_peers_from_control_nodes' in attrs:
-            attrs['peers_from_control_nodes'] = attrs.pop('canonical_address_peers_from_control_nodes')
+        def get_field_from_model_or_attrs(fd):
+            return attrs.get(fd, self.instance and getattr(self.instance, fd) or None)
+
+        def check_peers_changed():
+            '''
+            return True if
+            - 'peers' in attrs
+            - instance peers matches peers in attrs
+            '''
+            return self.instance and 'peers' in attrs and set(self.instance.peers.all()) != set(attrs['peers'])
 
         if not self.instance and not settings.IS_K8S:
             raise serializers.ValidationError(_("Can only create instances on Kubernetes or OpenShift."))
 
-        # cannot enable peers_from_control_nodes if listener_port is not set
-        if attrs.get('peers_from_control_nodes'):
-            port = attrs.get('listener_port', -1)  # -1 denotes missing, None denotes explicit null
-            if (port is None) or (port == -1 and self.instance and self.instance.canonical_address is None):
-                raise serializers.ValidationError(_("Cannot enable peers_from_control_nodes if listener_port is not set."))
+        node_type = get_field_from_model_or_attrs("node_type")
+        peers_from_control_nodes = get_field_from_model_or_attrs("peers_from_control_nodes")
+        listener_port = get_field_from_model_or_attrs("listener_port")
+        peers = attrs.get('peers', [])
+
+        if peers_from_control_nodes and node_type not in (Instance.Types.EXECUTION, Instance.Types.HOP):
+            raise serializers.ValidationError(_("peers_from_control_nodes can only be enabled for execution or hop nodes."))
+
+        if node_type in [Instance.Types.CONTROL, Instance.Types.HYBRID]:
+            if check_peers_changed():
+                raise serializers.ValidationError(
+                    _("Setting peers manually for control nodes is not allowed. Enable peers_from_control_nodes on the hop and execution nodes instead.")
+                )
+
+        if not listener_port and peers_from_control_nodes:
+            raise serializers.ValidationError(_("Field listener_port must be a valid integer when peers_from_control_nodes is enabled."))
+
+        if not listener_port and self.instance and self.instance.peers_from.exists():
+            raise serializers.ValidationError(_("Field listener_port must be a valid integer when other nodes peer to it."))
+
+        for peer in peers:
+            if peer.listener_port is None:
+                raise serializers.ValidationError(_("Field listener_port must be set on peer ") + peer.hostname + ".")
+
+        if not settings.IS_K8S:
+            if check_peers_changed():
+                raise serializers.ValidationError(_("Cannot change peers."))
 
         return super().validate(attrs)
 
@@ -5805,8 +5636,8 @@ class InstanceSerializer(BaseSerializer):
                     raise serializers.ValidationError(_("Can only change the state on Kubernetes or OpenShift."))
                 if value != Instance.States.DEPROVISIONING:
                     raise serializers.ValidationError(_("Can only change instances to the 'deprovisioning' state."))
-                if self.instance.managed:
-                    raise serializers.ValidationError(_("Cannot deprovision managed nodes."))
+                if self.instance.node_type not in (Instance.Types.EXECUTION, Instance.Types.HOP):
+                    raise serializers.ValidationError(_("Can only deprovision execution or hop nodes."))
         else:
             if value and value != Instance.States.INSTALLED:
                 raise serializers.ValidationError(_("Can only create instances in the 'installed' state."))
@@ -5825,48 +5656,18 @@ class InstanceSerializer(BaseSerializer):
     def validate_listener_port(self, value):
         """
         Cannot change listener port, unless going from none to integer, and vice versa
-        If instance is managed, cannot change listener port at all
         """
-        if self.instance:
-            canonical_address_port = self.instance.canonical_address_port
-            if value and canonical_address_port and canonical_address_port != value:
-                raise serializers.ValidationError(_("Cannot change listener port."))
-            if self.instance.managed and value != canonical_address_port:
-                raise serializers.ValidationError(_("Cannot change listener port for managed nodes."))
-        return value
-
-    def validate_peers(self, value):
-        # cannot peer to an instance more than once
-        peers_instances = Counter(p.instance_id for p in value)
-        if any(count > 1 for count in peers_instances.values()):
-            raise serializers.ValidationError(_("Cannot peer to the same instance more than once."))
-
-        if self.instance:
-            instance_addresses = set(self.instance.receptor_addresses.all())
-            setting_peers = set(value)
-            peers_changed = set(self.instance.peers.all()) != setting_peers
-
-            if not settings.IS_K8S and peers_changed:
-                raise serializers.ValidationError(_("Cannot change peers."))
-
-            if self.instance.managed and peers_changed:
-                raise serializers.ValidationError(_("Setting peers manually for managed nodes is not allowed."))
-
-            # cannot peer to self
-            if instance_addresses & setting_peers:
-                raise serializers.ValidationError(_("Instance cannot peer to its own address."))
-
-            # cannot peer to an instance that is already peered to this instance
-            if instance_addresses:
-                for p in setting_peers:
-                    if set(p.instance.peers.all()) & instance_addresses:
-                        raise serializers.ValidationError(_(f"Instance {p.instance.hostname} is already peered to this instance."))
+        if value and self.instance and self.instance.listener_port and self.instance.listener_port != value:
+            raise serializers.ValidationError(_("Cannot change listener port."))
 
         return value
 
     def validate_peers_from_control_nodes(self, value):
-        if self.instance and self.instance.managed and self.instance.canonical_address_peers_from_control_nodes != value:
-            raise serializers.ValidationError(_("Cannot change peers_from_control_nodes for managed nodes."))
+        """
+        Can only enable for K8S based deployments
+        """
+        if value and not settings.IS_K8S:
+            raise serializers.ValidationError(_("Can only be enabled on Kubernetes or Openshift."))
 
         return value
 

awx/api/templates/instance_install_bundle/group_vars/all.yml

@@ -17,18 +17,19 @@ custom_worksign_public_keyfile: receptor/work_public_key.pem
 custom_tls_certfile: receptor/tls/receptor.crt
 custom_tls_keyfile: receptor/tls/receptor.key
 custom_ca_certfile: receptor/tls/ca/mesh-CA.crt
-{% if listener_port %}
-receptor_protocol: {{ listener_protocol }}
+receptor_protocol: 'tcp'
+{% if instance.listener_port %}
 receptor_listener: true
-receptor_port: {{ listener_port }}
+receptor_port: {{ instance.listener_port }}
 {% else %}
 receptor_listener: false
 {% endif %}
 {% if peers %}
 receptor_peers:
 {% for peer in peers %}
-  - address: {{ peer.address }}
-    protocol: {{ peer.protocol }}
+  - host: {{ peer.host }}
+    port: {{ peer.port }}
+    protocol: tcp
 {% endfor %}
 {% endif %}
 {% verbatim %}

awx/api/templates/instance_install_bundle/requirements.yml

@@ -1,4 +1,4 @@
 ---
 collections:
   - name: ansible.receptor
-    version: 2.0.3
+    version: 2.0.2

awx/api/urls/instance.py

@@ -10,7 +10,6 @@ from awx.api.views import (
     InstanceInstanceGroupsList,
     InstanceHealthCheck,
     InstancePeersList,
-    InstanceReceptorAddressesList,
 )
 from awx.api.views.instance_install_bundle import InstanceInstallBundle
 
@@ -22,7 +21,6 @@ urls = [
     re_path(r'^(?P<pk>[0-9]+)/instance_groups/$', InstanceInstanceGroupsList.as_view(), name='instance_instance_groups_list'),
     re_path(r'^(?P<pk>[0-9]+)/health_check/$', InstanceHealthCheck.as_view(), name='instance_health_check'),
     re_path(r'^(?P<pk>[0-9]+)/peers/$', InstancePeersList.as_view(), name='instance_peers_list'),
-    re_path(r'^(?P<pk>[0-9]+)/receptor_addresses/$', InstanceReceptorAddressesList.as_view(), name='instance_receptor_addresses_list'),
     re_path(r'^(?P<pk>[0-9]+)/install_bundle/$', InstanceInstallBundle.as_view(), name='instance_install_bundle'),
 ]
 

awx/api/urls/receptor_address.py

@@ -1,17 +0,0 @@
-# Copyright (c) 2017 Ansible, Inc.
-# All Rights Reserved.
-
-from django.urls import re_path
-
-from awx.api.views import (
-    ReceptorAddressesList,
-    ReceptorAddressDetail,
-)
-
-
-urls = [
-    re_path(r'^$', ReceptorAddressesList.as_view(), name='receptor_addresses_list'),
-    re_path(r'^(?P<pk>[0-9]+)/$', ReceptorAddressDetail.as_view(), name='receptor_address_detail'),
-]
-
-__all__ = ['urls']

awx/api/urls/urls.py

@@ -85,7 +85,6 @@ from .oauth2_root import urls as oauth2_root_urls
 from .workflow_approval_template import urls as workflow_approval_template_urls
 from .workflow_approval import urls as workflow_approval_urls
 from .analytics import urls as analytics_urls
-from .receptor_address import urls as receptor_address_urls
 
 v2_urls = [
     re_path(r'^$', ApiV2RootView.as_view(), name='api_v2_root_view'),
@@ -156,7 +155,6 @@ v2_urls = [
     re_path(r'^bulk/host_create/$', BulkHostCreateView.as_view(), name='bulk_host_create'),
     re_path(r'^bulk/host_delete/$', BulkHostDeleteView.as_view(), name='bulk_host_delete'),
     re_path(r'^bulk/job_launch/$', BulkJobLaunchView.as_view(), name='bulk_job_launch'),
-    re_path(r'^receptor_addresses/', include(receptor_address_urls)),
 ]
 
 

awx/api/versioning.py

@@ -2,21 +2,28 @@
 # All Rights Reserved.
 
 from django.conf import settings
+from django.urls import NoReverseMatch
 
-from rest_framework.reverse import reverse as drf_reverse
+from rest_framework.reverse import _reverse
 from rest_framework.versioning import URLPathVersioning as BaseVersioning
 
 
-def is_optional_api_urlpattern_prefix_request(request):
-    if settings.OPTIONAL_API_URLPATTERN_PREFIX and request:
-        if request.path.startswith(f"/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}"):
-            return True
-    return False
+def drf_reverse(viewname, args=None, kwargs=None, request=None, format=None, **extra):
+    """
+    Copy and monkey-patch `rest_framework.reverse.reverse` to prevent adding unwarranted
+    query string parameters.
+    """
+    scheme = getattr(request, 'versioning_scheme', None)
+    if scheme is not None:
+        try:
+            url = scheme.reverse(viewname, args, kwargs, request, format, **extra)
+        except NoReverseMatch:
+            # In case the versioning scheme reversal fails, fallback to the
+            # default implementation
+            url = _reverse(viewname, args, kwargs, request, format, **extra)
+    else:
+        url = _reverse(viewname, args, kwargs, request, format, **extra)
 
-
-def transform_optional_api_urlpattern_prefix_url(request, url):
-    if is_optional_api_urlpattern_prefix_request(request):
-        url = url.replace('/api', f"/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}")
     return url
 
 

awx/api/views/__init__.py

@@ -60,9 +60,6 @@ from oauth2_provider.models import get_access_token_model
 import pytz
 from wsgiref.util import FileWrapper
 
-# django-ansible-base
-from ansible_base.rbac.models import RoleEvaluation, ObjectRole
-
 # AWX
 from awx.main.tasks.system import send_notifications, update_inventory_computed_fields
 from awx.main.access import get_user_queryset
@@ -90,7 +87,6 @@ from awx.api.generics import (
 from awx.api.views.labels import LabelSubListCreateAttachDetachView
 from awx.api.versioning import reverse
 from awx.main import models
-from awx.main.models.rbac import get_role_definition
 from awx.main.utils import (
     camelcase_to_underscore,
     extract_ansible_vars,
@@ -276,24 +272,16 @@ class DashboardJobsGraphView(APIView):
 
         success_query = user_unified_jobs.filter(status='successful')
         failed_query = user_unified_jobs.filter(status='failed')
-        canceled_query = user_unified_jobs.filter(status='canceled')
-        error_query = user_unified_jobs.filter(status='error')
 
         if job_type == 'inv_sync':
             success_query = success_query.filter(instance_of=models.InventoryUpdate)
             failed_query = failed_query.filter(instance_of=models.InventoryUpdate)
-            canceled_query = canceled_query.filter(instance_of=models.InventoryUpdate)
-            error_query = error_query.filter(instance_of=models.InventoryUpdate)
         elif job_type == 'playbook_run':
             success_query = success_query.filter(instance_of=models.Job)
             failed_query = failed_query.filter(instance_of=models.Job)
-            canceled_query = canceled_query.filter(instance_of=models.Job)
-            error_query = error_query.filter(instance_of=models.Job)
         elif job_type == 'scm_update':
             success_query = success_query.filter(instance_of=models.ProjectUpdate)
             failed_query = failed_query.filter(instance_of=models.ProjectUpdate)
-            canceled_query = canceled_query.filter(instance_of=models.ProjectUpdate)
-            error_query = error_query.filter(instance_of=models.ProjectUpdate)
 
         end = now()
         interval = 'day'
@@ -309,12 +297,10 @@ class DashboardJobsGraphView(APIView):
         else:
             return Response({'error': _('Unknown period "%s"') % str(period)}, status=status.HTTP_400_BAD_REQUEST)
 
-        dashboard_data = {"jobs": {"successful": [], "failed": [], "canceled": [], "error": []}}
+        dashboard_data = {"jobs": {"successful": [], "failed": []}}
 
         succ_list = dashboard_data['jobs']['successful']
         fail_list = dashboard_data['jobs']['failed']
-        canceled_list = dashboard_data['jobs']['canceled']
-        error_list = dashboard_data['jobs']['error']
 
         qs_s = (
             success_query.filter(finished__range=(start, end))
@@ -332,22 +318,6 @@ class DashboardJobsGraphView(APIView):
             .annotate(agg=Count('id', distinct=True))
         )
         data_f = {item['d']: item['agg'] for item in qs_f}
-        qs_c = (
-            canceled_query.filter(finished__range=(start, end))
-            .annotate(d=Trunc('finished', interval, tzinfo=end.tzinfo))
-            .order_by()
-            .values('d')
-            .annotate(agg=Count('id', distinct=True))
-        )
-        data_c = {item['d']: item['agg'] for item in qs_c}
-        qs_e = (
-            error_query.filter(finished__range=(start, end))
-            .annotate(d=Trunc('finished', interval, tzinfo=end.tzinfo))
-            .order_by()
-            .values('d')
-            .annotate(agg=Count('id', distinct=True))
-        )
-        data_e = {item['d']: item['agg'] for item in qs_e}
 
         start_date = start.replace(hour=0, minute=0, second=0, microsecond=0)
         for d in itertools.count():
@@ -356,8 +326,6 @@ class DashboardJobsGraphView(APIView):
                 break
             succ_list.append([time.mktime(date.timetuple()), data_s.get(date, 0)])
             fail_list.append([time.mktime(date.timetuple()), data_f.get(date, 0)])
-            canceled_list.append([time.mktime(date.timetuple()), data_c.get(date, 0)])
-            error_list.append([time.mktime(date.timetuple()), data_e.get(date, 0)])
 
         return Response(dashboard_data)
 
@@ -369,20 +337,12 @@ class InstanceList(ListCreateAPIView):
     search_fields = ('hostname',)
     ordering = ('id',)
 
-    def get_queryset(self):
-        qs = super().get_queryset().prefetch_related('receptor_addresses')
-        return qs
-
 
 class InstanceDetail(RetrieveUpdateAPIView):
     name = _("Instance Detail")
     model = models.Instance
     serializer_class = serializers.InstanceSerializer
 
-    def get_queryset(self):
-        qs = super().get_queryset().prefetch_related('receptor_addresses')
-        return qs
-
     def update_raw_data(self, data):
         # these fields are only valid on creation of an instance, so they unwanted on detail view
         data.pop('node_type', None)
@@ -415,37 +375,13 @@ class InstanceUnifiedJobsList(SubListAPIView):
 
 
 class InstancePeersList(SubListAPIView):
-    name = _("Peers")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
+    name = _("Instance Peers")
     parent_model = models.Instance
+    model = models.Instance
+    serializer_class = serializers.InstanceSerializer
     parent_access = 'read'
+    search_fields = {'hostname'}
     relationship = 'peers'
-    search_fields = ('address',)
-
-
-class InstanceReceptorAddressesList(SubListAPIView):
-    name = _("Receptor Addresses")
-    model = models.ReceptorAddress
-    parent_key = 'instance'
-    parent_model = models.Instance
-    serializer_class = serializers.ReceptorAddressSerializer
-    search_fields = ('address',)
-
-
-class ReceptorAddressesList(ListAPIView):
-    name = _("Receptor Addresses")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
-    search_fields = ('address',)
-
-
-class ReceptorAddressDetail(RetrieveAPIView):
-    name = _("Receptor Address Detail")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
-    parent_model = models.Instance
-    relationship = 'receptor_addresses'
 
 
 class InstanceInstanceGroupsList(InstanceGroupMembershipMixin, SubListCreateAttachDetachAPIView):
@@ -540,7 +476,6 @@ class InstanceGroupAccessList(ResourceAccessList):
 
 
 class InstanceGroupObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.InstanceGroup
@@ -729,7 +664,6 @@ class TeamUsersList(BaseUsersList):
 
 
 class TeamRolesList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializerWithParentAccess
     metadata_class = RoleMetadata
@@ -769,12 +703,10 @@ class TeamRolesList(SubListAttachDetachAPIView):
 
 
 class TeamObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Team
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -792,15 +724,8 @@ class TeamProjectsList(SubListAPIView):
         self.check_parent_access(team)
         model_ct = ContentType.objects.get_for_model(self.model)
         parent_ct = ContentType.objects.get_for_model(self.parent_model)
-
-        rd = get_role_definition(team.member_role)
-        role = ObjectRole.objects.filter(object_id=team.id, content_type=parent_ct, role_definition=rd).first()
-        if role is None:
-            # Team has no permissions, therefore team has no projects
-            return self.model.objects.none()
-        else:
-            project_qs = self.model.accessible_objects(self.request.user, 'read_role')
-            return project_qs.filter(id__in=RoleEvaluation.objects.filter(content_type_id=model_ct.id, role=role).values_list('object_id'))
+        proj_roles = models.Role.objects.filter(Q(ancestors__content_type=parent_ct) & Q(ancestors__object_id=team.pk), content_type=model_ct)
+        return self.model.accessible_objects(self.request.user, 'read_role').filter(pk__in=[t.content_object.pk for t in proj_roles])
 
 
 class TeamActivityStreamList(SubListAPIView):
@@ -815,23 +740,10 @@ class TeamActivityStreamList(SubListAPIView):
         self.check_parent_access(parent)
 
         qs = self.request.user.get_queryset(self.model)
-
         return qs.filter(
             Q(team=parent)
-            | Q(
-                project__in=RoleEvaluation.objects.filter(
-                    role__in=parent.has_roles.all(), content_type_id=ContentType.objects.get_for_model(models.Project).id, codename='view_project'
-                )
-                .values_list('object_id')
-                .distinct()
-            )
-            | Q(
-                credential__in=RoleEvaluation.objects.filter(
-                    role__in=parent.has_roles.all(), content_type_id=ContentType.objects.get_for_model(models.Credential).id, codename='view_credential'
-                )
-                .values_list('object_id')
-                .distinct()
-            )
+            | Q(project__in=models.Project.accessible_objects(parent.member_role, 'read_role'))
+            | Q(credential__in=models.Credential.accessible_objects(parent.member_role, 'read_role'))
         )
 
 
@@ -1083,12 +995,10 @@ class ProjectAccessList(ResourceAccessList):
 
 
 class ProjectObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Project
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -1246,7 +1156,6 @@ class UserTeamsList(SubListAPIView):
 
 
 class UserRolesList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializerWithParentAccess
     metadata_class = RoleMetadata
@@ -1521,12 +1430,10 @@ class CredentialAccessList(ResourceAccessList):
 
 
 class CredentialObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Credential
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -2313,6 +2220,13 @@ class JobTemplateList(ListCreateAPIView):
     serializer_class = serializers.JobTemplateSerializer
     always_allow_superuser = False
 
+    def post(self, request, *args, **kwargs):
+        ret = super(JobTemplateList, self).post(request, *args, **kwargs)
+        if ret.status_code == 201:
+            job_template = models.JobTemplate.objects.get(id=ret.data['id'])
+            job_template.admin_role.members.add(request.user)
+        return ret
+
 
 class JobTemplateDetail(RelatedJobsPreventDeleteMixin, RetrieveUpdateDestroyAPIView):
     model = models.JobTemplate
@@ -2858,12 +2772,10 @@ class JobTemplateAccessList(ResourceAccessList):
 
 
 class JobTemplateObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.JobTemplate
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -3246,12 +3158,10 @@ class WorkflowJobTemplateAccessList(ResourceAccessList):
 
 
 class WorkflowJobTemplateObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.WorkflowJobTemplate
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -4260,7 +4170,6 @@ class ActivityStreamDetail(RetrieveAPIView):
 
 
 class RoleList(ListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     permission_classes = (IsAuthenticated,)
@@ -4268,13 +4177,11 @@ class RoleList(ListAPIView):
 
 
 class RoleDetail(RetrieveAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
 
 
 class RoleUsersList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.User
     serializer_class = serializers.UserSerializer
     parent_model = models.Role
@@ -4309,7 +4216,6 @@ class RoleUsersList(SubListAttachDetachAPIView):
 
 
 class RoleTeamsList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Team
     serializer_class = serializers.TeamSerializer
     parent_model = models.Role
@@ -4354,12 +4260,10 @@ class RoleTeamsList(SubListAttachDetachAPIView):
             team.member_role.children.remove(role)
         else:
             team.member_role.children.add(role)
-
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
 class RoleParentsList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Role
@@ -4373,7 +4277,6 @@ class RoleParentsList(SubListAPIView):
 
 
 class RoleChildrenList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Role

awx/api/views/analytics.py

@@ -48,23 +48,23 @@ class AnalyticsRootView(APIView):
 
     def get(self, request, format=None):
         data = OrderedDict()
-        data['authorized'] = reverse('api:analytics_authorized', request=request)
-        data['reports'] = reverse('api:analytics_reports_list', request=request)
-        data['report_options'] = reverse('api:analytics_report_options_list', request=request)
-        data['adoption_rate'] = reverse('api:analytics_adoption_rate', request=request)
-        data['adoption_rate_options'] = reverse('api:analytics_adoption_rate_options', request=request)
-        data['event_explorer'] = reverse('api:analytics_event_explorer', request=request)
-        data['event_explorer_options'] = reverse('api:analytics_event_explorer_options', request=request)
-        data['host_explorer'] = reverse('api:analytics_host_explorer', request=request)
-        data['host_explorer_options'] = reverse('api:analytics_host_explorer_options', request=request)
-        data['job_explorer'] = reverse('api:analytics_job_explorer', request=request)
-        data['job_explorer_options'] = reverse('api:analytics_job_explorer_options', request=request)
-        data['probe_templates'] = reverse('api:analytics_probe_templates_explorer', request=request)
-        data['probe_templates_options'] = reverse('api:analytics_probe_templates_options', request=request)
-        data['probe_template_for_hosts'] = reverse('api:analytics_probe_template_for_hosts_explorer', request=request)
-        data['probe_template_for_hosts_options'] = reverse('api:analytics_probe_template_for_hosts_options', request=request)
-        data['roi_templates'] = reverse('api:analytics_roi_templates_explorer', request=request)
-        data['roi_templates_options'] = reverse('api:analytics_roi_templates_options', request=request)
+        data['authorized'] = reverse('api:analytics_authorized')
+        data['reports'] = reverse('api:analytics_reports_list')
+        data['report_options'] = reverse('api:analytics_report_options_list')
+        data['adoption_rate'] = reverse('api:analytics_adoption_rate')
+        data['adoption_rate_options'] = reverse('api:analytics_adoption_rate_options')
+        data['event_explorer'] = reverse('api:analytics_event_explorer')
+        data['event_explorer_options'] = reverse('api:analytics_event_explorer_options')
+        data['host_explorer'] = reverse('api:analytics_host_explorer')
+        data['host_explorer_options'] = reverse('api:analytics_host_explorer_options')
+        data['job_explorer'] = reverse('api:analytics_job_explorer')
+        data['job_explorer_options'] = reverse('api:analytics_job_explorer_options')
+        data['probe_templates'] = reverse('api:analytics_probe_templates_explorer')
+        data['probe_templates_options'] = reverse('api:analytics_probe_templates_options')
+        data['probe_template_for_hosts'] = reverse('api:analytics_probe_template_for_hosts_explorer')
+        data['probe_template_for_hosts_options'] = reverse('api:analytics_probe_template_for_hosts_options')
+        data['roi_templates'] = reverse('api:analytics_roi_templates_explorer')
+        data['roi_templates_options'] = reverse('api:analytics_roi_templates_options')
         return Response(data)
 
