add serializer stuff so shows up in DRF

This adds concept of priority to jobs.
The task manager now orders on priority, then created.
All rules around instance group capacity etc still apply. So even if a
job has very high priority, if there is not available capacity in the
available instance groups, it will not be scheduled.

Higher number is higher priority.
Default priority is 0.

For dependencies spawned from other jobs, assign them the priority of
the job that caused them to be created.

Still need to add prompt on launch stuff for priority to be consistent.

.codecov.yml

@@ -2,7 +2,7 @@
 
 codecov:
   notify:
-    after_n_builds: 9  # Number of test matrix+lint jobs uploading coverage
+    after_n_builds: 6  # Number of test matrix+lint jobs uploading coverage
     wait_for_ci: false
 
   require_ci_to_pass: false

.coveragerc

@@ -17,23 +17,6 @@ exclude_also =
 
 [run]
 branch = True
-# NOTE: `disable_warnings` is needed when `pytest-cov` runs in tandem
-# NOTE: with `pytest-xdist`. These warnings are false negative in this
-# NOTE: context.
-#
-# NOTE: It's `coveragepy` that emits the warnings and previously they
-# NOTE: wouldn't get on the radar of `pytest`'s `filterwarnings`
-# NOTE: mechanism. This changed, however, with `pytest >= 8.4`. And
-# NOTE: since we set `filterwarnings = error`, those warnings are being
-# NOTE: raised as exceptions, cascading into `pytest`'s internals and
-# NOTE: causing tracebacks and crashes of the test sessions.
-#
-# Ref:
-# * https://github.com/pytest-dev/pytest-cov/issues/693
-# * https://github.com/pytest-dev/pytest-cov/pull/695
-# * https://github.com/pytest-dev/pytest-cov/pull/696
-disable_warnings =
-  module-not-measured
 omit =
     awx/main/migrations/*
     awx/settings/defaults.py

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,8 +4,7 @@
 <!---
 If you are fixing an existing issue, please include "related #nnn" in your
 commit message and your description; but you should still explain what
-the change does. Also please make sure that if this PR has an attached JIRA, put AAP-<number>
-in as the first entry for your PR title.
+the change does.
 -->
 
 ##### ISSUE TYPE
@@ -23,6 +22,11 @@ in as the first entry for your PR title.
  - Docs
  - Other
 
+##### AWX VERSION
+<!--- Paste verbatim output from `make VERSION` between quotes below -->
+```
+
+```
 
 
 ##### ADDITIONAL INFORMATION

.github/actions/awx_devel_image/action.yml

@@ -11,7 +11,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: ./.github/actions/setup-python
+    - name: Get python version from Makefile
+      shell: bash
+      run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
     - name: Set lower case owner name
       shell: bash
@@ -24,9 +26,26 @@ runs:
       run: |
         echo "${{ inputs.github-token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-    - uses: ./.github/actions/setup-ssh-agent
+    - name: Generate placeholder SSH private key if SSH auth for private repos is not needed
+      id: generate_key
+      shell: bash
+      run: |
+        if [[ -z "${{ inputs.private-github-key }}" ]]; then
+          ssh-keygen -t ed25519 -C "github-actions" -N "" -f ~/.ssh/id_ed25519
+          echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+          cat ~/.ssh/id_ed25519 >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+        else
+          echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+          echo "${{ inputs.private-github-key }}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Add private GitHub key to SSH agent
+      uses: webfactory/ssh-agent@v0.9.0
       with:
-        ssh-private-key: ${{ inputs.private-github-key }}
+        ssh-private-key: ${{ steps.generate_key.outputs.SSH_PRIVATE_KEY }}
+
 
     - name: Pre-pull latest devel image to warm cache
       shell: bash

.github/actions/run_awx_devel/action.yml

@@ -36,7 +36,7 @@ runs:
 
     - name: Upgrade ansible-core
       shell: bash
-      run: python3 -m pip install --upgrade 'ansible-core<2.18'
+      run: python3 -m pip install --upgrade ansible-core
 
     - name: Install system deps
       shell: bash

.github/actions/setup-python/action.yml

@@ -1,27 +0,0 @@
-name: 'Setup Python from Makefile'
-description: 'Extract and set up Python version from Makefile'
-inputs:
-  python-version:
-    description: 'Override Python version (optional)'
-    required: false
-    default: ''
-  working-directory:
-    description: 'Directory containing the Makefile'
-    required: false
-    default: '.'
-runs:
-  using: composite
-  steps:
-    - name: Get python version from Makefile
-      shell: bash
-      run: |
-        if [ -n "${{ inputs.python-version }}" ]; then
-          echo "py_version=${{ inputs.python-version }}" >> $GITHUB_ENV
-        else
-          cd ${{ inputs.working-directory }}
-          echo "py_version=`make PYTHON_VERSION`" >> $GITHUB_ENV
-        fi
-    - name: Install python
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ env.py_version }}

.github/actions/setup-ssh-agent/action.yml

@@ -1,29 +0,0 @@
-name: 'Setup SSH for GitHub'
-description: 'Configure SSH for private repository access'
-inputs:
-  ssh-private-key:
-    description: 'SSH private key for repository access'
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Generate placeholder SSH private key if SSH auth for private repos is not needed
-      id: generate_key
-      shell: bash
-      run: |
-        if [[ -z "${{ inputs.ssh-private-key }}" ]]; then
-          ssh-keygen -t ed25519 -C "github-actions" -N "" -f ~/.ssh/id_ed25519
-          echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
-          cat ~/.ssh/id_ed25519 >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-        else
-          echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
-          echo "${{ inputs.ssh-private-key }}" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Add private GitHub key to SSH agent
-      uses: webfactory/ssh-agent@v0.9.0
-      with:
-        ssh-private-key: ${{ steps.generate_key.outputs.SSH_PRIVATE_KEY }}

.github/workflows/ci.yml

@@ -130,7 +130,7 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -161,10 +161,6 @@ jobs:
           show-progress: false
           path: awx
 
-      - uses: ./awx/.github/actions/setup-ssh-agent
-        with:
-          ssh-private-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
-
       - name: Checkout awx-operator
         uses: actions/checkout@v4
         with:
@@ -172,14 +168,39 @@ jobs:
           repository: ansible/awx-operator
           path: awx-operator
 
-      - uses: ./awx/.github/actions/setup-python
+      - name: Get python version from Makefile
+        working-directory: awx
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v4
         with:
-          working-directory: awx
+          python-version: ${{ env.py_version }}
 
       - name: Install playbook dependencies
         run: |
           python3 -m pip install docker
 
+      - name: Generate placeholder SSH private key if SSH auth for private repos is not needed
+        id: generate_key
+        shell: bash
+        run: |
+          if [[ -z "${{ secrets.PRIVATE_GITHUB_KEY }}" ]]; then
+            ssh-keygen -t ed25519 -C "github-actions" -N "" -f ~/.ssh/id_ed25519
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            cat ~/.ssh/id_ed25519 >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            echo "${{ secrets.PRIVATE_GITHUB_KEY }}" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Add private GitHub key to SSH agent
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ steps.generate_key.outputs.SSH_PRIVATE_KEY }}
+
       - name: Build AWX image
         working-directory: awx
         run: |
@@ -278,7 +299,7 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -335,7 +356,6 @@ jobs:
         with:
           name: coverage-${{ matrix.target-regex.name }}
           path: ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage/
-          retention-days: 1
 
       - uses: ./.github/actions/upload_awx_devel_logs
         if: always()
@@ -353,22 +373,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          persist-credentials: false
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
       - name: Upgrade ansible-core
-        run: python3 -m pip install --upgrade 'ansible-core<2.18'
+        run: python3 -m pip install --upgrade ansible-core
 
-      - name: Download coverage artifacts
+      - name: Download coverage artifacts A to H
         uses: actions/download-artifact@v4
         with:
-          merge-multiple: true
+          name: coverage-a-h
+          path: coverage
+
+      - name: Download coverage artifacts I to P
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-i-p
+          path: coverage
+
+      - name: Download coverage artifacts Z to Z
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-r-z0-9
           path: coverage
-          pattern: coverage-*
 
       - name: Combine coverage
         run: |
@@ -386,6 +416,46 @@ jobs:
           echo '## AWX Collection Integration Coverage HTML' >> $GITHUB_STEP_SUMMARY
           echo 'Download the HTML artifacts to view the coverage report.' >> $GITHUB_STEP_SUMMARY
 
+      # This is a huge hack, there's no official action for removing artifacts currently.
+      # Also ACTIONS_RUNTIME_URL and ACTIONS_RUNTIME_TOKEN aren't available in normal run
+      # steps, so we have to use github-script to get them.
+      #
+      # The advantage of doing this, though, is that we save on artifact storage space.
+
+      - name: Get secret artifact runtime URL
+        uses: actions/github-script@v6
+        id: get-runtime-url
+        with:
+          result-encoding: string
+          script: |
+            const { ACTIONS_RUNTIME_URL } = process.env;
+            return ACTIONS_RUNTIME_URL;
+
+      - name: Get secret artifact runtime token
+        uses: actions/github-script@v6
+        id: get-runtime-token
+        with:
+          result-encoding: string
+          script: |
+            const { ACTIONS_RUNTIME_TOKEN } = process.env;
+            return ACTIONS_RUNTIME_TOKEN;
+
+      - name: Remove intermediary artifacts
+        env:
+          ACTIONS_RUNTIME_URL: ${{ steps.get-runtime-url.outputs.result }}
+          ACTIONS_RUNTIME_TOKEN: ${{ steps.get-runtime-token.outputs.result }}
+        run: |
+          echo "::add-mask::${ACTIONS_RUNTIME_TOKEN}"
+          artifacts=$(
+            curl -H "Authorization: Bearer $ACTIONS_RUNTIME_TOKEN" \
+              ${ACTIONS_RUNTIME_URL}_apis/pipelines/workflows/${{ github.run_id }}/artifacts?api-version=6.0-preview \
+            | jq -r '.value | .[] | select(.name | startswith("coverage-")) | .url'
+          )
+
+          for artifact in $artifacts; do
+            curl -i -X DELETE -H "Accept: application/json;api-version=6.0-preview" -H "Authorization: Bearer $ACTIONS_RUNTIME_TOKEN" "$artifact"
+          done
+
       - name: Upload coverage report as artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/devel_images.yml

@@ -49,10 +49,14 @@ jobs:
         run: |
           echo "DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER,,}" >> $GITHUB_ENV
           echo "COMPOSE_TAG=${GITHUB_REF##*/}" >> $GITHUB_ENV
+          echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
         env:
           OWNER: '${{ github.repository_owner }}'
 
-      - uses: ./.github/actions/setup-python
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.py_version }}
 
       - name: Log in to registry
         run: |
@@ -69,9 +73,25 @@ jobs:
           make ui
         if: matrix.build-targets.image-name == 'awx'
 
-      - uses: ./.github/actions/setup-ssh-agent
+      - name: Generate placeholder SSH private key if SSH auth for private repos is not needed
+        id: generate_key
+        shell: bash
+        run: |
+          if [[ -z "${{ secrets.PRIVATE_GITHUB_KEY }}" ]]; then
+            ssh-keygen -t ed25519 -C "github-actions" -N "" -f ~/.ssh/id_ed25519
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            cat ~/.ssh/id_ed25519 >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            echo "${{ secrets.PRIVATE_GITHUB_KEY }}" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Add private GitHub key to SSH agent
+        uses: webfactory/ssh-agent@v0.9.0
         with:
-          ssh-private-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
+          ssh-private-key: ${{ steps.generate_key.outputs.SSH_PRIVATE_KEY }}
 
       - name: Build and push AWX devel images
         run: |

.github/workflows/docs.yml

@@ -12,7 +12,7 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 

.github/workflows/label_issue.yml

@@ -34,11 +34,9 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
-
+      - uses: actions/setup-python@v4
       - name: Install python requests
         run: pip install requests
-
       - name: Check if user is a member of Ansible org
         uses: jannekem/run-python-script-action@v1
         id: check_user

.github/workflows/label_pr.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 

.github/workflows/promote.yml

@@ -36,7 +36,13 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - name: Get python version from Makefile
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.py_version }}
 
       - name: Install dependencies
         run: |

.github/workflows/stage.yml

@@ -64,9 +64,14 @@ jobs:
           repository: ansible/awx-logos
           path: awx-logos
 
-      - uses: ./awx/.github/actions/setup-python
+      - name: Get python version from Makefile
+        working-directory: awx
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v4
         with:
-          working-directory: awx
+          python-version: ${{ env.py_version }}
 
       - name: Install playbook dependencies
         run: |

.github/workflows/upload_schema.yml

@@ -23,15 +23,37 @@ jobs:
         with:
           show-progress: false
 
-      - uses: ./.github/actions/setup-python
+      - name: Get python version from Makefile
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.py_version }}
 
       - name: Log in to registry
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - uses: ./.github/actions/setup-ssh-agent
+      - name: Generate placeholder SSH private key if SSH auth for private repos is not needed
+        id: generate_key
+        shell: bash
+        run: |
+          if [[ -z "${{ secrets.PRIVATE_GITHUB_KEY }}" ]]; then
+            ssh-keygen -t ed25519 -C "github-actions" -N "" -f ~/.ssh/id_ed25519
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            cat ~/.ssh/id_ed25519 >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            echo "SSH_PRIVATE_KEY<<EOF" >> $GITHUB_OUTPUT
+            echo "${{ secrets.PRIVATE_GITHUB_KEY }}" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Add private GitHub key to SSH agent
+        uses: webfactory/ssh-agent@v0.9.0
         with:
-          ssh-private-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
+          ssh-private-key: ${{ steps.generate_key.outputs.SSH_PRIVATE_KEY }}
 
       - name: Pre-pull image to warm build cache
         run: |

.gitignore

@@ -150,8 +150,6 @@ use_dev_supervisor.txt
 
 awx/ui/src
 awx/ui/build
-awx/ui/.ui-built
-awx/ui_next
 
 # Docs build stuff
 docs/docsite/build/

Makefile

@@ -19,12 +19,6 @@ COLLECTION_VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py | cut -d .
 COLLECTION_SANITY_ARGS ?= --docker
 # collection unit testing directories
 COLLECTION_TEST_DIRS ?= awx_collection/test/awx
-# pytest added args to collect coverage
-COVERAGE_ARGS ?= --cov --cov-report=xml --junitxml=reports/junit.xml
-# pytest test directories
-TEST_DIRS ?= awx/main/tests/unit awx/main/tests/functional awx/conf/tests
-# pytest args to run tests in parallel
-PARALLEL_TESTS ?= -n auto
 # collection integration test directories (defaults to all)
 COLLECTION_TEST_TARGET ?=
 # args for collection install
@@ -315,14 +309,14 @@ black: reports
 	@chmod +x .git/hooks/pre-commit
 
 genschema: reports
-	$(MAKE) swagger PYTEST_ADDOPTS="--genschema --create-db "
+	$(MAKE) swagger PYTEST_ARGS="--genschema --create-db "
 	mv swagger.json schema.json
 
 swagger: reports
 	@if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi; \
-	(set -o pipefail && py.test $(COVERAGE_ARGS) $(PARALLEL_TESTS) awx/conf/tests/functional awx/main/tests/functional/api awx/main/tests/docs | tee reports/$@.report)
+	(set -o pipefail && py.test --cov --cov-report=xml --junitxml=reports/junit.xml $(PYTEST_ARGS) awx/conf/tests/functional awx/main/tests/functional/api awx/main/tests/docs | tee reports/$@.report)
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
 	then \
 	  echo 'cov-report-files=reports/coverage.xml' >> "${GITHUB_OUTPUT}"; \
@@ -340,12 +334,14 @@ api-lint:
 awx-link:
 	[ -d "/awx_devel/awx.egg-info" ] || $(PYTHON) /awx_devel/tools/scripts/egg_info_dev
 
+TEST_DIRS ?= awx/main/tests/unit awx/main/tests/functional awx/conf/tests
+PYTEST_ARGS ?= -n auto
 ## Run all API unit tests.
 test:
 	if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi; \
-	PYTHONDONTWRITEBYTECODE=1 py.test -p no:cacheprovider $(PARALLEL_TESTS) $(TEST_DIRS)
+	PYTHONDONTWRITEBYTECODE=1 py.test -p no:cacheprovider $(PYTEST_ARGS) $(TEST_DIRS)
 	cd awxkit && $(VENV_BASE)/awx/bin/tox -re py3
 	awx-manage check_migrations --dry-run --check  -n 'missing_migration_file'
 
@@ -354,7 +350,7 @@ live_test:
 
 ## Run all API unit tests with coverage enabled.
 test_coverage:
-	$(MAKE) test PYTEST_ADDOPTS="--create-db $(COVERAGE_ARGS)"
+	$(MAKE) test PYTEST_ARGS="--create-db --cov --cov-report=xml --junitxml=reports/junit.xml"
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
 	then \
 	  echo 'cov-report-files=awxkit/coverage.xml,reports/coverage.xml' >> "${GITHUB_OUTPUT}"; \
@@ -362,7 +358,7 @@ test_coverage:
 	fi
 
 test_migrations:
-	PYTHONDONTWRITEBYTECODE=1 py.test -p no:cacheprovider --migrations -m migration_test --create-db $(PARALLEL_TESTS) $(COVERAGE_ARGS) $(TEST_DIRS)
+	PYTHONDONTWRITEBYTECODE=1 py.test -p no:cacheprovider --migrations -m migration_test --create-db --cov=awx --cov-report=xml --junitxml=reports/junit.xml $(PYTEST_ARGS) $(TEST_DIRS)
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
 	then \
 	  echo 'cov-report-files=reports/coverage.xml' >> "${GITHUB_OUTPUT}"; \
@@ -378,9 +374,9 @@ test_collection:
 	if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi && \
-	if ! [ -x "$(shell command -v ansible-playbook)" ]; then pip install "ansible-core<2.19"; fi
+	if ! [ -x "$(shell command -v ansible-playbook)" ]; then pip install ansible-core; fi
 	ansible --version
-	py.test $(COLLECTION_TEST_DIRS) $(COVERAGE_ARGS) -v
+	py.test $(COLLECTION_TEST_DIRS) --cov --cov-report=xml --junitxml=reports/junit.xml -v
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
 	then \
 	  echo 'cov-report-files=reports/coverage.xml' >> "${GITHUB_OUTPUT}"; \
@@ -417,7 +413,7 @@ install_collection: build_collection
 test_collection_sanity:
 	rm -rf awx_collection_build/
 	rm -rf $(COLLECTION_INSTALL)
-	if ! [ -x "$(shell command -v ansible-test)" ]; then pip install "ansible-core<2.19"; fi
+	if ! [ -x "$(shell command -v ansible-test)" ]; then pip install ansible-core; fi
 	ansible --version
 	COLLECTION_VERSION=1.0.0 $(MAKE) install_collection
 	cd $(COLLECTION_INSTALL) && \

README.md

@@ -3,17 +3,6 @@
 
 <img src="https://raw.githubusercontent.com/ansible/awx-logos/master/awx/ui/client/assets/logo-login.svg?sanitize=true" width=200 alt="AWX" />
 
-> [!CAUTION]
-> The last release of this repository was released on Jul 2, 2024.
-> **Releases of this project are now paused during a large scale refactoring.**
-> For more information, follow [the Forum](https://forum.ansible.com/) and - more specifically - see the various communications on the matter:
->
-> * [Blog: Upcoming Changes to the AWX Project](https://www.ansible.com/blog/upcoming-changes-to-the-awx-project/)
-> * [Streamlining AWX Releases](https://forum.ansible.com/t/streamlining-awx-releases/6894) Primary update
-> * [Refactoring AWX into a Pluggable, Service-Oriented Architecture](https://forum.ansible.com/t/refactoring-awx-into-a-pluggable-service-oriented-architecture/7404)
-> * [Upcoming changes to AWX Operator installation methods](https://forum.ansible.com/t/upcoming-changes-to-awx-operator-installation-methods/7598)
-> * [AWX UI and credential types transitioning to the new pluggable architecture](https://forum.ansible.com/t/awx-ui-and-credential-types-transitioning-to-the-new-pluggable-architecture/8027)
-
 AWX provides a web-based user interface, REST API, and task engine built on top of [Ansible](https://github.com/ansible/ansible). It is one of the upstream projects for [Red Hat Ansible Automation Platform](https://www.ansible.com/products/automation-platform).
 
 To install AWX, please view the [Install guide](./INSTALL.md).

awx/api/serializers.py

@@ -6,8 +6,6 @@ import copy
 import json
 import logging
 import re
-import yaml
-import urllib.parse
 from collections import Counter, OrderedDict
 from datetime import timedelta
 from uuid import uuid4
@@ -117,7 +115,6 @@ from awx.main.utils import (
 from awx.main.utils.filters import SmartFilter
 from awx.main.utils.plugins import load_combined_inventory_source_options
 from awx.main.utils.named_url_graph import reset_counters
-from awx.main.utils.inventory_vars import update_group_variables
 from awx.main.scheduler.task_manager_models import TaskManagerModels
 from awx.main.redact import UriCleaner, REPLACE_STR
 from awx.main.signals import update_inventory_computed_fields
@@ -629,41 +626,15 @@ class BaseSerializer(serializers.ModelSerializer, metaclass=BaseSerializerMetacl
         return exclusions
 
     def validate(self, attrs):
-        """
-        Apply serializer validation. Called by DRF.
-
-        Can be extended by subclasses. Or consider overwriting
-        `validate_with_obj` in subclasses, which provides access to the model
-        object and exception handling for field validation.
-
-        :param dict attrs: The names and values of the model form fields.
-        :raise rest_framework.exceptions.ValidationError: If the validation
-            fails.
-
-            The exception must contain a dict with the names of the form fields
-            which failed validation as keys, and a list of error messages as
-            values. This ensures that the error messages are rendered near the
-            relevant fields.
-        :return: The names and values from the model form fields, possibly
-            modified by the validations.
-        :rtype: dict
-        """
         attrs = super(BaseSerializer, self).validate(attrs)
-        # Create/update a model instance and run its full_clean() method to
-        # do any validation implemented on the model class.
-        exclusions = self.get_validation_exclusions(self.instance)
-        # Create a new model instance or take the existing one if it exists,
-        # and update its attributes with the respective field values from
-        # attrs.
-        obj = self.instance or self.Meta.model()
-        for k, v in attrs.items():
-            if k not in exclusions and k != 'canonical_address_port':
-                setattr(obj, k, v)
         try:
-            # Run serializer validators which need the model object for
-            # validation.
-            self.validate_with_obj(attrs, obj)
-            # Apply any validations implemented on the model class.
+            # Create/update a model instance and run its full_clean() method to
+            # do any validation implemented on the model class.
+            exclusions = self.get_validation_exclusions(self.instance)
+            obj = self.instance or self.Meta.model()
+            for k, v in attrs.items():
+                if k not in exclusions and k != 'canonical_address_port':
+                    setattr(obj, k, v)
             obj.full_clean(exclude=exclusions)
             # full_clean may modify values on the instance; copy those changes
             # back to attrs so they are saved.
@@ -692,32 +663,6 @@ class BaseSerializer(serializers.ModelSerializer, metaclass=BaseSerializerMetacl
             raise ValidationError(d)
         return attrs
 
-    def validate_with_obj(self, attrs, obj):
-        """
-        Overwrite this if you need the model instance for your validation.
-
-        :param dict attrs: The names and values of the model form fields.
-        :param obj: An instance of the class's meta model.
-
-            If the serializer runs on a newly created object, obj contains only
-            the attrs from its serializer. If the serializer runs because an
-            object has been edited, obj is the existing model instance with all
-            attributes and values available.
-        :raise django.core.exceptionsValidationError: Raise this if your
-            validation fails.
-
-            To make the error appear at the respective form field, instantiate
-            the Exception with a dict containing the field name as key and the
-            error message as value.
-
-            Example: ``ValidationError({"password": "Not good enough!"})``
-
-            If the exception contains just a string, the message cannot be
-            related to a field and is rendered at the top of the model form.
-        :return: None
-        """
-        return
-
     def reverse(self, *args, **kwargs):
         kwargs['request'] = self.context.get('request')
         return reverse(*args, **kwargs)
@@ -734,29 +679,15 @@ class EmptySerializer(serializers.Serializer):
     pass
 
 
-class OpaQueryPathMixin(serializers.Serializer):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-
-    def validate_opa_query_path(self, value):
-        # Decode the URL and re-encode it
-        decoded_value = urllib.parse.unquote(value)
-        re_encoded_value = urllib.parse.quote(decoded_value, safe='/')
-
-        if value != re_encoded_value:
-            raise serializers.ValidationError(_("The URL must be properly encoded."))
-
-        return value
-
-
-class UnifiedJobTemplateSerializer(BaseSerializer, OpaQueryPathMixin):
+class UnifiedJobTemplateSerializer(BaseSerializer):
     # As a base serializer, the capabilities prefetch is not used directly,
     # instead they are derived from the Workflow Job Template Serializer and the Job Template Serializer, respectively.
+    priority = serializers.IntegerField(required=False, min_value=0, max_value=32000)
     capabilities_prefetch = []
 
     class Meta:
         model = UnifiedJobTemplate
-        fields = ('*', 'last_job_run', 'last_job_failed', 'next_job_run', 'status', 'execution_environment')
+        fields = ('*', 'last_job_run', 'last_job_failed', 'next_job_run', 'status', 'priority', 'execution_environment')
 
     def get_related(self, obj):
         res = super(UnifiedJobTemplateSerializer, self).get_related(obj)
@@ -1054,6 +985,7 @@ class UserSerializer(BaseSerializer):
         return ret
 
     def validate_password(self, value):
+        django_validate_password(value)
         if not self.instance and value in (None, ''):
             raise serializers.ValidationError(_('Password required for new User.'))
 
@@ -1076,50 +1008,6 @@ class UserSerializer(BaseSerializer):
 
         return value
 
-    def validate_with_obj(self, attrs, obj):
-        """
-        Validate the password with the Django password validators
-
-        To enable the Django password validators, configure
-        `settings.AUTH_PASSWORD_VALIDATORS` as described in the [Django
-        docs](https://docs.djangoproject.com/en/5.1/topics/auth/passwords/#enabling-password-validation)
-
-        :param dict attrs: The User form field names and their values as a dict.
-            Example::
-
-                {
-                    'username': 'TestUsername', 'first_name': 'FirstName',
-                    'last_name': 'LastName', 'email': 'First.Last@my.org',
-                    'is_superuser': False, 'is_system_auditor': False,
-                    'password': 'secret123'
-                }
-
-        :param obj: The User model instance.
-        :raises django.core.exceptions.ValidationError: Raise this if at least
-            one Django password validator fails.
-
-            The exception contains a dict ``{"password": <error-message>``}
-            which indicates that the password field has failed validation, and
-            the reason for failure.
-        :return: None.
-        """
-        # We must do this here instead of in `validate_password` bacause some
-        # django password validators need access to other model instance fields,
-        # e.g. ``username`` for the ``UserAttributeSimilarityValidator``.
-        password = attrs.get("password")
-        # Skip validation if no password has been entered. This may happen when
-        # an existing User is edited.
-        if password and password != '$encrypted$':
-            # Apply validators from settings.AUTH_PASSWORD_VALIDATORS. This may
-            # raise ValidationError.
-            #
-            # If the validation fails, re-raise the exception with adjusted
-            # content to make the error appear near the password field.
-            try:
-                django_validate_password(password, user=obj)
-            except DjangoValidationError as exc:
-                raise DjangoValidationError({"password": exc.messages})
-
     def _update_password(self, obj, new_password):
         if new_password and new_password != '$encrypted$':
             obj.set_password(new_password)
@@ -1182,12 +1070,12 @@ class UserActivityStreamSerializer(UserSerializer):
         fields = ('*', '-is_system_auditor')
 
 
-class OrganizationSerializer(BaseSerializer, OpaQueryPathMixin):
+class OrganizationSerializer(BaseSerializer):
     show_capabilities = ['edit', 'delete']
 
     class Meta:
         model = Organization
-        fields = ('*', 'max_hosts', 'custom_virtualenv', 'default_environment', 'opa_query_path')
+        fields = ('*', 'max_hosts', 'custom_virtualenv', 'default_environment')
         read_only_fields = ('*', 'custom_virtualenv')
 
     def get_related(self, obj):
@@ -1541,7 +1429,7 @@ class LabelsListMixin(object):
         return res
 
 
-class InventorySerializer(LabelsListMixin, BaseSerializerWithVariables, OpaQueryPathMixin):
+class InventorySerializer(LabelsListMixin, BaseSerializerWithVariables):
     show_capabilities = ['edit', 'delete', 'adhoc', 'copy']
     capabilities_prefetch = ['admin', 'adhoc', {'copy': 'organization.inventory_admin'}]
 
@@ -1562,7 +1450,6 @@ class InventorySerializer(LabelsListMixin, BaseSerializerWithVariables, OpaQuery
             'inventory_sources_with_failures',
             'pending_deletion',
             'prevent_instance_group_fallback',
-            'opa_query_path',
         )
 
     def get_related(self, obj):
@@ -1632,68 +1519,8 @@ class InventorySerializer(LabelsListMixin, BaseSerializerWithVariables, OpaQuery
 
         if kind == 'smart' and not host_filter:
             raise serializers.ValidationError({'host_filter': _('Smart inventories must specify host_filter')})
-
         return super(InventorySerializer, self).validate(attrs)
 
-    @staticmethod
-    def _update_variables(variables, inventory_id):
-        """
-        Update the inventory variables of the 'all'-group.
-
-        The variables field contains vars from the inventory dialog, hence
-        representing the "all"-group variables.
-
-        Since this is not an update from an inventory source, we update the
-        variables when the inventory details form is saved.
-
-        A user edit on the inventory variables is considered a reset of the
-        variables update history. Particularly if the user removes a variable by
-        editing the inventory variables field, the variable is not supposed to
-        reappear with a value from a previous inventory source update.
-
-        We achieve this by forcing `reset=True` on such an update.
-
-        As a side-effect, variables which have been set by source updates and
-        have survived a user-edit (i.e. they have not been deleted from the
-        variables field) will be assumed to originate from the user edit and are
-        thus no longer deleted from the inventory when they are removed from
-        their original source!
-
-        Note that we use the inventory source id -1 for user-edit updates
-        because a regular inventory source cannot have an id of -1 since
-        PostgreSQL assigns pk's starting from 1 (if this assumption doesn't hold
-        true, we have to assign another special value for invsrc_id).
-
-        :param str variables: The variables as plain text in yaml or json
-            format.
-        :param int inventory_id: The primary key of the related inventory
-            object.
-        """
-        variables_dict = parse_yaml_or_json(variables, silent_failure=False)
-        logger.debug(f"InventorySerializer._update_variables: {inventory_id=} {variables_dict=}, {variables=}")
-        update_group_variables(
-            group_id=None,  # `None` denotes the 'all' group (which doesn't have a pk).
-            newvars=variables_dict,
-            dbvars=None,
-            invsrc_id=-1,
-            inventory_id=inventory_id,
-            reset=True,
-        )
-
-    def create(self, validated_data):
-        """Called when a new inventory has to be created."""
-        logger.debug(f"InventorySerializer.create({validated_data=}) >>>>")
-        obj = super().create(validated_data)
-        self._update_variables(validated_data.get("variables") or "", obj.id)
-        return obj
-
-    def update(self, obj, validated_data):
-        """Called when an existing inventory is updated."""
-        logger.debug(f"InventorySerializer.update({validated_data=}) >>>>")
-        obj = super().update(obj, validated_data)
-        self._update_variables(validated_data.get("variables") or "", obj.id)
-        return obj
-
 
 class ConstructedFieldMixin(serializers.Field):
     def get_attribute(self, instance):
@@ -1983,12 +1810,10 @@ class GroupSerializer(BaseSerializerWithVariables):
         return res
 
     def validate(self, attrs):
-        # Do not allow the group name to conflict with an existing host name.
         name = force_str(attrs.get('name', self.instance and self.instance.name or ''))
         inventory = attrs.get('inventory', self.instance and self.instance.inventory or '')
         if Host.objects.filter(name=name, inventory=inventory).exists():
             raise serializers.ValidationError(_('A Host with that name already exists.'))
-        #
         return super(GroupSerializer, self).validate(attrs)
 
     def validate_name(self, value):
@@ -3172,6 +2997,7 @@ class JobOptionsSerializer(LabelsListMixin, BaseSerializer):
             'scm_branch',
             'forks',
             'limit',
+            'priority',
             'verbosity',
             'extra_vars',
             'job_tags',
@@ -3294,6 +3120,7 @@ class JobTemplateMixin(object):
 class JobTemplateSerializer(JobTemplateMixin, UnifiedJobTemplateSerializer, JobOptionsSerializer):
     show_capabilities = ['start', 'schedule', 'copy', 'edit', 'delete']
     capabilities_prefetch = ['admin', 'execute', {'copy': ['project.use', 'inventory.use']}]
+    priority = serializers.IntegerField(required=False, min_value=0, max_value=32000)
 
     status = serializers.ChoiceField(choices=JobTemplate.JOB_TEMPLATE_STATUS_CHOICES, read_only=True, required=False)
 
@@ -3301,6 +3128,7 @@ class JobTemplateSerializer(JobTemplateMixin, UnifiedJobTemplateSerializer, JobO
         model = JobTemplate
         fields = (
             '*',
+            'priority',
             'host_config_key',
             'ask_scm_branch_on_launch',
             'ask_diff_mode_on_launch',
@@ -3327,7 +3155,6 @@ class JobTemplateSerializer(JobTemplateMixin, UnifiedJobTemplateSerializer, JobO
             'webhook_service',
             'webhook_credential',
             'prevent_instance_group_fallback',
-            'opa_query_path',
         )
         read_only_fields = ('*', 'custom_virtualenv')
 
@@ -3429,6 +3256,7 @@ class JobSerializer(UnifiedJobSerializer, JobOptionsSerializer):
             'diff_mode',
             'job_slice_number',
             'job_slice_count',
+            'priority',
             'webhook_service',
             'webhook_credential',
             'webhook_guid',
@@ -3879,6 +3707,7 @@ class WorkflowJobTemplateWithSpecSerializer(WorkflowJobTemplateSerializer):
 
 class WorkflowJobSerializer(LabelsListMixin, UnifiedJobSerializer):
     limit = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
+    priority = serializers.IntegerField(required=False, min_value=0, max_value=32000)
     scm_branch = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
 
     skip_tags = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
@@ -3899,6 +3728,7 @@ class WorkflowJobSerializer(LabelsListMixin, UnifiedJobSerializer):
             '-controller_node',
             'inventory',
             'limit',
+            'priority',
             'scm_branch',
             'webhook_service',
             'webhook_credential',
@@ -4016,6 +3846,7 @@ class LaunchConfigurationBaseSerializer(BaseSerializer):
     job_type = serializers.ChoiceField(allow_blank=True, allow_null=True, required=False, default=None, choices=NEW_JOB_TYPE_CHOICES)
     job_tags = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
     limit = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
+    priority = serializers.IntegerField(required=False, min_value=0, max_value=32000)
     skip_tags = serializers.CharField(allow_blank=True, allow_null=True, required=False, default=None)
     diff_mode = serializers.BooleanField(required=False, allow_null=True, default=None)
     verbosity = serializers.ChoiceField(allow_null=True, required=False, default=None, choices=VERBOSITY_CHOICES)
@@ -4034,6 +3865,7 @@ class LaunchConfigurationBaseSerializer(BaseSerializer):
             'job_tags',
             'skip_tags',
             'limit',
+            'priority',
             'skip_tags',
             'diff_mode',
             'verbosity',
@@ -4527,6 +4359,7 @@ class JobLaunchSerializer(BaseSerializer):
     job_type = serializers.ChoiceField(required=False, choices=NEW_JOB_TYPE_CHOICES, write_only=True)
     skip_tags = serializers.CharField(required=False, write_only=True, allow_blank=True)
     limit = serializers.CharField(required=False, write_only=True, allow_blank=True)
+    priority = serializers.IntegerField(required=False, write_only=False, min_value=0, max_value=32000)
     verbosity = serializers.ChoiceField(required=False, choices=VERBOSITY_CHOICES, write_only=True)
     execution_environment = serializers.PrimaryKeyRelatedField(queryset=ExecutionEnvironment.objects.all(), required=False, write_only=True)
     labels = serializers.PrimaryKeyRelatedField(many=True, queryset=Label.objects.all(), required=False, write_only=True)
@@ -4544,6 +4377,7 @@ class JobLaunchSerializer(BaseSerializer):
             'inventory',
             'scm_branch',
             'limit',
+            'priority',
             'job_tags',
             'skip_tags',
             'job_type',
@@ -4729,6 +4563,7 @@ class WorkflowJobLaunchSerializer(BaseSerializer):
     extra_vars = VerbatimField(required=False, write_only=True)
     inventory = serializers.PrimaryKeyRelatedField(queryset=Inventory.objects.all(), required=False, write_only=True)
     limit = serializers.CharField(required=False, write_only=True, allow_blank=True)
+    priority = serializers.IntegerField(required=False, write_only=False, min_value=0, max_value=32000)
     scm_branch = serializers.CharField(required=False, write_only=True, allow_blank=True)
     workflow_job_template_data = serializers.SerializerMethodField()
 
@@ -4868,13 +4703,14 @@ class BulkJobLaunchSerializer(serializers.Serializer):
     )
     inventory = serializers.PrimaryKeyRelatedField(queryset=Inventory.objects.all(), required=False, write_only=True)
     limit = serializers.CharField(write_only=True, required=False, allow_blank=False)
+    # priority = serializers.IntegerField(write_only=True, required=False, min_value=0, max_value=32000)
     scm_branch = serializers.CharField(write_only=True, required=False, allow_blank=False)
     skip_tags = serializers.CharField(write_only=True, required=False, allow_blank=False)
     job_tags = serializers.CharField(write_only=True, required=False, allow_blank=False)
 
     class Meta:
         model = WorkflowJob
-        fields = ('name', 'jobs', 'description', 'extra_vars', 'organization', 'inventory', 'limit', 'scm_branch', 'skip_tags', 'job_tags')
+        fields = ('name', 'jobs', 'description', 'extra_vars', 'organization', 'inventory', 'limit', 'priority', 'scm_branch', 'skip_tags', 'job_tags')
         read_only_fields = ()
 
     def validate(self, attrs):
@@ -5998,34 +5834,6 @@ class InstanceGroupSerializer(BaseSerializer):
             raise serializers.ValidationError(_('Only Kubernetes credentials can be associated with an Instance Group'))
         return value
 
-    def validate_pod_spec_override(self, value):
-        if not value:
-            return value
-
-        # value should be empty for non-container groups
-        if self.instance and not self.instance.is_container_group:
-            raise serializers.ValidationError(_('pod_spec_override is only valid for container groups'))
-
-        pod_spec_override_json = None
-        # defect if the value is yaml or json if yaml convert to json
-        try:
-            # convert yaml to json
-            pod_spec_override_json = yaml.safe_load(value)
-        except yaml.YAMLError:
-            try:
-                pod_spec_override_json = json.loads(value)
-            except json.JSONDecodeError:
-                raise serializers.ValidationError(_('pod_spec_override must be valid yaml or json'))
-
-        # validate the
-        spec = pod_spec_override_json.get('spec', {})
-        automount_service_account_token = spec.get('automountServiceAccountToken', False)
-
-        if automount_service_account_token:
-            raise serializers.ValidationError(_('automountServiceAccountToken is not allowed for security reasons'))
-
-        return value
-
     def validate(self, attrs):
         attrs = super(InstanceGroupSerializer, self).validate(attrs)
 

awx/api/views/__init__.py

@@ -56,7 +56,7 @@ from wsgiref.util import FileWrapper
 # django-ansible-base
 from ansible_base.lib.utils.requests import get_remote_hosts
 from ansible_base.rbac.models import RoleEvaluation, ObjectRole
-from ansible_base.rbac import permission_registry
+from ansible_base.resource_registry.shared_types import OrganizationType, TeamType, UserType
 
 # AWX
 from awx.main.tasks.system import send_notifications, update_inventory_computed_fields
@@ -671,16 +671,81 @@ class ScheduleUnifiedJobsList(SubListAPIView):
     name = _('Schedule Jobs List')
 
 
+def immutablesharedfields(cls):
+    '''
+    Class decorator to prevent modifying shared resources when ALLOW_LOCAL_RESOURCE_MANAGEMENT setting is set to False.
+
+    Works by overriding these view methods:
+    - create
+    - delete
+    - perform_update
+    create and delete are overridden to raise a PermissionDenied exception.
+    perform_update is overridden to check if any shared fields are being modified,
+    and raise a PermissionDenied exception if so.
+    '''
+    # create instead of perform_create because some of our views
+    # override create instead of perform_create
+    if hasattr(cls, 'create'):
+        cls.original_create = cls.create
+
+        @functools.wraps(cls.create)
+        def create_wrapper(*args, **kwargs):
+            if settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT:
+                return cls.original_create(*args, **kwargs)
+            raise PermissionDenied({'detail': _('Creation of this resource is not allowed. Create this resource via the platform ingress.')})
+
+        cls.create = create_wrapper
+
+    if hasattr(cls, 'delete'):
+        cls.original_delete = cls.delete
+
+        @functools.wraps(cls.delete)
+        def delete_wrapper(*args, **kwargs):
+            if settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT:
+                return cls.original_delete(*args, **kwargs)
+            raise PermissionDenied({'detail': _('Deletion of this resource is not allowed. Delete this resource via the platform ingress.')})
+
+        cls.delete = delete_wrapper
+
+    if hasattr(cls, 'perform_update'):
+        cls.original_perform_update = cls.perform_update
+
+        @functools.wraps(cls.perform_update)
+        def update_wrapper(*args, **kwargs):
+            if not settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT:
+                view, serializer = args
+                instance = view.get_object()
+                if instance:
+                    if isinstance(instance, models.Organization):
+                        shared_fields = OrganizationType._declared_fields.keys()
+                    elif isinstance(instance, models.User):
+                        shared_fields = UserType._declared_fields.keys()
+                    elif isinstance(instance, models.Team):
+                        shared_fields = TeamType._declared_fields.keys()
+                    attrs = serializer.validated_data
+                    for field in shared_fields:
+                        if field in attrs and getattr(instance, field) != attrs[field]:
+                            raise PermissionDenied({field: _(f"Cannot change shared field '{field}'. Alter this field via the platform ingress.")})
+            return cls.original_perform_update(*args, **kwargs)
+
+        cls.perform_update = update_wrapper
+
+    return cls
+
+
+@immutablesharedfields
 class TeamList(ListCreateAPIView):
     model = models.Team
     serializer_class = serializers.TeamSerializer
 
 
+@immutablesharedfields
 class TeamDetail(RetrieveUpdateDestroyAPIView):
     model = models.Team
     serializer_class = serializers.TeamSerializer
 
 
+@immutablesharedfields
 class TeamUsersList(BaseUsersList):
     model = models.User
     serializer_class = serializers.UserSerializer
@@ -751,8 +816,8 @@ class TeamProjectsList(SubListAPIView):
     def get_queryset(self):
         team = self.get_parent_object()
         self.check_parent_access(team)
-        model_ct = permission_registry.content_type_model.objects.get_for_model(self.model)
-        parent_ct = permission_registry.content_type_model.objects.get_for_model(self.parent_model)
+        model_ct = ContentType.objects.get_for_model(self.model)
+        parent_ct = ContentType.objects.get_for_model(self.parent_model)
 
         rd = get_role_definition(team.member_role)
         role = ObjectRole.objects.filter(object_id=team.id, content_type=parent_ct, role_definition=rd).first()
@@ -1062,6 +1127,7 @@ class ProjectCopy(CopyAPIView):
     copy_return_serializer_class = serializers.ProjectSerializer
 
 
+@immutablesharedfields
 class UserList(ListCreateAPIView):
     model = models.User
     serializer_class = serializers.UserSerializer
@@ -1118,6 +1184,14 @@ class UserRolesList(SubListAttachDetachAPIView):
         role = get_object_or_400(models.Role, pk=sub_id)
 
         content_types = ContentType.objects.get_for_models(models.Organization, models.Team, models.Credential)  # dict of {model: content_type}
+        # Prevent user to be associated with team/org when ALLOW_LOCAL_RESOURCE_MANAGEMENT is False
+        if not settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT:
+            for model in [models.Organization, models.Team]:
+                ct = content_types[model]
+                if role.content_type == ct and role.role_field in ['member_role', 'admin_role']:
+                    data = dict(msg=_(f"Cannot directly modify user membership to {ct.model}. Direct shared resource management disabled"))
+                    return Response(data, status=status.HTTP_403_FORBIDDEN)
+
         credential_content_type = content_types[models.Credential]
         if role.content_type == credential_content_type:
             if 'disassociate' not in request.data and role.content_object.organization and user not in role.content_object.organization.member_role:
@@ -1190,6 +1264,7 @@ class UserActivityStreamList(SubListAPIView):
         return qs.filter(Q(actor=parent) | Q(user__in=[parent]))
 
 
+@immutablesharedfields
 class UserDetail(RetrieveUpdateDestroyAPIView):
     model = models.User
     serializer_class = serializers.UserSerializer
@@ -4164,6 +4239,13 @@ class RoleUsersList(SubListAttachDetachAPIView):
         role = self.get_parent_object()
 
         content_types = ContentType.objects.get_for_models(models.Organization, models.Team, models.Credential)  # dict of {model: content_type}
+        if not settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT:
+            for model in [models.Organization, models.Team]:
+                ct = content_types[model]
+                if role.content_type == ct and role.role_field in ['member_role', 'admin_role']:
+                    data = dict(msg=_(f"Cannot directly modify user membership to {ct.model}. Direct shared resource management disabled"))
+                    return Response(data, status=status.HTTP_403_FORBIDDEN)
+
         credential_content_type = content_types[models.Credential]
         if role.content_type == credential_content_type:
             if 'disassociate' not in request.data and role.content_object.organization and user not in role.content_object.organization.member_role:

awx/api/views/analytics.py

@@ -10,7 +10,7 @@ from awx.api.generics import APIView, Response
 from awx.api.permissions import AnalyticsPermission
 from awx.api.versioning import reverse
 from awx.main.utils import get_awx_version
-from awx.main.utils.analytics_proxy import OIDCClient
+from awx.main.utils.analytics_proxy import OIDCClient, DEFAULT_OIDC_TOKEN_ENDPOINT
 from rest_framework import status
 
 from collections import OrderedDict
@@ -202,16 +202,10 @@ class AnalyticsGenericView(APIView):
             if method not in ["GET", "POST", "OPTIONS"]:
                 return self._error_response(ERROR_UNSUPPORTED_METHOD, method, remote=False, status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
             url = self._get_analytics_url(request.path)
-            using_subscriptions_credentials = False
             try:
-                rh_user = getattr(settings, 'REDHAT_USERNAME', None)
-                rh_password = getattr(settings, 'REDHAT_PASSWORD', None)
-                if not (rh_user and rh_password):
-                    rh_user = self._get_setting('SUBSCRIPTIONS_CLIENT_ID', None, ERROR_MISSING_USER)
-                    rh_password = self._get_setting('SUBSCRIPTIONS_CLIENT_SECRET', None, ERROR_MISSING_PASSWORD)
-                    using_subscriptions_credentials = True
-
-                client = OIDCClient(rh_user, rh_password)
+                rh_user = self._get_setting('REDHAT_USERNAME', None, ERROR_MISSING_USER)
+                rh_password = self._get_setting('REDHAT_PASSWORD', None, ERROR_MISSING_PASSWORD)
+                client = OIDCClient(rh_user, rh_password, DEFAULT_OIDC_TOKEN_ENDPOINT, ['api.console'])
                 response = client.make_request(
                     method,
                     url,
@@ -222,17 +216,17 @@ class AnalyticsGenericView(APIView):
                     timeout=(31, 31),
                 )
             except requests.RequestException:
-                # subscriptions credentials are not valid for basic auth, so just return 401
-                if using_subscriptions_credentials:
-                    response = Response(status=status.HTTP_401_UNAUTHORIZED)
-                else:
-                    logger.error("Automation Analytics API request failed, trying base auth method")
-                    response = self._base_auth_request(request, method, url, rh_user, rh_password, headers)
+                logger.error("Automation Analytics API request failed, trying base auth method")
+                response = self._base_auth_request(request, method, url, rh_user, rh_password, headers)
+            except MissingSettings:
+                rh_user = self._get_setting('SUBSCRIPTIONS_USERNAME', None, ERROR_MISSING_USER)
+                rh_password = self._get_setting('SUBSCRIPTIONS_PASSWORD', None, ERROR_MISSING_PASSWORD)
+                response = self._base_auth_request(request, method, url, rh_user, rh_password, headers)
             #
             # Missing or wrong user/pass
             #
             if response.status_code == status.HTTP_401_UNAUTHORIZED:
-                text = response.get('text', '').rstrip("\n")
+                text = (response.text or '').rstrip("\n")
                 return self._error_response(ERROR_UNAUTHORIZED, text, remote=True, remote_status_code=response.status_code)
             #
             # Not found, No entitlement or No data in Analytics

awx/api/views/organization.py

@@ -53,15 +53,18 @@ from awx.api.serializers import (
     CredentialSerializer,
 )
 from awx.api.views.mixin import RelatedJobsPreventDeleteMixin, OrganizationCountsMixin, OrganizationInstanceGroupMembershipMixin
+from awx.api.views import immutablesharedfields
 
 logger = logging.getLogger('awx.api.views.organization')
 
 
+@immutablesharedfields
 class OrganizationList(OrganizationCountsMixin, ListCreateAPIView):
     model = Organization
     serializer_class = OrganizationSerializer
 
 
+@immutablesharedfields
 class OrganizationDetail(RelatedJobsPreventDeleteMixin, RetrieveUpdateDestroyAPIView):
     model = Organization
     serializer_class = OrganizationSerializer
@@ -104,6 +107,7 @@ class OrganizationInventoriesList(SubListAPIView):
     relationship = 'inventories'
 
 
+@immutablesharedfields
 class OrganizationUsersList(BaseUsersList):
     model = User
     serializer_class = UserSerializer
@@ -112,6 +116,7 @@ class OrganizationUsersList(BaseUsersList):
     ordering = ('username',)
 
 
+@immutablesharedfields
 class OrganizationAdminsList(BaseUsersList):
     model = User
     serializer_class = UserSerializer
@@ -150,6 +155,7 @@ class OrganizationWorkflowJobTemplatesList(SubListCreateAPIView):
     parent_key = 'organization'
 
 
+@immutablesharedfields
 class OrganizationTeamsList(SubListCreateAttachDetachAPIView):
     model = Team
     serializer_class = TeamSerializer

awx/api/views/root.py

@@ -32,7 +32,6 @@ from awx.api.versioning import URLPathVersioning, reverse, drf_reverse
 from awx.main.constants import PRIVILEGE_ESCALATION_METHODS
 from awx.main.models import Project, Organization, Instance, InstanceGroup, JobTemplate
 from awx.main.utils import set_environ
-from awx.main.utils.analytics_proxy import TokenError
 from awx.main.utils.licensing import get_licenser
 
 logger = logging.getLogger('awx.api.views.root')
@@ -177,21 +176,19 @@ class ApiV2SubscriptionView(APIView):
 
     def post(self, request):
         data = request.data.copy()
-        if data.get('subscriptions_client_secret') == '$encrypted$':
-            data['subscriptions_client_secret'] = settings.SUBSCRIPTIONS_CLIENT_SECRET
+        if data.get('subscriptions_password') == '$encrypted$':
+            data['subscriptions_password'] = settings.SUBSCRIPTIONS_PASSWORD
         try:
-            user, pw = data.get('subscriptions_client_id'), data.get('subscriptions_client_secret')
+            user, pw = data.get('subscriptions_username'), data.get('subscriptions_password')
             with set_environ(**settings.AWX_TASK_ENV):
                 validated = get_licenser().validate_rh(user, pw)
             if user:
-                settings.SUBSCRIPTIONS_CLIENT_ID = data['subscriptions_client_id']
+                settings.SUBSCRIPTIONS_USERNAME = data['subscriptions_username']
             if pw:
-                settings.SUBSCRIPTIONS_CLIENT_SECRET = data['subscriptions_client_secret']
+                settings.SUBSCRIPTIONS_PASSWORD = data['subscriptions_password']
         except Exception as exc:
             msg = _("Invalid Subscription")
-            if isinstance(exc, TokenError) or (
-                isinstance(exc, requests.exceptions.HTTPError) and getattr(getattr(exc, 'response', None), 'status_code', None) == 401
-            ):
+            if isinstance(exc, requests.exceptions.HTTPError) and getattr(getattr(exc, 'response', None), 'status_code', None) == 401:
                 msg = _("The provided credentials are invalid (HTTP 401).")
             elif isinstance(exc, requests.exceptions.ProxyError):
                 msg = _("Unable to connect to proxy server.")
@@ -218,12 +215,12 @@ class ApiV2AttachView(APIView):
 
     def post(self, request):
         data = request.data.copy()
-        subscription_id = data.get('subscription_id', None)
-        if not subscription_id:
-            return Response({"error": _("No subscription ID provided.")}, status=status.HTTP_400_BAD_REQUEST)
-        user = getattr(settings, 'SUBSCRIPTIONS_CLIENT_ID', None)
-        pw = getattr(settings, 'SUBSCRIPTIONS_CLIENT_SECRET', None)
-        if subscription_id and user and pw:
+        pool_id = data.get('pool_id', None)
+        if not pool_id:
+            return Response({"error": _("No subscription pool ID provided.")}, status=status.HTTP_400_BAD_REQUEST)
+        user = getattr(settings, 'SUBSCRIPTIONS_USERNAME', None)
+        pw = getattr(settings, 'SUBSCRIPTIONS_PASSWORD', None)
+        if pool_id and user and pw:
             data = request.data.copy()
             try:
                 with set_environ(**settings.AWX_TASK_ENV):
@@ -242,7 +239,7 @@ class ApiV2AttachView(APIView):
                     logger.exception(smart_str(u"Invalid subscription submitted."), extra=dict(actor=request.user.username))
                 return Response({"error": msg}, status=status.HTTP_400_BAD_REQUEST)
         for sub in validated:
-            if sub['subscription_id'] == subscription_id:
+            if sub['pool_id'] == pool_id:
                 sub['valid_key'] = True
                 settings.LICENSE = sub
                 return Response(sub)

awx/conf/fields.py

@@ -10,7 +10,7 @@ from django.core.validators import URLValidator, _lazy_re_compile
 from django.utils.translation import gettext_lazy as _
 
 # Django REST Framework
-from rest_framework.fields import BooleanField, CharField, ChoiceField, DictField, DateTimeField, EmailField, IntegerField, ListField, FloatField  # noqa
+from rest_framework.fields import BooleanField, CharField, ChoiceField, DictField, DateTimeField, EmailField, IntegerField, ListField  # noqa
 from rest_framework.serializers import PrimaryKeyRelatedField  # noqa
 