 

awx/api/views/instance_install_bundle.py

@@ -124,19 +124,10 @@ def generate_inventory_yml(instance_obj):
 
 
 def generate_group_vars_all_yml(instance_obj):
-    # get peers
     peers = []
-    for addr in instance_obj.peers.select_related('instance'):
-        peers.append(dict(address=addr.get_full_address(), protocol=addr.protocol))
-    context = dict(instance=instance_obj, peers=peers)
-
-    canonical_addr = instance_obj.canonical_address
-    if canonical_addr:
-        context['listener_port'] = canonical_addr.port
-        protocol = canonical_addr.protocol if canonical_addr.protocol != 'wss' else 'ws'
-        context['listener_protocol'] = protocol
-
-    all_yaml = render_to_string("instance_install_bundle/group_vars/all.yml", context=context)
+    for instance in instance_obj.peers.all():
+        peers.append(dict(host=instance.hostname, port=instance.listener_port))
+    all_yaml = render_to_string("instance_install_bundle/group_vars/all.yml", context=dict(instance=instance_obj, peers=peers))
     # convert consecutive newlines with a single newline
     return re.sub(r'\n+', '\n', all_yaml)
 

awx/api/views/inventory.py

@@ -152,7 +152,6 @@ class InventoryObjectRolesList(SubListAPIView):
     serializer_class = RoleSerializer
     parent_model = Inventory
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()

awx/api/views/mesh_visualizer.py

@@ -17,7 +17,7 @@ class MeshVisualizer(APIView):
     def get(self, request, format=None):
         data = {
             'nodes': InstanceNodeSerializer(Instance.objects.all(), many=True).data,
-            'links': InstanceLinkSerializer(InstanceLink.objects.select_related('target__instance', 'source'), many=True).data,
+            'links': InstanceLinkSerializer(InstanceLink.objects.select_related('target', 'source'), many=True).data,
         }
 
         return Response(data)

awx/api/views/organization.py

@@ -226,7 +226,6 @@ class OrganizationObjectRolesList(SubListAPIView):
     serializer_class = RoleSerializer
     parent_model = Organization
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()

awx/api/views/root.py

@@ -13,7 +13,6 @@ from django.utils.decorators import method_decorator
 from django.views.decorators.csrf import ensure_csrf_cookie
 from django.template.loader import render_to_string
 from django.utils.translation import gettext_lazy as _
-from django.urls import reverse as django_reverse
 
 from rest_framework.permissions import AllowAny, IsAuthenticated
 from rest_framework.response import Response
@@ -28,7 +27,7 @@ from awx.main.analytics import all_collectors
 from awx.main.ha import is_ha_environment
 from awx.main.utils import get_awx_version, get_custom_venv_choices
 from awx.main.utils.licensing import validate_entitlement_manifest
-from awx.api.versioning import URLPathVersioning, is_optional_api_urlpattern_prefix_request, reverse, drf_reverse
+from awx.api.versioning import reverse, drf_reverse
 from awx.main.constants import PRIVILEGE_ESCALATION_METHODS
 from awx.main.models import Project, Organization, Instance, InstanceGroup, JobTemplate
 from awx.main.utils import set_environ
@@ -40,19 +39,19 @@ logger = logging.getLogger('awx.api.views.root')
 class ApiRootView(APIView):
     permission_classes = (AllowAny,)
     name = _('REST API')
-    versioning_class = URLPathVersioning
+    versioning_class = None
     swagger_topic = 'Versioning'
 
     @method_decorator(ensure_csrf_cookie)
     def get(self, request, format=None):
         '''List supported API versions'''
-        v2 = reverse('api:api_v2_root_view', request=request, kwargs={'version': 'v2'})
+
+        v2 = reverse('api:api_v2_root_view', kwargs={'version': 'v2'})
         data = OrderedDict()
         data['description'] = _('AWX REST API')
         data['current_version'] = v2
         data['available_versions'] = dict(v2=v2)
-        if not is_optional_api_urlpattern_prefix_request(request):
-            data['oauth2'] = drf_reverse('api:oauth_authorization_root_view')
+        data['oauth2'] = drf_reverse('api:oauth_authorization_root_view')
         data['custom_logo'] = settings.CUSTOM_LOGO
         data['custom_login_info'] = settings.CUSTOM_LOGIN_INFO
         data['login_redirect_override'] = settings.LOGIN_REDIRECT_OVERRIDE
@@ -85,7 +84,6 @@ class ApiVersionRootView(APIView):
         data['ping'] = reverse('api:api_v2_ping_view', request=request)
         data['instances'] = reverse('api:instance_list', request=request)
         data['instance_groups'] = reverse('api:instance_group_list', request=request)
-        data['receptor_addresses'] = reverse('api:receptor_addresses_list', request=request)
         data['config'] = reverse('api:api_v2_config_view', request=request)
         data['settings'] = reverse('api:setting_category_list', request=request)
         data['me'] = reverse('api:user_me_list', request=request)
@@ -131,10 +129,6 @@ class ApiVersionRootView(APIView):
         data['mesh_visualizer'] = reverse('api:mesh_visualizer_view', request=request)
         data['bulk'] = reverse('api:bulk', request=request)
         data['analytics'] = reverse('api:analytics_root_view', request=request)
-        data['service_index'] = django_reverse('service-index-root')
-        data['role_definitions'] = django_reverse('roledefinition-list')
-        data['role_user_assignments'] = django_reverse('roleuserassignment-list')
-        data['role_team_assignments'] = django_reverse('roleteamassignment-list')
         return Response(data)
 
 

awx/conf/conf.py

@@ -55,7 +55,6 @@ register(
     # Optional; category_slug will be slugified version of category if not
     # explicitly provided.
     category_slug='cows',
-    hidden=True,
 )
 
 

awx/conf/fields.py

@@ -61,10 +61,6 @@ class StringListBooleanField(ListField):
 
     def to_representation(self, value):
         try:
-            if isinstance(value, str):
-                # https://github.com/encode/django-rest-framework/commit/a180bde0fd965915718b070932418cabc831cee1
-                # DRF changed truthy and falsy lists to be capitalized
-                value = value.lower()
             if isinstance(value, (list, tuple)):
                 return super(StringListBooleanField, self).to_representation(value)
             elif value in BooleanField.TRUE_VALUES:
@@ -82,8 +78,6 @@ class StringListBooleanField(ListField):
 
     def to_internal_value(self, data):
         try:
-            if isinstance(data, str):
-                data = data.lower()
             if isinstance(data, (list, tuple)):
                 return super(StringListBooleanField, self).to_internal_value(data)
             elif data in BooleanField.TRUE_VALUES:

awx/conf/registry.py

@@ -127,8 +127,6 @@ class SettingsRegistry(object):
         encrypted = bool(field_kwargs.pop('encrypted', False))
         defined_in_file = bool(field_kwargs.pop('defined_in_file', False))
         unit = field_kwargs.pop('unit', None)
-        hidden = field_kwargs.pop('hidden', False)
-        warning_text = field_kwargs.pop('warning_text', None)
         if getattr(field_kwargs.get('child', None), 'source', None) is not None:
             field_kwargs['child'].source = None
         field_instance = field_class(**field_kwargs)
@@ -136,14 +134,12 @@ class SettingsRegistry(object):
         field_instance.category = category
         field_instance.depends_on = depends_on
         field_instance.unit = unit
-        field_instance.hidden = hidden
         if placeholder is not empty:
             field_instance.placeholder = placeholder
         field_instance.defined_in_file = defined_in_file
         if field_instance.defined_in_file:
             field_instance.help_text = str(_('This value has been set manually in a settings file.')) + '\n\n' + str(field_instance.help_text)
         field_instance.encrypted = encrypted
-        field_instance.warning_text = warning_text
         original_field_instance = field_instance
         if field_class != original_field_class:
             original_field_instance = original_field_class(**field_kwargs)

awx/conf/settings.py

@@ -1,7 +1,6 @@
 # Python
 import contextlib
 import logging
-import psycopg
 import threading
 import time
 import os
@@ -14,7 +13,7 @@ from django.conf import settings, UserSettingsHolder
 from django.core.cache import cache as django_cache
 from django.core.exceptions import ImproperlyConfigured, SynchronousOnlyOperation
 from django.db import transaction, connection
-from django.db.utils import DatabaseError, ProgrammingError
+from django.db.utils import Error as DBError, ProgrammingError
 from django.utils.functional import cached_property
 
 # Django REST Framework
@@ -81,26 +80,18 @@ def _ctit_db_wrapper(trans_safe=False):
                     logger.debug('Obtaining database settings in spite of broken transaction.')
                     transaction.set_rollback(False)
         yield
-    except ProgrammingError as e:
-        # Exception raised for programming errors
-        # Examples may be table not found or already exists,
-        # this generally means we can't fetch Tower configuration
-        # because the database hasn't actually finished migrating yet;
-        # this is usually a sign that a service in a container (such as ws_broadcast)
-        # has come up *before* the database has finished migrating, and
-        # especially that the conf.settings table doesn't exist yet
-        # syntax error in the SQL statement, wrong number of parameters specified, etc.
+    except DBError as exc:
         if trans_safe:
-            logger.debug(f'Database settings are not available, using defaults. error: {str(e)}')
-        else:
-            logger.exception('Error modifying something related to database settings.')
-    except DatabaseError as e:
-        if trans_safe:
-            cause = e.__cause__
-            if cause and hasattr(cause, 'sqlstate'):
-                sqlstate = cause.sqlstate
-                sqlstate_str = psycopg.errors.lookup(sqlstate)
-                logger.error('SQL Error state: {} - {}'.format(sqlstate, sqlstate_str))
+            level = logger.warning
+            if isinstance(exc, ProgrammingError):
+                if 'relation' in str(exc) and 'does not exist' in str(exc):
+                    # this generally means we can't fetch Tower configuration
+                    # because the database hasn't actually finished migrating yet;
+                    # this is usually a sign that a service in a container (such as ws_broadcast)
+                    # has come up *before* the database has finished migrating, and
+                    # especially that the conf.settings table doesn't exist yet
+                    level = logger.debug
+            level(f'Database settings are not available, using defaults. error: {str(exc)}')
         else:
             logger.exception('Error modifying something related to database settings.')
     finally:

awx/conf/tests/unit/test_settings.py

@@ -130,9 +130,9 @@ def test_default_setting(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system', default='DEFAULT')
 
     settings_to_cache = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache)
-    assert settings.AWX_SOME_SETTING == 'DEFAULT'
-    assert settings.cache.get('AWX_SOME_SETTING') == 'DEFAULT'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache):
+        assert settings.AWX_SOME_SETTING == 'DEFAULT'
+        assert settings.cache.get('AWX_SOME_SETTING') == 'DEFAULT'
 
 
 @pytest.mark.defined_in_file(AWX_SOME_SETTING='DEFAULT')
@@ -146,9 +146,9 @@ def test_setting_is_not_from_setting_file(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system', default='DEFAULT')
 
     settings_to_cache = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache)
-    assert settings.AWX_SOME_SETTING == 'DEFAULT'
-    assert settings.registry.get_setting_field('AWX_SOME_SETTING').defined_in_file is False
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache):
+        assert settings.AWX_SOME_SETTING == 'DEFAULT'
+        assert settings.registry.get_setting_field('AWX_SOME_SETTING').defined_in_file is False
 
 
 def test_empty_setting(settings, mocker):
@@ -156,10 +156,10 @@ def test_empty_setting(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system')
 
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([]), 'first.return_value': None})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    with pytest.raises(AttributeError):
-        settings.AWX_SOME_SETTING
-    assert settings.cache.get('AWX_SOME_SETTING') == SETTING_CACHE_NOTSET
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        with pytest.raises(AttributeError):
+            settings.AWX_SOME_SETTING
+        assert settings.cache.get('AWX_SOME_SETTING') == SETTING_CACHE_NOTSET
 
 
 def test_setting_from_db(settings, mocker):
@@ -168,9 +168,9 @@ def test_setting_from_db(settings, mocker):
 
     setting_from_db = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([setting_from_db]), 'first.return_value': setting_from_db})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    assert settings.AWX_SOME_SETTING == 'FROM_DB'
-    assert settings.cache.get('AWX_SOME_SETTING') == 'FROM_DB'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        assert settings.AWX_SOME_SETTING == 'FROM_DB'
+        assert settings.cache.get('AWX_SOME_SETTING') == 'FROM_DB'
 
 
 @pytest.mark.defined_in_file(AWX_SOME_SETTING='DEFAULT')
@@ -205,8 +205,8 @@ def test_db_setting_update(settings, mocker):
 
     existing_setting = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
     setting_list = mocker.Mock(**{'order_by.return_value.first.return_value': existing_setting})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=setting_list)
-    settings.AWX_SOME_SETTING = 'NEW-VALUE'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=setting_list):
+        settings.AWX_SOME_SETTING = 'NEW-VALUE'
 
     assert existing_setting.value == 'NEW-VALUE'
     existing_setting.save.assert_called_with(update_fields=['value'])
@@ -217,8 +217,8 @@ def test_db_setting_deletion(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system')
 
     existing_setting = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=[existing_setting])
-    del settings.AWX_SOME_SETTING
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=[existing_setting]):
+        del settings.AWX_SOME_SETTING
 
     assert existing_setting.delete.call_count == 1
 
@@ -283,10 +283,10 @@ def test_sensitive_cache_data_is_encrypted(settings, mocker):
     # use its primary key as part of the encryption key
     setting_from_db = mocker.Mock(pk=123, key='AWX_ENCRYPTED', value='SECRET!')
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([setting_from_db]), 'first.return_value': setting_from_db})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    cache.set('AWX_ENCRYPTED', 'SECRET!')
-    assert cache.get('AWX_ENCRYPTED') == 'SECRET!'
-    assert native_cache.get('AWX_ENCRYPTED') == 'FRPERG!'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        cache.set('AWX_ENCRYPTED', 'SECRET!')
+        assert cache.get('AWX_ENCRYPTED') == 'SECRET!'
+        assert native_cache.get('AWX_ENCRYPTED') == 'FRPERG!'
 
 
 def test_readonly_sensitive_cache_data_is_encrypted(settings):

awx/main/access.py

@@ -20,10 +20,7 @@ from rest_framework.exceptions import ParseError, PermissionDenied
 # Django OAuth Toolkit
 from awx.main.models.oauth import OAuth2Application, OAuth2AccessToken
 
-# django-ansible-base
 from ansible_base.lib.utils.validation import to_python_boolean
-from ansible_base.rbac.models import RoleEvaluation
-from ansible_base.rbac import permission_registry
 
 # AWX
 from awx.main.utils import (
@@ -60,7 +57,6 @@ from awx.main.models import (
     Project,
     ProjectUpdate,
     ProjectUpdateEvent,
-    ReceptorAddress,
     Role,
     Schedule,
     SystemJob,
@@ -75,6 +71,8 @@ from awx.main.models import (
     WorkflowJobTemplateNode,
     WorkflowApproval,
     WorkflowApprovalTemplate,
+    ROLE_SINGLETON_SYSTEM_ADMINISTRATOR,
+    ROLE_SINGLETON_SYSTEM_AUDITOR,
 )
 from awx.main.models.mixins import ResourceMixin
 
@@ -265,11 +263,7 @@ class BaseAccess(object):
         return self.can_change(obj, data)
 
     def can_delete(self, obj):
-        if self.user.is_superuser:
-            return True
-        if obj._meta.model_name in [cls._meta.model_name for cls in permission_registry.all_registered_models]:
-            return self.user.has_obj_perm(obj, 'delete')
-        return False
+        return self.user.is_superuser
 
     def can_copy(self, obj):
         return self.can_add({'reference_obj': obj})
@@ -644,10 +638,7 @@ class UserAccess(BaseAccess):
     """
 
     model = User
-    prefetch_related = (
-        'profile',
-        'resource',
-    )
+    prefetch_related = ('profile',)
 
     def filtered_queryset(self):
         if settings.ORG_ADMINS_CAN_SEE_ALL_USERS and (self.user.admin_of_organizations.exists() or self.user.auditor_of_organizations.exists()):
@@ -656,7 +647,9 @@ class UserAccess(BaseAccess):
             qs = (
                 User.objects.filter(pk__in=Organization.accessible_objects(self.user, 'read_role').values('member_role__members'))
                 | User.objects.filter(pk=self.user.id)
-                | User.objects.filter(is_superuser=True)
+                | User.objects.filter(
+                    pk__in=Role.objects.filter(singleton_name__in=[ROLE_SINGLETON_SYSTEM_ADMINISTRATOR, ROLE_SINGLETON_SYSTEM_AUDITOR]).values('members')
+                )
             ).distinct()
         return qs
 
@@ -714,15 +707,6 @@ class UserAccess(BaseAccess):
             if not allow_orphans:
                 # in these cases only superusers can modify orphan users
                 return False
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                # Permission granted if the user has all permissions that the target user has
-                target_perms = set(
-                    RoleEvaluation.objects.filter(role__in=obj.has_roles.all()).values_list('object_id', 'content_type_id', 'codename').distinct()
-                )
-                user_perms = set(
-                    RoleEvaluation.objects.filter(role__in=self.user.has_roles.all()).values_list('object_id', 'content_type_id', 'codename').distinct()
-                )
-                return not (target_perms - user_perms)
             return not obj.roles.all().exclude(ancestors__in=self.user.roles.all()).exists()
         else:
             return self.is_all_org_admin(obj)
@@ -850,7 +834,6 @@ class OrganizationAccess(NotificationAttachMixin, BaseAccess):
     prefetch_related = (
         'created_by',
         'modified_by',
-        'resource',  # dab_resource_registry
     )
     # organization admin_role is not a parent of organization auditor_role
     notification_attach_roles = ['admin_role', 'auditor_role']
@@ -961,6 +944,9 @@ class InventoryAccess(BaseAccess):
     def can_update(self, obj):
         return self.user in obj.update_role
 
+    def can_delete(self, obj):
+        return self.can_admin(obj, None)
+
     def can_run_ad_hoc_commands(self, obj):
         return self.user in obj.adhoc_role
 
@@ -1316,7 +1302,6 @@ class TeamAccess(BaseAccess):
         'created_by',
         'modified_by',
         'organization',
-        'resource',  # dab_resource_registry
     )
 
     def filtered_queryset(self):
@@ -1414,12 +1399,8 @@ class ExecutionEnvironmentAccess(BaseAccess):
     def can_change(self, obj, data):
         if obj and obj.organization_id is None:
             raise PermissionDenied
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            if not self.user.has_obj_perm(obj, 'change'):
-                raise PermissionDenied
-        else:
-            if self.user not in obj.organization.execution_environment_admin_role:
-                raise PermissionDenied
+        if self.user not in obj.organization.execution_environment_admin_role:
+            raise PermissionDenied
         if data and 'organization' in data:
             new_org = get_object_from_data('organization', Organization, data, obj=obj)
             if not new_org or self.user not in new_org.execution_environment_admin_role:
@@ -2449,29 +2430,6 @@ class InventoryUpdateEventAccess(BaseAccess):
         return False
 
 
-class ReceptorAddressAccess(BaseAccess):
-    """
-    I can see receptor address records whenever I can access the instance
-    """
-
-    model = ReceptorAddress
-
-    def filtered_queryset(self):
-        return self.model.objects.filter(Q(instance__in=Instance.accessible_pk_qs(self.user, 'read_role')))
-
-    @check_superuser
-    def can_add(self, data):
-        return False
-
-    @check_superuser
-    def can_change(self, obj, data):
-        return False
-
-    @check_superuser
-    def can_delete(self, obj):
-        return False
-
-
 class SystemJobEventAccess(BaseAccess):
     """
     I can only see manage System Jobs events if I'm a super user
@@ -2605,8 +2563,6 @@ class ScheduleAccess(UnifiedCredentialsMixin, BaseAccess):
         if not JobLaunchConfigAccess(self.user).can_add(data):
             return False
         if not data:
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                return self.user.has_roles.filter(permission_partials__codename__in=['execute_jobtemplate', 'update_project', 'update_inventory']).exists()
             return Role.objects.filter(role_field__in=['update_role', 'execute_role'], ancestors__in=self.user.roles.all()).exists()
 
         return self.check_related('unified_job_template', UnifiedJobTemplate, data, role_field='execute_role', mandatory=True)
@@ -2635,8 +2591,6 @@ class NotificationTemplateAccess(BaseAccess):
     prefetch_related = ('created_by', 'modified_by', 'organization')
 
     def filtered_queryset(self):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            return self.model.access_qs(self.user, 'view')
         return self.model.objects.filter(
             Q(organization__in=Organization.accessible_objects(self.user, 'notification_admin_role')) | Q(organization__in=self.user.auditor_of_organizations)
         ).distinct()
@@ -2805,7 +2759,7 @@ class ActivityStreamAccess(BaseAccess):
                 | Q(notification_template__organization__in=auditing_orgs)
                 | Q(notification__notification_template__organization__in=auditing_orgs)
                 | Q(label__organization__in=auditing_orgs)
-                | Q(role__in=Role.visible_roles(self.user) if auditing_orgs else [])
+                | Q(role__in=Role.objects.filter(ancestors__in=self.user.roles.all()) if auditing_orgs else [])
             )
 
         project_set = Project.accessible_pk_qs(self.user, 'read_role')
@@ -2862,10 +2816,13 @@ class RoleAccess(BaseAccess):
 
     def filtered_queryset(self):
         result = Role.visible_roles(self.user)
-        # Make system admin/auditor mandatorily visible.
-        mandatories = ('system_administrator', 'system_auditor')
-        super_qs = Role.objects.filter(singleton_name__in=mandatories)
-        return result | super_qs
+        # Sanity check: is the requesting user an orphaned non-admin/auditor?
+        # if yes, make system admin/auditor mandatorily visible.
+        if not self.user.is_superuser and not self.user.is_system_auditor and not self.user.organizations.exists():
+            mandatories = ('system_administrator', 'system_auditor')
+            super_qs = Role.objects.filter(singleton_name__in=mandatories)
+            result = result | super_qs
+        return result
 
     def can_add(self, obj, data):
         # Unsupported for now

awx/main/analytics/analytics_tasks.py

@@ -2,7 +2,7 @@
 import logging
 
 # AWX
-from awx.main.analytics.subsystem_metrics import DispatcherMetrics, CallbackReceiverMetrics
+from awx.main.analytics.subsystem_metrics import Metrics
 from awx.main.dispatch.publish import task
 from awx.main.dispatch import get_task_queuename
 
@@ -11,5 +11,4 @@ logger = logging.getLogger('awx.main.scheduler')
 
 @task(queue=get_task_queuename)
 def send_subsystem_metrics():
-    DispatcherMetrics().send_metrics()
-    CallbackReceiverMetrics().send_metrics()
+    Metrics().send_metrics()

awx/main/analytics/collectors.py

@@ -419,7 +419,7 @@ def _events_table(since, full_path, until, tbl, where_column, project_job_create
                           resolved_action,
                           resolved_role,
                           -- '-' operator listed here:
-                          -- https://www.postgresql.org/docs/15/functions-json.html
+                          -- https://www.postgresql.org/docs/12/functions-json.html
                           -- note that operator is only supported by jsonb objects
                           -- https://www.postgresql.org/docs/current/datatype-json.html
                           (CASE WHEN event = 'playbook_on_stats' THEN {event_data} - 'artifact_data' END) as playbook_on_stats,

awx/main/analytics/subsystem_metrics.py

@@ -1,15 +1,10 @@
-import itertools
 import redis
 import json
 import time
 import logging
 
-import prometheus_client
-from prometheus_client.core import GaugeMetricFamily, HistogramMetricFamily
-from prometheus_client.registry import CollectorRegistry
 from django.conf import settings
-from django.http import HttpRequest
-from rest_framework.request import Request
+from django.apps import apps
 
 from awx.main.consumers import emit_channel_notification
 from awx.main.utils import is_testing
@@ -18,30 +13,6 @@ root_key = settings.SUBSYSTEM_METRICS_REDIS_KEY_PREFIX
 logger = logging.getLogger('awx.main.analytics')
 
 
-class MetricsNamespace:
-    def __init__(self, namespace):
-        self._namespace = namespace
-
-
-class MetricsServerSettings(MetricsNamespace):
-    def port(self):
-        return settings.METRICS_SUBSYSTEM_CONFIG['server'][self._namespace]['port']
-
-
-class MetricsServer(MetricsServerSettings):
-    def __init__(self, namespace, registry):
-        MetricsNamespace.__init__(self, namespace)
-        self._registry = registry
-
-    def start(self):
-        try:
-            # TODO: addr for ipv6 ?
-            prometheus_client.start_http_server(self.port(), addr='localhost', registry=self._registry)
-        except Exception:
-            logger.error(f"MetricsServer failed to start for service '{self._namespace}.")
-            raise
-
-
 class BaseM:
     def __init__(self, field, help_text):
         self.field = field
@@ -177,40 +148,76 @@ class HistogramM(BaseM):
         return output_text
 
 
-class Metrics(MetricsNamespace):
-    # metric name, help_text
-    METRICSLIST = []
-    _METRICSLIST = [
-        FloatM('subsystem_metrics_pipe_execute_seconds', 'Time spent saving metrics to redis'),
-        IntM('subsystem_metrics_pipe_execute_calls', 'Number of calls to pipe_execute'),
-        FloatM('subsystem_metrics_send_metrics_seconds', 'Time spent sending metrics to other nodes'),
-    ]
-
-    def __init__(self, namespace, auto_pipe_execute=False, instance_name=None, metrics_have_changed=True, **kwargs):
-        MetricsNamespace.__init__(self, namespace)
-
+class Metrics:
+    def __init__(self, auto_pipe_execute=False, instance_name=None):
         self.pipe = redis.Redis.from_url(settings.BROKER_URL).pipeline()
         self.conn = redis.Redis.from_url(settings.BROKER_URL)
         self.last_pipe_execute = time.time()
         # track if metrics have been modified since last saved to redis
         # start with True so that we get an initial save to redis
-        self.metrics_have_changed = metrics_have_changed
+        self.metrics_have_changed = True
         self.pipe_execute_interval = settings.SUBSYSTEM_METRICS_INTERVAL_SAVE_TO_REDIS
         self.send_metrics_interval = settings.SUBSYSTEM_METRICS_INTERVAL_SEND_METRICS
         # auto pipe execute will commit transaction of metric data to redis
         # at a regular interval (pipe_execute_interval). If set to False,
         # the calling function should call .pipe_execute() explicitly
         self.auto_pipe_execute = auto_pipe_execute
+        Instance = apps.get_model('main', 'Instance')
         if instance_name:
             self.instance_name = instance_name
         elif is_testing():
             self.instance_name = "awx_testing"
         else:
-            self.instance_name = settings.CLUSTER_HOST_ID  # Same as Instance.objects.my_hostname() BUT we do not need to import Instance
+            self.instance_name = Instance.objects.my_hostname()
 
+        # metric name, help_text
+        METRICSLIST = [
+            SetIntM('callback_receiver_events_queue_size_redis', 'Current number of events in redis queue'),
+            IntM('callback_receiver_events_popped_redis', 'Number of events popped from redis'),
+            IntM('callback_receiver_events_in_memory', 'Current number of events in memory (in transfer from redis to db)'),
+            IntM('callback_receiver_batch_events_errors', 'Number of times batch insertion failed'),
+            FloatM('callback_receiver_events_insert_db_seconds', 'Total time spent saving events to database'),
+            IntM('callback_receiver_events_insert_db', 'Number of events batch inserted into database'),
+            IntM('callback_receiver_events_broadcast', 'Number of events broadcast to other control plane nodes'),
+            HistogramM(
+                'callback_receiver_batch_events_insert_db', 'Number of events batch inserted into database', settings.SUBSYSTEM_METRICS_BATCH_INSERT_BUCKETS
+            ),
+            SetFloatM('callback_receiver_event_processing_avg_seconds', 'Average processing time per event per callback receiver batch'),
+            FloatM('subsystem_metrics_pipe_execute_seconds', 'Time spent saving metrics to redis'),
+            IntM('subsystem_metrics_pipe_execute_calls', 'Number of calls to pipe_execute'),
+            FloatM('subsystem_metrics_send_metrics_seconds', 'Time spent sending metrics to other nodes'),
+            SetFloatM('task_manager_get_tasks_seconds', 'Time spent in loading tasks from db'),
+            SetFloatM('task_manager_start_task_seconds', 'Time spent starting task'),
+            SetFloatM('task_manager_process_running_tasks_seconds', 'Time spent processing running tasks'),
+            SetFloatM('task_manager_process_pending_tasks_seconds', 'Time spent processing pending tasks'),
+            SetFloatM('task_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('task_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('task_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetIntM('task_manager_tasks_started', 'Number of tasks started'),
+            SetIntM('task_manager_running_processed', 'Number of running tasks processed'),
+            SetIntM('task_manager_pending_processed', 'Number of pending tasks processed'),
+            SetIntM('task_manager_tasks_blocked', 'Number of tasks blocked from running'),
+            SetFloatM('task_manager_commit_seconds', 'Time spent in db transaction, including on_commit calls'),
+            SetFloatM('dependency_manager_get_tasks_seconds', 'Time spent loading pending tasks from db'),
+            SetFloatM('dependency_manager_generate_dependencies_seconds', 'Time spent generating dependencies for pending tasks'),
+            SetFloatM('dependency_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('dependency_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('dependency_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetIntM('dependency_manager_pending_processed', 'Number of pending tasks processed'),
+            SetFloatM('workflow_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('workflow_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('workflow_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetFloatM('workflow_manager_spawn_workflow_graph_jobs_seconds', 'Time spent spawning workflow tasks'),
+            SetFloatM('workflow_manager_get_tasks_seconds', 'Time spent loading workflow tasks from db'),
+            # dispatcher subsystem metrics
+            SetIntM('dispatcher_pool_scale_up_events', 'Number of times local dispatcher scaled up a worker since startup'),
+            SetIntM('dispatcher_pool_active_task_count', 'Number of active tasks in the worker pool when last task was submitted'),
+            SetIntM('dispatcher_pool_max_worker_count', 'Highest number of workers in worker pool in last collection interval, about 20s'),
+            SetFloatM('dispatcher_availability', 'Fraction of time (in last collection interval) dispatcher was able to receive messages'),
+        ]
         # turn metric list into dictionary with the metric name as a key
         self.METRICS = {}
-        for m in itertools.chain(self.METRICSLIST, self._METRICSLIST):
+        for m in METRICSLIST:
             self.METRICS[m.field] = m
 
         # track last time metrics were sent to other nodes
@@ -223,7 +230,7 @@ class Metrics(MetricsNamespace):
             m.reset_value(self.conn)
         self.metrics_have_changed = True
         self.conn.delete(root_key + "_lock")
-        for m in self.conn.scan_iter(root_key + '-' + self._namespace + '_instance_*'):
+        for m in self.conn.scan_iter(root_key + '_instance_*'):
             self.conn.delete(m)
 
     def inc(self, field, value):
@@ -290,7 +297,7 @@ class Metrics(MetricsNamespace):
     def send_metrics(self):
         # more than one thread could be calling this at the same time, so should
         # acquire redis lock before sending metrics
-        lock = self.conn.lock(root_key + '-' + self._namespace + '_lock')
+        lock = self.conn.lock(root_key + '_lock')
         if not lock.acquire(blocking=False):
             return
         try:
@@ -300,10 +307,9 @@ class Metrics(MetricsNamespace):
                 payload = {
                     'instance': self.instance_name,
                     'metrics': serialized_metrics,
-                    'metrics_namespace': self._namespace,
                 }
                 # store the serialized data locally as well, so that load_other_metrics will read it
-                self.conn.set(root_key + '-' + self._namespace + '_instance_' + self.instance_name, serialized_metrics)
+                self.conn.set(root_key + '_instance_' + self.instance_name, serialized_metrics)
                 emit_channel_notification("metrics", payload)
 
                 self.previous_send_metrics.set(current_time)
@@ -325,14 +331,14 @@ class Metrics(MetricsNamespace):
         instances_filter = request.query_params.getlist("node")
         # get a sorted list of instance names
         instance_names = [self.instance_name]
-        for m in self.conn.scan_iter(root_key + '-' + self._namespace + '_instance_*'):
+        for m in self.conn.scan_iter(root_key + '_instance_*'):
             instance_names.append(m.decode('UTF-8').split('_instance_')[1])
         instance_names.sort()
         # load data, including data from the this local instance
         instance_data = {}
         for instance in instance_names:
             if len(instances_filter) == 0 or instance in instances_filter:
-                instance_data_from_redis = self.conn.get(root_key + '-' + self._namespace + '_instance_' + instance)
+                instance_data_from_redis = self.conn.get(root_key + '_instance_' + instance)
                 # data from other instances may not be available. That is OK.
                 if instance_data_from_redis:
                     instance_data[instance] = json.loads(instance_data_from_redis.decode('UTF-8'))
@@ -351,120 +357,6 @@ class Metrics(MetricsNamespace):
         return output_text
 
 
-class DispatcherMetrics(Metrics):
-    METRICSLIST = [
-        SetFloatM('task_manager_get_tasks_seconds', 'Time spent in loading tasks from db'),
-        SetFloatM('task_manager_start_task_seconds', 'Time spent starting task'),
-        SetFloatM('task_manager_process_running_tasks_seconds', 'Time spent processing running tasks'),
-        SetFloatM('task_manager_process_pending_tasks_seconds', 'Time spent processing pending tasks'),
-        SetFloatM('task_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('task_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('task_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetIntM('task_manager_tasks_started', 'Number of tasks started'),
-        SetIntM('task_manager_running_processed', 'Number of running tasks processed'),
-        SetIntM('task_manager_pending_processed', 'Number of pending tasks processed'),
-        SetIntM('task_manager_tasks_blocked', 'Number of tasks blocked from running'),
-        SetFloatM('task_manager_commit_seconds', 'Time spent in db transaction, including on_commit calls'),
-        SetFloatM('dependency_manager_get_tasks_seconds', 'Time spent loading pending tasks from db'),
-        SetFloatM('dependency_manager_generate_dependencies_seconds', 'Time spent generating dependencies for pending tasks'),
-        SetFloatM('dependency_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('dependency_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('dependency_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetIntM('dependency_manager_pending_processed', 'Number of pending tasks processed'),
-        SetFloatM('workflow_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('workflow_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('workflow_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetFloatM('workflow_manager_spawn_workflow_graph_jobs_seconds', 'Time spent spawning workflow tasks'),
-        SetFloatM('workflow_manager_get_tasks_seconds', 'Time spent loading workflow tasks from db'),
-        # dispatcher subsystem metrics
-        SetIntM('dispatcher_pool_scale_up_events', 'Number of times local dispatcher scaled up a worker since startup'),
-        SetIntM('dispatcher_pool_active_task_count', 'Number of active tasks in the worker pool when last task was submitted'),
-        SetIntM('dispatcher_pool_max_worker_count', 'Highest number of workers in worker pool in last collection interval, about 20s'),
-        SetFloatM('dispatcher_availability', 'Fraction of time (in last collection interval) dispatcher was able to receive messages'),
-    ]
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.METRICS_SERVICE_DISPATCHER, *args, **kwargs)
-
-
-class CallbackReceiverMetrics(Metrics):
-    METRICSLIST = [
-        SetIntM('callback_receiver_events_queue_size_redis', 'Current number of events in redis queue'),
-        IntM('callback_receiver_events_popped_redis', 'Number of events popped from redis'),
-        IntM('callback_receiver_events_in_memory', 'Current number of events in memory (in transfer from redis to db)'),
-        IntM('callback_receiver_batch_events_errors', 'Number of times batch insertion failed'),
-        FloatM('callback_receiver_events_insert_db_seconds', 'Total time spent saving events to database'),
-        IntM('callback_receiver_events_insert_db', 'Number of events batch inserted into database'),
-        IntM('callback_receiver_events_broadcast', 'Number of events broadcast to other control plane nodes'),
-        HistogramM(
-            'callback_receiver_batch_events_insert_db', 'Number of events batch inserted into database', settings.SUBSYSTEM_METRICS_BATCH_INSERT_BUCKETS
-        ),
-        SetFloatM('callback_receiver_event_processing_avg_seconds', 'Average processing time per event per callback receiver batch'),
-    ]
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.METRICS_SERVICE_CALLBACK_RECEIVER, *args, **kwargs)
-
-
 def metrics(request):
-    output_text = ''
-    for m in [DispatcherMetrics(), CallbackReceiverMetrics()]:
-        output_text += m.generate_metrics(request)
-    return output_text
-
-
-class CustomToPrometheusMetricsCollector(prometheus_client.registry.Collector):
-    """
-    Takes the metric data from redis -> our custom metric fields -> prometheus
-    library metric fields.
-
-    The plan is to get rid of the use of redis, our custom metric fields, and
-    to switch fully to the prometheus library. At that point, this translation
-    code will be deleted.
-    """
-
-    def __init__(self, metrics_obj, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._metrics = metrics_obj
-
-    def collect(self):
-        my_hostname = settings.CLUSTER_HOST_ID
-
-        instance_data = self._metrics.load_other_metrics(Request(HttpRequest()))
-        if not instance_data:
-            logger.debug(f"No metric data not found in redis for metric namespace '{self._metrics._namespace}'")
-            return None
-
-        host_metrics = instance_data.get(my_hostname)
-        for _, metric in self._metrics.METRICS.items():
-            entry = host_metrics.get(metric.field)
-            if not entry:
-                logger.debug(f"{self._metrics._namespace} metric '{metric.field}' not found in redis data payload {json.dumps(instance_data, indent=2)}")
-                continue
-            if isinstance(metric, HistogramM):
-                buckets = list(zip(metric.buckets, entry['counts']))
-                buckets = [[str(i[0]), str(i[1])] for i in buckets]
-                yield HistogramMetricFamily(metric.field, metric.help_text, buckets=buckets, sum_value=entry['sum'])
-            else:
-                yield GaugeMetricFamily(metric.field, metric.help_text, value=entry)
-
-
-class CallbackReceiverMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        registry.register(CustomToPrometheusMetricsCollector(DispatcherMetrics(metrics_have_changed=False)))
-        super().__init__(settings.METRICS_SERVICE_CALLBACK_RECEIVER, registry)
-
-
-class DispatcherMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        registry.register(CustomToPrometheusMetricsCollector(CallbackReceiverMetrics(metrics_have_changed=False)))
-        super().__init__(settings.METRICS_SERVICE_DISPATCHER, registry)
-
-
-class WebsocketsMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        # registry.register()
-        super().__init__(settings.METRICS_SERVICE_WEBSOCKETS, registry)
+    m = Metrics()
+    return m.generate_metrics(request)

awx/main/apps.py

@@ -1,40 +1,7 @@
 from django.apps import AppConfig
 from django.utils.translation import gettext_lazy as _
-from awx.main.utils.named_url_graph import _customize_graph, generate_graph
-from awx.conf import register, fields
 
 
 class MainConfig(AppConfig):
     name = 'awx.main'
     verbose_name = _('Main')
-
-    def load_named_url_feature(self):
-        models = [m for m in self.get_models() if hasattr(m, 'get_absolute_url')]
-        generate_graph(models)
-        _customize_graph()
-        register(
-            'NAMED_URL_FORMATS',
-            field_class=fields.DictField,
-            read_only=True,
-            label=_('Formats of all available named urls'),
-            help_text=_('Read-only list of key-value pairs that shows the standard format of all available named URLs.'),
-            category=_('Named URL'),
-            category_slug='named-url',
-        )
-        register(
-            'NAMED_URL_GRAPH_NODES',
-            field_class=fields.DictField,
-            read_only=True,
-            label=_('List of all named url graph nodes.'),
-            help_text=_(
-                'Read-only list of key-value pairs that exposes named URL graph topology.'
-                ' Use this list to programmatically generate named URLs for resources'
-            ),
-            category=_('Named URL'),
-            category_slug='named-url',
-        )
-
-    def ready(self):
-        super().ready()
-
-        self.load_named_url_feature()

awx/main/conf.py

@@ -2,7 +2,6 @@
 import logging
 
 # Django
-from django.core.checks import Error
 from django.utils.translation import gettext_lazy as _
 
 # Django REST Framework
@@ -93,7 +92,6 @@ register(
     ),
     category=_('System'),
     category_slug='system',
-    required=False,
 )
 
 register(
@@ -776,7 +774,6 @@ register(
     allow_null=True,
     category=_('System'),
     category_slug='system',
-    required=False,
 )
 register(
     'AUTOMATION_ANALYTICS_LAST_ENTRIES',
@@ -818,7 +815,6 @@ register(
     help_text=_('Max jobs to allow bulk jobs to launch'),
     category=_('Bulk Actions'),
     category_slug='bulk',
-    hidden=True,
 )
 
 register(
@@ -829,7 +825,6 @@ register(
     help_text=_('Max number of hosts to allow to be created in a single bulk action'),
     category=_('Bulk Actions'),
     category_slug='bulk',
-    hidden=True,
 )
 
 register(
@@ -840,7 +835,6 @@ register(
     help_text=_('Max number of hosts to allow to be deleted in a single bulk action'),
     category=_('Bulk Actions'),
     category_slug='bulk',
-    hidden=True,
 )
 
 register(
@@ -851,7 +845,6 @@ register(
     help_text=_('Enable preview of new user interface.'),
     category=_('System'),
     category_slug='system',
-    hidden=True,
 )
 
 register(
@@ -955,27 +948,3 @@ def logging_validate(serializer, attrs):
 
 
 register_validate('logging', logging_validate)
-
-
-def csrf_trusted_origins_validate(serializer, attrs):
-    if not serializer.instance or not hasattr(serializer.instance, 'CSRF_TRUSTED_ORIGINS'):
-        return attrs
-    if 'CSRF_TRUSTED_ORIGINS' not in attrs:
-        return attrs
-    errors = []
-    for origin in attrs['CSRF_TRUSTED_ORIGINS']:
-        if "://" not in origin:
-            errors.append(
-                Error(
-                    "As of Django 4.0, the values in the CSRF_TRUSTED_ORIGINS "
-                    "setting must start with a scheme (usually http:// or "
-                    "https://) but found %s. See the release notes for details." % origin,
-                )
-            )
-    if errors:
-        error_messages = [error.msg for error in errors]
-        raise serializers.ValidationError(_('\n'.join(error_messages)))
-    return attrs
-
-
-register_validate('system', csrf_trusted_origins_validate)

awx/main/constants.py

@@ -14,7 +14,7 @@ __all__ = [
     'STANDARD_INVENTORY_UPDATE_ENV',
 ]
 
-CLOUD_PROVIDERS = ('azure_rm', 'ec2', 'gce', 'vmware', 'openstack', 'rhv', 'satellite6', 'controller', 'insights', 'terraform')
+CLOUD_PROVIDERS = ('azure_rm', 'ec2', 'gce', 'vmware', 'openstack', 'rhv', 'satellite6', 'controller', 'insights')
 PRIVILEGE_ESCALATION_METHODS = [
     ('sudo', _('Sudo')),
     ('su', _('Su')),
@@ -114,28 +114,3 @@ SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS = 'unique_managed_hosts'
 
 # Shared prefetch to use for creating a queryset for the purpose of writing or saving facts
 HOST_FACTS_FIELDS = ('name', 'ansible_facts', 'ansible_facts_modified', 'modified', 'inventory_id')
-
-# Data for RBAC compatibility layer
-role_name_to_perm_mapping = {
-    'adhoc_role': ['adhoc_'],
-    'approval_role': ['approve_'],
-    'auditor_role': ['audit_'],
-    'admin_role': ['change_', 'add_', 'delete_'],
-    'execute_role': ['execute_'],
-    'read_role': ['view_'],
-    'update_role': ['update_'],
-    'member_role': ['member_'],
-    'use_role': ['use_'],
-}
-
-org_role_to_permission = {
-    'notification_admin_role': 'add_notificationtemplate',
-    'project_admin_role': 'add_project',
-    'execute_role': 'execute_jobtemplate',
-    'inventory_admin_role': 'add_inventory',
-    'credential_admin_role': 'add_credential',
-    'workflow_admin_role': 'add_workflowjobtemplate',
-    'job_template_admin_role': 'change_jobtemplate',  # TODO: this doesnt really work, solution not clear
-    'execution_environment_admin_role': 'add_executionenvironment',
-    'auditor_role': 'view_project',  # TODO: also doesnt really work
-}

awx/main/consumers.py

@@ -106,7 +106,7 @@ class RelayConsumer(AsyncJsonWebsocketConsumer):
         if group == "metrics":
             message = json.loads(message['text'])
             conn = redis.Redis.from_url(settings.BROKER_URL)
-            conn.set(settings.SUBSYSTEM_METRICS_REDIS_KEY_PREFIX + "-" + message['metrics_namespace'] + "_instance_" + message['instance'], message['metrics'])
+            conn.set(settings.SUBSYSTEM_METRICS_REDIS_KEY_PREFIX + "_instance_" + message['instance'], message['metrics'])
         else:
             await self.channel_layer.group_send(group, message)
 

awx/main/credential_plugins/azure_kv.py

@@ -1,10 +1,9 @@
-from azure.keyvault.secrets import SecretClient
-from azure.identity import ClientSecretCredential
-from msrestazure import azure_cloud
-
 from .plugin import CredentialPlugin
 
 from django.utils.translation import gettext_lazy as _
+from azure.keyvault import KeyVaultClient, KeyVaultAuthentication
+from azure.common.credentials import ServicePrincipalCredentials
+from msrestazure import azure_cloud
 
 
 # https://github.com/Azure/msrestazure-for-python/blob/master/msrestazure/azure_cloud.py
@@ -55,9 +54,22 @@ azure_keyvault_inputs = {
 
 
 def azure_keyvault_backend(**kwargs):
-    csc = ClientSecretCredential(tenant_id=kwargs['tenant'], client_id=kwargs['client'], client_secret=kwargs['secret'])
-    kv = SecretClient(credential=csc, vault_url=kwargs['url'])
-    return kv.get_secret(name=kwargs['secret_field'], version=kwargs.get('secret_version', '')).value
+    url = kwargs['url']
+    [cloud] = [c for c in clouds if c.name == kwargs.get('cloud_name', default_cloud.name)]
+
+    def auth_callback(server, resource, scope):
+        credentials = ServicePrincipalCredentials(
+            url=url,
+            client_id=kwargs['client'],
+            secret=kwargs['secret'],
+            tenant=kwargs['tenant'],
+            resource=f"https://{cloud.suffixes.keyvault_dns.split('.', 1).pop()}",
+        )
+        token = credentials.token
+        return token['token_type'], token['access_token']
+
+    kv = KeyVaultClient(KeyVaultAuthentication(auth_callback))
+    return kv.get_secret(url, kwargs['secret_field'], kwargs.get('secret_version', '')).value
 
 
 azure_keyvault_plugin = CredentialPlugin('Microsoft Azure Key Vault', inputs=azure_keyvault_inputs, backend=azure_keyvault_backend)

awx/main/dispatch/__init__.py

@@ -1,7 +1,6 @@
 import os
 import psycopg
 import select
-from copy import deepcopy
 
 from contextlib import contextmanager
 
@@ -95,8 +94,8 @@ class PubSub(object):
 
 
 def create_listener_connection():
-    conf = deepcopy(settings.DATABASES['default'])
-    conf['OPTIONS'] = deepcopy(conf.get('OPTIONS', {}))
+    conf = settings.DATABASES['default'].copy()
+    conf['OPTIONS'] = conf.get('OPTIONS', {}).copy()
     # Modify the application name to distinguish from other connections the process might use
     conf['OPTIONS']['application_name'] = get_application_name(settings.CLUSTER_HOST_ID, function='listener')
 
@@ -106,11 +105,7 @@ def create_listener_connection():
     for k, v in settings.LISTENER_DATABASES.get('default', {}).get('OPTIONS', {}).items():
         conf['OPTIONS'][k] = v
 
-    # Allow password-less authentication
-    if 'PASSWORD' in conf:
-        conf['OPTIONS']['password'] = conf.pop('PASSWORD')
-
-    connection_data = f"dbname={conf['NAME']} host={conf['HOST']} user={conf['USER']} port={conf['PORT']}"
+    connection_data = f"dbname={conf['NAME']} host={conf['HOST']} user={conf['USER']} password={conf['PASSWORD']} port={conf['PORT']}"
     return psycopg.connect(connection_data, autocommit=True, **conf['OPTIONS'])
 
 

awx/main/dispatch/worker/base.py

@@ -162,13 +162,13 @@ class AWXConsumerRedis(AWXConsumerBase):
 class AWXConsumerPG(AWXConsumerBase):
     def __init__(self, *args, schedule=None, **kwargs):
         super().__init__(*args, **kwargs)
-        self.pg_max_wait = getattr(settings, 'DISPATCHER_DB_DOWNTOWN_TOLLERANCE', settings.DISPATCHER_DB_DOWNTIME_TOLERANCE)
+        self.pg_max_wait = settings.DISPATCHER_DB_DOWNTIME_TOLERANCE
         # if no successful loops have ran since startup, then we should fail right away
         self.pg_is_down = True  # set so that we fail if we get database errors on startup
         init_time = time.time()
         self.pg_down_time = init_time - self.pg_max_wait  # allow no grace period
         self.last_cleanup = init_time
-        self.subsystem_metrics = s_metrics.DispatcherMetrics(auto_pipe_execute=False)
+        self.subsystem_metrics = s_metrics.Metrics(auto_pipe_execute=False)
         self.last_metrics_gather = init_time
         self.listen_cumulative_time = 0.0
         if schedule:
@@ -259,12 +259,6 @@ class AWXConsumerPG(AWXConsumerBase):
                 current_downtime = time.time() - self.pg_down_time
                 if current_downtime > self.pg_max_wait:
                     logger.exception(f"Postgres event consumer has not recovered in {current_downtime} s, exiting")
-                    # Sending QUIT to multiprocess queue to signal workers to exit
-                    for worker in self.pool.workers:
-                        try:
-                            worker.quit()
-                        except Exception:
-                            logger.exception(f"Error sending QUIT to worker {worker}")
                     raise
                 # Wait for a second before next attempt, but still listen for any shutdown signals
                 for i in range(10):
@@ -276,12 +270,6 @@ class AWXConsumerPG(AWXConsumerBase):
             except Exception:
                 # Log unanticipated exception in addition to writing to stderr to get timestamps and other metadata
                 logger.exception('Encountered unhandled error in dispatcher main loop')
-                # Sending QUIT to multiprocess queue to signal workers to exit
-                for worker in self.pool.workers:
-                    try:
-                        worker.quit()
-                    except Exception:
-                        logger.exception(f"Error sending QUIT to worker {worker}")
                 raise
 
 

awx/main/dispatch/worker/callback.py

@@ -72,7 +72,7 @@ class CallbackBrokerWorker(BaseWorker):
     def __init__(self):
         self.buff = {}
         self.redis = redis.Redis.from_url(settings.BROKER_URL)
-        self.subsystem_metrics = s_metrics.CallbackReceiverMetrics(auto_pipe_execute=False)
+        self.subsystem_metrics = s_metrics.Metrics(auto_pipe_execute=False)
         self.queue_pop = 0
         self.queue_name = settings.CALLBACK_QUEUE
         self.prof = AWXProfiler("CallbackBrokerWorker")

awx/main/fields.py

@@ -5,7 +5,6 @@
 import copy
 import json
 import re
-import sys
 import urllib.parse
 
 from jinja2 import sandbox, StrictUndefined
@@ -407,13 +406,11 @@ class SmartFilterField(models.TextField):
         # https://docs.python.org/2/library/stdtypes.html#truth-value-testing
         if not value:
             return None
-        # avoid doing too much during migrations
-        if 'migrate' not in sys.argv:
-            value = urllib.parse.unquote(value)
-            try:
-                SmartFilter().query_from_string(value)
-            except RuntimeError as e:
-                raise models.base.ValidationError(e)
+        value = urllib.parse.unquote(value)
+        try:
+            SmartFilter().query_from_string(value)
+        except RuntimeError as e:
+            raise models.base.ValidationError(e)
         return super(SmartFilterField, self).get_prep_value(value)
 