 # AWX
@@ -207,8 +207,7 @@ class URLField(CharField):
         if self.allow_plain_hostname:
             try:
                 url_parts = urlparse.urlsplit(value)
-                looks_like_ipv6 = bool(url_parts.netloc and url_parts.netloc.startswith('[') and url_parts.netloc.endswith(']'))
-                if not looks_like_ipv6 and url_parts.hostname and '.' not in url_parts.hostname:
+                if url_parts.hostname and '.' not in url_parts.hostname:
                     netloc = '{}.local'.format(url_parts.hostname)
                     if url_parts.port:
                         netloc = '{}:{}'.format(netloc, url_parts.port)

awx/conf/migrations/_subscriptions.py

@@ -27,5 +27,5 @@ def _migrate_setting(apps, old_key, new_key, encrypted=False):
 
 
 def prefill_rh_credentials(apps, schema_editor):
-    _migrate_setting(apps, 'REDHAT_USERNAME', 'SUBSCRIPTIONS_CLIENT_ID', encrypted=False)
-    _migrate_setting(apps, 'REDHAT_PASSWORD', 'SUBSCRIPTIONS_CLIENT_SECRET', encrypted=True)
+    _migrate_setting(apps, 'REDHAT_USERNAME', 'SUBSCRIPTIONS_USERNAME', encrypted=False)
+    _migrate_setting(apps, 'REDHAT_PASSWORD', 'SUBSCRIPTIONS_PASSWORD', encrypted=True)

awx/conf/registry.py

@@ -38,7 +38,6 @@ class SettingsRegistry(object):
         if setting in self._registry:
             raise ImproperlyConfigured('Setting "{}" is already registered.'.format(setting))
         category = kwargs.setdefault('category', None)
-        kwargs.setdefault('required', False)  # No setting is ordinarily required
         category_slug = kwargs.setdefault('category_slug', slugify(category or '') or None)
         if category_slug in {'all', 'changed', 'user-defaults'}:
             raise ImproperlyConfigured('"{}" is a reserved category slug.'.format(category_slug))

awx/conf/tests/unit/test_fields.py

@@ -128,41 +128,3 @@ class TestURLField:
         else:
             with pytest.raises(ValidationError):
                 field.run_validators(url)
-
-    @pytest.mark.parametrize(
-        "url, expect_error",
-        [
-            ("https://[1:2:3]", True),
-            ("http://[1:2:3]", True),
-            ("https://[2001:db8:3333:4444:5555:6666:7777:8888", True),
-            ("https://2001:db8:3333:4444:5555:6666:7777:8888", True),
-            ("https://[2001:db8:3333:4444:5555:6666:7777:8888]", False),
-            ("https://[::1]", False),
-            ("https://[::]", False),
-            ("https://[2001:db8::1]", False),
-            ("https://[2001:db8:0:0:0:0:1:1]", False),
-            ("https://[fe80::2%eth0]", True),  # ipv6 scope identifier
-            ("https://[fe80:0:0:0:200:f8ff:fe21:67cf]", False),
-            ("https://[::ffff:192.168.1.10]", False),
-            ("https://[0:0:0:0:0:ffff:c000:0201]", False),
-            ("https://[2001:0db8:000a:0001:0000:0000:0000:0000]", False),
-            ("https://[2001:db8:a:1::]", False),
-            ("https://[ff02::1]", False),
-            ("https://[ff02:0:0:0:0:0:0:1]", False),
-            ("https://[fc00::1]", False),
-            ("https://[fd12:3456:789a:1::1]", False),
-            ("https://[2001:db8::abcd:ef12:3456:7890]", False),
-            ("https://[2001:db8:0000:abcd:0000:ef12:0000:3456]", False),
-            ("https://[::ffff:10.0.0.1]", False),
-            ("https://[2001:db8:cafe::]", False),
-            ("https://[2001:db8:cafe:0:0:0:0:0]", False),
-            ("https://[fe80::210:f3ff:fedf:4567%3]", True),  # ipv6 scope identifier, numerical interface
-        ],
-    )
-    def test_ipv6_urls(self, url, expect_error):
-        field = URLField()
-        if expect_error:
-            with pytest.raises(ValidationError, match="Enter a valid URL"):
-                field.run_validators(url)
-        else:
-            field.run_validators(url)

awx/main/access.py

@@ -2098,7 +2098,7 @@ class WorkflowJobAccess(BaseAccess):
     def filtered_queryset(self):
         return WorkflowJob.objects.filter(
             Q(unified_job_template__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
-            | Q(organization__in=Organization.accessible_pk_qs(self.user, 'auditor_role'))
+            | Q(organization__in=Organization.objects.filter(Q(admin_role__members=self.user)), is_bulk_job=True)
         )
 
     def can_read(self, obj):
@@ -2496,11 +2496,12 @@ class UnifiedJobAccess(BaseAccess):
 
     def filtered_queryset(self):
         inv_pk_qs = Inventory._accessible_pk_qs(Inventory, self.user, 'read_role')
+        org_auditor_qs = Organization.objects.filter(Q(admin_role__members=self.user) | Q(auditor_role__members=self.user))
         qs = self.model.objects.filter(
             Q(unified_job_template_id__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
             | Q(inventoryupdate__inventory_source__inventory__id__in=inv_pk_qs)
             | Q(adhoccommand__inventory__id__in=inv_pk_qs)
-            | Q(organization__in=Organization.accessible_pk_qs(self.user, 'auditor_role'))
+            | Q(organization__in=org_auditor_qs)
         )
         return qs
 

awx/main/analytics/analytics_tasks.py

@@ -3,13 +3,13 @@ import logging
 
 # AWX
 from awx.main.analytics.subsystem_metrics import DispatcherMetrics, CallbackReceiverMetrics
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 from awx.main.dispatch import get_task_queuename
 
 logger = logging.getLogger('awx.main.scheduler')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def send_subsystem_metrics():
     DispatcherMetrics().send_metrics()
     CallbackReceiverMetrics().send_metrics()

awx/main/analytics/collectors.py

@@ -142,7 +142,7 @@ def config(since, **kwargs):
     return {
         'platform': {
             'system': platform.system(),
-            'dist': (distro.name(), distro.version(), distro.codename()),
+            'dist': distro.linux_distribution(),
             'release': platform.release(),
             'type': install_type,
         },

awx/main/analytics/core.py

@@ -22,7 +22,7 @@ from ansible_base.lib.utils.db import advisory_lock
 from awx.main.models import Job
 from awx.main.access import access_registry
 from awx.main.utils import get_awx_http_client_headers, set_environ, datetime_hook
-from awx.main.utils.analytics_proxy import OIDCClient
+from awx.main.utils.analytics_proxy import OIDCClient, DEFAULT_OIDC_TOKEN_ENDPOINT
 
 __all__ = ['register', 'gather', 'ship']
 
@@ -186,7 +186,7 @@ def gather(dest=None, module=None, subset=None, since=None, until=None, collecti
 
         if not (
             settings.AUTOMATION_ANALYTICS_URL
-            and ((settings.REDHAT_USERNAME and settings.REDHAT_PASSWORD) or (settings.SUBSCRIPTIONS_CLIENT_ID and settings.SUBSCRIPTIONS_CLIENT_SECRET))
+            and ((settings.REDHAT_USERNAME and settings.REDHAT_PASSWORD) or (settings.SUBSCRIPTIONS_USERNAME and settings.SUBSCRIPTIONS_PASSWORD))
         ):
             logger.log(log_level, "Not gathering analytics, configuration is invalid. Use --dry-run to gather locally without sending.")
             return None
@@ -324,10 +324,10 @@ def gather(dest=None, module=None, subset=None, since=None, until=None, collecti
                     settings.AUTOMATION_ANALYTICS_LAST_ENTRIES = json.dumps(last_entries, cls=DjangoJSONEncoder)
 
         if collection_type != 'dry-run':
-            for fpath in tarfiles:
-                if os.path.exists(fpath):
-                    os.remove(fpath)
-
+            if succeeded:
+                for fpath in tarfiles:
+                    if os.path.exists(fpath):
+                        os.remove(fpath)
             with disable_activity_stream():
                 if not settings.AUTOMATION_ANALYTICS_LAST_GATHER or until > settings.AUTOMATION_ANALYTICS_LAST_GATHER:
                     # `AUTOMATION_ANALYTICS_LAST_GATHER` is set whether collection succeeds or fails;
@@ -368,20 +368,8 @@ def ship(path):
         logger.error('AUTOMATION_ANALYTICS_URL is not set')
         return False
 
-    rh_id = getattr(settings, 'REDHAT_USERNAME', None)
-    rh_secret = getattr(settings, 'REDHAT_PASSWORD', None)
-
-    if not (rh_id and rh_secret):
-        rh_id = getattr(settings, 'SUBSCRIPTIONS_CLIENT_ID', None)
-        rh_secret = getattr(settings, 'SUBSCRIPTIONS_CLIENT_SECRET', None)
-
-    if not rh_id:
-        logger.error('Neither REDHAT_USERNAME nor SUBSCRIPTIONS_CLIENT_ID are set')
-        return False
-
-    if not rh_secret:
-        logger.error('Neither REDHAT_PASSWORD nor SUBSCRIPTIONS_CLIENT_SECRET are set')
-        return False
+    rh_user = getattr(settings, 'REDHAT_USERNAME', None)
+    rh_password = getattr(settings, 'REDHAT_PASSWORD', None)
 
     with open(path, 'rb') as f:
         files = {'file': (os.path.basename(path), f, settings.INSIGHTS_AGENT_MIME)}
@@ -389,13 +377,25 @@ def ship(path):
         s.headers = get_awx_http_client_headers()
         s.headers.pop('Content-Type')
         with set_environ(**settings.AWX_TASK_ENV):
-            try:
-                client = OIDCClient(rh_id, rh_secret)
-                response = client.make_request("POST", url, headers=s.headers, files=files, verify=settings.INSIGHTS_CERT_PATH, timeout=(31, 31))
-            except requests.RequestException:
-                logger.error("Automation Analytics API request failed, trying base auth method")
-                response = s.post(url, files=files, verify=settings.INSIGHTS_CERT_PATH, auth=(rh_id, rh_secret), headers=s.headers, timeout=(31, 31))
-
+            if rh_user and rh_password:
+                try:
+                    client = OIDCClient(rh_user, rh_password, DEFAULT_OIDC_TOKEN_ENDPOINT, ['api.console'])
+                    response = client.make_request("POST", url, headers=s.headers, files=files, verify=settings.INSIGHTS_CERT_PATH, timeout=(31, 31))
+                except requests.RequestException:
+                    logger.error("Automation Analytics API request failed, trying base auth method")
+                    response = s.post(url, files=files, verify=settings.INSIGHTS_CERT_PATH, auth=(rh_user, rh_password), headers=s.headers, timeout=(31, 31))
+            elif not rh_user or not rh_password:
+                logger.info('REDHAT_USERNAME and REDHAT_PASSWORD are not set, using SUBSCRIPTIONS_USERNAME and SUBSCRIPTIONS_PASSWORD')
+                rh_user = getattr(settings, 'SUBSCRIPTIONS_USERNAME', None)
+                rh_password = getattr(settings, 'SUBSCRIPTIONS_PASSWORD', None)
+                if rh_user and rh_password:
+                    response = s.post(url, files=files, verify=settings.INSIGHTS_CERT_PATH, auth=(rh_user, rh_password), headers=s.headers, timeout=(31, 31))
+                elif not rh_user:
+                    logger.error('REDHAT_USERNAME and SUBSCRIPTIONS_USERNAME are not set')
+                    return False
+                elif not rh_password:
+                    logger.error('REDHAT_PASSWORD and SUBSCRIPTIONS_USERNAME are not set')
+                    return False
         # Accept 2XX status_codes
         if response.status_code >= 300:
             logger.error('Upload failed with status {}, {}'.format(response.status_code, response.text))

awx/main/analytics/metrics.py

@@ -128,7 +128,6 @@ def metrics():
         registry=REGISTRY,
     )
 
-    LICENSE_EXPIRY = Gauge('awx_license_expiry', 'Time before license expires', registry=REGISTRY)
     LICENSE_INSTANCE_TOTAL = Gauge('awx_license_instance_total', 'Total number of managed hosts provided by your license', registry=REGISTRY)
     LICENSE_INSTANCE_FREE = Gauge('awx_license_instance_free', 'Number of remaining managed hosts provided by your license', registry=REGISTRY)
 
@@ -149,7 +148,6 @@ def metrics():
         }
     )
 
-    LICENSE_EXPIRY.set(str(license_info.get('time_remaining', 0)))
     LICENSE_INSTANCE_TOTAL.set(str(license_info.get('instance_count', 0)))
     LICENSE_INSTANCE_FREE.set(str(license_info.get('free_instances', 0)))
 

awx/main/analytics/subsystem_metrics.py

@@ -9,7 +9,6 @@ from prometheus_client.core import GaugeMetricFamily, HistogramMetricFamily
 from prometheus_client.registry import CollectorRegistry
 from django.conf import settings
 from django.http import HttpRequest
-import redis.exceptions
 from rest_framework.request import Request
 
 from awx.main.consumers import emit_channel_notification
@@ -291,12 +290,8 @@ class Metrics(MetricsNamespace):
     def send_metrics(self):
         # more than one thread could be calling this at the same time, so should
         # acquire redis lock before sending metrics
-        try:
-            lock = self.conn.lock(root_key + '-' + self._namespace + '_lock')
-            if not lock.acquire(blocking=False):
-                return
-        except redis.exceptions.ConnectionError as exc:
-            logger.warning(f'Connection error in send_metrics: {exc}')
+        lock = self.conn.lock(root_key + '-' + self._namespace + '_lock')
+        if not lock.acquire(blocking=False):
             return
         try:
             current_time = time.time()

awx/main/apps.py

@@ -1,9 +1,6 @@
 import os
 
-from dispatcherd.config import setup as dispatcher_setup
-
 from django.apps import AppConfig
-from django.db import connection
 from django.utils.translation import gettext_lazy as _
 from awx.main.utils.common import bypass_in_test, load_all_entry_points_for
 from awx.main.utils.migration import is_database_synchronized
@@ -79,28 +76,9 @@ class MainConfig(AppConfig):
             cls = entry_point.load()
             InventorySourceOptions.injectors[entry_point_name] = cls
 
-    def configure_dispatcherd(self):
-        """This implements the default configuration for dispatcherd
-
-        If running the tasking service like awx-manage run_dispatcher,
-        some additional config will be applied on top of this.
-        This configuration provides the minimum such that code can submit
-        tasks to pg_notify to run those tasks.
-        """
-        from awx.main.dispatch.config import get_dispatcherd_config
-
-        if connection.vendor != 'postgresql':
-            config_dict = get_dispatcherd_config(mock_publish=True)
-        else:
-            config_dict = get_dispatcherd_config()
-
-        dispatcher_setup(config_dict)
-
     def ready(self):
         super().ready()
 
-        self.configure_dispatcherd()
-
         """
         Credential loading triggers database operations. There are cases we want to call
         awx-manage collectstatic without a database. All management commands invoke the ready() code

awx/main/conf.py

@@ -12,7 +12,6 @@ from rest_framework import serializers
 from awx.conf import fields, register, register_validate
 from awx.main.models import ExecutionEnvironment
 from awx.main.constants import SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS
-from awx.main.tasks.policy import OPA_AUTH_TYPES
 
 logger = logging.getLogger('awx.main.conf')
 
@@ -91,6 +90,7 @@ register(
     ),
     category=_('System'),
     category_slug='system',
+    required=False,
 )
 
 register(
@@ -105,7 +105,6 @@ register(
     ),
     category=_('System'),
     category_slug='system',
-    hidden=True,
 )
 
 register(
@@ -125,8 +124,8 @@ register(
     allow_blank=True,
     encrypted=False,
     read_only=False,
-    label=_('Red Hat Client ID for Analytics'),
-    help_text=_('Client ID used to send data to Automation Analytics'),
+    label=_('Red Hat customer username'),
+    help_text=_('This username is used to send data to Automation Analytics'),
     category=_('System'),
     category_slug='system',
 )
@@ -138,34 +137,34 @@ register(
     allow_blank=True,
     encrypted=True,
     read_only=False,
-    label=_('Red Hat Client Secret for Analytics'),
-    help_text=_('Client secret used to send data to Automation Analytics'),
+    label=_('Red Hat customer password'),
+    help_text=_('This password is used to send data to Automation Analytics'),
     category=_('System'),
     category_slug='system',
 )
 
 register(
-    'SUBSCRIPTIONS_CLIENT_ID',
+    'SUBSCRIPTIONS_USERNAME',
     field_class=fields.CharField,
     default='',
     allow_blank=True,
     encrypted=False,
     read_only=False,
-    label=_('Red Hat Client ID for Subscriptions'),
-    help_text=_('Client ID used to retrieve subscription and content information'),  # noqa
+    label=_('Red Hat or Satellite username'),
+    help_text=_('This username is used to retrieve subscription and content information'),  # noqa
     category=_('System'),
     category_slug='system',
 )
 
 register(
-    'SUBSCRIPTIONS_CLIENT_SECRET',
+    'SUBSCRIPTIONS_PASSWORD',
     field_class=fields.CharField,
     default='',
     allow_blank=True,
     encrypted=True,
     read_only=False,
-    label=_('Red Hat Client Secret for Subscriptions'),
-    help_text=_('Client secret used to retrieve subscription and content information'),  # noqa
+    label=_('Red Hat or Satellite password'),
+    help_text=_('This password is used to retrieve subscription and content information'),  # noqa
     category=_('System'),
     category_slug='system',
 )
@@ -238,6 +237,7 @@ register(
     help_text=_('List of modules allowed to be used by ad-hoc jobs.'),
     category=_('Jobs'),
     category_slug='jobs',
+    required=False,
 )
 
 register(
@@ -248,6 +248,7 @@ register(
         ('never', _('Never')),
         ('template', _('Only On Job Template Definitions')),
     ],
+    required=True,
     label=_('When can extra variables contain Jinja templates?'),
     help_text=_(
         'Ansible allows variable substitution via the Jinja2 templating '
@@ -272,6 +273,7 @@ register(
 register(
     'AWX_ISOLATION_SHOW_PATHS',
     field_class=fields.StringListIsolatedPathField,
+    required=False,
     label=_('Paths to expose to isolated jobs'),
     help_text=_(
         'List of paths that would otherwise be hidden to expose to isolated jobs. Enter one path per line. '
@@ -437,6 +439,7 @@ register(
 register(
     'AWX_ANSIBLE_CALLBACK_PLUGINS',
     field_class=fields.StringListField,
+    required=False,
     label=_('Ansible Callback Plugins'),
     help_text=_('List of paths to search for extra callback plugins to be used when running jobs. Enter one path per line.'),
     category=_('Jobs'),
@@ -550,6 +553,7 @@ register(
     help_text=_('Port on Logging Aggregator to send logs to (if required and not provided in Logging Aggregator).'),
     category=_('Logging'),
     category_slug='logging',
+    required=False,
 )
 register(
     'LOG_AGGREGATOR_TYPE',
@@ -571,6 +575,7 @@ register(
     help_text=_('Username for external log aggregator (if required; HTTP/s only).'),
     category=_('Logging'),
     category_slug='logging',
+    required=False,
 )
 register(
     'LOG_AGGREGATOR_PASSWORD',
@@ -582,6 +587,7 @@ register(
     help_text=_('Password or authentication token for external log aggregator (if required; HTTP/s only).'),
     category=_('Logging'),
     category_slug='logging',
+    required=False,
 )
 register(
     'LOG_AGGREGATOR_LOGGERS',
@@ -768,6 +774,7 @@ register(
     allow_null=True,
     category=_('System'),
     category_slug='system',
+    required=False,
     hidden=True,
 )
 register(
@@ -973,124 +980,3 @@ def csrf_trusted_origins_validate(serializer, attrs):
 
 
 register_validate('system', csrf_trusted_origins_validate)
-
-
-register(
-    'OPA_HOST',
-    field_class=fields.CharField,
-    label=_('OPA server hostname'),
-    default='',
-    help_text=_('The hostname used to connect to the OPA server. If empty, policy enforcement will be disabled.'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-    allow_blank=True,
-)
-
-register(
-    'OPA_PORT',
-    field_class=fields.IntegerField,
-    label=_('OPA server port'),
-    default=8181,
-    help_text=_('The port used to connect to the OPA server. Defaults to 8181.'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)
-
-register(
-    'OPA_SSL',
-    field_class=fields.BooleanField,
-    label=_('Use SSL for OPA connection'),
-    default=False,
-    help_text=_('Enable or disable the use of SSL to connect to the OPA server. Defaults to false.'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)
-
-register(
-    'OPA_AUTH_TYPE',
-    field_class=fields.ChoiceField,
-    label=_('OPA authentication type'),
-    choices=[OPA_AUTH_TYPES.NONE, OPA_AUTH_TYPES.TOKEN, OPA_AUTH_TYPES.CERTIFICATE],
-    default=OPA_AUTH_TYPES.NONE,
-    help_text=_('The authentication type that will be used to connect to the OPA server: "None", "Token", or "Certificate".'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)
-
-register(
-    'OPA_AUTH_TOKEN',
-    field_class=fields.CharField,
-    label=_('OPA authentication token'),
-    default='',
-    help_text=_(
-        'The token for authentication to the OPA server. Required when OPA_AUTH_TYPE is "Token". If an authorization header is defined in OPA_AUTH_CUSTOM_HEADERS, it will be overridden by OPA_AUTH_TOKEN.'
-    ),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-    allow_blank=True,
-    encrypted=True,
-)
-
-register(
-    'OPA_AUTH_CLIENT_CERT',
-    field_class=fields.CharField,
-    label=_('OPA client certificate content'),
-    default='',
-    help_text=_('The content of the client certificate file for mTLS authentication to the OPA server. Required when OPA_AUTH_TYPE is "Certificate".'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-    allow_blank=True,
-)
-
-register(
-    'OPA_AUTH_CLIENT_KEY',
-    field_class=fields.CharField,
-    label=_('OPA client key content'),
-    default='',
-    help_text=_('The content of the client key for mTLS authentication to the OPA server. Required when OPA_AUTH_TYPE is "Certificate".'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-    allow_blank=True,
-    encrypted=True,
-)
-
-register(
-    'OPA_AUTH_CA_CERT',
-    field_class=fields.CharField,
-    label=_('OPA CA certificate content'),
-    default='',
-    help_text=_('The content of the CA certificate for mTLS authentication to the OPA server. Required when OPA_AUTH_TYPE is "Certificate".'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-    allow_blank=True,
-)
-
-register(
-    'OPA_AUTH_CUSTOM_HEADERS',
-    field_class=fields.DictField,
-    label=_('OPA custom authentication headers'),
-    default={},
-    help_text=_('Optional custom headers included in requests to the OPA server. Defaults to empty dictionary ({}).'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)
-
-register(
-    'OPA_REQUEST_TIMEOUT',
-    field_class=fields.FloatField,
-    label=_('OPA request timeout'),
-    default=1.5,
-    help_text=_('The number of seconds after which the connection to the OPA server will time out. Defaults to 1.5 seconds.'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)
-
-register(
-    'OPA_REQUEST_RETRIES',
-    field_class=fields.IntegerField,
-    label=_('OPA request retry count'),
-    default=2,
-    help_text=_('The number of retry attempts for connecting to the OPA server. Default is 2.'),
-    category=('PolicyAsCode'),
-    category_slug='policyascode',
-)

awx/main/constants.py

@@ -77,8 +77,6 @@ LOGGER_BLOCKLIST = (
     'awx.main.utils.log',
     # loggers that may be called getting logging settings
     'awx.conf',
-    # dispatcherd should only use 1 database connection
-    'dispatcherd',
 )
 
 # Reported version for node seen in receptor mesh but for which capacity check

awx/main/dispatch/config.py

@@ -1,53 +0,0 @@
-from django.conf import settings
-
-from ansible_base.lib.utils.db import get_pg_notify_params
-from awx.main.dispatch import get_task_queuename
-from awx.main.dispatch.pool import get_auto_max_workers
-
-
-def get_dispatcherd_config(for_service: bool = False, mock_publish: bool = False) -> dict:
-    """Return a dictionary config for dispatcherd
-
-    Parameters:
-    for_service: if True, include dynamic options needed for running the dispatcher service
-      this will require database access, you should delay evaluation until after app setup
-    """
-    config = {
-        "version": 2,
-        "service": {
-            "pool_kwargs": {
-                "min_workers": settings.JOB_EVENT_WORKERS,
-                "max_workers": get_auto_max_workers(),
-            },
-            "main_kwargs": {"node_id": settings.CLUSTER_HOST_ID},
-            "process_manager_cls": "ForkServerManager",
-            "process_manager_kwargs": {"preload_modules": ['awx.main.dispatch.hazmat']},
-        },
-        "brokers": {
-            "socket": {"socket_path": settings.DISPATCHERD_DEBUGGING_SOCKFILE},
-        },
-        "publish": {"default_control_broker": "socket"},
-        "worker": {"worker_cls": "awx.main.dispatch.worker.dispatcherd.AWXTaskWorker"},
-    }
-
-    if mock_publish:
-        config["brokers"]["noop"] = {}
-        config["publish"]["default_broker"] = "noop"
-    else:
-        config["brokers"]["pg_notify"] = {
-            "config": get_pg_notify_params(),
-            "sync_connection_factory": "ansible_base.lib.utils.db.psycopg_connection_from_django",
-            "default_publish_channel": settings.CLUSTER_HOST_ID,  # used for debugging commands
-        }
-        config["publish"]["default_broker"] = "pg_notify"
-
-    if for_service:
-        config["producers"] = {
-            "ScheduledProducer": {"task_schedule": settings.DISPATCHER_SCHEDULE},
-            "OnStartProducer": {"task_list": {"awx.main.tasks.system.dispatch_startup": {}}},
-            "ControlProducer": {},
-        }
-
-        config["brokers"]["pg_notify"]["channels"] = ['tower_broadcast_all', 'tower_settings_change', get_task_queuename()]
-
-    return config

awx/main/dispatch/hazmat.py

@@ -1,36 +0,0 @@
-import django
-
-# dispatcherd publisher logic is likely to be used, but needs manual preload
-from dispatcherd.brokers import pg_notify  # noqa
-
-# Cache may not be initialized until we are in the worker, so preload here
-from channels_redis import core  # noqa
-
-from awx import prepare_env
-
-from dispatcherd.utils import resolve_callable
-
-
-prepare_env()
-
-django.setup()  # noqa
-
-
-from django.conf import settings
-
-
-# Preload all periodic tasks so their imports will be in shared memory
-for name, options in settings.CELERYBEAT_SCHEDULE.items():
-    resolve_callable(options['task'])
-
-
-# Preload in-line import from tasks
-from awx.main.scheduler.kubernetes import PodManager  # noqa
-
-
-from django.core.cache import cache as django_cache
-from django.db import connection
-
-
-connection.close()
-django_cache.close()

awx/main/dispatch/periodic.py

@@ -88,10 +88,8 @@ class Scheduler:
         # internally times are all referenced relative to startup time, add grace period
         self.global_start = time.time() + 2.0
 
-    def get_and_mark_pending(self, reftime=None):
-        if reftime is None:
-            reftime = time.time()  # mostly for tests
-        relative_time = reftime - self.global_start
+    def get_and_mark_pending(self):
+        relative_time = time.time() - self.global_start
         to_run = []
         for job in self.jobs:
             if job.due_to_run(relative_time):
@@ -100,10 +98,8 @@ class Scheduler:
                 job.mark_run(relative_time)
         return to_run
 
-    def time_until_next_run(self, reftime=None):
-        if reftime is None:
-            reftime = time.time()  # mostly for tests
-        relative_time = reftime - self.global_start
+    def time_until_next_run(self):
+        relative_time = time.time() - self.global_start
         next_job = min(self.jobs, key=lambda j: j.next_run)
         delta = next_job.next_run - relative_time
         if delta <= 0.1:
@@ -119,11 +115,10 @@ class Scheduler:
     def debug(self, *args, **kwargs):
         data = dict()
         data['title'] = 'Scheduler status'
-        reftime = time.time()
 
-        now = datetime.fromtimestamp(reftime).strftime('%Y-%m-%d %H:%M:%S UTC')
+        now = datetime.fromtimestamp(time.time()).strftime('%Y-%m-%d %H:%M:%S UTC')
         start_time = datetime.fromtimestamp(self.global_start).strftime('%Y-%m-%d %H:%M:%S UTC')
-        relative_time = reftime - self.global_start
+        relative_time = time.time() - self.global_start
         data['started_time'] = start_time
         data['current_time'] = now
         data['current_time_relative'] = round(relative_time, 3)

awx/main/dispatch/pool.py

@@ -7,7 +7,6 @@ import time
 import traceback
 from datetime import datetime
 from uuid import uuid4
-import json
 
 import collections
 from multiprocessing import Process
@@ -26,10 +25,7 @@ from ansible_base.lib.logging.runtime import log_excess_runtime
 
 from awx.main.models import UnifiedJob
 from awx.main.dispatch import reaper
-from awx.main.utils.common import get_mem_effective_capacity, get_corrected_memory, get_corrected_cpu, get_cpu_effective_capacity
-
-# ansible-runner
-from ansible_runner.utils.capacity import get_mem_in_bytes, get_cpu_count
+from awx.main.utils.common import convert_mem_str_to_bytes, get_mem_effective_capacity
 
 if 'run_callback_receiver' in sys.argv:
     logger = logging.getLogger('awx.main.commands.run_callback_receiver')
@@ -37,9 +33,6 @@ else:
     logger = logging.getLogger('awx.main.dispatch')
 
 
-RETIRED_SENTINEL_TASK = "[retired]"
-
-
 class NoOpResultQueue(object):
     def put(self, item):
         pass
@@ -84,17 +77,11 @@ class PoolWorker(object):
         self.queue = MPQueue(queue_size)
         self.process = Process(target=target, args=(self.queue, self.finished) + args)
         self.process.daemon = True
-        self.creation_time = time.monotonic()
-        self.retiring = False
 
     def start(self):
         self.process.start()
 
     def put(self, body):
-        if self.retiring:
-            uuid = body.get('uuid', 'N/A') if isinstance(body, dict) else 'N/A'
-            logger.info(f"Worker pid:{self.pid} is retiring. Refusing new task {uuid}.")
-            raise QueueFull("Worker is retiring and not accepting new tasks")  # AutoscalePool.write handles QueueFull
         uuid = '?'
         if isinstance(body, dict):
             if not body.get('uuid'):
@@ -113,11 +100,6 @@ class PoolWorker(object):
         """
         self.queue.put('QUIT')
 