 

awx/main/management/commands/add_receptor_address.py

@@ -1,53 +0,0 @@
-# Copyright (c) 2015 Ansible, Inc.
-# All Rights Reserved
-
-from django.core.management.base import BaseCommand
-
-from awx.main.models import Instance, ReceptorAddress
-
-
-def add_address(**kwargs):
-    try:
-        instance = Instance.objects.get(hostname=kwargs.pop('instance'))
-        kwargs['instance'] = instance
-
-        if kwargs.get('canonical') and instance.receptor_addresses.filter(canonical=True).exclude(address=kwargs['address']).exists():
-            print(f"Instance {instance.hostname} already has a canonical address, skipping")
-            return False
-        # if ReceptorAddress already exists with address, just update
-        # otherwise, create new ReceptorAddress
-        addr, _ = ReceptorAddress.objects.update_or_create(address=kwargs.pop('address'), defaults=kwargs)
-        print(f"Successfully added receptor address {addr.get_full_address()}")
-        return True
-    except Exception as e:
-        print(f"Error adding receptor address: {e}")
-        return False
-
-
-class Command(BaseCommand):
-    """
-    Internal controller command.
-    Register receptor address to an already-registered instance.
-    """
-
-    help = "Add receptor address to an instance."
-
-    def add_arguments(self, parser):
-        parser.add_argument('--instance', dest='instance', required=True, type=str, help="Instance hostname this address is added to")
-        parser.add_argument('--address', dest='address', required=True, type=str, help="Receptor address")
-        parser.add_argument('--port', dest='port', type=int, help="Receptor listener port")
-        parser.add_argument('--websocket_path', dest='websocket_path', type=str, default="", help="Path for websockets")
-        parser.add_argument('--is_internal', action='store_true', help="If true, address only resolvable within the Kubernetes cluster")
-        parser.add_argument('--protocol', type=str, default='tcp', choices=['tcp', 'ws', 'wss'], help="Protocol to use for the Receptor listener")
-        parser.add_argument('--canonical', action='store_true', help="If true, address is the canonical address for the instance")
-        parser.add_argument('--peers_from_control_nodes', action='store_true', help="If true, control nodes will peer to this address")
-
-    def handle(self, **options):
-        address_options = {
-            k: options[k]
-            for k in ('instance', 'address', 'port', 'websocket_path', 'is_internal', 'protocol', 'peers_from_control_nodes', 'canonical')
-            if options[k]
-        }
-        changed = add_address(**address_options)
-        if changed:
-            print("(changed: True)")

awx/main/management/commands/check_instance_ready.py

@@ -1,12 +0,0 @@
-from django.core.management.base import BaseCommand, CommandError
-from awx.main.models.ha import Instance
-
-
-class Command(BaseCommand):
-    help = 'Check if the task manager instance is ready throw error if not ready, can be use as readiness probe for k8s.'
-
-    def handle(self, *args, **options):
-        if Instance.objects.me().node_state != Instance.States.READY:
-            raise CommandError('Instance is not ready')  # so that return code is not 0
-
-        return

awx/main/management/commands/dump_auth_config.py

@@ -1,195 +0,0 @@
-import json
-import os
-import sys
-import re
-from typing import Any
-
-from django.core.management.base import BaseCommand
-from django.conf import settings
-
-from awx.conf import settings_registry
-
-
-class Command(BaseCommand):
-    help = 'Dump the current auth configuration in django_ansible_base.authenticator format, currently supports LDAP and SAML'
-
-    DAB_SAML_AUTHENTICATOR_KEYS = {
-        "SP_ENTITY_ID": True,
-        "SP_PUBLIC_CERT": True,
-        "SP_PRIVATE_KEY": True,
-        "ORG_INFO": True,
-        "TECHNICAL_CONTACT": True,
-        "SUPPORT_CONTACT": True,
-        "SP_EXTRA": False,
-        "SECURITY_CONFIG": False,
-        "EXTRA_DATA": False,
-        "ENABLED_IDPS": True,
-        "CALLBACK_URL": False,
-    }
-
-    DAB_LDAP_AUTHENTICATOR_KEYS = {
-        "SERVER_URI": True,
-        "BIND_DN": False,
-        "BIND_PASSWORD": False,
-        "CONNECTION_OPTIONS": False,
-        "GROUP_TYPE": True,
-        "GROUP_TYPE_PARAMS": True,
-        "GROUP_SEARCH": False,
-        "START_TLS": False,
-        "USER_DN_TEMPLATE": True,
-        "USER_ATTR_MAP": True,
-        "USER_SEARCH": False,
-    }
-
-    def is_enabled(self, settings, keys):
-        missing_fields = []
-        for key, required in keys.items():
-            if required and not settings.get(key):
-                missing_fields.append(key)
-        if missing_fields:
-            return False, missing_fields
-        return True, None
-
-    def get_awx_ldap_settings(self) -> dict[str, dict[str, Any]]:
-        awx_ldap_settings = {}
-
-        for awx_ldap_setting in settings_registry.get_registered_settings(category_slug='ldap'):
-            key = awx_ldap_setting.removeprefix("AUTH_LDAP_")
-            value = getattr(settings, awx_ldap_setting, None)
-            awx_ldap_settings[key] = value
-
-        grouped_settings = {}
-
-        for key, value in awx_ldap_settings.items():
-            match = re.search(r'(\d+)', key)
-            index = int(match.group()) if match else 0
-            new_key = re.sub(r'\d+_', '', key)
-
-            if index not in grouped_settings:
-                grouped_settings[index] = {}
-
-            grouped_settings[index][new_key] = value
-            if new_key == "GROUP_TYPE" and value:
-                grouped_settings[index][new_key] = type(value).__name__
-
-            if new_key == "SERVER_URI" and value:
-                value = value.split(", ")
-                grouped_settings[index][new_key] = value
-
-            if type(value).__name__ == "LDAPSearch":
-                data = []
-                data.append(value.base_dn)
-                data.append("SCOPE_SUBTREE")
-                data.append(value.filterstr)
-                grouped_settings[index][new_key] = data
-
-        return grouped_settings
-
-    def get_awx_saml_settings(self) -> dict[str, Any]:
-        awx_saml_settings = {}
-        for awx_saml_setting in settings_registry.get_registered_settings(category_slug='saml'):
-            awx_saml_settings[awx_saml_setting.removeprefix("SOCIAL_AUTH_SAML_")] = getattr(settings, awx_saml_setting, None)
-
-        return awx_saml_settings
-
-    def format_config_data(self, enabled, awx_settings, type, keys, name):
-        config = {
-            "type": f"ansible_base.authentication.authenticator_plugins.{type}",
-            "name": name,
-            "enabled": enabled,
-            "create_objects": True,
-            "users_unique": False,
-            "remove_users": True,
-            "configuration": {},
-        }
-        for k in keys:
-            v = awx_settings.get(k)
-            config["configuration"].update({k: v})
-
-        if type == "saml":
-            idp_to_key_mapping = {
-                "url": "IDP_URL",
-                "x509cert": "IDP_X509_CERT",
-                "entity_id": "IDP_ENTITY_ID",
-                "attr_email": "IDP_ATTR_EMAIL",
-                "attr_groups": "IDP_GROUPS",
-                "attr_username": "IDP_ATTR_USERNAME",
-                "attr_last_name": "IDP_ATTR_LAST_NAME",
-                "attr_first_name": "IDP_ATTR_FIRST_NAME",
-                "attr_user_permanent_id": "IDP_ATTR_USER_PERMANENT_ID",
-            }
-            for idp_name in awx_settings.get("ENABLED_IDPS", {}):
-                for key in idp_to_key_mapping:
-                    value = awx_settings["ENABLED_IDPS"][idp_name].get(key)
-                    if value is not None:
-                        config["name"] = idp_name
-                        config["configuration"].update({idp_to_key_mapping[key]: value})
-
-        return config
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "output_file",
-            nargs="?",
-            type=str,
-            default=None,
-            help="Output JSON file path",
-        )
-
-    def handle(self, *args, **options):
-        try:
-            data = []
-
-            # dump SAML settings
-            awx_saml_settings = self.get_awx_saml_settings()
-            awx_saml_enabled, saml_missing_fields = self.is_enabled(awx_saml_settings, self.DAB_SAML_AUTHENTICATOR_KEYS)
-            if awx_saml_enabled:
-                awx_saml_name = awx_saml_settings["ENABLED_IDPS"]
-                data.append(
-                    self.format_config_data(
-                        awx_saml_enabled,
-                        awx_saml_settings,
-                        "saml",
-                        self.DAB_SAML_AUTHENTICATOR_KEYS,
-                        awx_saml_name,
-                    )
-                )
-            else:
-                data.append({"SAML_missing_fields": saml_missing_fields})
-
-            # dump LDAP settings
-            awx_ldap_group_settings = self.get_awx_ldap_settings()
-            for awx_ldap_name, awx_ldap_settings in awx_ldap_group_settings.items():
-                awx_ldap_enabled, ldap_missing_fields = self.is_enabled(awx_ldap_settings, self.DAB_LDAP_AUTHENTICATOR_KEYS)
-                if awx_ldap_enabled:
-                    data.append(
-                        self.format_config_data(
-                            awx_ldap_enabled,
-                            awx_ldap_settings,
-                            "ldap",
-                            self.DAB_LDAP_AUTHENTICATOR_KEYS,
-                            f"LDAP_{awx_ldap_name}",
-                        )
-                    )
-                else:
-                    data.append({f"LDAP_{awx_ldap_name}_missing_fields": ldap_missing_fields})
-
-            # write to file if requested
-            if options["output_file"]:
-                # Define the path for the output JSON file
-                output_file = options["output_file"]
-
-                # Ensure the directory exists
-                os.makedirs(os.path.dirname(output_file), exist_ok=True)
-
-                # Write data to the JSON file
-                with open(output_file, "w") as f:
-                    json.dump(data, f, indent=4)
-
-                self.stdout.write(self.style.SUCCESS(f"Auth config data dumped to {output_file}"))
-            else:
-                self.stdout.write(json.dumps(data, indent=4))
-
-        except Exception as e:
-            self.stdout.write(self.style.ERROR(f"An error occurred: {str(e)}"))
-            sys.exit(1)

awx/main/management/commands/list_instances.py

@@ -55,7 +55,7 @@ class Command(BaseCommand):
 
                 capacity = f' capacity={x.capacity}' if x.node_type != 'hop' else ''
                 version = f" version={x.version or '?'}" if x.node_type != 'hop' else ''
-                heartbeat = f' heartbeat="{x.last_seen:%Y-%m-%d %H:%M:%S}"' if x.last_seen else ''
+                heartbeat = f' heartbeat="{x.last_seen:%Y-%m-%d %H:%M:%S}"' if x.capacity or x.node_type == 'hop' else ''
                 print(f'\t{color}{x.hostname}{capacity} node_type={x.node_type}{version}{heartbeat}{end_color}')
 
             print()

awx/main/management/commands/provision_instance.py

@@ -25,17 +25,20 @@ class Command(BaseCommand):
 
     def add_arguments(self, parser):
         parser.add_argument('--hostname', dest='hostname', type=str, help="Hostname used during provisioning")
+        parser.add_argument('--listener_port', dest='listener_port', type=int, help="Receptor listener port")
         parser.add_argument('--node_type', type=str, default='hybrid', choices=['control', 'execution', 'hop', 'hybrid'], help="Instance Node type")
         parser.add_argument('--uuid', type=str, help="Instance UUID")
 
-    def _register_hostname(self, hostname, node_type, uuid):
+    def _register_hostname(self, hostname, node_type, uuid, listener_port):
         if not hostname:
             if not settings.AWX_AUTO_DEPROVISION_INSTANCES:
                 raise CommandError('Registering with values from settings only intended for use in K8s installs')
 
             from awx.main.management.commands.register_queue import RegisterQueue
 
-            (changed, instance) = Instance.objects.register(ip_address=os.environ.get('MY_POD_IP'), node_type='control', node_uuid=settings.SYSTEM_UUID)
+            (changed, instance) = Instance.objects.register(
+                ip_address=os.environ.get('MY_POD_IP'), listener_port=listener_port, node_type='control', node_uuid=settings.SYSTEM_UUID
+            )
             RegisterQueue(settings.DEFAULT_CONTROL_PLANE_QUEUE_NAME, 100, 0, [], is_container_group=False).register()
             RegisterQueue(
                 settings.DEFAULT_EXECUTION_QUEUE_NAME,
@@ -48,17 +51,16 @@ class Command(BaseCommand):
                 max_concurrent_jobs=settings.DEFAULT_EXECUTION_QUEUE_MAX_CONCURRENT_JOBS,
             ).register()
         else:
-            (changed, instance) = Instance.objects.register(hostname=hostname, node_type=node_type, node_uuid=uuid)
+            (changed, instance) = Instance.objects.register(hostname=hostname, node_type=node_type, node_uuid=uuid, listener_port=listener_port)
         if changed:
             print("Successfully registered instance {}".format(hostname))
         else:
             print("Instance already registered {}".format(instance.hostname))
-
         self.changed = changed
 
     @transaction.atomic
     def handle(self, **options):
         self.changed = False
-        self._register_hostname(options.get('hostname'), options.get('node_type'), options.get('uuid'))
+        self._register_hostname(options.get('hostname'), options.get('node_type'), options.get('uuid'), options.get('listener_port'))
         if self.changed:
             print("(changed: True)")

awx/main/management/commands/register_peers.py

@@ -1,7 +1,9 @@
+import warnings
+
 from django.core.management.base import BaseCommand, CommandError
 from django.db import transaction
 
-from awx.main.models import Instance, InstanceLink, ReceptorAddress
+from awx.main.models import Instance, InstanceLink
 
 
 class Command(BaseCommand):
@@ -26,9 +28,7 @@ class Command(BaseCommand):
 
     def handle(self, **options):
         # provides a mapping of hostname to Instance objects
-        nodes = Instance.objects.all().in_bulk(field_name='hostname')
-        # provides a mapping of address to ReceptorAddress objects
-        addresses = ReceptorAddress.objects.all().in_bulk(field_name='address')
+        nodes = Instance.objects.in_bulk(field_name='hostname')
 
         if options['source'] not in nodes:
             raise CommandError(f"Host {options['source']} is not a registered instance.")
@@ -39,14 +39,6 @@ class Command(BaseCommand):
         if options['exact'] is not None and options['disconnect']:
             raise CommandError("The option --disconnect may not be used with --exact.")
 
-        # make sure each target has a receptor address
-        peers = options['peers'] or []
-        disconnect = options['disconnect'] or []
-        exact = options['exact'] or []
-        for peer in peers + disconnect + exact:
-            if peer not in addresses:
-                raise CommandError(f"Peer {peer} does not have a receptor address.")
-
         # No 1-cycles
         for collection in ('peers', 'disconnect', 'exact'):
             if options[collection] is not None and options['source'] in options[collection]:
@@ -55,12 +47,9 @@ class Command(BaseCommand):
         # No 2-cycles
         if options['peers'] or options['exact'] is not None:
             peers = set(options['peers'] or options['exact'])
-            if options['source'] in addresses:
-                incoming = set(InstanceLink.objects.filter(target=addresses[options['source']]).values_list('source__hostname', flat=True))
-            else:
-                incoming = set()
+            incoming = set(InstanceLink.objects.filter(target=nodes[options['source']]).values_list('source__hostname', flat=True))
             if peers & incoming:
-                raise CommandError(f"Source node {options['source']} should not link to nodes already peering to it: {peers & incoming}.")
+                warnings.warn(f"Source node {options['source']} should not link to nodes already peering to it: {peers & incoming}.")
 
         if options['peers']:
             missing_peers = set(options['peers']) - set(nodes)
@@ -71,7 +60,7 @@ class Command(BaseCommand):
             results = 0
             for target in options['peers']:
                 _, created = InstanceLink.objects.update_or_create(
-                    source=nodes[options['source']], target=addresses[target], defaults={'link_state': InstanceLink.States.ESTABLISHED}
+                    source=nodes[options['source']], target=nodes[target], defaults={'link_state': InstanceLink.States.ESTABLISHED}
                 )
                 if created:
                     results += 1
@@ -81,9 +70,9 @@ class Command(BaseCommand):
         if options['disconnect']:
             results = 0
             for target in options['disconnect']:
-                if target not in addresses:  # Be permissive, the node might have already been de-registered.
+                if target not in nodes:  # Be permissive, the node might have already been de-registered.
                     continue
-                n, _ = InstanceLink.objects.filter(source=nodes[options['source']], target=addresses[target]).delete()
+                n, _ = InstanceLink.objects.filter(source=nodes[options['source']], target=nodes[target]).delete()
                 results += n
 
             print(f"{results} peer links removed from the database.")
@@ -92,11 +81,11 @@ class Command(BaseCommand):
             additions = 0
             with transaction.atomic():
                 peers = set(options['exact'])
-                links = set(InstanceLink.objects.filter(source=nodes[options['source']]).values_list('target__address', flat=True))
-                removals, _ = InstanceLink.objects.filter(source=nodes[options['source']], target__instance__hostname__in=links - peers).delete()
+                links = set(InstanceLink.objects.filter(source=nodes[options['source']]).values_list('target__hostname', flat=True))
+                removals, _ = InstanceLink.objects.filter(source=nodes[options['source']], target__hostname__in=links - peers).delete()
                 for target in peers - links:
                     _, created = InstanceLink.objects.update_or_create(
-                        source=nodes[options['source']], target=addresses[target], defaults={'link_state': InstanceLink.States.ESTABLISHED}
+                        source=nodes[options['source']], target=nodes[target], defaults={'link_state': InstanceLink.States.ESTABLISHED}
                     )
                     if created:
                         additions += 1

awx/main/management/commands/remove_receptor_address.py

@@ -1,26 +0,0 @@
-# Copyright (c) 2015 Ansible, Inc.
-# All Rights Reserved
-
-from django.core.management.base import BaseCommand
-
-from awx.main.models import ReceptorAddress
-
-
-class Command(BaseCommand):
-    """
-    Internal controller command.
-    Delete a receptor address.
-    """
-
-    help = "Add receptor address to an instance."
-
-    def add_arguments(self, parser):
-        parser.add_argument('--address', dest='address', type=str, help="Receptor address to remove")
-
-    def handle(self, **options):
-        deleted = ReceptorAddress.objects.filter(address=options['address']).delete()
-        if deleted[0]:
-            print(f"Successfully removed {options['address']}")
-            print("(changed: True)")
-        else:
-            print(f"Did not remove {options['address']}, not found")

awx/main/management/commands/run_callback_receiver.py

@@ -3,7 +3,6 @@
 
 from django.conf import settings
 from django.core.management.base import BaseCommand
-from awx.main.analytics.subsystem_metrics import CallbackReceiverMetricsServer
 
 from awx.main.dispatch.control import Control
 from awx.main.dispatch.worker import AWXConsumerRedis, CallbackBrokerWorker
@@ -26,9 +25,6 @@ class Command(BaseCommand):
             print(Control('callback_receiver').status())
             return
         consumer = None
-
-        CallbackReceiverMetricsServer().start()
-
         try:
             consumer = AWXConsumerRedis(
                 'callback_receiver',

awx/main/management/commands/run_dispatcher.py

@@ -10,7 +10,6 @@ from awx.main.dispatch import get_task_queuename
 from awx.main.dispatch.control import Control
 from awx.main.dispatch.pool import AutoscalePool
 from awx.main.dispatch.worker import AWXConsumerPG, TaskWorker
-from awx.main.analytics.subsystem_metrics import DispatcherMetricsServer
 
 logger = logging.getLogger('awx.main.dispatch')
 
@@ -63,8 +62,6 @@ class Command(BaseCommand):
 
         consumer = None
 
-        DispatcherMetricsServer().start()
-
         try:
             queues = ['tower_broadcast_all', 'tower_settings_change', get_task_queuename()]
             consumer = AWXConsumerPG('dispatcher', TaskWorker(), queues, AutoscalePool(min_workers=4), schedule=settings.CELERYBEAT_SCHEDULE)

awx/main/management/commands/run_wsrelay.py

@@ -16,7 +16,6 @@ from awx.main.analytics.broadcast_websocket import (
     RelayWebsocketStatsManager,
     safe_name,
 )
-from awx.main.analytics.subsystem_metrics import WebsocketsMetricsServer
 from awx.main.wsrelay import WebSocketRelayManager
 
 
@@ -101,9 +100,8 @@ class Command(BaseCommand):
             migrating = bool(executor.migration_plan(executor.loader.graph.leaf_nodes()))
             connection.close()  # Because of async nature, main loop will use new connection, so close this
         except Exception as exc:
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f'Error on startup of run_wsrelay (error: {exc}), slept for 10s...')
+            logger.warning(f'Error on startup of run_wsrelay (error: {exc}), retry in 10s...')
+            time.sleep(10)
             return
 
         # In containerized deployments, migrations happen in the task container,
@@ -122,14 +120,13 @@ class Command(BaseCommand):
             return
 
         try:
-            my_hostname = Instance.objects.my_hostname()  # This relies on settings.CLUSTER_HOST_ID which requires database connection
+            my_hostname = Instance.objects.my_hostname()
             logger.info('Active instance with hostname {} is registered.'.format(my_hostname))
         except RuntimeError as e:
             # the CLUSTER_HOST_ID in the task, and web instance must match and
             # ensure network connectivity between the task and web instance
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f"Unable to return currently active instance: {e}, slept for 10s before return.")
+            logger.info('Unable to return currently active instance: {}, retry in 5s...'.format(e))
+            time.sleep(5)
             return
 
         if options.get('status'):
@@ -166,16 +163,8 @@ class Command(BaseCommand):
 
             return
 
-        WebsocketsMetricsServer().start()
-
         try:
-            logger.info('Starting Websocket Relayer...')
             websocket_relay_manager = WebSocketRelayManager()
             asyncio.run(websocket_relay_manager.run())
         except KeyboardInterrupt:
             logger.info('Terminating Websocket Relayer')
-        except BaseException as e:  # BaseException is used to catch all exceptions including asyncio.CancelledError
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f"Encounter error while running Websocket Relayer {e}, slept for 10s...")
-            return

awx/main/managers.py

@@ -115,14 +115,7 @@ class InstanceManager(models.Manager):
             return node[0]
         raise RuntimeError("No instance found with the current cluster host id")
 
-    def register(
-        self,
-        node_uuid=None,
-        hostname=None,
-        ip_address="",
-        node_type='hybrid',
-        defaults=None,
-    ):
+    def register(self, node_uuid=None, hostname=None, ip_address="", listener_port=None, node_type='hybrid', defaults=None):
         if not hostname:
             hostname = settings.CLUSTER_HOST_ID
 
@@ -168,6 +161,9 @@ class InstanceManager(models.Manager):
                 if instance.node_type != node_type:
                     instance.node_type = node_type
                     update_fields.append('node_type')
+                if instance.listener_port != listener_port:
+                    instance.listener_port = listener_port
+                    update_fields.append('listener_port')
                 if update_fields:
                     instance.save(update_fields=update_fields)
                     return (True, instance)
@@ -178,13 +174,11 @@ class InstanceManager(models.Manager):
             create_defaults = {
                 'node_state': Instance.States.INSTALLED,
                 'capacity': 0,
-                'managed': True,
             }
             if defaults is not None:
                 create_defaults.update(defaults)
             uuid_option = {'uuid': node_uuid if node_uuid is not None else uuid.uuid4()}
             if node_type == 'execution' and 'version' not in create_defaults:
                 create_defaults['version'] = RECEPTOR_PENDING
-            instance = self.create(hostname=hostname, ip_address=ip_address, node_type=node_type, **create_defaults, **uuid_option)
-
+            instance = self.create(hostname=hostname, ip_address=ip_address, listener_port=listener_port, node_type=node_type, **create_defaults, **uuid_option)
         return (True, instance)

awx/main/middleware.py

@@ -1,25 +1,25 @@
 # Copyright (c) 2015 Ansible, Inc.
 # All Rights Reserved.
 