-    @property
-    def age(self):
-        """Returns the current age of the worker in seconds."""
-        return time.monotonic() - self.creation_time
-
     @property
     def pid(self):
         return self.process.pid
@@ -164,8 +146,6 @@ class PoolWorker(object):
                 # the purpose of self.managed_tasks is to just track internal
                 # state of which events are *currently* being processed.
                 logger.warning('Event UUID {} appears to be have been duplicated.'.format(uuid))
-            if self.retiring:
-                self.managed_tasks[RETIRED_SENTINEL_TASK] = {'task': RETIRED_SENTINEL_TASK}
 
     @property
     def current_task(self):
@@ -281,8 +261,6 @@ class WorkerPool(object):
             '{% for w in workers %}'
             '.  worker[pid:{{ w.pid }}]{% if not w.alive %} GONE exit={{ w.exitcode }}{% endif %}'
             ' sent={{ w.messages_sent }}'
-            ' age={{ "%.0f"|format(w.age) }}s'
-            ' retiring={{ w.retiring }}'
             '{% if w.messages_finished %} finished={{ w.messages_finished }}{% endif %}'
             ' qsize={{ w.managed_tasks|length }}'
             ' rss={{ w.mb }}MB'
@@ -329,41 +307,6 @@ class WorkerPool(object):
             logger.exception('could not kill {}'.format(worker.pid))
 
 
-def get_auto_max_workers():
-    """Method we normally rely on to get max_workers
-
-    Uses almost same logic as Instance.local_health_check
-    The important thing is to be MORE than Instance.capacity
-    so that the task-manager does not over-schedule this node
-
-    Ideally we would just use the capacity from the database plus reserve workers,
-    but this poses some bootstrap problems where OCP task containers
-    register themselves after startup
-    """
-    # Get memory from ansible-runner
-    total_memory_gb = get_mem_in_bytes()
-
-    # This may replace memory calculation with a user override
-    corrected_memory = get_corrected_memory(total_memory_gb)
-
-    # Get same number as max forks based on memory, this function takes memory as bytes
-    mem_capacity = get_mem_effective_capacity(corrected_memory, is_control_node=True)
-
-    # Follow same process for CPU capacity constraint
-    cpu_count = get_cpu_count()
-    corrected_cpu = get_corrected_cpu(cpu_count)
-    cpu_capacity = get_cpu_effective_capacity(corrected_cpu, is_control_node=True)
-
-    # Here is what is different from health checks,
-    auto_max = max(mem_capacity, cpu_capacity)
-
-    # add magic number of extra workers to ensure
-    # we have a few extra workers to run the heartbeat
-    auto_max += 7
-
-    return auto_max
-
-
 class AutoscalePool(WorkerPool):
     """
     An extended pool implementation that automatically scales workers up and
@@ -374,13 +317,22 @@ class AutoscalePool(WorkerPool):
 
     def __init__(self, *args, **kwargs):
         self.max_workers = kwargs.pop('max_workers', None)
-        self.max_worker_lifetime_seconds = kwargs.pop(
-            'max_worker_lifetime_seconds', getattr(settings, 'WORKER_MAX_LIFETIME_SECONDS', 14400)
-        )  # Default to 4 hours
         super(AutoscalePool, self).__init__(*args, **kwargs)
 
         if self.max_workers is None:
-            self.max_workers = get_auto_max_workers()
+            settings_absmem = getattr(settings, 'SYSTEM_TASK_ABS_MEM', None)
+            if settings_absmem is not None:
+                # There are 1073741824 bytes in a gigabyte. Convert bytes to gigabytes by dividing by 2**30
+                total_memory_gb = convert_mem_str_to_bytes(settings_absmem) // 2**30
+            else:
+                total_memory_gb = (psutil.virtual_memory().total >> 30) + 1  # noqa: round up
+
+            # Get same number as max forks based on memory, this function takes memory as bytes
+            self.max_workers = get_mem_effective_capacity(total_memory_gb * 2**30)
+
+            # add magic prime number of extra workers to ensure
+            # we have a few extra workers to run the heartbeat
+            self.max_workers += 7
 
         # max workers can't be less than min_workers
         self.max_workers = max(self.min_workers, self.max_workers)
@@ -394,9 +346,6 @@ class AutoscalePool(WorkerPool):
         self.scale_up_ct = 0
         self.worker_count_max = 0
 
-        # last time we wrote current tasks, to avoid too much log spam
-        self.last_task_list_log = time.monotonic()
-
     def produce_subsystem_metrics(self, metrics_object):
         metrics_object.set('dispatcher_pool_scale_up_events', self.scale_up_ct)
         metrics_object.set('dispatcher_pool_active_task_count', sum(len(w.managed_tasks) for w in self.workers))
@@ -436,7 +385,6 @@ class AutoscalePool(WorkerPool):
         """
         orphaned = []
         for w in self.workers[::]:
-            is_retirement_age = self.max_worker_lifetime_seconds is not None and w.age > self.max_worker_lifetime_seconds
             if not w.alive:
                 # the worker process has exited
                 # 1. take the task it was running and enqueue the error
@@ -445,10 +393,6 @@ class AutoscalePool(WorkerPool):
                 #    send them to another worker
                 logger.error('worker pid:{} is gone (exit={})'.format(w.pid, w.exitcode))
                 if w.current_task:
-                    if w.current_task == {'task': RETIRED_SENTINEL_TASK}:
-                        logger.debug('scaling down worker pid:{} due to worker age: {}'.format(w.pid, w.age))
-                        self.workers.remove(w)
-                        continue
                     if w.current_task != 'QUIT':
                         try:
                             for j in UnifiedJob.objects.filter(celery_task_id=w.current_task['uuid']):
@@ -459,7 +403,6 @@ class AutoscalePool(WorkerPool):
                         logger.warning(f'Worker was told to quit but has not, pid={w.pid}')
                 orphaned.extend(w.orphaned_tasks)
                 self.workers.remove(w)
-
             elif w.idle and len(self.workers) > self.min_workers:
                 # the process has an empty queue (it's idle) and we have
                 # more processes in the pool than we need (> min)
@@ -468,22 +411,6 @@ class AutoscalePool(WorkerPool):
                 logger.debug('scaling down worker pid:{}'.format(w.pid))
                 w.quit()
                 self.workers.remove(w)
-
-            elif w.idle and is_retirement_age:
-                logger.debug('scaling down worker pid:{} due to worker age: {}'.format(w.pid, w.age))
-                w.quit()
-                self.workers.remove(w)
-
-            elif is_retirement_age and not w.retiring and not w.idle:
-                logger.info(
-                    f"Worker pid:{w.pid} (age: {w.age:.0f}s) exceeded max lifetime ({self.max_worker_lifetime_seconds:.0f}s). "
-                    "Signaling for graceful retirement."
-                )
-                # Send QUIT signal; worker will finish current task then exit.
-                w.quit()
-                # mark as retiring to reject any future tasks that might be assigned in meantime
-                w.retiring = True
-
             if w.alive:
                 # if we discover a task manager invocation that's been running
                 # too long, reap it (because otherwise it'll just hold the postgres
@@ -536,14 +463,6 @@ class AutoscalePool(WorkerPool):
                 self.worker_count_max = new_worker_ct
             return ret
 
-    @staticmethod
-    def fast_task_serialization(current_task):
-        try:
-            return str(current_task.get('task')) + ' - ' + str(sorted(current_task.get('args', []))) + ' - ' + str(sorted(current_task.get('kwargs', {})))
-        except Exception:
-            # just make sure this does not make things worse
-            return str(current_task)
-
     def write(self, preferred_queue, body):
         if 'guid' in body:
             set_guid(body['guid'])
@@ -565,15 +484,6 @@ class AutoscalePool(WorkerPool):
                 if isinstance(body, dict):
                     task_name = body.get('task')
                 logger.warning(f'Workers maxed, queuing {task_name}, load: {sum(len(w.managed_tasks) for w in self.workers)} / {len(self.workers)}')
-                # Once every 10 seconds write out task list for debugging
-                if time.monotonic() - self.last_task_list_log >= 10.0:
-                    task_counts = {}
-                    for worker in self.workers:
-                        task_slug = self.fast_task_serialization(worker.current_task)
-                        task_counts.setdefault(task_slug, 0)
-                        task_counts[task_slug] += 1
-                    logger.info(f'Running tasks by count:\n{json.dumps(task_counts, indent=2)}')
-                    self.last_task_list_log = time.monotonic()
                 return super(AutoscalePool, self).write(preferred_queue, body)
         except Exception:
             for conn in connections.all():

awx/main/dispatch/publish.py

@@ -4,9 +4,6 @@ import json
 import time
 from uuid import uuid4
 
-from dispatcherd.publish import submit_task
-from dispatcherd.utils import resolve_callable
-
 from django_guid import get_guid
 from django.conf import settings
 
@@ -96,19 +93,6 @@ class task:
 
             @classmethod
             def apply_async(cls, args=None, kwargs=None, queue=None, uuid=None, **kw):
-                try:
-                    from flags.state import flag_enabled
-
-                    if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                        # At this point we have the import string, and submit_task wants the method, so back to that
-                        actual_task = resolve_callable(cls.name)
-                        return submit_task(actual_task, args=args, kwargs=kwargs, queue=queue, uuid=uuid, **kw)
-                except Exception:
-                    logger.exception(f"[DISPATCHER] Failed to check for alternative dispatcherd implementation for {cls.name}")
-                    # Continue with original implementation if anything fails
-                    pass
-
-                # Original implementation follows
                 queue = queue or getattr(cls.queue, 'im_func', cls.queue)
                 if not queue:
                     msg = f'{cls.name}: Queue value required and may not be None'

awx/main/dispatch/worker/base.py

@@ -15,7 +15,6 @@ from datetime import timedelta
 
 from django import db
 from django.conf import settings
-import redis.exceptions
 
 from ansible_base.lib.logging.runtime import log_excess_runtime
 
@@ -131,13 +130,10 @@ class AWXConsumerBase(object):
     @log_excess_runtime(logger, debug_cutoff=0.05, cutoff=0.2)
     def record_statistics(self):
         if time.time() - self.last_stats > 1:  # buffer stat recording to once per second
-            save_data = self.pool.debug()
             try:
-                self.redis.set(f'awx_{self.name}_statistics', save_data)
-            except redis.exceptions.ConnectionError as exc:
-                logger.warning(f'Redis connection error saving {self.name} status data:\n{exc}\nmissed data:\n{save_data}')
+                self.redis.set(f'awx_{self.name}_statistics', self.pool.debug())
             except Exception:
-                logger.exception(f"Unknown redis error saving {self.name} status data:\nmissed data:\n{save_data}")
+                logger.exception(f"encountered an error communicating with redis to store {self.name} statistics")
             self.last_stats = time.time()
 
     def run(self, *args, **kwargs):
@@ -193,10 +189,7 @@ class AWXConsumerPG(AWXConsumerBase):
         current_time = time.time()
         self.pool.produce_subsystem_metrics(self.subsystem_metrics)
         self.subsystem_metrics.set('dispatcher_availability', self.listen_cumulative_time / (current_time - self.last_metrics_gather))
-        try:
-            self.subsystem_metrics.pipe_execute()
-        except redis.exceptions.ConnectionError as exc:
-            logger.warning(f'Redis connection error saving dispatcher metrics, error:\n{exc}')
+        self.subsystem_metrics.pipe_execute()
         self.listen_cumulative_time = 0.0
         self.last_metrics_gather = current_time
 
@@ -212,11 +205,7 @@ class AWXConsumerPG(AWXConsumerBase):
         except Exception as exc:
             logger.warning(f'Failed to save dispatcher statistics {exc}')
 
-        # Everything benchmarks to the same original time, so that skews due to
-        # runtime of the actions, themselves, do not mess up scheduling expectations
-        reftime = time.time()
-
-        for job in self.scheduler.get_and_mark_pending(reftime=reftime):
+        for job in self.scheduler.get_and_mark_pending():
             if 'control' in job.data:
                 try:
                     job.data['control']()
@@ -233,12 +222,12 @@ class AWXConsumerPG(AWXConsumerBase):
 
         self.listen_start = time.time()
 
-        return self.scheduler.time_until_next_run(reftime=reftime)
+        return self.scheduler.time_until_next_run()
 
     def run(self, *args, **kwargs):
         super(AWXConsumerPG, self).run(*args, **kwargs)
 
-        logger.info(f"Running {self.name}, workers min={self.pool.min_workers} max={self.pool.max_workers}, listening to queues {self.queues}")
+        logger.info(f"Running worker {self.name} listening to queues {self.queues}")
         init = False
 
         while True:

awx/main/dispatch/worker/callback.py

@@ -86,7 +86,6 @@ class CallbackBrokerWorker(BaseWorker):
         return os.getpid()
 
     def read(self, queue):
-        has_redis_error = False
         try:
             res = self.redis.blpop(self.queue_name, timeout=1)
             if res is None:
@@ -96,21 +95,14 @@ class CallbackBrokerWorker(BaseWorker):
             self.subsystem_metrics.inc('callback_receiver_events_popped_redis', 1)
             self.subsystem_metrics.inc('callback_receiver_events_in_memory', 1)
             return json.loads(res[1])
-        except redis.exceptions.ConnectionError as exc:
-            # Low noise log, because very common and many workers will write this
-            logger.error(f"redis connection error: {exc}")
-            has_redis_error = True
-            time.sleep(5)
         except redis.exceptions.RedisError:
             logger.exception("encountered an error communicating with redis")
-            has_redis_error = True
             time.sleep(1)
         except (json.JSONDecodeError, KeyError):
             logger.exception("failed to decode JSON message from redis")
         finally:
-            if not has_redis_error:
-                self.record_statistics()
-                self.record_read_metrics()
+            self.record_statistics()
+            self.record_read_metrics()
 
         return {'event': 'FLUSH'}
 

awx/main/dispatch/worker/dispatcherd.py

@@ -1,14 +0,0 @@
-from dispatcherd.worker.task import TaskWorker
-
-from django.db import connection
-
-
-class AWXTaskWorker(TaskWorker):
-
-    def on_start(self) -> None:
-        """Get worker connected so that first task it gets will be worked quickly"""
-        connection.ensure_connection()
-
-    def pre_task(self, message) -> None:
-        """This should remedy bad connections that can not fix themselves"""
-        connection.close_if_unusable_or_obsolete()

awx/main/exceptions.py

@@ -38,12 +38,5 @@ class PostRunError(Exception):
         super(PostRunError, self).__init__(msg)
 
 
-class PolicyEvaluationError(Exception):
-    def __init__(self, msg, status='failed', tb=''):
-        self.status = status
-        self.tb = tb
-        super(PolicyEvaluationError, self).__init__(msg)
-
-
 class ReceptorNodeNotFound(RuntimeError):
     pass

awx/main/management/commands/inventory_import.py

@@ -33,7 +33,6 @@ from awx.main.utils.safe_yaml import sanitize_jinja
 from awx.main.models.rbac import batch_role_ancestor_rebuilding
 from awx.main.utils import ignore_inventory_computed_fields, get_licenser
 from awx.main.utils.execution_environments import get_default_execution_environment
-from awx.main.utils.inventory_vars import update_group_variables
 from awx.main.signals import disable_activity_stream
 from awx.main.constants import STANDARD_INVENTORY_UPDATE_ENV
 
@@ -458,19 +457,19 @@ class Command(BaseCommand):
         """
         Update inventory variables from "all" group.
         """
+        # TODO: We disable variable overwrite here in case user-defined inventory variables get
+        # mangled. But we still need to figure out a better way of processing multiple inventory
+        # update variables mixing with each other.
+        # issue for this: https://github.com/ansible/awx/issues/11623
+
         if self.inventory.kind == 'constructed' and self.inventory_source.overwrite_vars:
             # NOTE: we had to add a exception case to not merge variables
             # to make constructed inventory coherent
             db_variables = self.all_group.variables
         else:
-            db_variables = update_group_variables(
-                group_id=None,  # `None` denotes the 'all' group (which doesn't have a pk).
-                newvars=self.all_group.variables,
-                dbvars=self.inventory.variables_dict,
-                invsrc_id=self.inventory_source.id,
-                inventory_id=self.inventory.id,
-                overwrite_vars=self.overwrite_vars,
-            )
+            db_variables = self.inventory.variables_dict
+            db_variables.update(self.all_group.variables)
+
         if db_variables != self.inventory.variables_dict:
             self.inventory.variables = json.dumps(db_variables)
             self.inventory.save(update_fields=['variables'])

awx/main/management/commands/run_callback_receiver.py

@@ -1,13 +1,10 @@
 # Copyright (c) 2015 Ansible, Inc.
 # All Rights Reserved.
 
-import redis
-
 from django.conf import settings
-from django.core.management.base import BaseCommand, CommandError
-import redis.exceptions
-
+from django.core.management.base import BaseCommand
 from awx.main.analytics.subsystem_metrics import CallbackReceiverMetricsServer
+
 from awx.main.dispatch.control import Control
 from awx.main.dispatch.worker import AWXConsumerRedis, CallbackBrokerWorker
 
@@ -30,10 +27,7 @@ class Command(BaseCommand):
             return
         consumer = None
 
-        try:
-            CallbackReceiverMetricsServer().start()
-        except redis.exceptions.ConnectionError as exc:
-            raise CommandError(f'Callback receiver could not connect to redis, error: {exc}')
+        CallbackReceiverMetricsServer().start()
 
         try:
             consumer = AWXConsumerRedis(

awx/main/management/commands/run_dispatcher.py

@@ -2,21 +2,11 @@
 # All Rights Reserved.
 import logging
 import yaml
-import os
-
-import redis
 
 from django.conf import settings
-from django.core.management.base import BaseCommand, CommandError
-
-from flags.state import flag_enabled
-
-from dispatcherd.factories import get_control_from_settings
-from dispatcherd import run_service
-from dispatcherd.config import setup as dispatcher_setup
+from django.core.management.base import BaseCommand
 
 from awx.main.dispatch import get_task_queuename
-from awx.main.dispatch.config import get_dispatcherd_config
 from awx.main.dispatch.control import Control
 from awx.main.dispatch.pool import AutoscalePool
 from awx.main.dispatch.worker import AWXConsumerPG, TaskWorker
@@ -48,44 +38,18 @@ class Command(BaseCommand):
             ),
         )
 
-    def verify_dispatcherd_socket(self):
-        if not os.path.exists(settings.DISPATCHERD_DEBUGGING_SOCKFILE):
-            raise CommandError('Dispatcher is not running locally')
-
     def handle(self, *arg, **options):
         if options.get('status'):
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                ctl = get_control_from_settings()
-                running_data = ctl.control_with_reply('status')
-                if len(running_data) != 1:
-                    raise CommandError('Did not receive expected number of replies')
-                print(yaml.dump(running_data[0], default_flow_style=False))
-                return
-            else:
-                print(Control('dispatcher').status())
-                return
+            print(Control('dispatcher').status())
+            return
         if options.get('schedule'):
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                print('NOT YET IMPLEMENTED')
-                return
-            else:
-                print(Control('dispatcher').schedule())
+            print(Control('dispatcher').schedule())
             return
         if options.get('running'):
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                ctl = get_control_from_settings()
-                running_data = ctl.control_with_reply('running')
-                print(yaml.dump(running_data, default_flow_style=False))
-                return
-            else:
-                print(Control('dispatcher').running())
-                return
+            print(Control('dispatcher').running())
+            return
         if options.get('reload'):
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                print('NOT YET IMPLEMENTED')
-                return
-            else:
-                return Control('dispatcher').control({'control': 'reload'})
+            return Control('dispatcher').control({'control': 'reload'})
         if options.get('cancel'):
             cancel_str = options.get('cancel')
             try:
@@ -94,36 +58,18 @@ class Command(BaseCommand):
                 cancel_data = [cancel_str]
             if not isinstance(cancel_data, list):
                 cancel_data = [cancel_str]
+            print(Control('dispatcher').cancel(cancel_data))
+            return
 
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                ctl = get_control_from_settings()
-                results = []
-                for task_id in cancel_data:
-                    # For each task UUID, send an individual cancel command
-                    result = ctl.control_with_reply('cancel', data={'uuid': task_id})
-                    results.append(result)
-                print(yaml.dump(results, default_flow_style=False))
-                return
-            else:
-                print(Control('dispatcher').cancel(cancel_data))
-                return
+        consumer = None
 
-        if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-            dispatcher_setup(get_dispatcherd_config(for_service=True))
-            run_service()
-        else:
-            consumer = None
+        DispatcherMetricsServer().start()
 
-            try:
-                DispatcherMetricsServer().start()
-            except redis.exceptions.ConnectionError as exc:
-                raise CommandError(f'Dispatcher could not connect to redis, error: {exc}')
-
-            try:
-                queues = ['tower_broadcast_all', 'tower_settings_change', get_task_queuename()]
-                consumer = AWXConsumerPG('dispatcher', TaskWorker(), queues, AutoscalePool(min_workers=4), schedule=settings.CELERYBEAT_SCHEDULE)
-                consumer.run()
-            except KeyboardInterrupt:
-                logger.debug('Terminating Task Dispatcher')
-                if consumer:
-                    consumer.stop()
+        try:
+            queues = ['tower_broadcast_all', 'tower_settings_change', get_task_queuename()]
+            consumer = AWXConsumerPG('dispatcher', TaskWorker(), queues, AutoscalePool(min_workers=4), schedule=settings.CELERYBEAT_SCHEDULE)
+            consumer.run()
+        except KeyboardInterrupt:
+            logger.debug('Terminating Task Dispatcher')
+            if consumer:
+                consumer.stop()

awx/main/migrations/0198_alter_inventorysource_source_and_more.py

@@ -1,61 +0,0 @@
-# Generated by Django 4.2.18 on 2025-02-27 20:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [('main', '0197_add_opa_query_path')]
-
-    operations = [
-        migrations.AlterField(
-            model_name='inventorysource',
-            name='source',
-            field=models.CharField(
-                choices=[
-                    ('file', 'File, Directory or Script'),
-                    ('constructed', 'Template additional groups and hostvars at runtime'),
-                    ('scm', 'Sourced from a Project'),
-                    ('ec2', 'Amazon EC2'),
-                    ('gce', 'Google Compute Engine'),
-                    ('azure_rm', 'Microsoft Azure Resource Manager'),
-                    ('vmware', 'VMware vCenter'),
-                    ('vmware_esxi', 'VMware ESXi'),
-                    ('satellite6', 'Red Hat Satellite 6'),
-                    ('openstack', 'OpenStack'),
-                    ('rhv', 'Red Hat Virtualization'),
-                    ('controller', 'Red Hat Ansible Automation Platform'),
-                    ('insights', 'Red Hat Insights'),
-                    ('terraform', 'Terraform State'),
-                    ('openshift_virtualization', 'OpenShift Virtualization'),
-                ],
-                default=None,
-                max_length=32,
-            ),
-        ),
-        migrations.AlterField(
-            model_name='inventoryupdate',
-            name='source',
-            field=models.CharField(
-                choices=[
-                    ('file', 'File, Directory or Script'),
-                    ('constructed', 'Template additional groups and hostvars at runtime'),
-                    ('scm', 'Sourced from a Project'),
-                    ('ec2', 'Amazon EC2'),
-                    ('gce', 'Google Compute Engine'),
-                    ('azure_rm', 'Microsoft Azure Resource Manager'),
-                    ('vmware', 'VMware vCenter'),
-                    ('vmware_esxi', 'VMware ESXi'),
-                    ('satellite6', 'Red Hat Satellite 6'),
-                    ('openstack', 'OpenStack'),
-                    ('rhv', 'Red Hat Virtualization'),
-                    ('controller', 'Red Hat Ansible Automation Platform'),
-                    ('insights', 'Red Hat Insights'),
-                    ('terraform', 'Terraform State'),
-                    ('openshift_virtualization', 'OpenShift Virtualization'),
-                ],
-                default=None,
-                max_length=32,
-            ),
-        ),
-    ]

awx/main/migrations/0198_delete_profile.py

@@ -0,0 +1,15 @@
+# Generated by Django 4.2.10 on 2024-09-16 10:22
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('main', '0197_add_opa_query_path'),
+    ]
+
+    operations = [
+        migrations.DeleteModel(
+            name='Profile',
+        ),
+    ]

awx/main/migrations/0199_inventorygroupvariableswithhistory_and_more.py

@@ -1,32 +0,0 @@
-# Generated by Django 4.2.20 on 2025-04-24 09:08
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('main', '0198_alter_inventorysource_source_and_more'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='InventoryGroupVariablesWithHistory',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('variables', models.JSONField()),
-                ('group', models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='inventory_group_variables', to='main.group')),
-                (
-                    'inventory',
-                    models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='inventory_group_variables', to='main.inventory'),
-                ),
-            ],
-        ),
-        migrations.AddConstraint(
-            model_name='inventorygroupvariableswithhistory',
-            constraint=models.UniqueConstraint(
-                fields=('inventory', 'group'), name='unique_inventory_group', violation_error_message='Inventory/Group combination must be unique.'
-            ),
-        ),
-    ]

awx/main/migrations/0199_remove_sso_app_content.py

@@ -0,0 +1,26 @@
+# Generated by Django 4.2.10 on 2024-09-16 15:21
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('main', '0198_delete_profile'),
+    ]
+
+    operations = [
+        # delete all sso application migrations
+        migrations.RunSQL("DELETE FROM django_migrations WHERE app = 'sso';"),
+        # delete all sso application content group permissions
+        migrations.RunSQL(
+            "DELETE FROM auth_group_permissions "
+            "WHERE permission_id IN "
+            "(SELECT id FROM auth_permission WHERE content_type_id in (SELECT id FROM django_content_type WHERE app_label = 'sso'));"
+        ),
+        # delete all sso application content permissions
+        migrations.RunSQL("DELETE FROM auth_permission " "WHERE content_type_id IN (SELECT id FROM django_content_type WHERE app_label = 'sso');"),
+        # delete sso application content type
+        migrations.RunSQL("DELETE FROM django_content_type WHERE app_label = 'sso';"),
+        # drop sso application created table
+        migrations.RunSQL("DROP TABLE IF EXISTS sso_userenterpriseauth;"),
+    ]

awx/main/migrations/0200_alter_inventorysource_source_and_more.py

@@ -0,0 +1,23 @@
+# Generated by Django 4.2.10 on 2024-10-22 15:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('main', '0199_remove_sso_app_content'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='inventorysource',
+            name='source',
+            field=models.CharField(default=None, max_length=32),
+        ),
+        migrations.AlterField(
+            model_name='inventoryupdate',
+            name='source',
+            field=models.CharField(default=None, max_length=32),
+        ),
+    ]

awx/main/migrations/0200_template_name_constraint.py

@@ -1,50 +0,0 @@
-# Generated by Django 4.2.20 on 2025-04-22 15:54
-
-import logging
-
-from django.db import migrations, models
-
-from awx.main.migrations._db_constraints import _rename_duplicates
-
-
-logger = logging.getLogger(__name__)
-
-
-def rename_jts(apps, schema_editor):
-    cls = apps.get_model('main', 'JobTemplate')
-    _rename_duplicates(cls)
-
-
-def rename_projects(apps, schema_editor):
-    cls = apps.get_model('main', 'Project')
-    _rename_duplicates(cls)
-
-
-def change_inventory_source_org_unique(apps, schema_editor):
-    cls = apps.get_model('main', 'InventorySource')
-    r = cls.objects.update(org_unique=False)
-    logger.info(f'Set database constraint rule for {r} inventory source objects')
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('main', '0199_inventorygroupvariableswithhistory_and_more'),
-    ]
-
-    operations = [
-        migrations.RunPython(rename_jts, migrations.RunPython.noop),
-        migrations.RunPython(rename_projects, migrations.RunPython.noop),
-        migrations.AddField(
-            model_name='unifiedjobtemplate',
-            name='org_unique',
-            field=models.BooleanField(blank=True, default=True, editable=False, help_text='Used internally to selectively enforce database constraint on name'),
-        ),
-        migrations.RunPython(change_inventory_source_org_unique, migrations.RunPython.noop),
-        migrations.AddConstraint(
-            model_name='unifiedjobtemplate',
-            constraint=models.UniqueConstraint(
-                condition=models.Q(('org_unique', True)), fields=('polymorphic_ctype', 'name', 'organization'), name='ujt_hard_name_constraint'
-            ),
-        ),
-    ]