-import functools
 import logging
 import threading
 import time
 import urllib.parse
-from pathlib import Path, PurePosixPath
 
 from django.conf import settings
 from django.contrib.auth import logout
-from django.db.migrations.recorder import MigrationRecorder
+from django.contrib.auth.models import User
+from django.db.migrations.executor import MigrationExecutor
 from django.db import connection
 from django.shortcuts import redirect
+from django.apps import apps
 from django.utils.deprecation import MiddlewareMixin
+from django.utils.translation import gettext_lazy as _
 from django.urls import reverse, resolve
 
-from awx.main import migrations
+from awx.main.utils.named_url_graph import generate_graph, GraphNode
+from awx.conf import fields, register
 from awx.main.utils.profiling import AWXProfiler
-from awx.main.utils.common import memoize
-from awx.urls import get_urlpatterns
 
 
 logger = logging.getLogger('awx.main.middleware')
@@ -97,7 +97,49 @@ class DisableLocalAuthMiddleware(MiddlewareMixin):
                 logout(request)
 
 
+def _customize_graph():
+    from awx.main.models import Instance, Schedule, UnifiedJobTemplate
+
+    for model in [Schedule, UnifiedJobTemplate]:
+        if model in settings.NAMED_URL_GRAPH:
+            settings.NAMED_URL_GRAPH[model].remove_bindings()
+            settings.NAMED_URL_GRAPH.pop(model)
+    if User not in settings.NAMED_URL_GRAPH:
+        settings.NAMED_URL_GRAPH[User] = GraphNode(User, ['username'], [])
+        settings.NAMED_URL_GRAPH[User].add_bindings()
+    if Instance not in settings.NAMED_URL_GRAPH:
+        settings.NAMED_URL_GRAPH[Instance] = GraphNode(Instance, ['hostname'], [])
+        settings.NAMED_URL_GRAPH[Instance].add_bindings()
+
+
 class URLModificationMiddleware(MiddlewareMixin):
+    def __init__(self, get_response):
+        models = [m for m in apps.get_app_config('main').get_models() if hasattr(m, 'get_absolute_url')]
+        generate_graph(models)
+        _customize_graph()
+        register(
+            'NAMED_URL_FORMATS',
+            field_class=fields.DictField,
+            read_only=True,
+            label=_('Formats of all available named urls'),
+            help_text=_('Read-only list of key-value pairs that shows the standard format of all available named URLs.'),
+            category=_('Named URL'),
+            category_slug='named-url',
+        )
+        register(
+            'NAMED_URL_GRAPH_NODES',
+            field_class=fields.DictField,
+            read_only=True,
+            label=_('List of all named url graph nodes.'),
+            help_text=_(
+                'Read-only list of key-value pairs that exposes named URL graph topology.'
+                ' Use this list to programmatically generate named URLs for resources'
+            ),
+            category=_('Named URL'),
+            category_slug='named-url',
+        )
+        super().__init__(get_response)
+
     @staticmethod
     def _hijack_for_old_jt_name(node, kwargs, named_url):
         try:
@@ -138,36 +180,14 @@ class URLModificationMiddleware(MiddlewareMixin):
 
     @classmethod
     def _convert_named_url(cls, url_path):
-        default_prefix = PurePosixPath('/api/v2/')
-        optional_prefix = PurePosixPath(f'/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}/v2/')
-
-        url_path_original = url_path
-        url_path = PurePosixPath(url_path)
-
-        if set(optional_prefix.parts).issubset(set(url_path.parts)):
-            url_prefix = optional_prefix
-        elif set(default_prefix.parts).issubset(set(url_path.parts)):
-            url_prefix = default_prefix
-        else:
-            return url_path_original
-
-        # Remove prefix
-        url_path = PurePosixPath(*url_path.parts[len(url_prefix.parts) :])
-        try:
-            resource_path = PurePosixPath(url_path.parts[0])
-            name = url_path.parts[1]
-            url_suffix = PurePosixPath(*url_path.parts[2:])  # remove name and resource
-        except IndexError:
-            return url_path_original
-
-        resource = resource_path.parts[0]
+        url_units = url_path.split('/')
+        # If the identifier is an empty string, it is always invalid.
+        if len(url_units) < 6 or url_units[1] != 'api' or url_units[2] not in ['v2'] or not url_units[4]:
+            return url_path
+        resource = url_units[3]
         if resource in settings.NAMED_URL_MAPPINGS:
-            pk = PurePosixPath(cls._named_url_to_pk(settings.NAMED_URL_GRAPH[settings.NAMED_URL_MAPPINGS[resource]], resource, name))
-        else:
-            return url_path_original
-
-        parts = url_prefix.parts + resource_path.parts + pk.parts + url_suffix.parts
-        return PurePosixPath(*parts).as_posix() + '/'
+            url_units[4] = cls._named_url_to_pk(settings.NAMED_URL_GRAPH[settings.NAMED_URL_MAPPINGS[resource]], resource, url_units[4])
+        return '/'.join(url_units)
 
     def process_request(self, request):
         old_path = request.path_info
@@ -178,46 +198,9 @@ class URLModificationMiddleware(MiddlewareMixin):
             request.path_info = new_path
 
 
-@memoize(ttl=20)
-def is_migrating():
-    latest_number = 0
-    latest_name = ''
-    for migration_path in Path(migrations.__path__[0]).glob('[0-9]*.py'):
-        try:
-            migration_number = int(migration_path.name.split('_', 1)[0])
-        except ValueError:
-            continue
-        if migration_number > latest_number:
-            latest_number = migration_number
-            latest_name = migration_path.name[: -len('.py')]
-    return not MigrationRecorder(connection).migration_qs.filter(app='main', name=latest_name).exists()
-
-
 class MigrationRanCheckMiddleware(MiddlewareMixin):
     def process_request(self, request):
-        if is_migrating() and getattr(resolve(request.path), 'url_name', '') != 'migrations_notran':
+        executor = MigrationExecutor(connection)
+        plan = executor.migration_plan(executor.loader.graph.leaf_nodes())
+        if bool(plan) and getattr(resolve(request.path), 'url_name', '') != 'migrations_notran':
             return redirect(reverse("ui:migrations_notran"))
-
-
-class OptionalURLPrefixPath(MiddlewareMixin):
-    @functools.lru_cache
-    def _url_optional(self, prefix):
-        # Relavant Django code path https://github.com/django/django/blob/stable/4.2.x/django/core/handlers/base.py#L300
-        #
-        # resolve_request(request)
-        #   get_resolver(request.urlconf)
-        #     _get_cached_resolver(request.urlconf) <-- cached via @functools.cache
-        #
-        # Django will attempt to cache the value(s) of request.urlconf
-        # Being hashable is a prerequisit for being cachable.
-        # tuple() is hashable list() is not.
-        # Hence the tuple(list()) wrap.
-        return tuple(get_urlpatterns(prefix=prefix))
-
-    def process_request(self, request):
-        prefix = settings.OPTIONAL_API_URLPATTERN_PREFIX
-
-        if request.path.startswith(f"/api/{prefix}"):
-            request.urlconf = self._url_optional(prefix)
-        else:
-            request.urlconf = 'awx.urls'

awx/main/migrations/0189_inbound_hop_nodes.py

@@ -1,150 +0,0 @@
-# Generated by Django 4.2.6 on 2024-01-19 19:24
-
-import django.core.validators
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-def create_receptor_addresses(apps, schema_editor):
-    """
-    If listener_port was defined on an instance, create a receptor address for it
-    """
-    Instance = apps.get_model('main', 'Instance')
-    ReceptorAddress = apps.get_model('main', 'ReceptorAddress')
-    for instance in Instance.objects.exclude(listener_port=None):
-        ReceptorAddress.objects.create(
-            instance=instance,
-            address=instance.hostname,
-            port=instance.listener_port,
-            peers_from_control_nodes=instance.peers_from_control_nodes,
-            protocol='tcp',
-            is_internal=False,
-            canonical=True,
-        )
-
-
-def link_to_receptor_addresses(apps, schema_editor):
-    """
-    Modify each InstanceLink to point to the newly created
-    ReceptorAddresses, using the new target field
-    """
-    InstanceLink = apps.get_model('main', 'InstanceLink')
-    for link in InstanceLink.objects.all():
-        link.target = link.target_old.receptor_addresses.get()
-        link.save()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0188_add_bitbucket_dc_webhook'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='ReceptorAddress',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('address', models.CharField(help_text='Routable address for this instance.', max_length=255)),
-                (
-                    'port',
-                    models.IntegerField(
-                        default=27199,
-                        help_text='Port for the address.',
-                        validators=[django.core.validators.MinValueValidator(0), django.core.validators.MaxValueValidator(65535)],
-                    ),
-                ),
-                ('websocket_path', models.CharField(blank=True, default='', help_text='Websocket path.', max_length=255)),
-                (
-                    'protocol',
-                    models.CharField(
-                        choices=[('tcp', 'TCP'), ('ws', 'WS'), ('wss', 'WSS')],
-                        default='tcp',
-                        help_text="Protocol to use for the Receptor listener, 'tcp', 'wss', or 'ws'.",
-                        max_length=10,
-                    ),
-                ),
-                ('is_internal', models.BooleanField(default=False, help_text='If True, only routable within the Kubernetes cluster.')),
-                ('canonical', models.BooleanField(default=False, help_text='If True, this address is the canonical address for the instance.')),
-                (
-                    'peers_from_control_nodes',
-                    models.BooleanField(default=False, help_text='If True, control plane cluster nodes should automatically peer to it.'),
-                ),
-            ],
-        ),
-        migrations.RemoveConstraint(
-            model_name='instancelink',
-            name='source_and_target_can_not_be_equal',
-        ),
-        migrations.RenameField(
-            model_name='instancelink',
-            old_name='target',
-            new_name='target_old',
-        ),
-        migrations.AlterUniqueTogether(
-            name='instancelink',
-            unique_together=set(),
-        ),
-        migrations.AddField(
-            model_name='instance',
-            name='managed',
-            field=models.BooleanField(default=False, editable=False, help_text='If True, this instance is managed by the control plane.'),
-        ),
-        migrations.AlterField(
-            model_name='instancelink',
-            name='source',
-            field=models.ForeignKey(help_text='The source instance of this peer link.', on_delete=django.db.models.deletion.CASCADE, to='main.instance'),
-        ),
-        migrations.AddField(
-            model_name='receptoraddress',
-            name='instance',
-            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='receptor_addresses', to='main.instance'),
-        ),
-        migrations.AddField(
-            model_name='activitystream',
-            name='receptor_address',
-            field=models.ManyToManyField(blank=True, to='main.receptoraddress'),
-        ),
-        migrations.AddConstraint(
-            model_name='receptoraddress',
-            constraint=models.UniqueConstraint(fields=('address',), name='unique_receptor_address', violation_error_message='Receptor address must be unique.'),
-        ),
-        migrations.AddField(
-            model_name='instancelink',
-            name='target',
-            field=models.ForeignKey(
-                help_text='The target receptor address of this peer link.', null=True, on_delete=django.db.models.deletion.CASCADE, to='main.receptoraddress'
-            ),
-        ),
-        migrations.RunPython(create_receptor_addresses),
-        migrations.RunPython(link_to_receptor_addresses),
-        migrations.RemoveField(
-            model_name='instance',
-            name='peers_from_control_nodes',
-        ),
-        migrations.RemoveField(
-            model_name='instance',
-            name='listener_port',
-        ),
-        migrations.RemoveField(
-            model_name='instancelink',
-            name='target_old',
-        ),
-        migrations.AlterField(
-            model_name='instance',
-            name='peers',
-            field=models.ManyToManyField(related_name='peers_from', through='main.InstanceLink', to='main.receptoraddress'),
-        ),
-        migrations.AlterField(
-            model_name='instancelink',
-            name='target',
-            field=models.ForeignKey(
-                help_text='The target receptor address of this peer link.', on_delete=django.db.models.deletion.CASCADE, to='main.receptoraddress'
-            ),
-        ),
-        migrations.AddConstraint(
-            model_name='instancelink',
-            constraint=models.UniqueConstraint(
-                fields=('source', 'target'), name='unique_source_target', violation_error_message='Field source and target must be unique together.'
-            ),
-        ),
-    ]

awx/main/migrations/0190_alter_inventorysource_source_and_more.py

@@ -1,58 +0,0 @@
-# Generated by Django 4.2.6 on 2024-02-15 20:51
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0189_inbound_hop_nodes'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='inventorysource',
-            name='source',
-            field=models.CharField(
-                choices=[
-                    ('file', 'File, Directory or Script'),
-                    ('constructed', 'Template additional groups and hostvars at runtime'),
-                    ('scm', 'Sourced from a Project'),
-                    ('ec2', 'Amazon EC2'),
-                    ('gce', 'Google Compute Engine'),
-                    ('azure_rm', 'Microsoft Azure Resource Manager'),
-                    ('vmware', 'VMware vCenter'),
-                    ('satellite6', 'Red Hat Satellite 6'),
-                    ('openstack', 'OpenStack'),
-                    ('rhv', 'Red Hat Virtualization'),
-                    ('controller', 'Red Hat Ansible Automation Platform'),
-                    ('insights', 'Red Hat Insights'),
-                    ('terraform', 'Terraform State'),
-                ],
-                default=None,
-                max_length=32,
-            ),
-        ),
-        migrations.AlterField(
-            model_name='inventoryupdate',
-            name='source',
-            field=models.CharField(
-                choices=[
-                    ('file', 'File, Directory or Script'),
-                    ('constructed', 'Template additional groups and hostvars at runtime'),
-                    ('scm', 'Sourced from a Project'),
-                    ('ec2', 'Amazon EC2'),
-                    ('gce', 'Google Compute Engine'),
-                    ('azure_rm', 'Microsoft Azure Resource Manager'),
-                    ('vmware', 'VMware vCenter'),
-                    ('satellite6', 'Red Hat Satellite 6'),
-                    ('openstack', 'OpenStack'),
-                    ('rhv', 'Red Hat Virtualization'),
-                    ('controller', 'Red Hat Ansible Automation Platform'),
-                    ('insights', 'Red Hat Insights'),
-                    ('terraform', 'Terraform State'),
-                ],
-                default=None,
-                max_length=32,
-            ),
-        ),
-    ]

awx/main/migrations/0191_add_django_permissions.py

@@ -1,85 +0,0 @@
-# Generated by Django 4.2.6 on 2023-11-13 20:10
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0190_alter_inventorysource_source_and_more'),
-        ('dab_rbac', '__first__'),
-    ]
-
-    operations = [
-        # Add custom permissions for all special actions, like update, use, adhoc, and so on
-        migrations.AlterModelOptions(
-            name='credential',
-            options={'ordering': ('name',), 'permissions': [('use_credential', 'Can use credential in a job or related resource')]},
-        ),
-        migrations.AlterModelOptions(
-            name='instancegroup',
-            options={'permissions': [('use_instancegroup', 'Can use instance group in a preference list of a resource')]},
-        ),
-        migrations.AlterModelOptions(
-            name='inventory',
-            options={
-                'ordering': ('name',),
-                'permissions': [
-                    ('use_inventory', 'Can use inventory in a job template'),
-                    ('adhoc_inventory', 'Can run ad hoc commands'),
-                    ('update_inventory', 'Can update inventory sources in inventory'),
-                ],
-                'verbose_name_plural': 'inventories',
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='jobtemplate',
-            options={'ordering': ('name',), 'permissions': [('execute_jobtemplate', 'Can run this job template')]},
-        ),
-        migrations.AlterModelOptions(
-            name='project',
-            options={
-                'ordering': ('id',),
-                'permissions': [('update_project', 'Can run a project update'), ('use_project', 'Can use project in a job template')],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='workflowjobtemplate',
-            options={
-                'permissions': [
-                    ('execute_workflowjobtemplate', 'Can run this workflow job template'),
-                    ('approve_workflowjobtemplate', 'Can approve steps in this workflow job template'),
-                ]
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='organization',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'ordering': ('name',),
-                'permissions': [
-                    ('member_organization', 'Basic participation permissions for organization'),
-                    ('audit_organization', 'Audit everything inside the organization'),
-                ],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='team',
-            options={'ordering': ('organization__name', 'name'), 'permissions': [('member_team', 'Inherit all roles assigned to this team')]},
-        ),
-        # Remove add default permission for a few models
-        migrations.AlterModelOptions(
-            name='jobtemplate',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'ordering': ('name',),
-                'permissions': [('execute_jobtemplate', 'Can run this job template')],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='instancegroup',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'permissions': [('use_instancegroup', 'Can use instance group in a preference list of a resource')],
-            },
-        ),
-    ]

awx/main/migrations/0192_custom_roles.py

@@ -1,20 +0,0 @@
-# Generated by Django 4.2.6 on 2023-11-21 02:06
-
-from django.db import migrations
-
-from awx.main.migrations._dab_rbac import migrate_to_new_rbac, create_permissions_as_operation, setup_managed_role_definitions
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0191_add_django_permissions'),
-        ('dab_rbac', '__first__'),
-    ]
-
-    operations = [
-        # make sure permissions and content types have been created by now
-        # these normally run in a post_migrate signal but we need them for our logic
-        migrations.RunPython(create_permissions_as_operation, migrations.RunPython.noop),
-        migrations.RunPython(setup_managed_role_definitions, migrations.RunPython.noop),
-        migrations.RunPython(migrate_to_new_rbac, migrations.RunPython.noop),
-    ]

awx/main/migrations/0193_alter_notification_notification_type_and_more.py

@@ -1,51 +0,0 @@
-# Generated by Django 4.2.6 on 2024-05-08 07:29
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('main', '0192_custom_roles'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='notification',
-            name='notification_type',
-            field=models.CharField(
-                choices=[
-                    ('awssns', 'AWS SNS'),
-                    ('email', 'Email'),
-                    ('grafana', 'Grafana'),
-                    ('irc', 'IRC'),
-                    ('mattermost', 'Mattermost'),
-                    ('pagerduty', 'Pagerduty'),
-                    ('rocketchat', 'Rocket.Chat'),
-                    ('slack', 'Slack'),
-                    ('twilio', 'Twilio'),
-                    ('webhook', 'Webhook'),
-                ],
-                max_length=32,
-            ),
-        ),
-        migrations.AlterField(
-            model_name='notificationtemplate',
-            name='notification_type',
-            field=models.CharField(
-                choices=[
-                    ('awssns', 'AWS SNS'),
-                    ('email', 'Email'),
-                    ('grafana', 'Grafana'),
-                    ('irc', 'IRC'),
-                    ('mattermost', 'Mattermost'),
-                    ('pagerduty', 'Pagerduty'),
-                    ('rocketchat', 'Rocket.Chat'),
-                    ('slack', 'Slack'),
-                    ('twilio', 'Twilio'),
-                    ('webhook', 'Webhook'),
-                ],
-                max_length=32,
-            ),
-        ),
-    ]

awx/main/migrations/_dab_rbac.py

@@ -1,359 +0,0 @@
-import json
-import logging
-
-from django.apps import apps as global_apps
-from django.db.models import ForeignKey
-from django.conf import settings
-from ansible_base.rbac.migrations._utils import give_permissions
-from ansible_base.rbac.management import create_dab_permissions
-
-from awx.main.fields import ImplicitRoleField
-from awx.main.constants import role_name_to_perm_mapping
-
-from ansible_base.rbac.permission_registry import permission_registry
-
-
-logger = logging.getLogger('awx.main.migrations._dab_rbac')
-
-
-def create_permissions_as_operation(apps, schema_editor):
-    create_dab_permissions(global_apps.get_app_config("main"), apps=apps)
-
-
-"""
-Data structures and methods for the migration of old Role model to ObjectRole
-"""
-
-system_admin = ImplicitRoleField(name='system_administrator')
-system_auditor = ImplicitRoleField(name='system_auditor')
-system_admin.model = None
-system_auditor.model = None
-
-
-def resolve_parent_role(f, role_path):
-    """
-    Given a field and a path declared in parent_role from the field definition, like
-        execute_role = ImplicitRoleField(parent_role='admin_role')
-    This expects to be passed in (execute_role object, "admin_role")
-    It hould return the admin_role from that object
-    """
-    if role_path == 'singleton:system_administrator':
-        return system_admin
-    elif role_path == 'singleton:system_auditor':
-        return system_auditor
-    else:
-        related_field = f
-        current_model = f.model
-        for related_field_name in role_path.split('.'):
-            related_field = current_model._meta.get_field(related_field_name)
-            if isinstance(related_field, ForeignKey) and not isinstance(related_field, ImplicitRoleField):
-                current_model = related_field.related_model
-        return related_field
-
-
-def build_role_map(apps):
-    """
-    For the old Role model, this builds and returns dictionaries (children, parents)
-    which give a global mapping of the ImplicitRoleField instances according to the graph
-    """
-    models = set(apps.get_app_config('main').get_models())
-
-    all_fields = set()
-    parents = {}
-    children = {}
-
-    all_fields.add(system_admin)
-    all_fields.add(system_auditor)
-
-    for cls in models:
-        for f in cls._meta.get_fields():
-            if isinstance(f, ImplicitRoleField):
-                all_fields.add(f)
-
-    for f in all_fields:
-        if f.parent_role is not None:
-            if isinstance(f.parent_role, str):
-                parent_roles = [f.parent_role]
-            else:
-                parent_roles = f.parent_role
-
-            # SPECIAL CASE: organization auditor_role is not a child of admin_role
-            # this makes no practical sense and conflicts with expected managed role
-            # so we put it in as a hack here
-            if f.name == 'auditor_role' and f.model._meta.model_name == 'organization':
-                parent_roles.append('admin_role')
-
-            parent_list = []
-            for rel_name in parent_roles:
-                parent_list.append(resolve_parent_role(f, rel_name))
-
-            parents[f] = parent_list
-
-    # build children lookup from parents lookup
-    for child_field, parent_list in parents.items():
-        for parent_field in parent_list:
-            children.setdefault(parent_field, [])
-            children[parent_field].append(child_field)
-
-    return (parents, children)
-
-
-def get_descendents(f, children_map):
-    """
-    Given ImplicitRoleField F and the children mapping, returns all descendents
-    of that field, as a set of other fields, including itself
-    """
-    ret = {f}
-    if f in children_map:
-        for child_field in children_map[f]:
-            ret.update(get_descendents(child_field, children_map))
-    return ret
-
-
-def get_permissions_for_role(role_field, children_map, apps):
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-    ContentType = apps.get_model('contenttypes', 'ContentType')
-
-    perm_list = []
-    for child_field in get_descendents(role_field, children_map):
-        if child_field.name in role_name_to_perm_mapping:
-            for perm_name in role_name_to_perm_mapping[child_field.name]:
-                if perm_name == 'add_' and role_field.model._meta.model_name != 'organization':
-                    continue  # only organizations can contain add permissions
-                perm = Permission.objects.filter(content_type=ContentType.objects.get_for_model(child_field.model), codename__startswith=perm_name).first()
-                if perm is not None and perm not in perm_list:
-                    perm_list.append(perm)
-
-    # special case for two models that have object roles but no organization roles in old system
-    if role_field.name == 'notification_admin_role' or (role_field.name == 'admin_role' and role_field.model._meta.model_name == 'organization'):
-        ct = ContentType.objects.get_for_model(apps.get_model('main', 'NotificationTemplate'))
-        perm_list.extend(list(Permission.objects.filter(content_type=ct)))
-    if role_field.name == 'execution_environment_admin_role' or (role_field.name == 'admin_role' and role_field.model._meta.model_name == 'organization'):
-        ct = ContentType.objects.get_for_model(apps.get_model('main', 'ExecutionEnvironment'))
-        perm_list.extend(list(Permission.objects.filter(content_type=ct)))
-
-    # more special cases for those same above special org-level roles
-    if role_field.name == 'auditor_role':
-        for codename in ('view_notificationtemplate', 'view_executionenvironment'):
-            perm_list.append(Permission.objects.get(codename=codename))
-
-    return perm_list
-
-
-def model_class(ct, apps):
-    """
-    You can not use model methods in migrations, so this duplicates
-    what ContentType.model_class does, using current apps
-    """
-    try:
-        return apps.get_model(ct.app_label, ct.model)
-    except LookupError:
-        return None
-
-
-def migrate_to_new_rbac(apps, schema_editor):
-    """
-    This method moves the assigned permissions from the old rbac.py models
-    to the new RoleDefinition and ObjectRole models
-    """
-    Role = apps.get_model('main', 'Role')
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    RoleUserAssignment = apps.get_model('dab_rbac', 'RoleUserAssignment')
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-
-    # remove add premissions that are not valid for migrations from old versions
-    for perm_str in ('add_organization', 'add_jobtemplate'):
-        perm = Permission.objects.filter(codename=perm_str).first()
-        if perm:
-            perm.delete()
-
-    managed_definitions = dict()
-    for role_definition in RoleDefinition.objects.filter(managed=True):
-        permissions = frozenset(role_definition.permissions.values_list('id', flat=True))
-        managed_definitions[permissions] = role_definition
-
-    # Build map of old role model
-    parents, children = build_role_map(apps)
-
-    # NOTE: this import is expected to break at some point, and then just move the data here
-    from awx.main.models.rbac import role_descriptions
-
-    for role in Role.objects.prefetch_related('members', 'parents').iterator():
-        if role.singleton_name:
-            continue  # only bothering to migrate object roles
-
-        team_roles = []
-        for parent in role.parents.all():
-            if parent.id not in json.loads(role.implicit_parents):
-                team_roles.append(parent)
-
-        # we will not create any roles that do not have any users or teams
-        if not (role.members.all() or team_roles):
-            logger.debug(f'Skipping role {role.role_field} for {role.content_type.model}-{role.object_id} due to no members')
-            continue
-
-        # get a list of permissions that the old role would grant
-        object_cls = apps.get_model(f'main.{role.content_type.model}')
-        object = object_cls.objects.get(pk=role.object_id)  # WORKAROUND, role.content_object does not work in migrations
-        f = object._meta.get_field(role.role_field)  # should be ImplicitRoleField
-        perm_list = get_permissions_for_role(f, children, apps)
-
-        permissions = frozenset(perm.id for perm in perm_list)
-
-        # With the needed permissions established, obtain the RoleDefinition this will need, priorities:
-        # 1. If it exists as a managed RoleDefinition then obviously use that
-        # 2. If we already created this for a prior role, use that
-        # 3. Create a new RoleDefinition that lists those permissions
-        if permissions in managed_definitions:
-            role_definition = managed_definitions[permissions]
-        else:
-            action = role.role_field.rsplit('_', 1)[0]  # remove the _field ending of the name
-            role_definition_name = f'{model_class(role.content_type, apps).__name__} {action.title()}'
-
-            description = role_descriptions[role.role_field]
-            if type(description) == dict:
-                if role.content_type.model in description:
-                    description = description.get(role.content_type.model)
-                else:
-                    description = description.get('default')
-            if '%s' in description:
-                description = description % role.content_type.model
-
-            role_definition, created = RoleDefinition.objects.get_or_create(
-                name=role_definition_name,
-                defaults={'description': description, 'content_type_id': role.content_type_id},
-            )
-
-            if created:
-                logger.info(f'Created custom Role Definition {role_definition_name}, pk={role_definition.pk}')
-                role_definition.permissions.set(perm_list)
-
-        # Create the object role and add users to it
-        give_permissions(
-            apps,
-            role_definition,
-            users=role.members.all(),
-            teams=[tr.object_id for tr in team_roles],
-            object_id=role.object_id,
-            content_type_id=role.content_type_id,
-        )
-
-    # Create new replacement system auditor role
-    new_system_auditor, created = RoleDefinition.objects.get_or_create(
-        name='System Auditor',
-        defaults={'description': 'Migrated singleton role giving read permission to everything', 'managed': True},
-    )
-    new_system_auditor.permissions.add(*list(Permission.objects.filter(codename__startswith='view')))
-
-    # migrate is_system_auditor flag, because it is no longer handled by a system role
-    old_system_auditor = Role.objects.filter(singleton_name='system_auditor').first()
-    if old_system_auditor:
-        # if the system auditor role is not present, this is a new install and no users should exist
-        ct = 0
-        for user in role.members.all():
-            RoleUserAssignment.objects.create(user=user, role_definition=new_system_auditor)
-            ct += 1
-        if ct:
-            logger.info(f'Migrated {ct} users to new system auditor flag')
-
-
-def get_or_create_managed(name, description, ct, permissions, RoleDefinition):
-    role_definition, created = RoleDefinition.objects.get_or_create(name=name, defaults={'managed': True, 'description': description, 'content_type': ct})
-    role_definition.permissions.set(list(permissions))
-
-    if not role_definition.managed:
-        role_definition.managed = True
-        role_definition.save(update_fields=['managed'])
-
-    if created:
-        logger.info(f'Created RoleDefinition {role_definition.name} pk={role_definition} with {len(permissions)} permissions')
-
-    return role_definition
-
-
-def setup_managed_role_definitions(apps, schema_editor):
-    """
-    Idepotent method to create or sync the managed role definitions
-    """
-    to_create = {
-        'object_admin': '{cls.__name__} Admin',
-        'org_admin': 'Organization Admin',
-        'org_children': 'Organization {cls.__name__} Admin',
-        'special': '{cls.__name__} {action}',
-    }
-
-    ContentType = apps.get_model('contenttypes', 'ContentType')
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    Organization = apps.get_model(settings.ANSIBLE_BASE_ORGANIZATION_MODEL)
-    org_ct = ContentType.objects.get_for_model(Organization)
-    managed_role_definitions = []
-
-    org_perms = set()
-    for cls in permission_registry._registry:
-        ct = ContentType.objects.get_for_model(cls)
-        object_perms = set(Permission.objects.filter(content_type=ct))
-        # Special case for InstanceGroup which has an organiation field, but is not an organization child object
-        if cls._meta.model_name != 'instancegroup':
-            org_perms.update(object_perms)
-
-        if 'object_admin' in to_create and cls != Organization:
-            indiv_perms = object_perms.copy()
-            add_perms = [perm for perm in indiv_perms if perm.codename.startswith('add_')]
-            if add_perms:
-                for perm in add_perms:
-                    indiv_perms.remove(perm)
-
-            managed_role_definitions.append(
-                get_or_create_managed(
-                    to_create['object_admin'].format(cls=cls), f'Has all permissions to a single {cls._meta.verbose_name}', ct, indiv_perms, RoleDefinition
-                )
-            )
-
-        if 'org_children' in to_create and cls != Organization:
-            org_child_perms = object_perms.copy()
-            org_child_perms.add(Permission.objects.get(codename='view_organization'))
-
-            managed_role_definitions.append(
-                get_or_create_managed(
-                    to_create['org_children'].format(cls=cls),
-                    f'Has all permissions to {cls._meta.verbose_name_plural} within an organization',
-                    org_ct,
-                    org_child_perms,
-                    RoleDefinition,
-                )
-            )
-
-        if 'special' in to_create:
-            special_perms = []
-            for perm in object_perms:
-                if perm.codename.split('_')[0] not in ('add', 'change', 'update', 'delete', 'view'):
-                    special_perms.append(perm)
-            for perm in special_perms:
-                action = perm.codename.split('_')[0]
-                view_perm = Permission.objects.get(content_type=ct, codename__startswith='view_')
-                managed_role_definitions.append(
-                    get_or_create_managed(
-                        to_create['special'].format(cls=cls, action=action.title()),
-                        f'Has {action} permissions to a single {cls._meta.verbose_name}',
-                        ct,
-                        [perm, view_perm],
-                        RoleDefinition,
-                    )
-                )
-
-    if 'org_admin' in to_create:
-        managed_role_definitions.append(
-            get_or_create_managed(
-                to_create['org_admin'].format(cls=Organization),
-                'Has all permissions to a single organization and all objects inside of it',
-                org_ct,
-                org_perms,
-                RoleDefinition,
-            )
-        )
-
-    unexpected_role_definitions = RoleDefinition.objects.filter(managed=True).exclude(pk__in=[rd.pk for rd in managed_role_definitions])
-    for role_definition in unexpected_role_definitions:
-        logger.info(f'Deleting old managed role definition {role_definition.name}, pk={role_definition.pk}')
-        role_definition.delete()

awx/main/models/__init__.py

@@ -1,19 +1,12 @@
 # Copyright (c) 2015 Ansible, Inc.
 # All Rights Reserved.
 
-import json
-
 # Django
 from django.conf import settings  # noqa
 from django.db import connection
 from django.db.models.signals import pre_delete  # noqa
 
-# django-ansible-base
-from ansible_base.resource_registry.fields import AnsibleResourceField
-from ansible_base.rbac import permission_registry
-from ansible_base.rbac.models import RoleDefinition, RoleUserAssignment
 from ansible_base.lib.utils.models import prevent_search
-from ansible_base.lib.utils.models import user_summary_fields
 
 # AWX
 from awx.main.models.base import BaseModel, PrimordialModel, accepts_json, CLOUD_INVENTORY_SOURCES, VERBOSITY_CHOICES  # noqa
@@ -21,7 +14,6 @@ from awx.main.models.unified_jobs import UnifiedJob, UnifiedJobTemplate, StdoutM
 from awx.main.models.organization import Organization, Profile, Team, UserSessionMembership  # noqa
 from awx.main.models.credential import Credential, CredentialType, CredentialInputSource, ManagedCredentialType, build_safe_env  # noqa
 from awx.main.models.projects import Project, ProjectUpdate  # noqa
-from awx.main.models.receptor_address import ReceptorAddress  # noqa
 from awx.main.models.inventory import (  # noqa
     CustomInventoryScript,
     Group,
@@ -106,8 +98,6 @@ from awx.main.access import get_user_queryset, check_user_access, check_user_acc
 User.add_to_class('get_queryset', get_user_queryset)
 User.add_to_class('can_access', check_user_access)
 User.add_to_class('can_access_with_errors', check_user_access_with_errors)
-User.add_to_class('resource', AnsibleResourceField(primary_key_field="id"))
-User.add_to_class('summary_fields', user_summary_fields)
 
 
 def convert_jsonfields():
@@ -200,21 +190,11 @@ User.add_to_class('auditor_of_organizations', user_get_auditor_of_organizations)
 User.add_to_class('created', created)
 
 
-def get_system_auditor_role():
-    rd, created = RoleDefinition.objects.get_or_create(
-        name='System Auditor', defaults={'description': 'Migrated singleton role giving read permission to everything'}
-    )
-    if created:
-        rd.permissions.add(*list(permission_registry.permission_qs.filter(codename__startswith='view')))
-    return rd
-
-
 @property
 def user_is_system_auditor(user):
     if not hasattr(user, '_is_system_auditor'):
         if user.pk:
-            rd = get_system_auditor_role()
-            user._is_system_auditor = RoleUserAssignment.objects.filter(user=user, role_definition=rd).exists()
+            user._is_system_auditor = user.roles.filter(singleton_name='system_auditor', role_field='system_auditor').exists()
         else:
             # Odd case where user is unsaved, this should never be relied on
             return False
@@ -228,17 +208,17 @@ def user_is_system_auditor(user, tf):
         # time they've logged in, and we've just created the new User in this
         # request), we need one to set up the system auditor role
         user.save()
-    rd = get_system_auditor_role()
-    assignment = RoleUserAssignment.objects.filter(user=user, role_definition=rd).first()
-    prior_value = bool(assignment)
-    if prior_value != bool(tf):
-        if assignment:
-            assignment.delete()
-        else:
-            rd.give_global_permission(user)
-        user._is_system_auditor = bool(tf)
-        entry = ActivityStream.objects.create(changes=json.dumps({"is_system_auditor": [prior_value, bool(tf)]}), object1='user', operation='update')
-        entry.user.add(user)
+    if tf:
+        role = Role.singleton('system_auditor')
+        # must check if member to not duplicate activity stream
+        if user not in role.members.all():
+            role.members.add(user)
+        user._is_system_auditor = True
+    else:
+        role = Role.singleton('system_auditor')
+        if user in role.members.all():
+            role.members.remove(user)
+        user._is_system_auditor = False
 
 
 User.add_to_class('is_system_auditor', user_is_system_auditor)
@@ -306,10 +286,6 @@ activity_stream_registrar.connect(WorkflowApprovalTemplate)
 activity_stream_registrar.connect(OAuth2Application)
 activity_stream_registrar.connect(OAuth2AccessToken)
 
-# Register models
-permission_registry.register(Project, Team, WorkflowJobTemplate, JobTemplate, Inventory, Organization, Credential, NotificationTemplate, ExecutionEnvironment)
-permission_registry.register(InstanceGroup, parent_field_name=None)  # Not part of an organization
-
 # prevent API filtering on certain Django-supplied sensitive fields
 prevent_search(User._meta.get_field('password'))
 prevent_search(OAuth2AccessToken._meta.get_field('token'))

awx/main/models/activity_stream.py

@@ -77,7 +77,6 @@ class ActivityStream(models.Model):
     notification_template = models.ManyToManyField("NotificationTemplate", blank=True)
     notification = models.ManyToManyField("Notification", blank=True)
     label = models.ManyToManyField("Label", blank=True)
-    receptor_address = models.ManyToManyField("ReceptorAddress", blank=True)
     role = models.ManyToManyField("Role", blank=True)
     instance = models.ManyToManyField("Instance", blank=True)
     instance_group = models.ManyToManyField("InstanceGroup", blank=True)

awx/main/models/base.py

@@ -7,9 +7,6 @@ from django.core.exceptions import ValidationError, ObjectDoesNotExist
 from django.utils.translation import gettext_lazy as _
 from django.utils.timezone import now
 
-# django-ansible-base
-from ansible_base.lib.utils.models import get_type_for_model
-
 # Django-CRUM
 from crum import get_current_user
 
@@ -142,23 +139,6 @@ class BaseModel(models.Model):
             self.save(update_fields=update_fields)
         return update_fields
 
-    def summary_fields(self):
-        """
-        This exists for use by django-ansible-base,
-        which has standard patterns that differ from AWX, but we enable views from DAB
-        for those views to list summary_fields for AWX models, those models need to provide this
-        """
-        from awx.api.serializers import SUMMARIZABLE_FK_FIELDS
-
-        model_name = get_type_for_model(self)
-        related_fields = SUMMARIZABLE_FK_FIELDS.get(model_name, {})
-        summary_data = {}
-        for field_name in related_fields:
-            fval = getattr(self, field_name, None)
-            if fval is not None:
-                summary_data[field_name] = fval
-        return summary_data
-
 
 class CreatedModifiedModel(BaseModel):
     """

awx/main/models/credential/__init__.py

@@ -83,7 +83,6 @@ class Credential(PasswordFieldsModel, CommonModelNameNotUnique, ResourceMixin):
         app_label = 'main'
         ordering = ('name',)
         unique_together = ('organization', 'name', 'credential_type')
-        permissions = [('use_credential', 'Can use credential in a job or related resource')]
 
     PASSWORD_FIELDS = ['inputs']
     FIELDS_TO_PRESERVE_AT_COPY = ['input_sources']
@@ -1217,34 +1216,6 @@ ManagedCredentialType(
     },
 )
 
-ManagedCredentialType(
-    namespace='terraform',
-    kind='cloud',
-    name=gettext_noop('Terraform backend configuration'),
-    managed=True,
-    inputs={
-        'fields': [
-            {
-                'id': 'configuration',
-                'label': gettext_noop('Backend configuration'),
-                'type': 'string',
-                'secret': True,
-                'multiline': True,
-                'help_text': gettext_noop('Terraform backend config as Hashicorp configuration language.'),
-            },
-            {
-                'id': 'gce_credentials',
-                'label': gettext_noop('Google Cloud Platform account credentials'),
-                'type': 'string',
-                'secret': True,
-                'multiline': True,
-                'help_text': gettext_noop('Google Cloud Platform account credentials in JSON format.'),
-            },
-        ],
-        'required': ['configuration'],
-    },
-)
-
 
 class CredentialInputSource(PrimordialModel):
     class Meta:

awx/main/models/credential/injectors.py

@@ -122,18 +122,3 @@ def kubernetes_bearer_token(cred, env, private_data_dir):
         env['K8S_AUTH_SSL_CA_CERT'] = to_container_path(path, private_data_dir)
     else:
         env['K8S_AUTH_VERIFY_SSL'] = 'False'
-
-
-def terraform(cred, env, private_data_dir):
-    handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
-    with os.fdopen(handle, 'w') as f:
-        os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
-        f.write(cred.get_input('configuration'))
-    env['TF_BACKEND_CONFIG_FILE'] = to_container_path(path, private_data_dir)
-    # Handle env variables for GCP account credentials
-    if 'gce_credentials' in cred.inputs:
-        handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
-        with os.fdopen(handle, 'w') as f:
-            os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
-            f.write(cred.get_input('gce_credentials'))
-        env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(path, private_data_dir)

awx/main/models/events.py

@@ -124,6 +124,8 @@ class BasePlaybookEvent(CreatedModifiedModel):
         'parent_uuid',
         'start_line',
         'end_line',
+        'host_id',
+        'host_name',
         'verbosity',
     ]
     WRAPUP_EVENT = 'playbook_on_stats'
@@ -471,7 +473,7 @@ class JobEvent(BasePlaybookEvent):
     An event/message logged from the callback when running a job.
     """
 
-    VALID_KEYS = BasePlaybookEvent.VALID_KEYS + ['job_id', 'workflow_job_id', 'job_created', 'host_id', 'host_name']
+    VALID_KEYS = BasePlaybookEvent.VALID_KEYS + ['job_id', 'workflow_job_id', 'job_created']
     JOB_REFERENCE = 'job_id'
 
     objects = DeferJobCreatedManager()

awx/main/models/ha.py

@@ -5,7 +5,7 @@ from decimal import Decimal
 import logging
 import os
 
-from django.core.validators import MinValueValidator
+from django.core.validators import MinValueValidator, MaxValueValidator
 from django.db import models, connection
 from django.db.models.signals import post_save, post_delete
 from django.dispatch import receiver
@@ -34,7 +34,6 @@ from awx.main.models.rbac import (
 from awx.main.models.unified_jobs import UnifiedJob
 from awx.main.utils.common import get_corrected_cpu, get_cpu_effective_capacity, get_corrected_memory, get_mem_effective_capacity
 from awx.main.models.mixins import RelatedJobsMixin, ResourceMixin
-from awx.main.models.receptor_address import ReceptorAddress
 
 # ansible-runner
 from ansible_runner.utils.capacity import get_cpu_count, get_mem_in_bytes
@@ -65,19 +64,8 @@ class HasPolicyEditsMixin(HasEditsMixin):
 
 
 class InstanceLink(BaseModel):
-    class Meta:
-        ordering = ("id",)
-        # add constraint for source and target to be unique together
-        constraints = [
-            models.UniqueConstraint(
-                fields=["source", "target"],
-                name="unique_source_target",
-                violation_error_message=_("Field source and target must be unique together."),
-            )
-        ]
-
-    source = models.ForeignKey('Instance', on_delete=models.CASCADE, help_text=_("The source instance of this peer link."))
-    target = models.ForeignKey('ReceptorAddress', on_delete=models.CASCADE, help_text=_("The target receptor address of this peer link."))
+    source = models.ForeignKey('Instance', on_delete=models.CASCADE, related_name='+')
+    target = models.ForeignKey('Instance', on_delete=models.CASCADE, related_name='reverse_peers')
 
     class States(models.TextChoices):
         ADDING = 'adding', _('Adding')
@@ -88,6 +76,11 @@ class InstanceLink(BaseModel):
         choices=States.choices, default=States.ADDING, max_length=16, help_text=_("Indicates the current life cycle stage of this peer link.")
     )
 
+    class Meta:
+        unique_together = ('source', 'target')
+        ordering = ("id",)
+        constraints = [models.CheckConstraint(check=~models.Q(source=models.F('target')), name='source_and_target_can_not_be_equal')]
+
 
 class Instance(HasPolicyEditsMixin, BaseModel):
     """A model representing an AWX instance running against this database."""
@@ -117,7 +110,6 @@ class Instance(HasPolicyEditsMixin, BaseModel):
         default="",
         max_length=50,
     )
-
     # Auto-fields, implementation is different from BaseModel
     created = models.DateTimeField(auto_now_add=True)
     modified = models.DateTimeField(auto_now=True)
@@ -193,9 +185,16 @@ class Instance(HasPolicyEditsMixin, BaseModel):
     node_state = models.CharField(
         choices=States.choices, default=States.READY, max_length=16, help_text=_("Indicates the current life cycle stage of this instance.")
     )
+    listener_port = models.PositiveIntegerField(
+        blank=True,
+        null=True,
+        default=None,
+        validators=[MinValueValidator(1024), MaxValueValidator(65535)],
+        help_text=_("Port that Receptor will listen for incoming connections on."),
+    )
 
-    managed = models.BooleanField(help_text=_("If True, this instance is managed by the control plane."), default=False, editable=False)
-    peers = models.ManyToManyField('ReceptorAddress', through=InstanceLink, through_fields=('source', 'target'), related_name='peers_from')
+    peers = models.ManyToManyField('self', symmetrical=False, through=InstanceLink, through_fields=('source', 'target'), related_name='peers_from')
+    peers_from_control_nodes = models.BooleanField(default=False, help_text=_("If True, control plane cluster nodes should automatically peer to it."))
 
     POLICY_FIELDS = frozenset(('managed_by_policy', 'hostname', 'capacity_adjustment'))
 
@@ -242,26 +241,6 @@ class Instance(HasPolicyEditsMixin, BaseModel):
             return True
         return self.health_check_started > self.last_health_check
 
-    @property
-    def canonical_address(self):
-        return self.receptor_addresses.filter(canonical=True).first()
-
-    @property
-    def canonical_address_port(self):
-        # note: don't create a different query for receptor addresses, as this is prefetched on the View for optimization
-        for addr in self.receptor_addresses.all():
-            if addr.canonical:
-                return addr.port
-        return None
-
-    @property
-    def canonical_address_peers_from_control_nodes(self):
-        # note: don't create a different query for receptor addresses, as this is prefetched on the View for optimization
-        for addr in self.receptor_addresses.all():
-            if addr.canonical:
-                return addr.peers_from_control_nodes
-        return False
-
     def get_cleanup_task_kwargs(self, **kwargs):
         """
         Produce options to use for the command: ansible-runner worker cleanup
@@ -485,9 +464,6 @@ class InstanceGroup(HasPolicyEditsMixin, BaseModel, RelatedJobsMixin, ResourceMi
 
     class Meta:
         app_label = 'main'
-        permissions = [('use_instancegroup', 'Can use instance group in a preference list of a resource')]
-        # Since this has no direct organization field only superuser can add, so remove add permission
-        default_permissions = ('change', 'delete', 'view')
 
     def set_default_policy_fields(self):
         self.policy_instance_list = []
@@ -525,35 +501,6 @@ def schedule_write_receptor_config(broadcast=True):
             write_receptor_config()  # just run locally
 
 
-@receiver(post_save, sender=ReceptorAddress)
-def receptor_address_saved(sender, instance, **kwargs):
-    from awx.main.signals import disable_activity_stream
-
-    address = instance
-
-    control_instances = set(Instance.objects.filter(node_type__in=[Instance.Types.CONTROL, Instance.Types.HYBRID]))
-    if address.peers_from_control_nodes:
-        # if control_instances is not a subset of current peers of address, then
-        # that means we need to add some InstanceLinks
-        if not control_instances <= set(address.peers_from.all()):
-            with disable_activity_stream():
-                for control_instance in control_instances:
-                    InstanceLink.objects.update_or_create(source=control_instance, target=address)
-                schedule_write_receptor_config()
-    else:
-        if address.peers_from.exists():
-            with disable_activity_stream():
-                address.peers_from.remove(*control_instances)
-                schedule_write_receptor_config()
-
-
-@receiver(post_delete, sender=ReceptorAddress)
-def receptor_address_deleted(sender, instance, **kwargs):
-    address = instance
-    if address.peers_from_control_nodes:
-        schedule_write_receptor_config()
-
-
 @receiver(post_save, sender=Instance)
 def on_instance_saved(sender, instance, created=False, raw=False, **kwargs):
     '''
@@ -564,14 +511,11 @@ def on_instance_saved(sender, instance, created=False, raw=False, **kwargs):
     2. a node changes its value of peers_from_control_nodes
     3. a new control node comes online and has instances to peer to
     '''
-    from awx.main.signals import disable_activity_stream
-
     if created and settings.IS_K8S and instance.node_type in [Instance.Types.CONTROL, Instance.Types.HYBRID]:
-        peers_addresses = ReceptorAddress.objects.filter(peers_from_control_nodes=True)
-        if peers_addresses.exists():
-            with disable_activity_stream():
-                instance.peers.add(*peers_addresses)
-                schedule_write_receptor_config(broadcast=False)
+        inst = Instance.objects.filter(peers_from_control_nodes=True)
+        if set(instance.peers.all()) != set(inst):
+            instance.peers.set(inst)
+            schedule_write_receptor_config(broadcast=False)
 
     if settings.IS_K8S and instance.node_type in [Instance.Types.HOP, Instance.Types.EXECUTION]:
         if instance.node_state == Instance.States.DEPROVISIONING:
@@ -580,6 +524,16 @@ def on_instance_saved(sender, instance, created=False, raw=False, **kwargs):
             # wait for jobs on the node to complete, then delete the
             # node and kick off write_receptor_config
             connection.on_commit(lambda: remove_deprovisioned_node.apply_async([instance.hostname]))
+        else:
+            control_instances = set(Instance.objects.filter(node_type__in=[Instance.Types.CONTROL, Instance.Types.HYBRID]))
+            if instance.peers_from_control_nodes:
+                if (control_instances & set(instance.peers_from.all())) != set(control_instances):
+                    instance.peers_from.add(*control_instances)
+                    schedule_write_receptor_config()  # keep method separate to make pytest mocking easier
+            else:
+                if set(control_instances) & set(instance.peers_from.all()):
+                    instance.peers_from.remove(*control_instances)
+                    schedule_write_receptor_config()
 
     if created or instance.has_policy_changes():
         schedule_policy_task()
@@ -594,6 +548,8 @@ def on_instance_group_deleted(sender, instance, using, **kwargs):
 @receiver(post_delete, sender=Instance)
 def on_instance_deleted(sender, instance, using, **kwargs):
     schedule_policy_task()
+    if settings.IS_K8S and instance.node_type in (Instance.Types.EXECUTION, Instance.Types.HOP) and instance.peers_from_control_nodes:
+        schedule_write_receptor_config()
 
 
 class UnifiedJobTemplateInstanceGroupMembership(models.Model):

awx/main/models/inventory.py

@@ -11,8 +11,6 @@ import os.path
 from urllib.parse import urljoin
 
 import yaml
-import tempfile
-import stat
 
 # Django
 from django.conf import settings
@@ -91,11 +89,6 @@ class Inventory(CommonModelNameNotUnique, ResourceMixin, RelatedJobsMixin):
         verbose_name_plural = _('inventories')
         unique_together = [('name', 'organization')]
         ordering = ('name',)
-        permissions = [
-            ('use_inventory', 'Can use inventory in a job template'),
-            ('adhoc_inventory', 'Can run ad hoc commands'),
-            ('update_inventory', 'Can update inventory sources in inventory'),
-        ]
 
     organization = models.ForeignKey(
         'Organization',
@@ -932,7 +925,6 @@ class InventorySourceOptions(BaseModel):
         ('rhv', _('Red Hat Virtualization')),
         ('controller', _('Red Hat Ansible Automation Platform')),
         ('insights', _('Red Hat Insights')),
-        ('terraform', _('Terraform State')),
     ]
 
     # From the options of the Django management base command
@@ -1407,7 +1399,7 @@ class InventoryUpdate(UnifiedJob, InventorySourceOptions, JobNotificationMixin,
         return selected_groups
 
 
-class CustomInventoryScript(CommonModelNameNotUnique):
+class CustomInventoryScript(CommonModelNameNotUnique, ResourceMixin):
     class Meta:
         app_label = 'main'
         ordering = ('name',)
@@ -1638,42 +1630,6 @@ class satellite6(PluginFileInjector):
         return ret
 