awx/main/migrations/0201_alter_oauth2application_unique_together_and_more.py

@@ -0,0 +1,39 @@
+# Generated by Django 4.2.10 on 2024-10-24 14:06
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('main', '0200_alter_inventorysource_source_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='oauth2application',
+            unique_together=None,
+        ),
+        migrations.RemoveField(
+            model_name='oauth2application',
+            name='organization',
+        ),
+        migrations.RemoveField(
+            model_name='oauth2application',
+            name='user',
+        ),
+        migrations.RemoveField(
+            model_name='activitystream',
+            name='o_auth2_access_token',
+        ),
+        migrations.RemoveField(
+            model_name='activitystream',
+            name='o_auth2_application',
+        ),
+        migrations.DeleteModel(
+            name='OAuth2AccessToken',
+        ),
+        migrations.DeleteModel(
+            name='OAuth2Application',
+        ),
+    ]

awx/main/migrations/0201_create_managed_creds.py

@@ -1,9 +0,0 @@
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0200_template_name_constraint'),
-    ]
-
-    operations = []

awx/main/migrations/0202_delete_token_cleanup_job.py

@@ -0,0 +1,44 @@
+# Generated by Django 4.2.16 on 2024-12-18 16:05
+
+from django.db import migrations, models
+
+from awx.main.migrations._create_system_jobs import delete_clear_tokens_sjt
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('main', '0201_alter_oauth2application_unique_together_and_more'),
+    ]
+
+    operations = [
+        migrations.RunPython(delete_clear_tokens_sjt, migrations.RunPython.noop),
+        migrations.AlterField(
+            model_name='systemjob',
+            name='job_type',
+            field=models.CharField(
+                blank=True,
+                choices=[
+                    ('cleanup_jobs', 'Remove jobs older than a certain number of days'),
+                    ('cleanup_activitystream', 'Remove activity stream entries older than a certain number of days'),
+                    ('cleanup_sessions', 'Removes expired browser sessions from the database'),
+                ],
+                default='',
+                max_length=32,
+            ),
+        ),
+        migrations.AlterField(
+            model_name='systemjobtemplate',
+            name='job_type',
+            field=models.CharField(
+                blank=True,
+                choices=[
+                    ('cleanup_jobs', 'Remove jobs older than a certain number of days'),
+                    ('cleanup_activitystream', 'Remove activity stream entries older than a certain number of days'),
+                    ('cleanup_sessions', 'Removes expired browser sessions from the database'),
+                ],
+                default='',
+                max_length=32,
+            ),
+        ),
+    ]

awx/main/migrations/0202_squashed_deletions.py

@@ -1,100 +0,0 @@
-# Generated by Django 4.2.10 on 2024-09-16 10:22
-
-from django.db import migrations, models
-
-from awx.main.migrations._create_system_jobs import delete_clear_tokens_sjt
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0201_create_managed_creds'),
-    ]
-
-    operations = [
-        migrations.DeleteModel(
-            name='Profile',
-        ),
-        # Remove SSO app content
-        # delete all sso application migrations
-        migrations.RunSQL("DELETE FROM django_migrations WHERE app = 'sso';"),
-        # delete all sso application content group permissions
-        migrations.RunSQL(
-            "DELETE FROM auth_group_permissions "
-            "WHERE permission_id IN "
-            "(SELECT id FROM auth_permission WHERE content_type_id in (SELECT id FROM django_content_type WHERE app_label = 'sso'));"
-        ),
-        # delete all sso application content permissions
-        migrations.RunSQL("DELETE FROM auth_permission " "WHERE content_type_id IN (SELECT id FROM django_content_type WHERE app_label = 'sso');"),
-        # delete sso application content type
-        migrations.RunSQL("DELETE FROM django_content_type WHERE app_label = 'sso';"),
-        # drop sso application created table
-        migrations.RunSQL("DROP TABLE IF EXISTS sso_userenterpriseauth;"),
-        # Alter inventory source source field
-        migrations.AlterField(
-            model_name='inventorysource',
-            name='source',
-            field=models.CharField(default=None, max_length=32),
-        ),
-        migrations.AlterField(
-            model_name='inventoryupdate',
-            name='source',
-            field=models.CharField(default=None, max_length=32),
-        ),
-        # Alter OAuth2Application unique together
-        migrations.AlterUniqueTogether(
-            name='oauth2application',
-            unique_together=None,
-        ),
-        migrations.RemoveField(
-            model_name='oauth2application',
-            name='organization',
-        ),
-        migrations.RemoveField(
-            model_name='oauth2application',
-            name='user',
-        ),
-        migrations.RemoveField(
-            model_name='activitystream',
-            name='o_auth2_access_token',
-        ),
-        migrations.RemoveField(
-            model_name='activitystream',
-            name='o_auth2_application',
-        ),
-        migrations.DeleteModel(
-            name='OAuth2AccessToken',
-        ),
-        migrations.DeleteModel(
-            name='OAuth2Application',
-        ),
-        # Delete system token cleanup jobs, because tokens were deleted
-        migrations.RunPython(delete_clear_tokens_sjt, migrations.RunPython.noop),
-        migrations.AlterField(
-            model_name='systemjob',
-            name='job_type',
-            field=models.CharField(
-                blank=True,
-                choices=[
-                    ('cleanup_jobs', 'Remove jobs older than a certain number of days'),
-                    ('cleanup_activitystream', 'Remove activity stream entries older than a certain number of days'),
-                    ('cleanup_sessions', 'Removes expired browser sessions from the database'),
-                ],
-                default='',
-                max_length=32,
-            ),
-        ),
-        migrations.AlterField(
-            model_name='systemjobtemplate',
-            name='job_type',
-            field=models.CharField(
-                blank=True,
-                choices=[
-                    ('cleanup_jobs', 'Remove jobs older than a certain number of days'),
-                    ('cleanup_activitystream', 'Remove activity stream entries older than a certain number of days'),
-                    ('cleanup_sessions', 'Removes expired browser sessions from the database'),
-                ],
-                default='',
-                max_length=32,
-            ),
-        ),
-    ]

awx/main/migrations/0202_unifiedjob_priority_unifiedjobtemplate_priority.py

@@ -0,0 +1,27 @@
+# Generated by Django 4.2.16 on 2025-03-11 14:40
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('main', '0201_delete_token_cleanup_job'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='unifiedjob',
+            name='priority',
+            field=models.PositiveIntegerField(
+                default=0,
+                editable=False,
+                help_text='Relative priority to other jobs. The higher the number, the higher the priority. Jobs with equivalent prioirty are started based on available capacity and launch time.',
+            ),
+        ),
+        migrations.AddField(
+            model_name='unifiedjobtemplate',
+            name='priority',
+            field=models.PositiveIntegerField(default=0),
+        ),
+    ]

awx/main/migrations/_dab_rbac.py

@@ -17,13 +17,7 @@ logger = logging.getLogger('awx.main.migrations._dab_rbac')
 
 
 def create_permissions_as_operation(apps, schema_editor):
-    # NOTE: the DAB ContentType changes adjusted how they fire
-    # before they would fire on every app config, like contenttypes
     create_dab_permissions(global_apps.get_app_config("main"), apps=apps)
-    # This changed to only fire once and do a global creation
-    # so we need to call it for specifically the dab_rbac app
-    # multiple calls will not hurt anything
-    create_dab_permissions(global_apps.get_app_config("dab_rbac"), apps=apps)
 
 
 """
@@ -118,12 +112,7 @@ def get_descendents(f, children_map):
 
 def get_permissions_for_role(role_field, children_map, apps):
     Permission = apps.get_model('dab_rbac', 'DABPermission')
-    try:
-        # After migration for remote permissions
-        ContentType = apps.get_model('dab_rbac', 'DABContentType')
-    except LookupError:
-        # If using DAB from before remote permissions are implemented
-        ContentType = apps.get_model('contenttypes', 'ContentType')
+    ContentType = apps.get_model('contenttypes', 'ContentType')
 
     perm_list = []
     for child_field in get_descendents(role_field, children_map):
@@ -292,13 +281,7 @@ def setup_managed_role_definitions(apps, schema_editor):
         'special': '{cls.__name__} {action}',
     }
 
-    try:
-        # After migration for remote permissions
-        ContentType = apps.get_model('dab_rbac', 'DABContentType')
-    except LookupError:
-        # If using DAB from before remote permissions are implemented
-        ContentType = apps.get_model('contenttypes', 'ContentType')
-
+    ContentType = apps.get_model('contenttypes', 'ContentType')
     Permission = apps.get_model('dab_rbac', 'DABPermission')
     RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
     Organization = apps.get_model(settings.ANSIBLE_BASE_ORGANIZATION_MODEL)

awx/main/migrations/_db_constraints.py

@@ -1,25 +0,0 @@
-import logging
-
-from django.db.models import Count
-
-
-logger = logging.getLogger(__name__)
-
-
-def _rename_duplicates(cls):
-    field = cls._meta.get_field('name')
-    max_len = field.max_length
-    for organization_id in cls.objects.order_by().values_list('organization_id', flat=True).distinct():
-        duplicate_data = cls.objects.values('name').filter(organization_id=organization_id).annotate(count=Count('name')).order_by().filter(count__gt=1)
-        for data in duplicate_data:
-            name = data['name']
-            for idx, ujt in enumerate(cls.objects.filter(name=name, organization_id=organization_id).order_by('created')):
-                if idx > 0:
-                    suffix = f'_dup{idx}'
-                    max_chars = max_len - len(suffix)
-                    if len(ujt.name) >= max_chars:
-                        ujt.name = ujt.name[:max_chars] + suffix
-                    else:
-                        ujt.name = ujt.name + suffix
-                    logger.info(f'Renaming duplicate {cls._meta.model_name} to `{ujt.name}` because of duplicate name entry')
-                    ujt.save(update_fields=['name'])

awx/main/models/__init__.py

@@ -33,7 +33,6 @@ from awx.main.models.inventory import (  # noqa
     InventorySource,
     InventoryUpdate,
     SmartInventoryMembership,
-    InventoryGroupVariablesWithHistory,
 )
 from awx.main.models.jobs import (  # noqa
     Job,

awx/main/models/events.py

@@ -24,7 +24,6 @@ from awx.main.managers import DeferJobCreatedManager
 from awx.main.constants import MINIMAL_EVENTS
 from awx.main.models.base import CreatedModifiedModel
 from awx.main.utils import ignore_inventory_computed_fields, camelcase_to_underscore
-from awx.main.utils.db import bulk_update_sorted_by_id
 
 analytics_logger = logging.getLogger('awx.analytics.job_events')
 
@@ -603,7 +602,7 @@ class JobEvent(BasePlaybookEvent):
                     h.last_job_host_summary_id = host_mapping[h.id]
                     updated_hosts.add(h)
 
-            bulk_update_sorted_by_id(Host, updated_hosts, ['last_job_id', 'last_job_host_summary_id'])
+            Host.objects.bulk_update(list(updated_hosts), ['last_job_id', 'last_job_host_summary_id'], batch_size=100)
 
             # Create/update Host Metrics
             self._update_host_metrics(updated_hosts_list)

awx/main/models/inventory.py

@@ -1120,10 +1120,8 @@ class InventorySource(UnifiedJobTemplate, InventorySourceOptions, CustomVirtualE
 
     def save(self, *args, **kwargs):
         # if this is a new object, inherit organization from its inventory
-        if not self.pk:
-            self.org_unique = False  # needed to exclude from unique (name, organization) constraint
-            if self.inventory and self.inventory.organization_id and not self.organization_id:
-                self.organization_id = self.inventory.organization_id
+        if not self.pk and self.inventory and self.inventory.organization_id and not self.organization_id:
+            self.organization_id = self.inventory.organization_id
 
         # If update_fields has been specified, add our field names to it,
         # if it hasn't been specified, then we're just doing a normal save.
@@ -1404,38 +1402,3 @@ class CustomInventoryScript(CommonModelNameNotUnique):
 
     def get_absolute_url(self, request=None):
         return reverse('api:inventory_script_detail', kwargs={'pk': self.pk}, request=request)
-
-
-class InventoryGroupVariablesWithHistory(models.Model):
-    """
-    Represents the inventory variables of one inventory group.
-
-    The purpose of this model is to persist the update history of the group
-    variables. The update history is maintained in another class
-    (`InventoryGroupVariables`), this class here is just a container for the
-    database storage.
-    """
-
-    class Meta:
-        constraints = [
-            # Do not allow the same inventory/group combination more than once.
-            models.UniqueConstraint(
-                fields=["inventory", "group"],
-                name="unique_inventory_group",
-                violation_error_message=_("Inventory/Group combination must be unique."),
-            ),
-        ]
-
-    inventory = models.ForeignKey(
-        'Inventory',
-        related_name='inventory_group_variables',
-        null=True,
-        on_delete=models.CASCADE,
-    )
-    group = models.ForeignKey(  # `None` denotes the 'all'-group.
-        'Group',
-        related_name='inventory_group_variables',
-        null=True,
-        on_delete=models.CASCADE,
-    )
-    variables = models.JSONField()  # The group variables, including their history.

awx/main/models/jobs.py

@@ -298,6 +298,7 @@ class JobTemplate(
                 'organization',
                 'survey_passwords',
                 'labels',
+                'priority',
                 'credentials',
                 'job_slice_number',
                 'job_slice_count',
@@ -358,6 +359,26 @@ class JobTemplate(
                 update_fields.append('organization_id')
         return super(JobTemplate, self).save(*args, **kwargs)
 
+    def validate_unique(self, exclude=None):
+        """Custom over-ride for JT specifically
+        because organization is inferred from project after full_clean is finished
+        thus the organization field is not yet set when validation happens
+        """
+        errors = []
+        for ut in JobTemplate.SOFT_UNIQUE_TOGETHER:
+            kwargs = {'name': self.name}
+            if self.project:
+                kwargs['organization'] = self.project.organization_id
+            else:
+                kwargs['organization'] = None
+            qs = JobTemplate.objects.filter(**kwargs)
+            if self.pk:
+                qs = qs.exclude(pk=self.pk)
+            if qs.exists():
+                errors.append('%s with this (%s) combination already exists.' % (JobTemplate.__name__, ', '.join(set(ut) - {'polymorphic_ctype'})))
+        if errors:
+            raise ValidationError(errors)
+
     def create_unified_job(self, **kwargs):
         prevent_slicing = kwargs.pop('_prevent_slicing', False)
         slice_ct = self.get_effective_slice_ct(kwargs)
@@ -384,26 +405,6 @@ class JobTemplate(
                 WorkflowJobNode.objects.create(**create_kwargs)
         return job
 
-    def validate_unique(self, exclude=None):
-        """Custom over-ride for JT specifically
-        because organization is inferred from project after full_clean is finished
-        thus the organization field is not yet set when validation happens
-        """
-        errors = []
-        for ut in JobTemplate.SOFT_UNIQUE_TOGETHER:
-            kwargs = {'name': self.name}
-            if self.project:
-                kwargs['organization'] = self.project.organization_id
-            else:
-                kwargs['organization'] = None
-            qs = JobTemplate.objects.filter(**kwargs)
-            if self.pk:
-                qs = qs.exclude(pk=self.pk)
-            if qs.exists():
-                errors.append('%s with this (%s) combination already exists.' % (JobTemplate.__name__, ', '.join(set(ut) - {'polymorphic_ctype'})))
-        if errors:
-            raise ValidationError(errors)
-
     def get_absolute_url(self, request=None):
         return reverse('api:job_template_detail', kwargs={'pk': self.pk}, request=request)
 
@@ -1175,7 +1176,7 @@ class SystemJobTemplate(UnifiedJobTemplate, SystemJobOptions):
 
     @classmethod
     def _get_unified_job_field_names(cls):
-        return ['name', 'description', 'organization', 'job_type', 'extra_vars']
+        return ['name', 'description', 'organization', 'priority', 'job_type', 'extra_vars']
 
     def get_absolute_url(self, request=None):
         return reverse('api:system_job_template_detail', kwargs={'pk': self.pk}, request=request)

awx/main/models/mixins.py

@@ -86,7 +86,7 @@ class ResourceMixin(models.Model):
             raise RuntimeError(f'Role filters only valid for users and ancestor role, received {accessor}')
 
         if content_types is None:
-            ct_kwarg = dict(content_type=ContentType.objects.get_for_model(cls))
+            ct_kwarg = dict(content_type_id=ContentType.objects.get_for_model(cls).id)
         else:
             ct_kwarg = dict(content_type_id__in=content_types)
 

awx/main/models/projects.py

@@ -354,7 +354,7 @@ class Project(UnifiedJobTemplate, ProjectOptions, ResourceMixin, CustomVirtualEn
 
     @classmethod
     def _get_unified_job_field_names(cls):
-        return set(f.name for f in ProjectOptions._meta.fields) | set(['name', 'description', 'organization'])
+        return set(f.name for f in ProjectOptions._meta.fields) | set(['name', 'description', 'priority', 'organization'])
 
     def clean_organization(self):
         if self.pk:

awx/main/models/rbac.py

@@ -27,7 +27,6 @@ from django.conf import settings
 
 # Ansible_base app
 from ansible_base.rbac.models import RoleDefinition, RoleUserAssignment, RoleTeamAssignment
-from ansible_base.rbac import permission_registry
 from ansible_base.lib.utils.models import get_type_for_model
 
 # AWX
@@ -562,7 +561,7 @@ def get_role_definition(role):
     model_print = type(obj).__name__
     perm_list = get_role_codenames(role)
     defaults = {
-        'content_type': permission_registry.content_type_model.objects.get_by_natural_key(role.content_type.app_label, role.content_type.model),
+        'content_type_id': role.content_type_id,
         'description': f'Has {action_name.title()} permission to {model_print} for backwards API compatibility',
     }
     # use Controller-specific role definitions for Team/Organization and member/admin

awx/main/models/unified_jobs.py

@@ -18,13 +18,11 @@ from collections import OrderedDict
 # Django
 from django.conf import settings
 from django.db import models, connection, transaction
-from django.db.models.constraints import UniqueConstraint
 from django.core.exceptions import NON_FIELD_ERRORS
 from django.utils.translation import gettext_lazy as _
 from django.utils.timezone import now
 from django.utils.encoding import smart_str
 from django.contrib.contenttypes.models import ContentType
-from flags.state import flag_enabled
 
 # REST Framework
 from rest_framework.exceptions import ParseError
@@ -34,7 +32,6 @@ from polymorphic.models import PolymorphicModel
 
 from ansible_base.lib.utils.models import prevent_search, get_type_for_model
 from ansible_base.rbac import permission_registry
-from ansible_base.rbac.models import RoleEvaluation
 
 # AWX
 from awx.main.models.base import CommonModelNameNotUnique, PasswordFieldsModel, NotificationFieldsModel
@@ -114,16 +111,18 @@ class UnifiedJobTemplate(PolymorphicModel, CommonModelNameNotUnique, ExecutionEn
         ordering = ('name',)
         # unique_together here is intentionally commented out. Please make sure sub-classes of this model
         # contain at least this uniqueness restriction: SOFT_UNIQUE_TOGETHER = [('polymorphic_ctype', 'name')]
-        # Unique name constraint - note that inventory source model is excluded from this constraint entirely
-        constraints = [
-            UniqueConstraint(fields=['polymorphic_ctype', 'name', 'organization'], condition=models.Q(org_unique=True), name='ujt_hard_name_constraint')
-        ]
+        # unique_together = [('polymorphic_ctype', 'name', 'organization')]
 
     old_pk = models.PositiveIntegerField(
         null=True,
         default=None,
         editable=False,
     )
+    priority = models.PositiveIntegerField(
+        null=False,
+        default=0,
+        editable=True,
+    )
     current_job = models.ForeignKey(
         'UnifiedJob',
         null=True,
@@ -186,9 +185,6 @@ class UnifiedJobTemplate(PolymorphicModel, CommonModelNameNotUnique, ExecutionEn
     )
     labels = models.ManyToManyField("Label", blank=True, related_name='%(class)s_labels')
     instance_groups = OrderedManyToManyField('InstanceGroup', blank=True, through='UnifiedJobTemplateInstanceGroupMembership')
-    org_unique = models.BooleanField(
-        blank=True, default=True, editable=False, help_text=_('Used internally to selectively enforce database constraint on name')
-    )
 
     def get_absolute_url(self, request=None):
         real_instance = self.get_real_instance()
@@ -219,21 +215,20 @@ class UnifiedJobTemplate(PolymorphicModel, CommonModelNameNotUnique, ExecutionEn
         # do not use this if in a subclass
         if cls != UnifiedJobTemplate:
             return super(UnifiedJobTemplate, cls).accessible_pk_qs(accessor, role_field)
+        from ansible_base.rbac.models import RoleEvaluation
 
         action = to_permissions[role_field]
 
         # Special condition for super auditor
         role_subclasses = cls._submodels_with_roles()
+        role_cts = ContentType.objects.get_for_models(*role_subclasses).values()
         all_codenames = {f'{action}_{cls._meta.model_name}' for cls in role_subclasses}
         if not (all_codenames - accessor.singleton_permissions()):
-            role_cts = ContentType.objects.get_for_models(*role_subclasses).values()
             qs = cls.objects.filter(polymorphic_ctype__in=role_cts)
             return qs.values_list('id', flat=True)
 
-        dab_role_cts = permission_registry.content_type_model.objects.get_for_models(*role_subclasses).values()
-
         return (
-            RoleEvaluation.objects.filter(role__in=accessor.has_roles.all(), codename__in=all_codenames, content_type_id__in=[ct.id for ct in dab_role_cts])
+            RoleEvaluation.objects.filter(role__in=accessor.has_roles.all(), codename__in=all_codenames, content_type_id__in=[ct.id for ct in role_cts])
             .values_list('object_id')
             .distinct()
         )
@@ -595,6 +590,13 @@ class UnifiedJob(
         default=None,
         editable=False,
     )
+    priority = models.PositiveIntegerField(
+        default=0,
+        editable=False,
+        help_text=_(
+            "Relative priority to other jobs. The higher the number, the higher the priority. Jobs with equivalent prioirty are started based on available capacity and launch time."
+        ),
+    )
     emitted_events = models.PositiveIntegerField(
         default=0,
         editable=False,
@@ -1372,30 +1374,7 @@ class UnifiedJob(
             traceback=self.result_traceback,
         )
 
-    def get_start_kwargs(self):
-        needed = self.get_passwords_needed_to_start()
-
-        decrypted_start_args = decrypt_field(self, 'start_args')
-
-        if not decrypted_start_args or decrypted_start_args == '{}':
-            return None
-
-        try:
-            start_args = json.loads(decrypted_start_args)
-        except Exception:
-            logger.exception(f'Unexpected malformed start_args on unified_job={self.id}')
-            return None
-
-        opts = dict([(field, start_args.get(field, '')) for field in needed])
-
-        if not all(opts.values()):
-            missing_fields = ', '.join([k for k, v in opts.items() if not v])
-            self.job_explanation = u'Missing needed fields: %s.' % missing_fields
-            self.save(update_fields=['job_explanation'])
-
-        return opts
-
-    def pre_start(self):
+    def pre_start(self, **kwargs):
         if not self.can_start:
             self.job_explanation = u'%s is not in a startable state: %s, expecting one of %s' % (self._meta.verbose_name, self.status, str(('new', 'waiting')))
             self.save(update_fields=['job_explanation'])
@@ -1416,11 +1395,26 @@ class UnifiedJob(
                 self.save(update_fields=['job_explanation'])
                 return (False, None)
 
-        opts = self.get_start_kwargs()
+        needed = self.get_passwords_needed_to_start()
+        try:
+            start_args = json.loads(decrypt_field(self, 'start_args'))
+        except Exception:
+            start_args = None
 
-        if opts and (not all(opts.values())):
+        if start_args in (None, ''):
+            start_args = kwargs
+
+        opts = dict([(field, start_args.get(field, '')) for field in needed])
+
+        if not all(opts.values()):
+            missing_fields = ', '.join([k for k, v in opts.items() if not v])
+            self.job_explanation = u'Missing needed fields: %s.' % missing_fields
+            self.save(update_fields=['job_explanation'])
             return (False, None)
 
+        if 'extra_vars' in kwargs:
+            self.handle_extra_data(kwargs['extra_vars'])
+
         # remove any job_explanations that may have been set while job was in pending
         if self.job_explanation != "":
             self.job_explanation = ""
@@ -1481,44 +1475,21 @@ class UnifiedJob(
     def cancel_dispatcher_process(self):
         """Returns True if dispatcher running this job acknowledged request and sent SIGTERM"""
         if not self.celery_task_id:
-            return False
-
+            return
         canceled = []
-        # Special case for task manager (used during workflow job cancellation)
         if not connection.get_autocommit():
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                try:
-                    from dispatcherd.factories import get_control_from_settings
-
-                    ctl = get_control_from_settings()
-                    ctl.control('cancel', data={'uuid': self.celery_task_id})
-                except Exception:
-                    logger.exception("Error sending cancel command to new dispatcher")
-            else:
-                try:
-                    ControlDispatcher('dispatcher', self.controller_node).cancel([self.celery_task_id], with_reply=False)
-                except Exception:
-                    logger.exception("Error sending cancel command to legacy dispatcher")
+            # this condition is purpose-written for the task manager, when it cancels jobs in workflows
+            ControlDispatcher('dispatcher', self.controller_node).cancel([self.celery_task_id], with_reply=False)
             return True  # task manager itself needs to act under assumption that cancel was received
 
-        # Standard case with reply
         try:
+            # Use control and reply mechanism to cancel and obtain confirmation
             timeout = 5
-            if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-                from dispatcherd.factories import get_control_from_settings
-
-                ctl = get_control_from_settings()
-                results = ctl.control_with_reply('cancel', data={'uuid': self.celery_task_id}, expected_replies=1, timeout=timeout)
-                # Check if cancel was successful by checking if we got any results
-                return bool(results and len(results) > 0)
-            else:
-                # Original implementation
-                canceled = ControlDispatcher('dispatcher', self.controller_node).cancel([self.celery_task_id])
+            canceled = ControlDispatcher('dispatcher', self.controller_node).cancel([self.celery_task_id])
         except socket.timeout:
             logger.error(f'could not reach dispatcher on {self.controller_node} within {timeout}s')
         except Exception:
             logger.exception("error encountered when checking task status")
-
         return bool(self.celery_task_id in canceled)  # True or False, whether confirmation was obtained
 
     def cancel(self, job_explanation=None, is_chain=False):

awx/main/models/workflow.py

@@ -416,7 +416,7 @@ class WorkflowJobOptions(LaunchTimeConfigBase):
     @classmethod
     def _get_unified_job_field_names(cls):
         r = set(f.name for f in WorkflowJobOptions._meta.fields) | set(
-            ['name', 'description', 'organization', 'survey_passwords', 'labels', 'limit', 'scm_branch', 'job_tags', 'skip_tags']
+            ['name', 'description', 'organization', 'survey_passwords', 'labels', 'limit', 'scm_branch', 'priority', 'job_tags', 'skip_tags']
         )
         r.remove('char_prompts')  # needed due to copying launch config to launch config
         return r

awx/main/notifications/grafana_backend.py

@@ -53,8 +53,8 @@ class GrafanaBackend(AWXBaseEmailBackend, CustomNotificationBase):
     ):
         super(GrafanaBackend, self).__init__(fail_silently=fail_silently)
         self.grafana_key = grafana_key
-        self.dashboardId = int(dashboardId) if dashboardId is not None and panelId != "" else None
-        self.panelId = int(panelId) if panelId is not None and panelId != "" else None
+        self.dashboardId = int(dashboardId) if dashboardId is not None else None
+        self.panelId = int(panelId) if panelId is not None else None
         self.annotation_tags = annotation_tags if annotation_tags is not None else []
         self.grafana_no_verify_ssl = grafana_no_verify_ssl
         self.isRegion = isRegion
@@ -97,7 +97,6 @@ class GrafanaBackend(AWXBaseEmailBackend, CustomNotificationBase):
             r = requests.post(
                 "{}/api/annotations".format(m.recipients()[0]), json=grafana_data, headers=grafana_headers, verify=(not self.grafana_no_verify_ssl)
             )
-
             if r.status_code >= 400:
                 logger.error(smart_str(_("Error sending notification grafana: {}").format(r.status_code)))
                 if not self.fail_silently:

awx/main/scheduler/kubernetes.py

@@ -174,9 +174,6 @@ class PodManager(object):
             )
             pod_spec['spec']['containers'][0]['name'] = self.pod_name
 
-        # Prevent mounting of service account token in job pods in order to prevent job pods from accessing the k8s API via in cluster service account auth
-        pod_spec['spec']['automountServiceAccountToken'] = False
-
         return pod_spec
 
 

awx/main/scheduler/task_manager.py

@@ -10,8 +10,6 @@ import time
 import sys
 import signal
 
-import redis
-
 # Django
 from django.db import transaction
 from django.utils.translation import gettext_lazy as _, gettext_noop
@@ -19,9 +17,6 @@ from django.utils.timezone import now as tz_now
 from django.conf import settings
 from django.contrib.contenttypes.models import ContentType
 
-# django-flags
-from flags.state import flag_enabled
-
 from ansible_base.lib.utils.models import get_type_for_model
 
 # django-ansible-base
@@ -51,7 +46,6 @@ from awx.main.signals import disable_activity_stream
 from awx.main.constants import ACTIVE_STATES
 from awx.main.scheduler.dependency_graph import DependencyGraph
 from awx.main.scheduler.task_manager_models import TaskManagerModels
-from awx.main.tasks.jobs import dispatch_waiting_jobs
 import awx.main.analytics.subsystem_metrics as s_metrics
 from awx.main.utils import decrypt_field
 
@@ -103,7 +97,7 @@ class TaskBase:
             UnifiedJob.objects.filter(**filter_args)
             .exclude(launch_type='sync')
             .exclude(polymorphic_ctype_id=wf_approval_ctype_id)
-            .order_by('created')
+            .order_by('-priority', 'created')
             .prefetch_related('dependent_jobs')
         )
         self.all_tasks = [t for t in qs]
@@ -126,8 +120,6 @@ class TaskBase:
                     self.subsystem_metrics.pipe_execute()
                 else:
                     logger.debug(f"skipping recording {self.prefix} metrics, last recorded {time_last_recorded} seconds ago")
-            except redis.exceptions.ConnectionError as exc:
-                logger.warning(f"Redis connection error saving metrics for {self.prefix}, error: {exc}")
             except Exception:
                 logger.exception(f"Error saving metrics for {self.prefix}")
 
@@ -294,7 +286,7 @@ class WorkflowManager(TaskBase):
 
     @timeit
     def get_tasks(self, filter_args):
-        self.all_tasks = [wf for wf in WorkflowJob.objects.filter(**filter_args)]
+        self.all_tasks = [wf for wf in WorkflowJob.objects.filter(**filter_args).order_by('-priority', 'created')]
 
     @timeit
     def _schedule(self):
@@ -344,12 +336,14 @@ class DependencyManager(TaskBase):
 
         return bool(((update.finished + timedelta(seconds=cache_timeout))) < tz_now())
 
-    def get_or_create_project_update(self, project_id):
+    def get_or_create_project_update(self, task):
+        project_id = task.project_id
+        priority = task.priority
         project = self.all_projects.get(project_id, None)
         if project is not None:
             latest_project_update = project.project_updates.filter(job_type='check').order_by("-created").first()
             if self.should_update_again(latest_project_update, project.scm_update_cache_timeout):
-                project_task = project.create_project_update(_eager_fields=dict(launch_type='dependency'))
+                project_task = project.create_project_update(_eager_fields=dict(launch_type='dependency', priority=priority))
                 project_task.signal_start()
                 return [project_task]
             else:
@@ -357,7 +351,7 @@ class DependencyManager(TaskBase):
         return []
 
     def gen_dep_for_job(self, task):
-        dependencies = self.get_or_create_project_update(task.project_id)
+        dependencies = self.get_or_create_project_update(task)
 
         try:
             start_args = json.loads(decrypt_field(task, field_name="start_args"))
@@ -369,7 +363,7 @@ class DependencyManager(TaskBase):
                 continue
             latest_inventory_update = inventory_source.inventory_updates.order_by("-created").first()
             if self.should_update_again(latest_inventory_update, inventory_source.update_cache_timeout):
-                inventory_task = inventory_source.create_inventory_update(_eager_fields=dict(launch_type='dependency'))
+                inventory_task = inventory_source.create_inventory_update(_eager_fields=dict(launch_type='dependency', priority=task.priority))
                 inventory_task.signal_start()
                 dependencies.append(inventory_task)
             else:
@@ -435,7 +429,6 @@ class TaskManager(TaskBase):
         # 5 minutes to start pending jobs. If this limit is reached, pending jobs
         # will no longer be started and will be started on the next task manager cycle.
         self.time_delta_job_explanation = timedelta(seconds=30)
-        self.control_nodes_to_notify: set[str] = set()
         super().__init__(prefix="task_manager")
 
     def after_lock_init(self):
@@ -524,19 +517,16 @@ class TaskManager(TaskBase):
                 task.save()
                 task.log_lifecycle("waiting")
 
-        if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-            self.control_nodes_to_notify.add(task.get_queue_name())
-        else:
-            # apply_async does a NOTIFY to the channel dispatcher is listening to
-            # postgres will treat this as part of the transaction, which is what we want
-            if task.status != 'failed' and type(task) is not WorkflowJob:
-                task_cls = task._get_task_class()
-                task_cls.apply_async(
-                    [task.pk],
-                    opts,
-                    queue=task.get_queue_name(),
-                    uuid=task.celery_task_id,
-                )
+        # apply_async does a NOTIFY to the channel dispatcher is listening to
+        # postgres will treat this as part of the transaction, which is what we want
+        if task.status != 'failed' and type(task) is not WorkflowJob:
+            task_cls = task._get_task_class()
+            task_cls.apply_async(
+                [task.pk],
+                opts,
+                queue=task.get_queue_name(),
+                uuid=task.celery_task_id,
+            )
 
         # In exception cases, like a job failing pre-start checks, we send the websocket status message.
         # For jobs going into waiting, we omit this because of performance issues, as it should go to running quickly
@@ -729,8 +719,3 @@ class TaskManager(TaskBase):
 
         for workflow_approval in self.get_expired_workflow_approvals():
             self.timeout_approval_node(workflow_approval)
-
-        if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-            for controller_node in self.control_nodes_to_notify:
-                logger.info(f'Notifying node {controller_node} of new waiting jobs.')
-                dispatch_waiting_jobs.apply_async(queue=controller_node)

awx/main/scheduler/tasks.py

@@ -7,7 +7,7 @@ from django.conf import settings
 # AWX
 from awx import MODE
 from awx.main.scheduler import TaskManager, DependencyManager, WorkflowManager
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 from awx.main.dispatch import get_task_queuename
 
 logger = logging.getLogger('awx.main.scheduler')
@@ -20,16 +20,16 @@ def run_manager(manager, prefix):
     manager().schedule()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def task_manager():
     run_manager(TaskManager, "task")
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def dependency_manager():
     run_manager(DependencyManager, "dependency")
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def workflow_manager():
     run_manager(WorkflowManager, "workflow")

awx/main/tasks/__init__.py

@@ -1 +1 @@
-from . import callback, facts, helpers, host_indirect, host_metrics, jobs, receptor, system  # noqa
+from . import host_metrics, jobs, receptor, system  # noqa

awx/main/tasks/facts.py

@@ -6,15 +6,16 @@ import logging
 
 # Django
 from django.conf import settings
+from django.db.models.query import QuerySet
 from django.utils.encoding import smart_str
 from django.utils.timezone import now
+from django.db import OperationalError
 
 # django-ansible-base
 from ansible_base.lib.logging.runtime import log_excess_runtime
 
 # AWX
-from awx.main.utils.db import bulk_update_sorted_by_id
-from awx.main.models import Host
+from awx.main.models.inventory import Host
 
 
 logger = logging.getLogger('awx.main.tasks.facts')
@@ -22,51 +23,63 @@ system_tracking_logger = logging.getLogger('awx.analytics.system_tracking')
 
 
 @log_excess_runtime(logger, debug_cutoff=0.01, msg='Inventory {inventory_id} host facts prepared for {written_ct} hosts, took {delta:.3f} s', add_log_data=True)
-def start_fact_cache(hosts, artifacts_dir, timeout=None, inventory_id=None, log_data=None):
-    log_data = log_data or {}
+def start_fact_cache(hosts, destination, log_data, timeout=None, inventory_id=None):
     log_data['inventory_id'] = inventory_id
     log_data['written_ct'] = 0
-    hosts_cached = []
-
-    # Create the fact_cache directory inside artifacts_dir
-    fact_cache_dir = os.path.join(artifacts_dir, 'fact_cache')
-    os.makedirs(fact_cache_dir, mode=0o700, exist_ok=True)
+    try:
+        os.makedirs(destination, mode=0o700)
+    except FileExistsError:
+        pass
 
     if timeout is None:
         timeout = settings.ANSIBLE_FACT_CACHE_TIMEOUT
 
-    last_write_time = None
+    if isinstance(hosts, QuerySet):
+        hosts = hosts.iterator()
 
+    last_filepath_written = None
     for host in hosts:
-        hosts_cached.append(host.name)
-        if not host.ansible_facts_modified or (timeout and host.ansible_facts_modified < now() - datetime.timedelta(seconds=timeout)):
+        if (not host.ansible_facts_modified) or (timeout and host.ansible_facts_modified < now() - datetime.timedelta(seconds=timeout)):
             continue  # facts are expired - do not write them
-
-        filepath = os.path.join(fact_cache_dir, host.name)
-        if not os.path.realpath(filepath).startswith(fact_cache_dir):
-            logger.error(f'facts for host {smart_str(host.name)} could not be cached')
+        filepath = os.sep.join(map(str, [destination, host.name]))
+        if not os.path.realpath(filepath).startswith(destination):
+            system_tracking_logger.error('facts for host {} could not be cached'.format(smart_str(host.name)))
             continue
-
         try:
             with codecs.open(filepath, 'w', encoding='utf-8') as f:
                 os.chmod(f.name, 0o600)
                 json.dump(host.ansible_facts, f)
                 log_data['written_ct'] += 1
-                last_write_time = os.path.getmtime(filepath)
+                last_filepath_written = filepath
         except IOError:
-            logger.error(f'facts for host {smart_str(host.name)} could not be cached')
+            system_tracking_logger.error('facts for host {} could not be cached'.format(smart_str(host.name)))
             continue
+    # make note of the time we wrote the last file so we can check if any file changed later
+    if last_filepath_written:
+        return os.path.getmtime(last_filepath_written)
+    return None
 
-    # Write summary file directly to the artifacts_dir
-    if inventory_id is not None:
-        summary_file = os.path.join(artifacts_dir, 'host_cache_summary.json')
-        summary_data = {
-            'last_write_time': last_write_time,
-            'hosts_cached': hosts_cached,
-            'written_ct': log_data['written_ct'],
-        }
-        with open(summary_file, 'w', encoding='utf-8') as f:
-            json.dump(summary_data, f, indent=2)
+
+def raw_update_hosts(host_list):
+    Host.objects.bulk_update(host_list, ['ansible_facts', 'ansible_facts_modified'])
+
+
+def update_hosts(host_list, max_tries=5):
+    if not host_list:
+        return
+    for i in range(max_tries):
+        try:
+            raw_update_hosts(host_list)
+        except OperationalError as exc:
+            # Deadlocks can happen if this runs at the same time as another large query
+            # inventory updates and updating last_job_host_summary are candidates for conflict
+            # but these would resolve easily on a retry
+            if i + 1 < max_tries:
+                logger.info(f'OperationalError (suspected deadlock) saving host facts retry {i}, message: {exc}')
+                continue
+            else:
+                raise
+        break
 
 
 @log_excess_runtime(
@@ -75,54 +88,35 @@ def start_fact_cache(hosts, artifacts_dir, timeout=None, inventory_id=None, log_
     msg='Inventory {inventory_id} host facts: updated {updated_ct}, cleared {cleared_ct}, unchanged {unmodified_ct}, took {delta:.3f} s',
     add_log_data=True,
 )
-def finish_fact_cache(artifacts_dir, job_id=None, inventory_id=None, log_data=None):
-    log_data = log_data or {}
+def finish_fact_cache(hosts, destination, facts_write_time, log_data, job_id=None, inventory_id=None):
     log_data['inventory_id'] = inventory_id
     log_data['updated_ct'] = 0
     log_data['unmodified_ct'] = 0
     log_data['cleared_ct'] = 0
-    # The summary file is directly inside the artifacts dir
-    summary_path = os.path.join(artifacts_dir, 'host_cache_summary.json')
-    if not os.path.exists(summary_path):
-        logger.error(f'Missing summary file at {summary_path}')
-        return
 
-    try:
-        with open(summary_path, 'r', encoding='utf-8') as f:
-            summary = json.load(f)
-        facts_write_time = os.path.getmtime(summary_path)  # After successful read
-    except (json.JSONDecodeError, OSError) as e:
-        logger.error(f'Error reading summary file at {summary_path}: {e}')
-        return
+    if isinstance(hosts, QuerySet):
+        hosts = hosts.iterator()
 
-    host_names = summary.get('hosts_cached', [])
-    hosts_cached = Host.objects.filter(name__in=host_names).order_by('id').iterator()
-    # Path where individual fact files were written
-    fact_cache_dir = os.path.join(artifacts_dir, 'fact_cache')
     hosts_to_update = []
-
-    for host in hosts_cached:
-        filepath = os.path.join(fact_cache_dir, host.name)
-        if not os.path.realpath(filepath).startswith(fact_cache_dir):
-            logger.error(f'Invalid path for facts file: {filepath}')
+    for host in hosts:
+        filepath = os.sep.join(map(str, [destination, host.name]))
+        if not os.path.realpath(filepath).startswith(destination):
+            system_tracking_logger.error('facts for host {} could not be cached'.format(smart_str(host.name)))
             continue
-
         if os.path.exists(filepath):
             # If the file changed since we wrote the last facts file, pre-playbook run...
             modified = os.path.getmtime(filepath)
-            if not facts_write_time or modified >= facts_write_time:
-                try:
-                    with codecs.open(filepath, 'r', encoding='utf-8') as f:
+            if (not facts_write_time) or modified > facts_write_time:
+                with codecs.open(filepath, 'r', encoding='utf-8') as f:
+                    try:
                         ansible_facts = json.load(f)
-                except ValueError:
-                    continue
-
-                if ansible_facts != host.ansible_facts:
+                    except ValueError:
+                        continue
                     host.ansible_facts = ansible_facts
                     host.ansible_facts_modified = now()
                     hosts_to_update.append(host)
-                    logger.info(
-                        f'New fact for inventory {smart_str(host.inventory.name)} host {smart_str(host.name)}',
+                    system_tracking_logger.info(
+                        'New fact for inventory {} host {}'.format(smart_str(host.inventory.name), smart_str(host.name)),
                         extra=dict(
                             inventory_id=host.inventory.id,
                             host_name=host.name,
@@ -132,21 +126,16 @@ def finish_fact_cache(artifacts_dir, job_id=None, inventory_id=None, log_data=No
                         ),
                     )
                     log_data['updated_ct'] += 1
-                else:
-                    log_data['unmodified_ct'] += 1
             else:
                 log_data['unmodified_ct'] += 1
         else:
             # if the file goes missing, ansible removed it (likely via clear_facts)
-            # if the file goes missing, but the host has not started facts, then we should not clear the facts
             host.ansible_facts = {}
             host.ansible_facts_modified = now()
             hosts_to_update.append(host)
-            logger.info(f'Facts cleared for inventory {smart_str(host.inventory.name)} host {smart_str(host.name)}')
+            system_tracking_logger.info('Facts cleared for inventory {} host {}'.format(smart_str(host.inventory.name), smart_str(host.name)))
             log_data['cleared_ct'] += 1
-
-        if len(hosts_to_update) >= 100:
-            bulk_update_sorted_by_id(Host, hosts_to_update, fields=['ansible_facts', 'ansible_facts_modified'])
+        if len(hosts_to_update) > 100:
+            update_hosts(hosts_to_update)
             hosts_to_update = []
-
-    bulk_update_sorted_by_id(Host, hosts_to_update, fields=['ansible_facts', 'ansible_facts_modified'])
+    update_hosts(hosts_to_update)

awx/main/tasks/host_indirect.py

@@ -12,7 +12,7 @@ from django.db import transaction
 # Django flags
 from flags.state import flag_enabled
 
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 from awx.main.dispatch import get_task_queuename
 from awx.main.models.indirect_managed_node_audit import IndirectManagedNodeAudit
 from awx.main.models.event_query import EventQuery
@@ -45,46 +45,26 @@ def build_indirect_host_data(job: Job, job_event_queries: dict[str, dict[str, st
     facts_missing_logged = False
     unhashable_facts_logged = False
 
-    job_event_queries_fqcn = {}
-    for query_k, query_v in job_event_queries.items():
-        if len(parts := query_k.split('.')) != 3:
-            logger.info(f"Skiping malformed query '{query_k}'. Expected to be of the form 'a.b.c'")
-            continue
-        if parts[2] != '*':
-            continue
-        job_event_queries_fqcn['.'.join(parts[0:2])] = query_v
-
     for event in job.job_events.filter(event_data__isnull=False).iterator():
         if 'res' not in event.event_data:
             continue
 
-        if not (resolved_action := event.event_data.get('resolved_action', None)):
+        if 'resolved_action' not in event.event_data or event.event_data['resolved_action'] not in job_event_queries.keys():
             continue
 
-        if len(resolved_action_parts := resolved_action.split('.')) != 3:
-            logger.debug(f"Malformed invocation module name '{resolved_action}'. Expected to be of the form 'a.b.c'")
-            continue
+        resolved_action = event.event_data['resolved_action']
 
-        resolved_action_fqcn = '.'.join(resolved_action_parts[0:2])
-
-        # Match module invocation to collection queries
-        # First match against fully qualified query names i.e. a.b.c
-        # Then try and match against wildcard queries i.e. a.b.*
-        if not (jq_str_for_event := job_event_queries.get(resolved_action, job_event_queries_fqcn.get(resolved_action_fqcn, {})).get('query')):
+        # We expect a dict with a 'query' key for the resolved_action
+        if 'query' not in job_event_queries[resolved_action]:
             continue
 
         # Recall from cache, or process the jq expression, and loop over the jq results
+        jq_str_for_event = job_event_queries[resolved_action]['query']
+
         if jq_str_for_event not in compiled_jq_expressions:
             compiled_jq_expressions[resolved_action] = jq.compile(jq_str_for_event)
         compiled_jq = compiled_jq_expressions[resolved_action]
-
-        try:
-            data_source = compiled_jq.input(event.event_data['res']).all()
-        except Exception as e:
-            logger.warning(f'error for module {resolved_action} and data {event.event_data["res"]}: {e}')
-            continue
-
-        for data in data_source:
+        for data in compiled_jq.input(event.event_data['res']).all():
             # From this jq result (specific to a single Ansible module), get index information about this host record
             if not data.get('canonical_facts'):
                 if not facts_missing_logged:
@@ -159,7 +139,7 @@ def cleanup_old_indirect_host_entries() -> None:
     IndirectManagedNodeAudit.objects.filter(created__lt=limit).delete()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def save_indirect_host_entries(job_id: int, wait_for_events: bool = True) -> None:
     try:
         job = Job.objects.get(id=job_id)
@@ -201,7 +181,7 @@ def save_indirect_host_entries(job_id: int, wait_for_events: bool = True) -> Non
         logger.exception(f'Error processing indirect host data for job_id={job_id}')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def cleanup_and_save_indirect_host_entries_fallback() -> None:
     if not flag_enabled("FEATURE_INDIRECT_NODE_COUNTING_ENABLED"):
         return

awx/main/tasks/host_metrics.py

@@ -7,18 +7,17 @@ from django.db.models import Count, F
 from django.db.models.functions import TruncMonth
 from django.utils.timezone import now
 from awx.main.dispatch import get_task_queuename
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 from awx.main.models.inventory import HostMetric, HostMetricSummaryMonthly
 from awx.main.tasks.helpers import is_run_threshold_reached
 from awx.conf.license import get_license
 from ansible_base.lib.utils.db import advisory_lock
-from awx.main.utils.db import bulk_update_sorted_by_id
 
 
 logger = logging.getLogger('awx.main.tasks.host_metrics')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def cleanup_host_metrics():
     if is_run_threshold_reached(getattr(settings, 'CLEANUP_HOST_METRICS_LAST_TS', None), getattr(settings, 'CLEANUP_HOST_METRICS_INTERVAL', 30) * 86400):
         logger.info(f"Executing cleanup_host_metrics, last ran at {getattr(settings, 'CLEANUP_HOST_METRICS_LAST_TS', '---')}")
@@ -29,7 +28,7 @@ def cleanup_host_metrics():
         logger.info("Finished cleanup_host_metrics")
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def host_metric_summary_monthly():
     """Run cleanup host metrics summary monthly task each week"""
     if is_run_threshold_reached(getattr(settings, 'HOST_METRIC_SUMMARY_TASK_LAST_TS', None), getattr(settings, 'HOST_METRIC_SUMMARY_TASK_INTERVAL', 7) * 86400):
@@ -147,9 +146,8 @@ class HostMetricSummaryMonthlyTask:
                 month = month + relativedelta(months=1)
 
             # Create/Update stats
-            HostMetricSummaryMonthly.objects.bulk_create(self.records_to_create)
-
-            bulk_update_sorted_by_id(HostMetricSummaryMonthly, self.records_to_update, ['license_consumed', 'hosts_added', 'hosts_deleted'])
+            HostMetricSummaryMonthly.objects.bulk_create(self.records_to_create, batch_size=1000)
+            HostMetricSummaryMonthly.objects.bulk_update(self.records_to_update, ['license_consumed', 'hosts_added', 'hosts_deleted'], batch_size=1000)
 
             # Set timestamp of last run
             settings.HOST_METRIC_SUMMARY_TASK_LAST_TS = now()

awx/main/tasks/jobs.py

@@ -17,11 +17,11 @@ import urllib.parse as urlparse
 
 # Django
 from django.conf import settings
-from django.db import transaction
 
 # Shared code for the AWX platform
 from awx_plugins.interfaces._temporary_private_container_api import CONTAINER_ROOT, get_incontainer_path
 
+
 # Runner
 import ansible_runner
 
@@ -29,12 +29,9 @@ import ansible_runner
 import git
 from gitdb.exc import BadName as BadGitName
 
-# Dispatcherd
-from dispatcherd.publish import task
-from dispatcherd.utils import serialize_task
 
 # AWX
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 from awx.main.dispatch import get_task_queuename
 from awx.main.constants import (
     PRIVILEGE_ESCALATION_METHODS,
@@ -42,13 +39,13 @@ from awx.main.constants import (
     JOB_FOLDER_PREFIX,
     MAX_ISOLATED_PATH_COLON_DELIMITER,
     CONTAINER_VOLUMES_MOUNT_TYPES,
+    ACTIVE_STATES,
     HOST_FACTS_FIELDS,
 )
 from awx.main.models import (
     Instance,
     Inventory,
     InventorySource,
-    UnifiedJob,
     Job,
     AdHocCommand,
     ProjectUpdate,
@@ -68,12 +65,11 @@ from awx.main.tasks.callback import (
     RunnerCallbackForProjectUpdate,
     RunnerCallbackForSystemJob,
 )
-from awx.main.tasks.policy import evaluate_policy
 from awx.main.tasks.signals import with_signal_handling, signal_callback
 from awx.main.tasks.receptor import AWXReceptorJob
 from awx.main.tasks.facts import start_fact_cache, finish_fact_cache
 from awx.main.tasks.system import update_smart_memberships_for_inventory, update_inventory_computed_fields, events_processed_hook
-from awx.main.exceptions import AwxTaskError, PolicyEvaluationError, PostRunError, ReceptorNodeNotFound
+from awx.main.exceptions import AwxTaskError, PostRunError, ReceptorNodeNotFound
 from awx.main.utils.ansible import read_ansible_config
 from awx.main.utils.safe_yaml import safe_dump, sanitize_jinja
 from awx.main.utils.common import (
@@ -115,15 +111,6 @@ def with_path_cleanup(f):
     return _wrapped
 
 
-@task(on_duplicate='queue_one', bind=True, queue=get_task_queuename)
-def dispatch_waiting_jobs(binder):
-    for uj in UnifiedJob.objects.filter(status='waiting', controller_node=settings.CLUSTER_HOST_ID).only('id', 'status', 'polymorphic_ctype', 'celery_task_id'):
-        kwargs = uj.get_start_kwargs()
-        if not kwargs:
-            kwargs = {}
-        binder.control('run', data={'task': serialize_task(uj._get_task_class()), 'args': [uj.id], 'kwargs': kwargs, 'uuid': uj.celery_task_id})
-
-
 class BaseTask(object):
     model = None
     event_model = None
@@ -131,7 +118,6 @@ class BaseTask(object):
     callback_class = RunnerCallback
 
     def __init__(self):
-        self.instance = None
         self.cleanup_paths = []
         self.update_attempts = int(getattr(settings, 'DISPATCHER_DB_DOWNTOWN_TOLLERANCE', settings.DISPATCHER_DB_DOWNTIME_TOLERANCE) / 5)
         self.runner_callback = self.callback_class(model=self.model)
@@ -319,8 +305,6 @@ class BaseTask(object):
         # Add ANSIBLE_* settings to the subprocess environment.
         for attr in dir(settings):
             if attr == attr.upper() and attr.startswith('ANSIBLE_') and not attr.startswith('ANSIBLE_BASE_'):
-                if attr == 'ANSIBLE_STANDARD_SETTINGS_FILES':
-                    continue  # special case intended only for dynaconf use
                 env[attr] = str(getattr(settings, attr))
         # Also set environment variables configured in AWX_TASK_ENV setting.
         for key, value in settings.AWX_TASK_ENV.items():
@@ -468,48 +452,27 @@ class BaseTask(object):
     def should_use_fact_cache(self):
         return False
 
-    def transition_status(self, pk: int) -> bool:
-        """Atomically transition status to running, if False returned, another process got it"""
-        with transaction.atomic():
-            # Explanation of parts for the fetch:
-            # .values - avoid loading a full object, this is known to lead to deadlocks due to signals
-            #   the signals load other related rows which another process may be locking, and happens in practice
-            # of=('self',) - keeps FK tables out of the lock list, another way deadlocks can happen
-            # .get - just load the single job
-            instance_data = UnifiedJob.objects.select_for_update(of=('self',)).values('status', 'cancel_flag').get(pk=pk)
-
-            # If status is not waiting (obtained under lock) then this process does not have clearence to run
-            if instance_data['status'] == 'waiting':
-                if instance_data['cancel_flag']:
-                    updated_status = 'canceled'
-                else:
-                    updated_status = 'running'
-                # Explanation of the update:
-                # .filter - again, do not load the full object
-                # .update - a bulk update on just that one row, avoid loading unintended data
-                UnifiedJob.objects.filter(pk=pk).update(status=updated_status, start_args='')
-            elif instance_data['status'] == 'running':
-                logger.info(f'Job {pk} is being ran by another process, exiting')
-                return False
-        return True
-
     @with_path_cleanup
     @with_signal_handling
     def run(self, pk, **kwargs):
         """
         Run the job/task and capture its output.
         """
-        if not self.instance:  # Used to skip fetch for local runs
-            if not self.transition_status(pk):
-                logger.info(f'Job {pk} is being ran by another process, exiting')
-                return
+        self.instance = self.model.objects.get(pk=pk)
+        if self.instance.status != 'canceled' and self.instance.cancel_flag:
+            self.instance = self.update_model(self.instance.pk, start_args='', status='canceled')
+        if self.instance.status not in ACTIVE_STATES:
+            # Prevent starting the job if it has been reaped or handled by another process.
+            raise RuntimeError(f'Not starting {self.instance.status} task pk={pk} because {self.instance.status} is not a valid active state')
 
-        # Load the instance
-        self.instance = self.update_model(pk)
-        if self.instance.status != 'running':
-            logger.error(f'Not starting {self.instance.status} task pk={pk} because its status "{self.instance.status}" is not expected')
-            return
+        if self.instance.execution_environment_id is None:
+            from awx.main.signals import disable_activity_stream
 