 
-class terraform(PluginFileInjector):
-    plugin_name = 'terraform_state'
-    namespace = 'cloud'
-    collection = 'terraform'
-    use_fqcn = True
-
-    def inventory_as_dict(self, inventory_update, private_data_dir):
-        ret = super().inventory_as_dict(inventory_update, private_data_dir)
-        credential = inventory_update.get_cloud_credential()
-        config_cred = credential.get_input('configuration')
-        if config_cred:
-            handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
-            with os.fdopen(handle, 'w') as f:
-                os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
-                f.write(config_cred)
-            ret['backend_config_files'] = to_container_path(path, private_data_dir)
-        return ret
-
-    def build_plugin_private_data(self, inventory_update, private_data_dir):
-        credential = inventory_update.get_cloud_credential()
-
-        private_data = {'credentials': {}}
-        gce_cred = credential.get_input('gce_credentials', default=None)
-        if gce_cred:
-            private_data['credentials'][credential] = gce_cred
-        return private_data
-
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
-        env = super(terraform, self).get_plugin_env(inventory_update, private_data_dir, private_data_files)
-        credential = inventory_update.get_cloud_credential()
-        cred_data = private_data_files['credentials']
-        if credential in cred_data:
-            env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(cred_data[credential], private_data_dir)
-        return env
-
-
 class controller(PluginFileInjector):
     plugin_name = 'tower'  # TODO: relying on routing for now, update after EEs pick up revised collection
     base_injector = 'template'

awx/main/models/jobs.py

@@ -205,9 +205,6 @@ class JobTemplate(UnifiedJobTemplate, JobOptions, SurveyJobTemplateMixin, Resour
     class Meta:
         app_label = 'main'
         ordering = ('name',)
-        permissions = [('execute_jobtemplate', 'Can run this job template')]
-        # Remove add permission, ability to add comes from use permission for inventory, project, credentials
-        default_permissions = ('change', 'delete', 'view')
 
     job_type = models.CharField(
         max_length=64,

awx/main/models/mixins.py

@@ -19,14 +19,13 @@ from django.utils.translation import gettext_lazy as _
 from ansible_base.lib.utils.models import prevent_search
 
 # AWX
-
-from awx.main.models.rbac import Role, RoleAncestorEntry, to_permissions
+from awx.main.models.rbac import Role, RoleAncestorEntry
 from awx.main.utils import parse_yaml_or_json, get_custom_venv_choices, get_licenser, polymorphic
 from awx.main.utils.execution_environments import get_default_execution_environment
 from awx.main.utils.encryption import decrypt_value, get_encryption_key, is_encrypted
 from awx.main.utils.polymorphic import build_polymorphic_ctypes_map
 from awx.main.fields import AskForField
-from awx.main.constants import ACTIVE_STATES, org_role_to_permission
+from awx.main.constants import ACTIVE_STATES
 
 
 logger = logging.getLogger('awx.main.models.mixins')
@@ -65,18 +64,6 @@ class ResourceMixin(models.Model):
 
     @staticmethod
     def _accessible_pk_qs(cls, accessor, role_field, content_types=None):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            if cls._meta.model_name == 'organization' and role_field in org_role_to_permission:
-                # Organization roles can not use the DAB RBAC shortcuts
-                # like Organization.access_qs(user, 'change_jobtemplate') is needed
-                # not just Organization.access_qs(user, 'change') is needed
-                if accessor.is_superuser:
-                    return cls.objects.values_list('id')
-
-                codename = org_role_to_permission[role_field]
-
-                return cls.access_ids_qs(accessor, codename, content_types=content_types)
-            return cls.access_ids_qs(accessor, to_permissions[role_field], content_types=content_types)
         if accessor._meta.model_name == 'user':
             ancestor_roles = accessor.roles.all()
         elif type(accessor) == Role:

awx/main/models/notifications.py

@@ -5,7 +5,6 @@ from copy import deepcopy
 import datetime
 import logging
 import json
-import traceback
 
 from django.db import models
 from django.conf import settings
@@ -31,7 +30,6 @@ from awx.main.notifications.mattermost_backend import MattermostBackend
 from awx.main.notifications.grafana_backend import GrafanaBackend
 from awx.main.notifications.rocketchat_backend import RocketChatBackend
 from awx.main.notifications.irc_backend import IrcBackend
-from awx.main.notifications.awssns_backend import AWSSNSBackend
 
 
 logger = logging.getLogger('awx.main.models.notifications')
@@ -41,7 +39,6 @@ __all__ = ['NotificationTemplate', 'Notification']
 
 class NotificationTemplate(CommonModelNameNotUnique):
     NOTIFICATION_TYPES = [
-        ('awssns', _('AWS SNS'), AWSSNSBackend),
         ('email', _('Email'), CustomEmailBackend),
         ('slack', _('Slack'), SlackBackend),
         ('twilio', _('Twilio'), TwilioBackend),
@@ -487,29 +484,14 @@ class JobNotificationMixin(object):
         if msg_template:
             try:
                 msg = env.from_string(msg_template).render(**context)
-            except (TemplateSyntaxError, UndefinedError, SecurityError) as e:
-                msg = '\r\n'.join([e.message, ''.join(traceback.format_exception(None, e, e.__traceback__).replace('\n', '\r\n'))])
+            except (TemplateSyntaxError, UndefinedError, SecurityError):
+                msg = ''
 
         if body_template:
             try:
                 body = env.from_string(body_template).render(**context)
-            except (TemplateSyntaxError, UndefinedError, SecurityError) as e:
-                body = '\r\n'.join([e.message, ''.join(traceback.format_exception(None, e, e.__traceback__).replace('\n', '\r\n'))])
-
-        # https://datatracker.ietf.org/doc/html/rfc2822#section-2.2
-        # Body should have at least 2 CRLF, some clients will interpret
-        # the email incorrectly with blank body.  So we will check that
-
-        if len(body.strip().splitlines()) < 1:
-            # blank body
-            body = '\r\n'.join(
-                [
-                    "The template rendering return a blank body.",
-                    "Please check the template.",
-                    "Refer to https://github.com/ansible/awx/issues/13983",
-                    "for further information.",
-                ]
-            )
+            except (TemplateSyntaxError, UndefinedError, SecurityError):
+                body = ''
 
         return (msg, body)
 

awx/main/models/organization.py

@@ -10,8 +10,6 @@ from django.contrib.sessions.models import Session
 from django.utils.timezone import now as tz_now
 from django.utils.translation import gettext_lazy as _
 
-# django-ansible-base
-from ansible_base.resource_registry.fields import AnsibleResourceField
 
 # AWX
 from awx.api.versioning import reverse
@@ -35,12 +33,6 @@ class Organization(CommonModel, NotificationFieldsModel, ResourceMixin, CustomVi
     class Meta:
         app_label = 'main'
         ordering = ('name',)
-        permissions = [
-            ('member_organization', 'Basic participation permissions for organization'),
-            ('audit_organization', 'Audit everything inside the organization'),
-        ]
-        # Remove add permission, only superuser can add
-        default_permissions = ('change', 'delete', 'view')
 
     instance_groups = OrderedManyToManyField('InstanceGroup', blank=True, through='OrganizationInstanceGroupMembership')
     galaxy_credentials = OrderedManyToManyField(
@@ -111,7 +103,6 @@ class Organization(CommonModel, NotificationFieldsModel, ResourceMixin, CustomVi
     approval_role = ImplicitRoleField(
         parent_role='admin_role',
     )
-    resource = AnsibleResourceField(primary_key_field="id")
 
     def get_absolute_url(self, request=None):
         return reverse('api:organization_detail', kwargs={'pk': self.pk}, request=request)
@@ -143,7 +134,6 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
         app_label = 'main'
         unique_together = [('organization', 'name')]
         ordering = ('organization__name', 'name')
-        permissions = [('member_team', 'Inherit all roles assigned to this team')]
 
     organization = models.ForeignKey(
         'Organization',
@@ -161,7 +151,6 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
     read_role = ImplicitRoleField(
         parent_role=['organization.auditor_role', 'member_role'],
     )
-    resource = AnsibleResourceField(primary_key_field="id")
 
     def get_absolute_url(self, request=None):
         return reverse('api:team_detail', kwargs={'pk': self.pk}, request=request)

awx/main/models/projects.py

@@ -259,7 +259,6 @@ class Project(UnifiedJobTemplate, ProjectOptions, ResourceMixin, CustomVirtualEn
     class Meta:
         app_label = 'main'
         ordering = ('id',)
-        permissions = [('update_project', 'Can run a project update'), ('use_project', 'Can use project in a job template')]
 
     default_environment = models.ForeignKey(
         'ExecutionEnvironment',

awx/main/models/rbac.py

@@ -7,30 +7,14 @@ import threading
 import contextlib
 import re
 
-# django-rest-framework
-from rest_framework.serializers import ValidationError
-
-# crum to impersonate users
-from crum import impersonate
-
 # Django
 from django.db import models, transaction, connection
-from django.db.models.signals import m2m_changed
-from django.contrib.auth import get_user_model
 from django.contrib.contenttypes.models import ContentType
 from django.contrib.contenttypes.fields import GenericForeignKey
 from django.utils.translation import gettext_lazy as _
-from django.apps import apps
-from django.conf import settings
-
-# Ansible_base app
-from ansible_base.rbac.models import RoleDefinition
-from ansible_base.lib.utils.models import get_type_for_model
 
 # AWX
 from awx.api.versioning import reverse
-from awx.main.migrations._dab_rbac import build_role_map, get_permissions_for_role
-from awx.main.constants import role_name_to_perm_mapping, org_role_to_permission
 
 __all__ = [
     'Role',
@@ -91,11 +75,6 @@ role_descriptions = {
 }
 
 
-to_permissions = {}
-for k, v in role_name_to_perm_mapping.items():
-    to_permissions[k] = v[0].strip('_')
-
-
 tls = threading.local()  # thread local storage
 
 
@@ -107,8 +86,10 @@ def check_singleton(func):
     """
 
     def wrapper(*args, **kwargs):
+        sys_admin = Role.singleton(ROLE_SINGLETON_SYSTEM_ADMINISTRATOR)
+        sys_audit = Role.singleton(ROLE_SINGLETON_SYSTEM_AUDITOR)
         user = args[0]
-        if user.is_superuser or user.is_system_auditor:
+        if user in sys_admin or user in sys_audit:
             if len(args) == 2:
                 return args[1]
             return Role.objects.all()
@@ -188,24 +169,6 @@ class Role(models.Model):
 
     def __contains__(self, accessor):
         if accessor._meta.model_name == 'user':
-            if accessor.is_superuser:
-                return True
-            if self.role_field == 'system_administrator':
-                return accessor.is_superuser
-            elif self.role_field == 'system_auditor':
-                return accessor.is_system_auditor
-            elif self.role_field in ('read_role', 'auditor_role') and accessor.is_system_auditor:
-                return True
-
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                if self.content_object and self.content_object._meta.model_name == 'organization' and self.role_field in org_role_to_permission:
-                    codename = org_role_to_permission[self.role_field]
-
-                    return accessor.has_obj_perm(self.content_object, codename)
-
-                if self.role_field not in to_permissions:
-                    raise Exception(f'{self.role_field} evaluated but not a translatable permission')
-                return accessor.has_obj_perm(self.content_object, to_permissions[self.role_field])
             return self.ancestors.filter(members=accessor).exists()
         else:
             raise RuntimeError(f'Role evaluations only valid for users, received {accessor}')
@@ -317,9 +280,6 @@ class Role(models.Model):
         #
         #
 
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            return
-
         if len(additions) == 0 and len(removals) == 0:
             return
 
@@ -452,12 +412,6 @@ class Role(models.Model):
         in their organization, but some of those roles descend from
         organization admin_role, but not auditor_role.
         """
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            from ansible_base.rbac.models import RoleEvaluation
-
-            q = RoleEvaluation.objects.filter(role__in=user.has_roles.all()).values_list('object_id', 'content_type_id').query
-            return roles_qs.extra(where=[f'(object_id,content_type_id) in ({q})'])
-
         return roles_qs.filter(
             id__in=RoleAncestorEntry.objects.filter(
                 descendent__in=RoleAncestorEntry.objects.filter(ancestor_id__in=list(user.roles.values_list('id', flat=True))).values_list(
@@ -480,13 +434,6 @@ class Role(models.Model):
         return self.singleton_name in [ROLE_SINGLETON_SYSTEM_ADMINISTRATOR, ROLE_SINGLETON_SYSTEM_AUDITOR]
 
 
-class AncestorManager(models.Manager):
-    def get_queryset(self):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            raise RuntimeError('The old RBAC system has been disabled, this should never be called')
-        return super(AncestorManager, self).get_queryset()
-
-
 class RoleAncestorEntry(models.Model):
     class Meta:
         app_label = 'main'
@@ -504,8 +451,6 @@ class RoleAncestorEntry(models.Model):
     content_type_id = models.PositiveIntegerField(null=False)
     object_id = models.PositiveIntegerField(null=False)
 
-    objects = AncestorManager()
-
 
 def role_summary_fields_generator(content_object, role_field):
     global role_descriptions
@@ -534,173 +479,3 @@ def role_summary_fields_generator(content_object, role_field):
     summary['name'] = role_names[role_field]
     summary['id'] = getattr(content_object, '{}_id'.format(role_field))
     return summary
-
-
-# ----------------- Custom Role Compatibility -------------------------
-# The following are methods to connect this (old) RBAC system to the new
-# system which allows custom roles
-# this follows the ORM interface layer documented in docs/rbac.md
-def get_role_codenames(role):
-    obj = role.content_object
-    if obj is None:
-        return
-    f = obj._meta.get_field(role.role_field)
-    parents, children = build_role_map(apps)
-    return [perm.codename for perm in get_permissions_for_role(f, children, apps)]
-
-
-def get_role_definition(role):
-    """Given a old-style role, this gives a role definition in the new RBAC system for it"""
-    obj = role.content_object
-    if obj is None:
-        return
-    f = obj._meta.get_field(role.role_field)
-    action_name = f.name.rsplit("_", 1)[0]
-    model_print = type(obj).__name__
-    rd_name = f'{model_print} {action_name.title()} Compat'
-    perm_list = get_role_codenames(role)
-    defaults = {
-        'content_type_id': role.content_type_id,
-        'description': f'Has {action_name.title()} permission to {model_print} for backwards API compatibility',
-    }
-    with impersonate(None):
-        try:
-            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
-        except ValidationError:
-            # This is a tricky case - practically speaking, users should not be allowed to create team roles
-            # or roles that include the team member permission.
-            # If we need to create this for compatibility purposes then we will create it as a managed non-editable role
-            defaults['managed'] = True
-            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
-    return rd
-
-
-def get_role_from_object_role(object_role):
-    """
-    Given an object role from the new system, return the corresponding role from the old system
-    reverses naming from get_role_definition, and the ANSIBLE_BASE_ROLE_PRECREATE setting.
-    """
-    rd = object_role.role_definition
-    if rd.name.endswith(' Compat'):
-        model_name, role_name, _ = rd.name.split()
-        role_name = role_name.lower()
-        role_name += '_role'
-    elif rd.name.endswith(' Admin') and rd.name.count(' ') == 2:
-        # cases like "Organization Project Admin"
-        model_name, target_model_name, role_name = rd.name.split()
-        role_name = role_name.lower()
-        model_cls = apps.get_model('main', target_model_name)
-        target_model_name = get_type_for_model(model_cls)
-        if target_model_name == 'notification_template':
-            target_model_name = 'notification'  # total exception
-        role_name = f'{target_model_name}_admin_role'
-    elif rd.name.endswith(' Admin'):
-        # cases like "project-admin"
-        role_name = 'admin_role'
-    else:
-        print(rd.name)
-        model_name, role_name = rd.name.split()
-        role_name = role_name.lower()
-        role_name += '_role'
-    return getattr(object_role.content_object, role_name)
-
-
-def give_or_remove_permission(role, actor, giving=True):
-    obj = role.content_object
-    if obj is None:
-        return
-    rd = get_role_definition(role)
-    rd.give_or_remove_permission(actor, obj, giving=giving)
-
-
-class SyncEnabled(threading.local):
-    def __init__(self):
-        self.enabled = True
-
-
-rbac_sync_enabled = SyncEnabled()
-
-
-@contextlib.contextmanager
-def disable_rbac_sync():
-    try:
-        previous_value = rbac_sync_enabled.enabled
-        rbac_sync_enabled.enabled = False
-        yield
-    finally:
-        rbac_sync_enabled.enabled = previous_value
-
-
-def give_creator_permissions(user, obj):
-    assignment = RoleDefinition.objects.give_creator_permissions(user, obj)
-    if assignment:
-        with disable_rbac_sync():
-            old_role = get_role_from_object_role(assignment.object_role)
-            old_role.members.add(user)
-
-
-def sync_members_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
-    if action.startswith('pre_'):
-        return
-    if not rbac_sync_enabled.enabled:
-        return
-
-    if action == 'post_add':
-        is_giving = True
-    elif action == 'post_remove':
-        is_giving = False
-    elif action == 'post_clear':
-        raise RuntimeError('Clearing of role members not supported')
-
-    if reverse:
-        user = instance
-    else:
-        role = instance
-
-    for user_or_role_id in pk_set:
-        if reverse:
-            role = Role.objects.get(pk=user_or_role_id)
-        else:
-            user = get_user_model().objects.get(pk=user_or_role_id)
-        give_or_remove_permission(role, user, giving=is_giving)
-
-
-def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
-    if action.startswith('pre_'):
-        return
-
-    if action == 'post_add':
-        is_giving = True
-    elif action == 'post_remove':
-        is_giving = False
-    elif action == 'post_clear':
-        raise RuntimeError('Clearing of role members not supported')
-
-    if reverse:
-        parent_role = instance
-    else:
-        child_role = instance
-
-    for role_id in pk_set:
-        if reverse:
-            child_role = Role.objects.get(id=role_id)
-        else:
-            parent_role = Role.objects.get(id=role_id)
-
-        # To a fault, we want to avoid running this if triggered from implicit_parents management
-        # we only want to do anything if we know for sure this is a non-implicit team role
-        if parent_role.role_field == 'member_role' and parent_role.content_type.model == 'team':
-            # Team internal parents are member_role->read_role and admin_role->member_role
-            # for the same object, this parenting will also be implicit_parents management
-            # do nothing for internal parents, but OTHER teams may still be assigned permissions to a team
-            if (child_role.content_type_id == parent_role.content_type_id) and (child_role.object_id == parent_role.object_id):
-                return
-
-            from awx.main.models.organization import Team
-
-            team = Team.objects.get(pk=parent_role.object_id)
-            give_or_remove_permission(child_role, team, giving=is_giving)
-
-
-m2m_changed.connect(sync_members_to_new_rbac, Role.members.through)
-m2m_changed.connect(sync_parents_to_new_rbac, Role.parents.through)

awx/main/models/receptor_address.py

@@ -1,67 +0,0 @@
-from django.db import models
-from django.core.validators import MinValueValidator, MaxValueValidator
-from django.utils.translation import gettext_lazy as _
-from awx.api.versioning import reverse
-
-
-class Protocols(models.TextChoices):
-    TCP = 'tcp', 'TCP'
-    WS = 'ws', 'WS'
-    WSS = 'wss', 'WSS'
-
-
-class ReceptorAddress(models.Model):
-    class Meta:
-        app_label = 'main'
-        constraints = [
-            models.UniqueConstraint(
-                fields=["address"],
-                name="unique_receptor_address",
-                violation_error_message=_("Receptor address must be unique."),
-            )
-        ]
-
-    address = models.CharField(help_text=_("Routable address for this instance."), max_length=255)
-    port = models.IntegerField(help_text=_("Port for the address."), default=27199, validators=[MinValueValidator(0), MaxValueValidator(65535)])
-    websocket_path = models.CharField(help_text=_("Websocket path."), max_length=255, default="", blank=True)
-    protocol = models.CharField(
-        help_text=_("Protocol to use for the Receptor listener, 'tcp', 'wss', or 'ws'."), max_length=10, default=Protocols.TCP, choices=Protocols.choices
-    )
-    is_internal = models.BooleanField(help_text=_("If True, only routable within the Kubernetes cluster."), default=False)
-    canonical = models.BooleanField(help_text=_("If True, this address is the canonical address for the instance."), default=False)
-    peers_from_control_nodes = models.BooleanField(help_text=_("If True, control plane cluster nodes should automatically peer to it."), default=False)
-    instance = models.ForeignKey(
-        'Instance',
-        related_name='receptor_addresses',
-        on_delete=models.CASCADE,
-        null=False,
-    )
-
-    def __str__(self):
-        return self.get_full_address()
-
-    def get_full_address(self):
-        scheme = ""
-        path = ""
-        port = ""
-        if self.protocol == "ws":
-            scheme = "wss://"
-
-        if self.protocol == "ws" and self.websocket_path:
-            path = f"/{self.websocket_path}"
-
-        if self.port:
-            port = f":{self.port}"
-
-        return f"{scheme}{self.address}{port}{path}"
-
-    def get_peer_type(self):
-        if self.protocol == 'tcp':
-            return 'tcp-peer'
-        elif self.protocol in ['ws', 'wss']:
-            return 'ws-peer'
-        else:
-            return None
-
-    def get_absolute_url(self, request=None):
-        return reverse('api:receptor_address_detail', kwargs={'pk': self.pk}, request=request)

awx/main/models/unified_jobs.py

@@ -37,8 +37,7 @@ from awx.main.models.base import CommonModelNameNotUnique, PasswordFieldsModel,
 from awx.main.dispatch import get_task_queuename
 from awx.main.dispatch.control import Control as ControlDispatcher
 from awx.main.registrar import activity_stream_registrar
-from awx.main.models.mixins import TaskManagerUnifiedJobMixin, ExecutionEnvironmentMixin
-from awx.main.models.rbac import to_permissions
+from awx.main.models.mixins import ResourceMixin, TaskManagerUnifiedJobMixin, ExecutionEnvironmentMixin
 from awx.main.utils.common import (
     camelcase_to_underscore,
     get_model_for_type,
@@ -211,15 +210,7 @@ class UnifiedJobTemplate(PolymorphicModel, CommonModelNameNotUnique, ExecutionEn
         # do not use this if in a subclass
         if cls != UnifiedJobTemplate:
             return super(UnifiedJobTemplate, cls).accessible_pk_qs(accessor, role_field)
-        from ansible_base.rbac.models import RoleEvaluation
-
-        action = to_permissions[role_field]
-
-        return (
-            RoleEvaluation.objects.filter(role__in=accessor.has_roles.all(), codename__startswith=action, content_type_id__in=cls._submodels_with_roles())
-            .values_list('object_id')
-            .distinct()
-        )
+        return ResourceMixin._accessible_pk_qs(cls, accessor, role_field, content_types=cls._submodels_with_roles())
 
     def _perform_unique_checks(self, unique_checks):
         # Handle the list of unique fields returned above. Replace with an
@@ -823,7 +814,7 @@ class UnifiedJob(
                 update_fields.append(key)
 
         if parent_instance:
-            if self.status in ('pending', 'running'):
+            if self.status in ('pending', 'waiting', 'running'):
                 if parent_instance.current_job != self:
                     parent_instance_set('current_job', self)
                 # Update parent with all the 'good' states of it's child
@@ -860,7 +851,7 @@ class UnifiedJob(
         # If this job already exists in the database, retrieve a copy of
         # the job in its prior state.
         # If update_fields are given without status, then that indicates no change
-        if self.status != 'waiting' and self.pk and ((not update_fields) or ('status' in update_fields)):
+        if self.pk and ((not update_fields) or ('status' in update_fields)):
             self_before = self.__class__.objects.get(pk=self.pk)
             if self_before.status != self.status:
                 status_before = self_before.status
@@ -902,8 +893,7 @@ class UnifiedJob(
                 update_fields.append('elapsed')
 
         # Ensure that the job template information is current.
-        # unless status is 'waiting', because this happens in large batches at end of task manager runs and is blocking
-        if self.status != 'waiting' and self.unified_job_template != self._get_parent_instance():
+        if self.unified_job_template != self._get_parent_instance():
             self.unified_job_template = self._get_parent_instance()
             if 'unified_job_template' not in update_fields:
                 update_fields.append('unified_job_template')
@@ -916,9 +906,8 @@ class UnifiedJob(
         # Okay; we're done. Perform the actual save.
         result = super(UnifiedJob, self).save(*args, **kwargs)
 
-        # If status changed, update the parent instance
-        # unless status is 'waiting', because this happens in large batches at end of task manager runs and is blocking
-        if self.status != status_before and self.status != 'waiting':
+        # If status changed, update the parent instance.
+        if self.status != status_before:
             # Update parent outside of the transaction for Job w/ allow_simultaneous=True
             # This dodges lock contention at the expense of the foreign key not being
             # completely correct.
@@ -1610,8 +1599,7 @@ class UnifiedJob(
             extra["controller_node"] = self.controller_node or "NOT_SET"
         elif state == "execution_node_chosen":
             extra["execution_node"] = self.execution_node or "NOT_SET"
-
-        logger_job_lifecycle.info(f"{msg} {json.dumps(extra)}")
+        logger_job_lifecycle.info(msg, extra=extra)
 