+            with disable_activity_stream():
+                self.instance = self.update_model(self.instance.pk, execution_environment=self.instance.resolve_execution_environment())
+
+        # self.instance because of the update_model pattern and when it's used in callback handlers
+        self.instance = self.update_model(pk, status='running', start_args='')  # blank field to remove encrypted passwords
         self.instance.websocket_emit_status("running")
         status, rc = 'error', None
         self.runner_callback.event_ct = 0
@@ -522,20 +485,12 @@ class BaseTask(object):
         private_data_dir = None
 
         try:
-            if self.instance.execution_environment_id is None:
-                from awx.main.signals import disable_activity_stream
-
-                with disable_activity_stream():
-                    self.instance = self.update_model(self.instance.pk, execution_environment=self.instance.resolve_execution_environment())
-
             self.instance.send_notification_templates("running")
             private_data_dir = self.build_private_data_dir(self.instance)
             self.pre_run_hook(self.instance, private_data_dir)
-            evaluate_policy(self.instance)
             self.build_project_dir(self.instance, private_data_dir)
             self.instance.log_lifecycle("preparing_playbook")
             if self.instance.cancel_flag or signal_callback():
-                logger.debug(f'detected pre-run cancel flag for {self.instance.log_format}')
                 self.instance = self.update_model(self.instance.pk, status='canceled')
 
             if self.instance.status != 'running':
@@ -658,11 +613,12 @@ class BaseTask(object):
             elif status == 'canceled':
                 self.instance = self.update_model(pk)
                 cancel_flag_value = getattr(self.instance, 'cancel_flag', False)
-                if cancel_flag_value is False:
+                if (cancel_flag_value is False) and signal_callback():
                     self.runner_callback.delay_update(skip_if_already_set=True, job_explanation="Task was canceled due to receiving a shutdown signal.")
                     status = 'failed'
-        except PolicyEvaluationError as exc:
-            self.runner_callback.delay_update(job_explanation=str(exc), result_traceback=str(exc))
+                elif cancel_flag_value is False:
+                    self.runner_callback.delay_update(skip_if_already_set=True, job_explanation="The running ansible process received a shutdown signal.")
+                    status = 'failed'
         except ReceptorNodeNotFound as exc:
             self.runner_callback.delay_update(job_explanation=str(exc))
         except Exception:
@@ -688,9 +644,6 @@ class BaseTask(object):
 
         # Field host_status_counts is used as a metric to check if event processing is finished
         # we send notifications if it is, if not, callback receiver will send them
-        if not self.instance:
-            logger.error(f'Unified job pk={pk} appears to be deleted while running')
-            return
         if (self.instance.host_status_counts is not None) or (not self.runner_callback.wrapup_event_dispatched):
             events_processed_hook(self.instance)
 
@@ -787,7 +740,6 @@ class SourceControlMixin(BaseTask):
             try:
                 # the job private_data_dir is passed so sync can download roles and collections there
                 sync_task = RunProjectUpdate(job_private_data_dir=private_data_dir)
-                sync_task.instance = local_project_sync  # avoids "waiting" status check, performance
                 sync_task.run(local_project_sync.id)
                 local_project_sync.refresh_from_db()
                 self.instance = self.update_model(self.instance.pk, scm_revision=local_project_sync.scm_revision)
@@ -851,7 +803,7 @@ class SourceControlMixin(BaseTask):
             self.release_lock(project)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 class RunJob(SourceControlMixin, BaseTask):
     """
     Run a job using ansible-playbook.
@@ -1139,8 +1091,8 @@ class RunJob(SourceControlMixin, BaseTask):
         # where ansible expects to find it
         if self.should_use_fact_cache():
             job.log_lifecycle("start_job_fact_cache")
-            self.hosts_with_facts_cached = start_fact_cache(
-                job.get_hosts_for_fact_cache(), artifacts_dir=os.path.join(private_data_dir, 'artifacts', str(job.id)), inventory_id=job.inventory_id
+            self.facts_write_time = start_fact_cache(
+                job.get_hosts_for_fact_cache(), os.path.join(private_data_dir, 'artifacts', str(job.id), 'fact_cache'), inventory_id=job.inventory_id
             )
 
     def build_project_dir(self, job, private_data_dir):
@@ -1150,7 +1102,7 @@ class RunJob(SourceControlMixin, BaseTask):
         super(RunJob, self).post_run_hook(job, status)
         job.refresh_from_db(fields=['job_env'])
         private_data_dir = job.job_env.get('AWX_PRIVATE_DATA_DIR')
-        if not private_data_dir:
+        if (not private_data_dir) or (not hasattr(self, 'facts_write_time')):
             # If there's no private data dir, that means we didn't get into the
             # actual `run()` call; this _usually_ means something failed in
             # the pre_run_hook method
@@ -1158,7 +1110,9 @@ class RunJob(SourceControlMixin, BaseTask):
         if self.should_use_fact_cache() and self.runner_callback.artifacts_processed:
             job.log_lifecycle("finish_job_fact_cache")
             finish_fact_cache(
-                artifacts_dir=os.path.join(private_data_dir, 'artifacts', str(job.id)),
+                job.get_hosts_for_fact_cache(),
+                os.path.join(private_data_dir, 'artifacts', str(job.id), 'fact_cache'),
+                facts_write_time=self.facts_write_time,
                 job_id=job.id,
                 inventory_id=job.inventory_id,
             )
@@ -1174,7 +1128,7 @@ class RunJob(SourceControlMixin, BaseTask):
                 update_inventory_computed_fields.delay(inventory.id)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 class RunProjectUpdate(BaseTask):
     model = ProjectUpdate
     event_model = ProjectUpdateEvent
@@ -1513,7 +1467,7 @@ class RunProjectUpdate(BaseTask):
         return []
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 class RunInventoryUpdate(SourceControlMixin, BaseTask):
     model = InventoryUpdate
     event_model = InventoryUpdateEvent
@@ -1624,7 +1578,7 @@ class RunInventoryUpdate(SourceControlMixin, BaseTask):
                 # Include any facts from input inventories so they can be used in filters
                 start_fact_cache(
                     input_inventory.hosts.only(*HOST_FACTS_FIELDS),
-                    artifacts_dir=os.path.join(private_data_dir, 'artifacts', str(inventory_update.id)),
+                    os.path.join(private_data_dir, 'artifacts', str(inventory_update.id), 'fact_cache'),
                     inventory_id=input_inventory.id,
                 )
 
@@ -1776,7 +1730,7 @@ class RunInventoryUpdate(SourceControlMixin, BaseTask):
             raise PostRunError('Error occured while saving inventory data, see traceback or server logs', status='error', tb=traceback.format_exc())
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 class RunAdHocCommand(BaseTask):
     """
     Run an ad hoc command using ansible.
@@ -1929,7 +1883,7 @@ class RunAdHocCommand(BaseTask):
         return d
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 class RunSystemJob(BaseTask):
     model = SystemJob
     event_model = SystemJobEvent

awx/main/tasks/policy.py

@@ -1,458 +0,0 @@
-import json
-import tempfile
-import contextlib
-
-from pprint import pformat
-
-from typing import Optional, Union
-
-from django.conf import settings
-from django.utils.translation import gettext_lazy as _
-from opa_client import OpaClient
-from opa_client.base import BaseClient
-from requests import HTTPError
-from rest_framework import serializers
-from rest_framework import fields
-
-from awx.main import models
-from awx.main.exceptions import PolicyEvaluationError
-
-
-# Monkey patching opa_client.base.BaseClient to fix retries and timeout settings
-_original_opa_base_client_init = BaseClient.__init__
-
-
-def _opa_base_client_init_fix(
-    self,
-    host: str = "localhost",
-    port: int = 8181,
-    version: str = "v1",
-    ssl: bool = False,
-    cert: Optional[Union[str, tuple]] = None,
-    headers: Optional[dict] = None,
-    retries: int = 2,
-    timeout: float = 1.5,
-):
-    _original_opa_base_client_init(self, host, port, version, ssl, cert, headers)
-    self.retries = retries
-    self.timeout = timeout
-
-
-BaseClient.__init__ = _opa_base_client_init_fix
-
-
-class _TeamSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.Team
-        fields = ('id', 'name')
-
-
-class _UserSerializer(serializers.ModelSerializer):
-    teams = serializers.SerializerMethodField()
-
-    class Meta:
-        model = models.User
-        fields = ('id', 'username', 'is_superuser', 'teams')
-
-    def get_teams(self, user: models.User):
-        teams = models.Team.access_qs(user, 'member')
-        return _TeamSerializer(many=True).to_representation(teams)
-
-
-class _ExecutionEnvironmentSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.ExecutionEnvironment
-        fields = (
-            'id',
-            'name',
-            'image',
-            'pull',
-        )
-
-
-class _InstanceGroupSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.InstanceGroup
-        fields = (
-            'id',
-            'name',
-            'capacity',
-            'jobs_running',
-            'jobs_total',
-            'max_concurrent_jobs',
-            'max_forks',
-        )
-
-
-class _InventorySourceSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.InventorySource
-        fields = ('id', 'name', 'source', 'status')
-
-
-class _InventorySerializer(serializers.ModelSerializer):
-    inventory_sources = _InventorySourceSerializer(many=True)
-
-    class Meta:
-        model = models.Inventory
-        fields = (
-            'id',
-            'name',
-            'description',
-            'kind',
-            'total_hosts',
-            'total_groups',
-            'has_inventory_sources',
-            'total_inventory_sources',
-            'has_active_failures',
-            'hosts_with_active_failures',
-            'inventory_sources',
-        )
-
-
-class _JobTemplateSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.JobTemplate
-        fields = (
-            'id',
-            'name',
-            'job_type',
-        )
-
-
-class _WorkflowJobTemplateSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.WorkflowJobTemplate
-        fields = (
-            'id',
-            'name',
-            'job_type',
-        )
-
-
-class _WorkflowJobSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.WorkflowJob
-        fields = (
-            'id',
-            'name',
-        )
-
-
-class _OrganizationSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.Organization
-        fields = (
-            'id',
-            'name',
-        )
-
-
-class _ProjectSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = models.Project
-        fields = (
-            'id',
-            'name',
-            'status',
-            'scm_type',
-            'scm_url',
-            'scm_branch',
-            'scm_refspec',
-            'scm_clean',
-            'scm_track_submodules',
-            'scm_delete_on_update',
-        )
-
-
-class _CredentialSerializer(serializers.ModelSerializer):
-    organization = _OrganizationSerializer()
-
-    class Meta:
-        model = models.Credential
-        fields = (
-            'id',
-            'name',
-            'description',
-            'organization',
-            'credential_type',
-            'managed',
-            'kind',
-            'cloud',
-            'kubernetes',
-        )
-
-
-class _LabelSerializer(serializers.ModelSerializer):
-    organization = _OrganizationSerializer()
-
-    class Meta:
-        model = models.Label
-        fields = ('id', 'name', 'organization')
-
-
-class JobSerializer(serializers.ModelSerializer):
-    created_by = _UserSerializer()
-    credentials = _CredentialSerializer(many=True)
-    execution_environment = _ExecutionEnvironmentSerializer()
-    instance_group = _InstanceGroupSerializer()
-    inventory = _InventorySerializer()
-    job_template = _JobTemplateSerializer()
-    labels = _LabelSerializer(many=True)
-    organization = _OrganizationSerializer()
-    project = _ProjectSerializer()
-    extra_vars = fields.SerializerMethodField()
-    hosts_count = fields.SerializerMethodField()
-    workflow_job = fields.SerializerMethodField()
-    workflow_job_template = fields.SerializerMethodField()
-
-    class Meta:
-        model = models.Job
-        fields = (
-            'id',
-            'name',
-            'created',
-            'created_by',
-            'credentials',
-            'execution_environment',
-            'extra_vars',
-            'forks',
-            'hosts_count',
-            'instance_group',
-            'inventory',
-            'job_template',
-            'job_type',
-            'job_type_name',
-            'labels',
-            'launch_type',
-            'limit',
-            'launched_by',
-            'organization',
-            'playbook',
-            'project',
-            'scm_branch',
-            'scm_revision',
-            'workflow_job',
-            'workflow_job_template',
-        )
-
-    def get_extra_vars(self, obj: models.Job):
-        return json.loads(obj.display_extra_vars())
-
-    def get_hosts_count(self, obj: models.Job):
-        return obj.hosts.count()
-
-    def get_workflow_job(self, obj: models.Job):
-        workflow_job: models.WorkflowJob = obj.get_workflow_job()
-        if workflow_job is None:
-            return None
-        return _WorkflowJobSerializer().to_representation(workflow_job)
-
-    def get_workflow_job_template(self, obj: models.Job):
-        workflow_job: models.WorkflowJob = obj.get_workflow_job()
-        if workflow_job is None:
-            return None
-
-        workflow_job_template: models.WorkflowJobTemplate = workflow_job.workflow_job_template
-        if workflow_job_template is None:
-            return None
-
-        return _WorkflowJobTemplateSerializer().to_representation(workflow_job_template)
-
-
-class OPAResultSerializer(serializers.Serializer):
-    allowed = fields.BooleanField(required=True)
-    violations = fields.ListField(child=fields.CharField())
-
-
-class OPA_AUTH_TYPES:
-    NONE = 'None'
-    TOKEN = 'Token'
-    CERTIFICATE = 'Certificate'
-
-
-@contextlib.contextmanager
-def opa_cert_file():
-    """
-    Context manager that creates temporary certificate files for OPA authentication.
-
-    For mTLS (mutual TLS), we need:
-    - Client certificate and key for client authentication
-    - CA certificate (optional) for server verification
-
-    Returns:
-        tuple: (client_cert_path, verify_path)
-            - client_cert_path: Path to client cert file or None if not using client cert
-            - verify_path: Path to CA cert file, True to use system CA store, or False for no verification
-    """
-    client_cert_temp = None
-    ca_temp = None
-
-    try:
-        # Case 1: Full mTLS with client cert and optional CA cert
-        if settings.OPA_AUTH_TYPE == OPA_AUTH_TYPES.CERTIFICATE:
-            # Create client certificate file (required for mTLS)
-            client_cert_temp = tempfile.NamedTemporaryFile(delete=True, mode='w', suffix=".pem")
-            client_cert_temp.write(settings.OPA_AUTH_CLIENT_CERT)
-            client_cert_temp.write("\n")
-            client_cert_temp.write(settings.OPA_AUTH_CLIENT_KEY)
-            client_cert_temp.write("\n")
-            client_cert_temp.flush()
-
-            # If CA cert is provided, use it for server verification
-            # Otherwise, use system CA store (True)
-            if settings.OPA_AUTH_CA_CERT:
-                ca_temp = tempfile.NamedTemporaryFile(delete=True, mode='w', suffix=".pem")
-                ca_temp.write(settings.OPA_AUTH_CA_CERT)
-                ca_temp.write("\n")
-                ca_temp.flush()
-                verify_path = ca_temp.name
-            else:
-                verify_path = True  # Use system CA store
-
-            yield (client_cert_temp.name, verify_path)
-
-        # Case 2: TLS with only server verification (no client cert)
-        elif settings.OPA_SSL:
-            # If CA cert is provided, use it for server verification
-            # Otherwise, use system CA store (True)
-            if settings.OPA_AUTH_CA_CERT:
-                ca_temp = tempfile.NamedTemporaryFile(delete=True, mode='w', suffix=".pem")
-                ca_temp.write(settings.OPA_AUTH_CA_CERT)
-                ca_temp.write("\n")
-                ca_temp.flush()
-                verify_path = ca_temp.name
-            else:
-                verify_path = True  # Use system CA store
-
-            yield (None, verify_path)
-
-        # Case 3: No TLS
-        else:
-            yield (None, False)
-
-    finally:
-        # Clean up temporary files
-        if client_cert_temp:
-            client_cert_temp.close()
-        if ca_temp:
-            ca_temp.close()
-
-
-@contextlib.contextmanager
-def opa_client(headers=None):
-    with opa_cert_file() as cert_files:
-        cert, verify = cert_files
-
-        with OpaClient(
-            host=settings.OPA_HOST,
-            port=settings.OPA_PORT,
-            headers=headers,
-            ssl=settings.OPA_SSL,
-            cert=cert,
-            timeout=settings.OPA_REQUEST_TIMEOUT,
-            retries=settings.OPA_REQUEST_RETRIES,
-        ) as client:
-            # Workaround for https://github.com/Turall/OPA-python-client/issues/32
-            # by directly setting cert and verify on requests.session
-            client._session.cert = cert
-            client._session.verify = verify
-
-            yield client
-
-
-def evaluate_policy(instance):
-    # Policy evaluation for Policy as Code feature
-    if not settings.OPA_HOST:
-        return
-
-    if not isinstance(instance, models.Job):
-        return
-
-    instance.log_lifecycle("evaluate_policy")
-
-    input_data = JobSerializer(instance=instance).data
-
-    headers = settings.OPA_AUTH_CUSTOM_HEADERS
-    if settings.OPA_AUTH_TYPE == OPA_AUTH_TYPES.TOKEN:
-        headers.update({'Authorization': 'Bearer {}'.format(settings.OPA_AUTH_TOKEN)})
-
-    if settings.OPA_AUTH_TYPE == OPA_AUTH_TYPES.CERTIFICATE and not settings.OPA_SSL:
-        raise PolicyEvaluationError(_('OPA_AUTH_TYPE=Certificate requires OPA_SSL to be enabled.'))
-
-    cert_settings_missing = []
-
-    if settings.OPA_AUTH_TYPE == OPA_AUTH_TYPES.CERTIFICATE:
-        if not settings.OPA_AUTH_CLIENT_CERT:
-            cert_settings_missing += ['OPA_AUTH_CLIENT_CERT']
-        if not settings.OPA_AUTH_CLIENT_KEY:
-            cert_settings_missing += ['OPA_AUTH_CLIENT_KEY']
-        if not settings.OPA_AUTH_CA_CERT:
-            cert_settings_missing += ['OPA_AUTH_CA_CERT']
-
-        if cert_settings_missing:
-            raise PolicyEvaluationError(_('Following certificate settings are missing for OPA_AUTH_TYPE=Certificate: {}').format(cert_settings_missing))
-
-    query_paths = [
-        ('Organization', instance.organization.opa_query_path),
-        ('Inventory', instance.inventory.opa_query_path),
-        ('Job template', instance.job_template.opa_query_path),
-    ]
-    violations = dict()
-    errors = dict()
-
-    try:
-        with opa_client(headers=headers) as client:
-            for path_type, query_path in query_paths:
-                response = dict()
-                try:
-                    if not query_path:
-                        continue
-
-                    response = client.query_rule(input_data=input_data, package_path=query_path)
-
-                except HTTPError as e:
-                    message = _('Call to OPA failed. Exception: {}').format(e)
-                    try:
-                        error_data = e.response.json()
-                    except ValueError:
-                        errors[path_type] = message
-                        continue
-
-                    error_code = error_data.get("code")
-                    error_message = error_data.get("message")
-                    if error_code or error_message:
-                        message = _('Call to OPA failed. Code: {}, Message: {}').format(error_code, error_message)
-                    errors[path_type] = message
-                    continue
-
-                except Exception as e:
-                    errors[path_type] = _('Call to OPA failed. Exception: {}').format(e)
-                    continue
-
-                result = response.get('result')
-                if result is None:
-                    errors[path_type] = _('Call to OPA did not return a "result" property. The path refers to an undefined document.')
-                    continue
-
-                result_serializer = OPAResultSerializer(data=result)
-                if not result_serializer.is_valid():
-                    errors[path_type] = _('OPA policy returned invalid result.')
-                    continue
-
-                result_data = result_serializer.validated_data
-                if not result_data.get("allowed") and (result_violations := result_data.get("violations")):
-                    violations[path_type] = result_violations
-
-            format_results = dict()
-            if any(errors[e] for e in errors):
-                format_results["Errors"] = errors
-
-            if any(violations[v] for v in violations):
-                format_results["Violations"] = violations
-
-            if violations or errors:
-                raise PolicyEvaluationError(pformat(format_results, width=80))
-
-    except Exception as e:
-        raise PolicyEvaluationError(_('This job cannot be executed due to a policy violation or error. See the following details:\n{}').format(e))

awx/main/tasks/receptor.py

@@ -32,7 +32,7 @@ from awx.main.constants import MAX_ISOLATED_PATH_COLON_DELIMITER
 from awx.main.tasks.signals import signal_state, signal_callback, SignalExit
 from awx.main.models import Instance, InstanceLink, UnifiedJob, ReceptorAddress
 from awx.main.dispatch import get_task_queuename
-from awx.main.dispatch.publish import task as task_awx
+from awx.main.dispatch.publish import task
 
 # Receptorctl
 from receptorctl.socket_interface import ReceptorControl
@@ -852,7 +852,7 @@ def reload_receptor():
         raise RuntimeError("Receptor reload failed")
 
 
-@task_awx()
+@task()
 def write_receptor_config():
     """
     This task runs async on each control node, K8S only.
@@ -875,7 +875,7 @@ def write_receptor_config():
             reload_receptor()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def remove_deprovisioned_node(hostname):
     InstanceLink.objects.filter(source__hostname=hostname).update(link_state=InstanceLink.States.REMOVING)
     InstanceLink.objects.filter(target__instance__hostname=hostname).update(link_state=InstanceLink.States.REMOVING)

awx/main/tasks/signals.py

@@ -14,21 +14,16 @@ class SignalExit(Exception):
 
 
 class SignalState:
-    # SIGTERM: Sent by supervisord to process group on shutdown
-    # SIGUSR1: The dispatcherd cancel signal
-    signals = (signal.SIGTERM, signal.SIGINT, signal.SIGUSR1)
-
     def reset(self):
-        for for_signal in self.signals:
-            self.signal_flags[for_signal] = False
-            self.original_methods[for_signal] = None
+        self.sigterm_flag = False
+        self.sigint_flag = False
 
         self.is_active = False  # for nested context managers
+        self.original_sigterm = None
+        self.original_sigint = None
         self.raise_exception = False
 
     def __init__(self):
-        self.signal_flags = {}
-        self.original_methods = {}
         self.reset()
 
     def raise_if_needed(self):
@@ -36,28 +31,31 @@ class SignalState:
             self.raise_exception = False  # so it is not raised a second time in error handling
             raise SignalExit()
 
-    def set_signal_flag(self, *args, for_signal=None):
-        self.signal_flags[for_signal] = True
-        logger.info(f'Processed signal {for_signal}, set exit flag')
+    def set_sigterm_flag(self, *args):
+        self.sigterm_flag = True
+        self.raise_if_needed()
+
+    def set_sigint_flag(self, *args):
+        self.sigint_flag = True
         self.raise_if_needed()
 
     def connect_signals(self):
-        for for_signal in self.signals:
-            self.original_methods[for_signal] = signal.getsignal(for_signal)
-            signal.signal(for_signal, lambda *args, for_signal=for_signal: self.set_signal_flag(*args, for_signal=for_signal))
+        self.original_sigterm = signal.getsignal(signal.SIGTERM)
+        self.original_sigint = signal.getsignal(signal.SIGINT)
+        signal.signal(signal.SIGTERM, self.set_sigterm_flag)
+        signal.signal(signal.SIGINT, self.set_sigint_flag)
         self.is_active = True
 
     def restore_signals(self):
-        for for_signal in self.signals:
-            original_method = self.original_methods[for_signal]
-            signal.signal(for_signal, original_method)
-            # if we got a signal while context manager was active, call parent methods.
-            if self.signal_flags[for_signal]:
-                if callable(original_method):
-                    try:
-                        original_method()
-                    except Exception as exc:
-                        logger.info(f'Error processing original {for_signal} signal, error: {str(exc)}')
+        signal.signal(signal.SIGTERM, self.original_sigterm)
+        signal.signal(signal.SIGINT, self.original_sigint)
+        # if we got a signal while context manager was active, call parent methods.
+        if self.sigterm_flag:
+            if callable(self.original_sigterm):
+                self.original_sigterm()
+        if self.sigint_flag:
+            if callable(self.original_sigint):
+                self.original_sigint()
         self.reset()
 
 
@@ -65,7 +63,7 @@ signal_state = SignalState()
 
 
 def signal_callback():
-    return any(signal_state.signal_flags[for_signal] for for_signal in signal_state.signals)
+    return bool(signal_state.sigterm_flag or signal_state.sigint_flag)
 
 
 def with_signal_handling(f):

awx/main/tasks/system.py

@@ -1,77 +1,78 @@
 # Python
+from collections import namedtuple
 import functools
 import importlib
 import itertools
 import json
 import logging
 import os
+import psycopg
+from io import StringIO
+from contextlib import redirect_stdout
 import shutil
 import time
-from collections import namedtuple
-from contextlib import redirect_stdout
-from datetime import datetime
 from distutils.version import LooseVersion as Version
-from io import StringIO
+from datetime import datetime
 
-# Runner
-import ansible_runner.cleanup
-import psycopg
-from ansible_base.lib.utils.db import advisory_lock
-
-# django-ansible-base
-from ansible_base.resource_registry.tasks.sync import SyncExecutor
+# Django
+from django.conf import settings
+from django.db import connection, transaction, DatabaseError, IntegrityError
+from django.db.models.fields.related import ForeignKey
+from django.utils.timezone import now, timedelta
+from django.utils.encoding import smart_str
+from django.contrib.auth.models import User
+from django.utils.translation import gettext_lazy as _
+from django.utils.translation import gettext_noop
+from django.core.cache import cache
+from django.core.exceptions import ObjectDoesNotExist
+from django.db.models.query import QuerySet
 
 # Django-CRUM
 from crum import impersonate
 
+# Django flags
+from flags.state import flag_enabled
+
+# Runner
+import ansible_runner.cleanup
+
 # dateutil
 from dateutil.parser import parse as parse_date
 
-# Django
-from django.conf import settings
-from django.contrib.auth.models import User
-from django.core.cache import cache
-from django.core.exceptions import ObjectDoesNotExist
-from django.db import DatabaseError, IntegrityError, connection, transaction
-from django.db.models.fields.related import ForeignKey
-from django.db.models.query import QuerySet
-from django.utils.encoding import smart_str
-from django.utils.timezone import now, timedelta
-from django.utils.translation import gettext_lazy as _
-from django.utils.translation import gettext_noop
-
-# Django flags
-from flags.state import flag_enabled
-from rest_framework.exceptions import PermissionDenied
+# django-ansible-base
+from ansible_base.resource_registry.tasks.sync import SyncExecutor
+from ansible_base.lib.utils.db import advisory_lock
 
 # AWX
 from awx import __version__ as awx_application_version
-from awx.conf import settings_registry
-from awx.main import analytics
 from awx.main.access import access_registry
-from awx.main.analytics.subsystem_metrics import DispatcherMetrics
-from awx.main.constants import ACTIVE_STATES, ERROR_STATES
-from awx.main.consumers import emit_channel_notification
-from awx.main.dispatch import get_task_queuename, reaper
-from awx.main.dispatch.publish import task as task_awx
 from awx.main.models import (
+    Schedule,
+    TowerScheduleState,
     Instance,
     InstanceGroup,
-    Inventory,
-    Job,
-    Notification,
-    Schedule,
-    SmartInventoryMembership,
-    TowerScheduleState,
     UnifiedJob,
+    Notification,
+    Inventory,
+    SmartInventoryMembership,
+    Job,
     convert_jsonfields,
 )
+from awx.main.constants import ACTIVE_STATES, ERROR_STATES
+from awx.main.dispatch.publish import task
+from awx.main.dispatch import get_task_queuename, reaper
+from awx.main.utils.common import ignore_inventory_computed_fields, ignore_inventory_group_removal
+
+from awx.main.utils.reload import stop_local_services
 from awx.main.tasks.helpers import is_run_threshold_reached
 from awx.main.tasks.host_indirect import save_indirect_host_entries
-from awx.main.tasks.receptor import administrative_workunit_reaper, get_receptor_ctl, worker_cleanup, worker_info, write_receptor_config
-from awx.main.utils.common import ignore_inventory_computed_fields, ignore_inventory_group_removal
-from awx.main.utils.reload import stop_local_services
-from dispatcherd.publish import task
+from awx.main.tasks.receptor import get_receptor_ctl, worker_info, worker_cleanup, administrative_workunit_reaper, write_receptor_config
+from awx.main.consumers import emit_channel_notification
+from awx.main import analytics
+from awx.conf import settings_registry
+from awx.main.analytics.subsystem_metrics import DispatcherMetrics
+
+from rest_framework.exceptions import PermissionDenied
 
 logger = logging.getLogger('awx.main.tasks.system')
 
@@ -82,12 +83,7 @@ Try upgrading OpenSSH or providing your private key in an different format. \
 '''
 
 
-def _run_dispatch_startup_common():
-    """
-    Execute the common startup initialization steps.
-    This includes updating schedules, syncing instance membership, and starting
-    local reaping and resetting metrics.
-    """
+def dispatch_startup():
     startup_logger = logging.getLogger('awx.main.tasks')
 
     # TODO: Enable this on VM installs
@@ -97,14 +93,14 @@ def _run_dispatch_startup_common():
     try:
         convert_jsonfields()
     except Exception:
-        logger.exception("Failed JSON field conversion, skipping.")
+        logger.exception("Failed json field conversion, skipping.")
 