     @property
     def launched_by(self):

awx/main/models/workflow.py

@@ -467,10 +467,6 @@ class WorkflowJobTemplate(UnifiedJobTemplate, WorkflowJobOptions, SurveyJobTempl
 
     class Meta:
         app_label = 'main'
-        permissions = [
-            ('execute_workflowjobtemplate', 'Can run this workflow job template'),
-            ('approve_workflowjobtemplate', 'Can approve steps in this workflow job template'),
-        ]
 
     notification_templates_approvals = models.ManyToManyField(
         "NotificationTemplate",

awx/main/notifications/awssns_backend.py

@@ -1,70 +0,0 @@
-# Copyright (c) 2016 Ansible, Inc.
-# All Rights Reserved.
-import json
-import logging
-
-import boto3
-from botocore.exceptions import ClientError
-
-from awx.main.notifications.base import AWXBaseEmailBackend
-from awx.main.notifications.custom_notification_base import CustomNotificationBase
-
-logger = logging.getLogger('awx.main.notifications.awssns_backend')
-WEBSOCKET_TIMEOUT = 30
-
-
-class AWSSNSBackend(AWXBaseEmailBackend, CustomNotificationBase):
-    init_parameters = {
-        "aws_region": {"label": "AWS Region", "type": "string", "default": ""},
-        "aws_access_key_id": {"label": "Access Key ID", "type": "string", "default": ""},
-        "aws_secret_access_key": {"label": "Secret Access Key", "type": "password", "default": ""},
-        "aws_session_token": {"label": "Session Token", "type": "password", "default": ""},
-        "sns_topic_arn": {"label": "SNS Topic ARN", "type": "string", "default": ""},
-    }
-    recipient_parameter = "sns_topic_arn"
-    sender_parameter = None
-
-    DEFAULT_BODY = "{{ job_metadata }}"
-    default_messages = CustomNotificationBase.job_metadata_messages
-
-    def __init__(self, aws_region, aws_access_key_id, aws_secret_access_key, aws_session_token, fail_silently=False, **kwargs):
-        session = boto3.session.Session()
-        client_config = {"service_name": 'sns'}
-        if aws_region:
-            client_config["region_name"] = aws_region
-        if aws_secret_access_key:
-            client_config["aws_secret_access_key"] = aws_secret_access_key
-        if aws_access_key_id:
-            client_config["aws_access_key_id"] = aws_access_key_id
-        if aws_session_token:
-            client_config["aws_session_token"] = aws_session_token
-        self.client = session.client(**client_config)
-        super(AWSSNSBackend, self).__init__(fail_silently=fail_silently)
-
-    def _sns_publish(self, topic_arn, message):
-        self.client.publish(TopicArn=topic_arn, Message=message, MessageAttributes={})
-
-    def format_body(self, body):
-        if isinstance(body, str):
-            try:
-                body = json.loads(body)
-            except json.JSONDecodeError:
-                pass
-
-        if isinstance(body, dict):
-            body = json.dumps(body)
-        # convert dict body to json string
-        return body
-
-    def send_messages(self, messages):
-        sent_messages = 0
-        for message in messages:
-            sns_topic_arn = str(message.recipients()[0])
-            try:
-                self._sns_publish(topic_arn=sns_topic_arn, message=message.body)
-                sent_messages += 1
-            except ClientError as error:
-                if not self.fail_silently:
-                    raise error
-
-        return sent_messages

awx/main/notifications/custom_notification_base.py

@@ -1,6 +1,5 @@
 # Copyright (c) 2019 Ansible, Inc.
 # All Rights Reserved.
-# -*-coding:utf-8-*-
 
 
 class CustomNotificationBase(object):
@@ -32,15 +31,3 @@ class CustomNotificationBase(object):
             "denied": {"message": DEFAULT_APPROVAL_DENIED_MSG, "body": None},
         },
     }
-
-    job_metadata_messages = {
-        "started": {"body": "{{ job_metadata }}"},
-        "success": {"body": "{{ job_metadata }}"},
-        "error": {"body": "{{ job_metadata }}"},
-        "workflow_approval": {
-            "running": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" needs review. This node can be viewed at: {{ workflow_url }}"}'},
-            "approved": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" was approved. {{ workflow_url }}"}'},
-            "timed_out": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" has timed out. {{ workflow_url }}"}'},
-            "denied": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" was denied. {{ workflow_url }}"}'},
-        },
-    }

awx/main/notifications/webhook_backend.py

@@ -27,7 +27,17 @@ class WebhookBackend(AWXBaseEmailBackend, CustomNotificationBase):
     sender_parameter = None
 
     DEFAULT_BODY = "{{ job_metadata }}"
-    default_messages = CustomNotificationBase.job_metadata_messages
+    default_messages = {
+        "started": {"body": DEFAULT_BODY},
+        "success": {"body": DEFAULT_BODY},
+        "error": {"body": DEFAULT_BODY},
+        "workflow_approval": {
+            "running": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" needs review. This node can be viewed at: {{ workflow_url }}"}'},
+            "approved": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" was approved. {{ workflow_url }}"}'},
+            "timed_out": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" has timed out. {{ workflow_url }}"}'},
+            "denied": {"body": '{"body": "The approval node \\"{{ approval_node_name }}\\" was denied. {{ workflow_url }}"}'},
+        },
+    }
 
     def __init__(self, http_method, headers, disable_ssl_verification=False, fail_silently=False, username=None, password=None, **kwargs):
         self.http_method = http_method

awx/main/routing.py

@@ -4,15 +4,13 @@ import logging
 from django.conf import settings
 from django.urls import re_path
 
+from channels.auth import AuthMiddlewareStack
 from channels.routing import ProtocolTypeRouter, URLRouter
 
-from ansible_base.lib.channels.middleware import DrfAuthMiddlewareStack
-
 from . import consumers
 
 
 logger = logging.getLogger('awx.main.routing')
-_application = None
 
 
 class AWXProtocolTypeRouter(ProtocolTypeRouter):
@@ -28,95 +26,13 @@ class AWXProtocolTypeRouter(ProtocolTypeRouter):
         super().__init__(*args, **kwargs)
 
 
-class MultipleURLRouterAdapter:
-    """
-    Django channels doesn't nicely support Auth_1(urls_1), Auth_2(urls_2), ..., Auth_n(urls_n)
-    This class allows assocating a websocket url with an auth
-    Ordering matters. The first matching url will be used.
-    """
-
-    def __init__(self, *auths):
-        self._auths = [a for a in auths]
-
-    async def __call__(self, scope, receive, send):
-        """
-        Loop through the list of passed in URLRouter's (they may or may not be wrapped by auth).
-        We know we have exhausted the list of URLRouter patterns when we get a
-        ValueError('No route found for path %s'). When that happens, move onto the next
-        URLRouter.
-        If the final URLRouter raises an error, re-raise it in the end.
-
-        We know that we found a match when no error is raised, end the loop.
-        """
-        last_index = len(self._auths) - 1
-        for i, auth in enumerate(self._auths):
-            try:
-                return await auth.__call__(scope, receive, send)
-            except ValueError as e:
-                if str(e).startswith('No route found for path'):
-                    # Only surface the error if on the last URLRouter
-                    if i == last_index:
-                        raise
-
-
 websocket_urlpatterns = [
-    re_path(r'api/websocket/$', consumers.EventConsumer.as_asgi()),
     re_path(r'websocket/$', consumers.EventConsumer.as_asgi()),
-]
-
-if settings.OPTIONAL_API_URLPATTERN_PREFIX:
-    websocket_urlpatterns.append(re_path(r'api/{}/v2/websocket/$'.format(settings.OPTIONAL_API_URLPATTERN_PREFIX), consumers.EventConsumer.as_asgi()))
-
-websocket_relay_urlpatterns = [
     re_path(r'websocket/relay/$', consumers.RelayConsumer.as_asgi()),
 ]
 
-
-def application_func(cls=AWXProtocolTypeRouter) -> ProtocolTypeRouter:
-    return cls(
-        {
-            'websocket': MultipleURLRouterAdapter(
-                URLRouter(websocket_relay_urlpatterns),
-                DrfAuthMiddlewareStack(URLRouter(websocket_urlpatterns)),
-            )
-        }
-    )
-
-
-def __getattr__(name: str) -> ProtocolTypeRouter:
-    """
-    Defer instantiating application.
-    For testing, we just need it to NOT run on import.
-
-    https://peps.python.org/pep-0562/#specification
-
-    Normally, someone would get application from this module via:
-        from awx.main.routing import application
-
-    and do something with the application:
-        application.do_something()
-
-    What does the callstack look like when the import runs?
-    ...
-        awx.main.routing.__getattribute__(...)                              # <-- we don't define this so NOOP as far as we are concerned
-        if '__getattr__' in awx.main.routing.__dict__:                      # <-- this triggers the function we are in
-            return awx.main.routing.__dict__.__getattr__("application")
-
-    Why isn't this function simply implemented as:
-        def __getattr__(name):
-            if not _application:
-              _application = application_func()
-            return _application
-
-    It could. I manually tested it and it passes test_routing.py.
-
-    But my understanding after reading the PEP-0562 specification link above is that
-    performance would be a bit worse due to the extra __getattribute__ calls when
-    we reference non-global variables.
-    """
-    if name == "application":
-        globs = globals()
-        if not globs['_application']:
-            globs['_application'] = application_func()
-        return globs['_application']
-    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+application = AWXProtocolTypeRouter(
+    {
+        'websocket': AuthMiddlewareStack(URLRouter(websocket_urlpatterns)),
+    }
+)

awx/main/scheduler/task_manager.py

@@ -68,7 +68,7 @@ class TaskBase:
         # initialize each metric to 0 and force metric_has_changed to true. This
         # ensures each task manager metric will be overridden when pipe_execute
         # is called later.
-        self.subsystem_metrics = s_metrics.DispatcherMetrics(auto_pipe_execute=False)
+        self.subsystem_metrics = s_metrics.Metrics(auto_pipe_execute=False)
         self.start_time = time.time()
 
         # We want to avoid calling settings in loops, so cache these settings at init time
@@ -105,7 +105,7 @@ class TaskBase:
             try:
                 # increment task_manager_schedule_calls regardless if the other
                 # metrics are recorded
-                s_metrics.DispatcherMetrics(auto_pipe_execute=True).inc(f"{self.prefix}__schedule_calls", 1)
+                s_metrics.Metrics(auto_pipe_execute=True).inc(f"{self.prefix}__schedule_calls", 1)
                 # Only record metrics if the last time recording was more
                 # than SUBSYSTEM_METRICS_TASK_MANAGER_RECORD_INTERVAL ago.
                 # Prevents a short-duration task manager that runs directly after a

awx/main/signals.py

@@ -126,8 +126,6 @@ def rebuild_role_ancestor_list(reverse, model, instance, pk_set, action, **kwarg
 
 def sync_superuser_status_to_rbac(instance, **kwargs):
     'When the is_superuser flag is changed on a user, reflect that in the membership of the System Admnistrator role'
-    if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-        return
     update_fields = kwargs.get('update_fields', None)
     if update_fields and 'is_superuser' not in update_fields:
         return
@@ -139,8 +137,6 @@ def sync_superuser_status_to_rbac(instance, **kwargs):
 
 def sync_rbac_to_superuser_status(instance, sender, **kwargs):
     'When the is_superuser flag is false but a user has the System Admin role, update the database to reflect that'
-    if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-        return
     if kwargs['action'] in ['post_add', 'post_remove', 'post_clear']:
         new_status_value = bool(kwargs['action'] == 'post_add')
         if hasattr(instance, 'singleton_name'):  # duck typing, role.members.add() vs user.roles.add()

awx/main/tasks/callback.py

@@ -29,7 +29,7 @@ class RunnerCallback:
         self.safe_env = {}
         self.event_ct = 0
         self.model = model
-        self.update_attempts = int(getattr(settings, 'DISPATCHER_DB_DOWNTOWN_TOLLERANCE', settings.DISPATCHER_DB_DOWNTIME_TOLERANCE) / 5)
+        self.update_attempts = int(settings.DISPATCHER_DB_DOWNTIME_TOLERANCE / 5)
         self.wrapup_event_dispatched = False
         self.artifacts_processed = False
         self.extra_update_fields = {}
@@ -95,17 +95,17 @@ class RunnerCallback:
         if self.parent_workflow_job_id:
             event_data['workflow_job_id'] = self.parent_workflow_job_id
         event_data['job_created'] = self.job_created
-
-        host = event_data.get('event_data', {}).get('host', '').strip()
-        if host:
-            event_data['host_name'] = host
-            if host in self.host_map:
-                event_data['host_id'] = self.host_map[host]
-        else:
-            event_data['host_name'] = ''
-            event_data['host_id'] = ''
-        if event_data.get('event') == 'playbook_on_stats':
-            event_data['host_map'] = self.host_map
+        if self.host_map:
+            host = event_data.get('event_data', {}).get('host', '').strip()
+            if host:
+                event_data['host_name'] = host
+                if host in self.host_map:
+                    event_data['host_id'] = self.host_map[host]
+            else:
+                event_data['host_name'] = ''
+                event_data['host_id'] = ''
+            if event_data.get('event') == 'playbook_on_stats':
+                event_data['host_map'] = self.host_map
 
         if isinstance(self, RunnerCallbackForProjectUpdate):
             # need a better way to have this check.

awx/main/tasks/jobs.py

@@ -114,7 +114,7 @@ class BaseTask(object):
 
     def __init__(self):
         self.cleanup_paths = []
-        self.update_attempts = int(getattr(settings, 'DISPATCHER_DB_DOWNTOWN_TOLLERANCE', settings.DISPATCHER_DB_DOWNTIME_TOLERANCE) / 5)
+        self.update_attempts = int(settings.DISPATCHER_DB_DOWNTIME_TOLERANCE / 5)
         self.runner_callback = self.callback_class(model=self.model)
 
     def update_model(self, pk, _attempt=0, **updates):

awx/main/tasks/receptor.py

@@ -27,7 +27,7 @@ from awx.main.utils.common import (
 )
 from awx.main.constants import MAX_ISOLATED_PATH_COLON_DELIMITER
 from awx.main.tasks.signals import signal_state, signal_callback, SignalExit
-from awx.main.models import Instance, InstanceLink, UnifiedJob, ReceptorAddress
+from awx.main.models import Instance, InstanceLink, UnifiedJob
 from awx.main.dispatch import get_task_queuename
 from awx.main.dispatch.publish import task
 from awx.main.utils.pglock import advisory_lock
@@ -49,70 +49,6 @@ class ReceptorConnectionType(Enum):
     STREAMTLS = 2
 
 
-"""
-Translate receptorctl messages that come in over stdout into
-structured messages. Currently, these are error messages.
-"""
-
-
-class ReceptorErrorBase:
-    _MESSAGE = 'Receptor Error'
-
-    def __init__(self, node: str = 'N/A', state_name: str = 'N/A'):
-        self.node = node
-        self.state_name = state_name
-
-    def __str__(self):
-        return f"{self.__class__.__name__} '{self._MESSAGE}' on node '{self.node}' with state '{self.state_name}'"
-
-
-class WorkUnitError(ReceptorErrorBase):
-    _MESSAGE = 'unknown work unit '
-
-    def __init__(self, work_unit_id: str, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.work_unit_id = work_unit_id
-
-    def __str__(self):
-        return f"{super().__str__()} work unit id '{self.work_unit_id}'"
-
-
-class WorkUnitCancelError(WorkUnitError):
-    _MESSAGE = 'error cancelling remote unit:  unknown work unit '
-
-
-class WorkUnitResultsError(WorkUnitError):
-    _MESSAGE = 'Failed to get results: unknown work unit '
-
-
-class UnknownError(ReceptorErrorBase):
-    _MESSAGE = 'Unknown receptor ctl error'
-
-    def __init__(self, msg, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._MESSAGE = msg
-
-
-class FuzzyError:
-    def __new__(self, e: RuntimeError, node: str, state_name: str):
-        """
-        At the time of writing this comment all of the sub-classes detection
-        is centralized in this parent class. It's like a Router().
-        Someone may find it better to push down the error detection logic into
-        each sub-class.
-        """
-        msg = e.args[0]
-
-        common_startswith = (WorkUnitCancelError, WorkUnitResultsError, WorkUnitError)
-
-        for klass in common_startswith:
-            if msg.startswith(klass._MESSAGE):
-                work_unit_id = msg[len(klass._MESSAGE) :]
-                return klass(work_unit_id, node=node, state_name=state_name)
-
-        return UnknownError(msg, node=node, state_name=state_name)
-
-
 def read_receptor_config():
     # for K8S deployments, getting a lock is necessary as another process
     # may be re-writing the config at this time
@@ -249,7 +185,6 @@ def run_until_complete(node, timing_data=None, **kwargs):
         timing_data['transmit_timing'] = run_start - transmit_start
     run_timing = 0.0
     stdout = ''
-    state_name = 'local var never set'
 
     try:
         resultfile = receptor_ctl.get_work_results(unit_id)
@@ -270,33 +205,13 @@ def run_until_complete(node, timing_data=None, **kwargs):
         stdout = resultfile.read()
         stdout = str(stdout, encoding='utf-8')
 
-    except RuntimeError as e:
-        receptor_e = FuzzyError(e, node, state_name)
-        if type(receptor_e) in (
-            WorkUnitError,
-            WorkUnitResultsError,
-        ):
-            logger.warning(f'While consuming job results: {receptor_e}')
-        else:
-            raise
     finally:
         if settings.RECEPTOR_RELEASE_WORK:
-            try:
-                res = receptor_ctl.simple_command(f"work release {unit_id}")
+            res = receptor_ctl.simple_command(f"work release {unit_id}")
+            if res != {'released': unit_id}:
+                logger.warning(f'Could not confirm release of receptor work unit id {unit_id} from {node}, data: {res}')
 
-                if res != {'released': unit_id}:
-                    logger.warning(f'Could not confirm release of receptor work unit id {unit_id} from {node}, data: {res}')
-
-                receptor_ctl.close()
-            except RuntimeError as e:
-                receptor_e = FuzzyError(e, node, state_name)
-                if type(receptor_e) in (
-                    WorkUnitError,
-                    WorkUnitCancelError,
-                ):
-                    logger.warning(f"While releasing work: {receptor_e}")
-                else:
-                    logger.error(f"While releasing work: {receptor_e}")
+        receptor_ctl.close()
 
     if state_name.lower() == 'failed':
         work_detail = status.get('Detail', '')
@@ -360,7 +275,7 @@ def _convert_args_to_cli(vargs):
     args = ['cleanup']
     for option in ('exclude_strings', 'remove_images'):
         if vargs.get(option):
-            args.append('--{}="{}"'.format(option.replace('_', '-'), ' '.join(vargs.get(option))))
+            args.append('--{}={}'.format(option.replace('_', '-'), ' '.join(vargs.get(option))))
     for option in ('file_pattern', 'image_prune', 'process_isolation_executable', 'grace_period'):
         if vargs.get(option) is True:
             args.append('--{}'.format(option.replace('_', '-')))
@@ -761,44 +676,36 @@ RECEPTOR_CONFIG_STARTER = (
 )
 
 
-def should_update_config(new_config):
+def should_update_config(instances):
     '''
     checks that the list of instances matches the list of
     tcp-peers in the config
     '''
-
     current_config = read_receptor_config()  # this gets receptor conf lock
+    current_peers = []
     for config_entry in current_config:
-        if config_entry not in new_config:
-            logger.warning(f"{config_entry} should not be in receptor config. Updating.")
-            return True
-    for config_entry in new_config:
-        if config_entry not in current_config:
-            logger.warning(f"{config_entry} missing from receptor config. Updating.")
-            return True
+        for key, value in config_entry.items():
+            if key.endswith('-peer'):
+                current_peers.append(value['address'])
+    intended_peers = [f"{i.hostname}:{i.listener_port}" for i in instances]
+    logger.debug(f"Peers current {current_peers} intended {intended_peers}")
+    if set(current_peers) == set(intended_peers):
+        return False  # config file is already update to date
 
-    return False
+    return True
 
 
 def generate_config_data():
     # returns two values
     #   receptor config - based on current database peers
     #   should_update   - If True, receptor_config differs from the receptor conf file on disk
-    addresses = ReceptorAddress.objects.filter(peers_from_control_nodes=True)
+    instances = Instance.objects.filter(node_type__in=(Instance.Types.EXECUTION, Instance.Types.HOP), peers_from_control_nodes=True)
 
     receptor_config = list(RECEPTOR_CONFIG_STARTER)
-    for address in addresses:
-        if address.get_peer_type():
-            peer = {
-                f'{address.get_peer_type()}': {
-                    'address': f'{address.get_full_address()}',
-                    'tls': 'tlsclient',
-                }
-            }
-            receptor_config.append(peer)
-        else:
-            logger.warning(f"Receptor address {address} has unsupported peer type, skipping.")
-    should_update = should_update_config(receptor_config)
+    for instance in instances:
+        peer = {'tcp-peer': {'address': f'{instance.hostname}:{instance.listener_port}', 'tls': 'tlsclient'}}
+        receptor_config.append(peer)
+    should_update = should_update_config(instances)
     return receptor_config, should_update
 
 
@@ -840,13 +747,14 @@ def write_receptor_config():
             with lock:
                 with open(__RECEPTOR_CONF, 'w') as file:
                     yaml.dump(receptor_config, file, default_flow_style=False)
+
             reload_receptor()
 
 
 @task(queue=get_task_queuename)
 def remove_deprovisioned_node(hostname):
     InstanceLink.objects.filter(source__hostname=hostname).update(link_state=InstanceLink.States.REMOVING)
-    InstanceLink.objects.filter(target__instance__hostname=hostname).update(link_state=InstanceLink.States.REMOVING)
+    InstanceLink.objects.filter(target__hostname=hostname).update(link_state=InstanceLink.States.REMOVING)
 
     node_jobs = UnifiedJob.objects.filter(
         execution_node=hostname,

awx/main/tasks/system.py

@@ -6,7 +6,6 @@ import itertools
 import json
 import logging
 import os
-import psycopg
 from io import StringIO
 from contextlib import redirect_stdout
 import shutil
@@ -63,7 +62,7 @@ from awx.main.tasks.receptor import get_receptor_ctl, worker_info, worker_cleanu
 from awx.main.consumers import emit_channel_notification
 from awx.main import analytics
 from awx.conf import settings_registry
-from awx.main.analytics.subsystem_metrics import DispatcherMetrics
+from awx.main.analytics.subsystem_metrics import Metrics
 
 from rest_framework.exceptions import PermissionDenied
 
@@ -114,7 +113,7 @@ def dispatch_startup():
     cluster_node_heartbeat()
     reaper.startup_reaping()
     reaper.reap_waiting(grace_period=0)
-    m = DispatcherMetrics()
+    m = Metrics()
     m.reset_values()
 
 
@@ -417,7 +416,7 @@ def handle_removed_image(remove_images=None):
 
 @task(queue=get_task_queuename)
 def cleanup_images_and_files():
-    _cleanup_images_and_files(image_prune=True)
+    _cleanup_images_and_files()
 
 
 @task(queue=get_task_queuename)
@@ -496,7 +495,7 @@ def inspect_established_receptor_connections(mesh_status):
     update_links = []
     for link in all_links:
         if link.link_state != InstanceLink.States.REMOVING:
-            if link.target.instance.hostname in active_receptor_conns.get(link.source.hostname, {}):
+            if link.target.hostname in active_receptor_conns.get(link.source.hostname, {}):
                 if link.link_state is not InstanceLink.States.ESTABLISHED:
                     link.link_state = InstanceLink.States.ESTABLISHED
                     update_links.append(link)
@@ -631,18 +630,10 @@ def cluster_node_heartbeat(dispatch_time=None, worker_tasks=None):
                 logger.error("Host {} last checked in at {}, marked as lost.".format(other_inst.hostname, other_inst.last_seen))
 
         except DatabaseError as e:
-            cause = e.__cause__
-            if cause and hasattr(cause, 'sqlstate'):
-                sqlstate = cause.sqlstate
-                sqlstate_str = psycopg.errors.lookup(sqlstate)
-                logger.debug('SQL Error state: {} - {}'.format(sqlstate, sqlstate_str))
-
-                if sqlstate == psycopg.errors.NoData:
-                    logger.debug('Another instance has marked {} as lost'.format(other_inst.hostname))
-                else:
-                    logger.exception("Error marking {} as lost.".format(other_inst.hostname))
+            if 'did not affect any rows' in str(e):
+                logger.debug('Another instance has marked {} as lost'.format(other_inst.hostname))
             else:
-                logger.exception('No SQL state available.  Error marking {} as lost'.format(other_inst.hostname))
+                logger.exception('Error marking {} as lost'.format(other_inst.hostname))
 
     # Run local reaper
     if worker_tasks is not None:
@@ -797,19 +788,10 @@ def update_inventory_computed_fields(inventory_id):
     try:
         i.update_computed_fields()
     except DatabaseError as e:
-        # https://github.com/django/django/blob/eff21d8e7a1cb297aedf1c702668b590a1b618f3/django/db/models/base.py#L1105
-        # django raises DatabaseError("Forced update did not affect any rows.")
-
-        # if sqlstate is set then there was a database error and otherwise will re-raise that error
-        cause = e.__cause__
-        if cause and hasattr(cause, 'sqlstate'):
-            sqlstate = cause.sqlstate
-            sqlstate_str = psycopg.errors.lookup(sqlstate)
-            logger.error('SQL Error state: {} - {}'.format(sqlstate, sqlstate_str))
-            raise
-
-        # otherwise
-        logger.debug('Exiting duplicate update_inventory_computed_fields task.')
+        if 'did not affect any rows' in str(e):
+            logger.debug('Exiting duplicate update_inventory_computed_fields task.')
+            return
+        raise
 
 
 def update_smart_memberships_for_inventory(smart_inventory):

awx/main/tests/data/ansible_utils/playbooks/valid/hello_world.yml

@@ -3,5 +3,5 @@
   hosts: all
   tasks:
     - name: Hello Message
-      ansible.builtin.debug:
+      debug:
         msg: "Hello World!"

awx/main/tests/data/inventory/plugins/terraform/env.json

@@ -1,3 +0,0 @@
-{
-    "GOOGLE_BACKEND_CREDENTIALS": "{{ file_reference }}"
-}

awx/main/tests/docs/conftest.py

@@ -1,8 +1,13 @@
 from awx.main.tests.functional.conftest import *  # noqa
-import os
-import pytest
 
 
-@pytest.fixture()
-def release():
-    return os.environ.get('VERSION_TARGET', '')
+def pytest_addoption(parser):
+    parser.addoption("--release", action="store", help="a release version number, e.g., 3.3.0")
+
+
+def pytest_generate_tests(metafunc):
+    # This is called for every test. Only get/set command line arguments
+    # if the argument is specified in the list of test "fixturenames".
+    option_value = metafunc.config.option.release
+    if 'release' in metafunc.fixturenames and option_value is not None:
+        metafunc.parametrize("release", [option_value])