-    startup_logger.debug("Syncing schedules")
+    startup_logger.debug("Syncing Schedules")
     for sch in Schedule.objects.all():
         try:
             sch.update_computed_fields()
         except Exception:
-            logger.exception("Failed to rebuild schedule %s.", sch)
+            logger.exception("Failed to rebuild schedule {}.".format(sch))
 
     #
     # When the dispatcher starts, if the instance cannot be found in the database,
@@ -124,67 +120,25 @@ def _run_dispatch_startup_common():
     apply_cluster_membership_policies()
     cluster_node_heartbeat()
     reaper.startup_reaping()
+    reaper.reap_waiting(grace_period=0)
     m = DispatcherMetrics()
     m.reset_values()
 
 
-def _legacy_dispatch_startup():
-    """
-    Legacy branch for startup: simply performs reaping of waiting jobs with a zero grace period.
-    """
-    logger.debug("Legacy dispatcher: calling reaper.reap_waiting with grace_period=0")
-    reaper.reap_waiting(grace_period=0)
-
-
-def _dispatcherd_dispatch_startup():
-    """
-    New dispatcherd branch for startup: uses the control API to re-submit waiting jobs.
-    """
-    logger.debug("Dispatcherd enabled: dispatching waiting jobs via control channel")
-    from awx.main.tasks.jobs import dispatch_waiting_jobs
-
-    dispatch_waiting_jobs.apply_async(queue=get_task_queuename())
-
-
-def dispatch_startup():
-    """
-    System initialization at startup.
-    First, execute the common logic.
-    Then, if FEATURE_DISPATCHERD_ENABLED is enabled, re-submit waiting jobs via the control API;
-    otherwise, fall back to legacy reaping of waiting jobs.
-    """
-    _run_dispatch_startup_common()
-    if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-        _dispatcherd_dispatch_startup()
-    else:
-        _legacy_dispatch_startup()
-
-
 def inform_cluster_of_shutdown():
-    """
-    Clean system shutdown that marks the current instance offline.
-    In legacy mode, it also reaps waiting jobs.
-    In dispatcherd mode, it relies on dispatcherd's built-in cleanup.
-    """
     try:
-        inst = Instance.objects.get(hostname=settings.CLUSTER_HOST_ID)
-        inst.mark_offline(update_last_seen=True, errors=_('Instance received normal shutdown signal'))
-    except Instance.DoesNotExist:
-        logger.exception("Cluster host not found: %s", settings.CLUSTER_HOST_ID)
-        return
-
-    if flag_enabled('FEATURE_DISPATCHERD_ENABLED'):
-        logger.debug("Dispatcherd mode: no extra reaping required for instance %s", inst.hostname)
-    else:
+        this_inst = Instance.objects.get(hostname=settings.CLUSTER_HOST_ID)
+        this_inst.mark_offline(update_last_seen=True, errors=_('Instance received normal shutdown signal'))
         try:
-            logger.debug("Legacy mode: reaping waiting jobs for instance %s", inst.hostname)
-            reaper.reap_waiting(inst, grace_period=0)
+            reaper.reap_waiting(this_inst, grace_period=0)
         except Exception:
-            logger.exception("Failed to reap waiting jobs for %s", inst.hostname)
-    logger.warning("Normal shutdown processed for instance %s; instance removed from capacity pool.", inst.hostname)
+            logger.exception('failed to reap waiting jobs for {}'.format(this_inst.hostname))
+        logger.warning('Normal shutdown signal for instance {}, removed self from capacity pool.'.format(this_inst.hostname))
+    except Exception:
+        logger.exception('Encountered problem with normal shutdown signal.')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def migrate_jsonfield(table, pkfield, columns):
     batchsize = 10000
     with advisory_lock(f'json_migration_{table}', wait=False) as acquired:
@@ -230,7 +184,7 @@ def migrate_jsonfield(table, pkfield, columns):
         logger.warning(f"Migration of {table} to jsonb is finished.")
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def apply_cluster_membership_policies():
     from awx.main.signals import disable_activity_stream
 
@@ -342,7 +296,7 @@ def apply_cluster_membership_policies():
         logger.debug('Cluster policy computation finished in {} seconds'.format(time.time() - started_compute))
 
 
-@task_awx(queue='tower_settings_change')
+@task(queue='tower_settings_change')
 def clear_setting_cache(setting_keys):
     # log that cache is being cleared
     logger.info(f"clear_setting_cache of keys {setting_keys}")
@@ -355,7 +309,7 @@ def clear_setting_cache(setting_keys):
     cache.delete_many(cache_keys)
 
 
-@task_awx(queue='tower_broadcast_all')
+@task(queue='tower_broadcast_all')
 def delete_project_files(project_path):
     # TODO: possibly implement some retry logic
     lock_file = project_path + '.lock'
@@ -373,7 +327,7 @@ def delete_project_files(project_path):
             logger.exception('Could not remove lock file {}'.format(lock_file))
 
 
-@task_awx(queue='tower_broadcast_all')
+@task(queue='tower_broadcast_all')
 def profile_sql(threshold=1, minutes=1):
     if threshold <= 0:
         cache.delete('awx-profile-sql-threshold')
@@ -383,7 +337,7 @@ def profile_sql(threshold=1, minutes=1):
         logger.error('SQL QUERIES >={}s ENABLED FOR {} MINUTE(S)'.format(threshold, minutes))
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def send_notifications(notification_list, job_id=None):
     if not isinstance(notification_list, list):
         raise TypeError("notification_list should be of type list")
@@ -428,13 +382,13 @@ def events_processed_hook(unified_job):
             save_indirect_host_entries.delay(unified_job.id)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def gather_analytics():
     if is_run_threshold_reached(getattr(settings, 'AUTOMATION_ANALYTICS_LAST_GATHER', None), settings.AUTOMATION_ANALYTICS_GATHER_INTERVAL):
         analytics.gather()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def purge_old_stdout_files():
     nowtime = time.time()
     for f in os.listdir(settings.JOBOUTPUT_ROOT):
@@ -496,18 +450,18 @@ class CleanupImagesAndFiles:
         cls.run_remote(this_inst, **kwargs)
 
 
-@task_awx(queue='tower_broadcast_all')
+@task(queue='tower_broadcast_all')
 def handle_removed_image(remove_images=None):
     """Special broadcast invocation of this method to handle case of deleted EE"""
     CleanupImagesAndFiles.run(remove_images=remove_images, file_pattern='')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def cleanup_images_and_files():
     CleanupImagesAndFiles.run(image_prune=True)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def cluster_node_health_check(node):
     """
     Used for the health check endpoint, refreshes the status of the instance, but must be ran on target node
@@ -526,7 +480,7 @@ def cluster_node_health_check(node):
     this_inst.local_health_check()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def execution_node_health_check(node):
     if node == '':
         logger.warning('Remote health check incorrectly called with blank string')
@@ -594,16 +548,8 @@ def inspect_established_receptor_connections(mesh_status):
 def inspect_execution_and_hop_nodes(instance_list):
     with advisory_lock('inspect_execution_and_hop_nodes_lock', wait=False):
         node_lookup = {inst.hostname: inst for inst in instance_list}
-        try:
-            ctl = get_receptor_ctl()
-        except FileNotFoundError:
-            logger.error('Receptor daemon not running, skipping execution node check')
-            return
-        try:
-            mesh_status = ctl.simple_command('status')
-        except ValueError as exc:
-            logger.error(f'Error running receptorctl status command, error: {str(exc)}')
-            return
+        ctl = get_receptor_ctl()
+        mesh_status = ctl.simple_command('status')
 
         inspect_established_receptor_connections(mesh_status)
 
@@ -651,109 +597,8 @@ def inspect_execution_and_hop_nodes(instance_list):
                     execution_node_health_check.apply_async([hostname])
 
 
-@task_awx(queue=get_task_queuename, bind_kwargs=['dispatch_time', 'worker_tasks'])
+@task(queue=get_task_queuename, bind_kwargs=['dispatch_time', 'worker_tasks'])
 def cluster_node_heartbeat(dispatch_time=None, worker_tasks=None):
-    """
-    Original implementation for AWX dispatcher.
-    Uses worker_tasks from bind_kwargs to track running tasks.
-    """
-    # Run common instance management logic
-    this_inst, instance_list, lost_instances = _heartbeat_instance_management()
-    if this_inst is None:
-        return  # Early return case from instance management
-
-    # Check versions
-    _heartbeat_check_versions(this_inst, instance_list)
-
-    # Handle lost instances
-    _heartbeat_handle_lost_instances(lost_instances, this_inst)
-
-    # Run local reaper - original implementation using worker_tasks
-    if worker_tasks is not None:
-        active_task_ids = []
-        for task_list in worker_tasks.values():
-            active_task_ids.extend(task_list)
-
-        # Convert dispatch_time to datetime
-        ref_time = datetime.fromisoformat(dispatch_time) if dispatch_time else now()
-
-        reaper.reap(instance=this_inst, excluded_uuids=active_task_ids, ref_time=ref_time)
-
-        if max(len(task_list) for task_list in worker_tasks.values()) <= 1:
-            reaper.reap_waiting(instance=this_inst, excluded_uuids=active_task_ids, ref_time=ref_time)
-
-
-@task(queue=get_task_queuename, bind=True)
-def adispatch_cluster_node_heartbeat(binder):
-    """
-    Dispatcherd implementation.
-    Uses Control API to get running tasks.
-    """
-    # Run common instance management logic
-    this_inst, instance_list, lost_instances = _heartbeat_instance_management()
-    if this_inst is None:
-        return  # Early return case from instance management
-
-    # Check versions
-    _heartbeat_check_versions(this_inst, instance_list)
-
-    # Handle lost instances
-    _heartbeat_handle_lost_instances(lost_instances, this_inst)
-
-    # Get running tasks using dispatcherd API
-    active_task_ids = _get_active_task_ids_from_dispatcherd(binder)
-    if active_task_ids is None:
-        logger.warning("No active task IDs retrieved from dispatcherd, skipping reaper")
-        return  # Failed to get task IDs, don't attempt reaping
-
-    # Run local reaper using tasks from dispatcherd
-    ref_time = now()  # No dispatch_time in dispatcherd version
-    logger.debug(f"Running reaper with {len(active_task_ids)} excluded UUIDs")
-    reaper.reap(instance=this_inst, excluded_uuids=active_task_ids, ref_time=ref_time)
-    # If waiting jobs are hanging out, resubmit them
-    if UnifiedJob.objects.filter(controller_node=settings.CLUSTER_HOST_ID, status='waiting').exists():
-        from awx.main.tasks.jobs import dispatch_waiting_jobs
-
-        dispatch_waiting_jobs.apply_async(queue=get_task_queuename())
-
-
-def _get_active_task_ids_from_dispatcherd(binder):
-    """
-    Retrieve active task IDs from the dispatcherd control API.
-
-    Returns:
-        list: List of active task UUIDs
-        None: If there was an error retrieving the data
-    """
-    active_task_ids = []
-    try:
-
-        logger.debug("Querying dispatcherd API for running tasks")
-        data = binder.control('running')
-
-        # Extract UUIDs from the running data
-        # Process running data: first item is a dict with node_id and task entries
-        data.pop('node_id', None)
-
-        # Extract task UUIDs from data structure
-        for task_key, task_value in data.items():
-            if isinstance(task_value, dict) and 'uuid' in task_value:
-                active_task_ids.append(task_value['uuid'])
-                logger.debug(f"Found active task with UUID: {task_value['uuid']}")
-            elif isinstance(task_key, str):
-                # Handle case where UUID might be the key
-                active_task_ids.append(task_key)
-                logger.debug(f"Found active task with key: {task_key}")
-
-        logger.debug(f"Retrieved {len(active_task_ids)} active task IDs from dispatcherd")
-        return active_task_ids
-    except Exception:
-        logger.exception("Failed to get running tasks from dispatcherd")
-        return None
-
-
-def _heartbeat_instance_management():
-    """Common logic for heartbeat instance management."""
     logger.debug("Cluster node heartbeat task.")
     nowtime = now()
     instance_list = list(Instance.objects.filter(node_state__in=(Instance.States.READY, Instance.States.UNAVAILABLE, Instance.States.INSTALLED)))
@@ -780,7 +625,7 @@ def _heartbeat_instance_management():
         this_inst.local_health_check()
         if startup_event and this_inst.capacity != 0:
             logger.warning(f'Rejoining the cluster as instance {this_inst.hostname}. Prior last_seen {last_last_seen}')
-            return None, None, None  # Early return case
+            return
         elif not last_last_seen:
             logger.warning(f'Instance does not have recorded last_seen, updating to {nowtime}')
         elif (nowtime - last_last_seen) > timedelta(seconds=settings.CLUSTER_NODE_HEARTBEAT_PERIOD + 2):
@@ -792,14 +637,8 @@ def _heartbeat_instance_management():
                 logger.warning(f'Recreated instance record {this_inst.hostname} after unexpected removal')
             this_inst.local_health_check()
         else:
-            logger.error("Cluster Host Not Found: {}".format(settings.CLUSTER_HOST_ID))
-            return None, None, None
-
-    return this_inst, instance_list, lost_instances
-
-
-def _heartbeat_check_versions(this_inst, instance_list):
-    """Check versions across instances and determine if shutdown is needed."""
+            raise RuntimeError("Cluster Host Not Found: {}".format(settings.CLUSTER_HOST_ID))
+    # IFF any node has a greater version than we do, then we'll shutdown services
     for other_inst in instance_list:
         if other_inst.node_type in ('execution', 'hop'):
             continue
@@ -816,9 +655,6 @@ def _heartbeat_check_versions(this_inst, instance_list):
             stop_local_services(communicate=False)
             raise RuntimeError("Shutting down.")
 
-
-def _heartbeat_handle_lost_instances(lost_instances, this_inst):
-    """Handle lost instances by reaping their jobs and marking them offline."""
     for other_inst in lost_instances:
         try:
             explanation = "Job reaped due to instance shutdown"
@@ -849,8 +685,17 @@ def _heartbeat_handle_lost_instances(lost_instances, this_inst):
             else:
                 logger.exception('No SQL state available.  Error marking {} as lost'.format(other_inst.hostname))
 
+    # Run local reaper
+    if worker_tasks is not None:
+        active_task_ids = []
+        for task_list in worker_tasks.values():
+            active_task_ids.extend(task_list)
+        reaper.reap(instance=this_inst, excluded_uuids=active_task_ids, ref_time=datetime.fromisoformat(dispatch_time))
+        if max(len(task_list) for task_list in worker_tasks.values()) <= 1:
+            reaper.reap_waiting(instance=this_inst, excluded_uuids=active_task_ids, ref_time=datetime.fromisoformat(dispatch_time))
 
-@task_awx(queue=get_task_queuename)
+
+@task(queue=get_task_queuename)
 def awx_receptor_workunit_reaper():
     """
     When an AWX job is launched via receptor, files such as status, stdin, and stdout are created
@@ -873,16 +718,8 @@ def awx_receptor_workunit_reaper():
     if not settings.RECEPTOR_RELEASE_WORK:
         return
     logger.debug("Checking for unreleased receptor work units")
-    try:
-        receptor_ctl = get_receptor_ctl()
-    except FileNotFoundError:
-        logger.info('Receptorctl sockfile not found for workunit reaper, doing nothing')
-        return
-    try:
-        receptor_work_list = receptor_ctl.simple_command("work list")
-    except ValueError as exc:
-        logger.info(f'Error getting work list for workunit reaper, error: {str(exc)}')
-        return
+    receptor_ctl = get_receptor_ctl()
+    receptor_work_list = receptor_ctl.simple_command("work list")
 
     unit_ids = [id for id in receptor_work_list]
     jobs_with_unreleased_receptor_units = UnifiedJob.objects.filter(work_unit_id__in=unit_ids).exclude(status__in=ACTIVE_STATES)
@@ -896,7 +733,7 @@ def awx_receptor_workunit_reaper():
     administrative_workunit_reaper(receptor_work_list)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def awx_k8s_reaper():
     if not settings.RECEPTOR_RELEASE_WORK:
         return
@@ -919,7 +756,7 @@ def awx_k8s_reaper():
                 logger.exception("Failed to delete orphaned pod {} from {}".format(job.log_format, group))
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def awx_periodic_scheduler():
     lock_session_timeout_milliseconds = settings.TASK_MANAGER_LOCK_TIMEOUT * 1000
     with advisory_lock('awx_periodic_scheduler_lock', lock_session_timeout_milliseconds=lock_session_timeout_milliseconds, wait=False) as acquired:
@@ -978,7 +815,7 @@ def awx_periodic_scheduler():
             emit_channel_notification('schedules-changed', dict(id=schedule.id, group_name="schedules"))
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def handle_failure_notifications(task_ids):
     """A task-ified version of the method that sends notifications."""
     found_task_ids = set()
@@ -993,7 +830,7 @@ def handle_failure_notifications(task_ids):
         logger.warning(f'Could not send notifications for {deleted_tasks} because they were not found in the database')
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def update_inventory_computed_fields(inventory_id):
     """
     Signal handler and wrapper around inventory.update_computed_fields to
@@ -1043,7 +880,7 @@ def update_smart_memberships_for_inventory(smart_inventory):
     return False
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def update_host_smart_inventory_memberships():
     smart_inventories = Inventory.objects.filter(kind='smart', host_filter__isnull=False, pending_deletion=False)
     changed_inventories = set([])
@@ -1059,7 +896,7 @@ def update_host_smart_inventory_memberships():
         smart_inventory.update_computed_fields()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def delete_inventory(inventory_id, user_id, retries=5):
     # Delete inventory as user
     if user_id is None:
@@ -1121,7 +958,7 @@ def _reconstruct_relationships(copy_mapping):
         new_obj.save()
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def deep_copy_model_obj(model_module, model_name, obj_pk, new_obj_pk, user_pk, permission_check_func=None):
     logger.debug('Deep copy {} from {} to {}.'.format(model_name, obj_pk, new_obj_pk))
 
@@ -1176,7 +1013,7 @@ def deep_copy_model_obj(model_module, model_name, obj_pk, new_obj_pk, user_pk, p
         update_inventory_computed_fields.delay(new_obj.id)
 
 
-@task_awx(queue=get_task_queuename)
+@task(queue=get_task_queuename)
 def periodic_resource_sync():
     if not getattr(settings, 'RESOURCE_SERVER', None):
         logger.debug("Skipping periodic resource_sync, RESOURCE_SERVER not configured")

awx/main/tests/data/inventory/plugins/controller/env.json

@@ -8,12 +8,5 @@
     "CONTROLLER_PASSWORD": "fooo",
     "CONTROLLER_USERNAME": "fooo",
     "CONTROLLER_OAUTH_TOKEN": "",
-    "CONTROLLER_VERIFY_SSL": "False",
-    "AAP_HOSTNAME": "https://foo.invalid",
-    "AAP_PASSWORD": "fooo",
-    "AAP_USERNAME": "fooo",
-    "AAP_VALIDATE_CERTS": "False",
-    "CONTROLLER_REQUEST_TIMEOUT": "fooo",
-    "AAP_REQUEST_TIMEOUT": "fooo",
-    "AAP_TOKEN": ""
+    "CONTROLLER_VERIFY_SSL": "False"
 }

awx/main/tests/data/projects/debug/sleep.yml

@@ -1,9 +0,0 @@
----
-- hosts: all
-  gather_facts: false
-  connection: local
-  vars:
-    sleep_interval: 5
-  tasks:
-    - name: sleep for a specified interval
-      command: sleep '{{ sleep_interval }}'

awx/main/tests/data/projects/facts/clear.yml

@@ -1,7 +0,0 @@
----
-
-- hosts: all
-  gather_facts: false
-  connection: local
-  tasks:
-    - meta: clear_facts

awx/main/tests/data/projects/facts/gather.yml

@@ -1,17 +0,0 @@
----
-
-- hosts: all
-  vars:
-    extra_value: ""
-  gather_facts: false
-  connection: local
-  tasks:
-    - name: set a custom fact
-      set_fact:
-        foo: "bar{{ extra_value }}"
-        bar:
-          a:
-            b:
-              - "c"
-              - "d"
-        cacheable: true

awx/main/tests/data/projects/facts/no_op.yml

@@ -1,9 +0,0 @@
----
-
-- hosts: all
-  gather_facts: false
-  connection: local
-  vars:
-    msg: 'hello'
-  tasks:
-    - debug: var=msg

awx/main/tests/data/projects/inventory_vars/inventory_var_deleted_in_source.ini

@@ -1,3 +0,0 @@
-[all:vars]
-a=value_a
-b=value_b

awx/main/tests/data/sleep_task.py

@@ -1,57 +0,0 @@
-import time
-import logging
-
-from dispatcherd.publish import task
-
-from django.db import connection
-
-from awx.main.dispatch import get_task_queuename
-from awx.main.dispatch.publish import task as old_task
-
-from ansible_base.lib.utils.db import advisory_lock
-
-
-logger = logging.getLogger(__name__)
-
-
-@old_task(queue=get_task_queuename)
-def sleep_task(seconds=10, log=False):
-    if log:
-        logger.info('starting sleep_task')
-    time.sleep(seconds)
-    if log:
-        logger.info('finished sleep_task')
-
-
-@task()
-def sleep_break_connection(seconds=0.2):
-    """
-    Interact with the database in an intentionally breaking way.
-    After this finishes, queries made by this connection are expected to error
-    with "the connection is closed"
-    This is obviously a problem for any task that comes afterwards.
-    So this is used to break things so that the fixes may be demonstrated.
-    """
-    with connection.cursor() as cursor:
-        cursor.execute(f"SET idle_session_timeout = '{seconds / 2}s';")
-
-    logger.info(f'sleeping for {seconds}s > {seconds / 2}s session timeout')
-    time.sleep(seconds)
-
-    for i in range(1, 3):
-        logger.info(f'\nRunning query number {i}')
-        try:
-            with connection.cursor() as cursor:
-                cursor.execute("SELECT 1;")
-                logger.info('  query worked, not expected')
-        except Exception as exc:
-            logger.info(f'  query errored as expected\ntype: {type(exc)}\nstr: {str(exc)}')
-
-    logger.info(f'Connection present: {bool(connection.connection)}, reports closed: {getattr(connection.connection, "closed", "not_found")}')
-
-
-@task()
-def advisory_lock_exception():
-    time.sleep(0.2)  # so it can fill up all the workers... hacky for now
-    with advisory_lock('advisory_lock_exception', lock_session_timeout_milliseconds=20):
-        raise RuntimeError('this is an intentional error')

awx/main/tests/functional/analytics/test_core.py

@@ -87,8 +87,8 @@ def mock_analytic_post():
             {
                 'REDHAT_USERNAME': 'redhat_user',
                 'REDHAT_PASSWORD': 'redhat_pass',  # NOSONAR
-                'SUBSCRIPTIONS_CLIENT_ID': '',
-                'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                'SUBSCRIPTIONS_USERNAME': '',
+                'SUBSCRIPTIONS_PASSWORD': '',
             },
             True,
             ('redhat_user', 'redhat_pass'),
@@ -98,8 +98,8 @@ def mock_analytic_post():
             {
                 'REDHAT_USERNAME': None,
                 'REDHAT_PASSWORD': None,
-                'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                'SUBSCRIPTIONS_CLIENT_SECRET': 'subs_pass',  # NOSONAR
+                'SUBSCRIPTIONS_USERNAME': 'subs_user',
+                'SUBSCRIPTIONS_PASSWORD': 'subs_pass',  # NOSONAR
             },
             True,
             ('subs_user', 'subs_pass'),
@@ -109,8 +109,8 @@ def mock_analytic_post():
             {
                 'REDHAT_USERNAME': '',
                 'REDHAT_PASSWORD': '',
-                'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                'SUBSCRIPTIONS_CLIENT_SECRET': 'subs_pass',  # NOSONAR
+                'SUBSCRIPTIONS_USERNAME': 'subs_user',
+                'SUBSCRIPTIONS_PASSWORD': 'subs_pass',  # NOSONAR
             },
             True,
             ('subs_user', 'subs_pass'),
@@ -120,8 +120,8 @@ def mock_analytic_post():
             {
                 'REDHAT_USERNAME': '',
                 'REDHAT_PASSWORD': '',
-                'SUBSCRIPTIONS_CLIENT_ID': '',
-                'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                'SUBSCRIPTIONS_USERNAME': '',
+                'SUBSCRIPTIONS_PASSWORD': '',
             },
             False,
             None,  # No request should be made
@@ -131,8 +131,8 @@ def mock_analytic_post():
             {
                 'REDHAT_USERNAME': '',
                 'REDHAT_PASSWORD': 'redhat_pass',  # NOSONAR
-                'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                'SUBSCRIPTIONS_USERNAME': 'subs_user',
+                'SUBSCRIPTIONS_PASSWORD': '',
             },
             False,
             None,  # Invalid, no request should be made
@@ -150,24 +150,3 @@ def test_ship_credential(setting_map, expected_result, expected_auth, temp_analy
             assert mock_analytic_post.call_args[1]['auth'] == expected_auth
         else:
             mock_analytic_post.assert_not_called()
-
-
-@pytest.mark.django_db
-def test_gather_cleanup_on_auth_failure(mock_valid_license, temp_analytic_tar):
-    settings.INSIGHTS_TRACKING_STATE = True
-    settings.AUTOMATION_ANALYTICS_URL = 'https://example.com/api'
-    settings.REDHAT_USERNAME = 'test_user'
-    settings.REDHAT_PASSWORD = 'test_password'
-
-    with tempfile.NamedTemporaryFile(delete=False, suffix='.tar.gz') as temp_file:
-        temp_file_path = temp_file.name
-
-    try:
-        with mock.patch('awx.main.analytics.core.ship', return_value=False):
-            with mock.patch('awx.main.analytics.core.package', return_value=temp_file_path):
-                gather(module=importlib.import_module(__name__), collection_type='scheduled')
-
-                assert not os.path.exists(temp_file_path), "Temp file was not cleaned up after ship failure"
-    finally:
-        if os.path.exists(temp_file_path):
-            os.remove(temp_file_path)

awx/main/tests/functional/analytics/test_metrics.py

@@ -30,7 +30,6 @@ EXPECTED_VALUES = {
     'awx_license_instance_free': 0,
     'awx_pending_jobs_total': 0,
     'awx_database_connections_total': 1,
-    'awx_license_expiry': 0,
 }
 
 

awx/main/tests/functional/api/test_analytics.py

@@ -97,8 +97,8 @@ class TestAnalyticsGenericView:
                     'INSIGHTS_TRACKING_STATE': True,
                     'REDHAT_USERNAME': 'redhat_user',
                     'REDHAT_PASSWORD': 'redhat_pass',  # NOSONAR
-                    'SUBSCRIPTIONS_CLIENT_ID': '',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                    'SUBSCRIPTIONS_USERNAME': '',
+                    'SUBSCRIPTIONS_PASSWORD': '',
                 },
                 ('redhat_user', 'redhat_pass'),
                 None,
@@ -109,8 +109,8 @@ class TestAnalyticsGenericView:
                     'INSIGHTS_TRACKING_STATE': True,
                     'REDHAT_USERNAME': '',
                     'REDHAT_PASSWORD': '',
-                    'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': 'subs_pass',  # NOSONAR
+                    'SUBSCRIPTIONS_USERNAME': 'subs_user',
+                    'SUBSCRIPTIONS_PASSWORD': 'subs_pass',  # NOSONAR
                 },
                 ('subs_user', 'subs_pass'),
                 None,
@@ -121,8 +121,8 @@ class TestAnalyticsGenericView:
                     'INSIGHTS_TRACKING_STATE': True,
                     'REDHAT_USERNAME': '',
                     'REDHAT_PASSWORD': '',
-                    'SUBSCRIPTIONS_CLIENT_ID': '',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                    'SUBSCRIPTIONS_USERNAME': '',
+                    'SUBSCRIPTIONS_PASSWORD': '',
                 },
                 None,
                 ERROR_MISSING_USER,
@@ -133,8 +133,8 @@ class TestAnalyticsGenericView:
                     'INSIGHTS_TRACKING_STATE': True,
                     'REDHAT_USERNAME': 'redhat_user',
                     'REDHAT_PASSWORD': 'redhat_pass',  # NOSONAR
-                    'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': 'subs_pass',  # NOSONAR
+                    'SUBSCRIPTIONS_USERNAME': 'subs_user',
+                    'SUBSCRIPTIONS_PASSWORD': 'subs_pass',  # NOSONAR
                 },
                 ('redhat_user', 'redhat_pass'),
                 None,
@@ -145,8 +145,8 @@ class TestAnalyticsGenericView:
                     'INSIGHTS_TRACKING_STATE': True,
                     'REDHAT_USERNAME': '',
                     'REDHAT_PASSWORD': '',
-                    'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',  # NOSONAR
-                    'SUBSCRIPTIONS_CLIENT_SECRET': '',
+                    'SUBSCRIPTIONS_USERNAME': 'subs_user',  # NOSONAR
+                    'SUBSCRIPTIONS_PASSWORD': '',
                 },
                 None,
                 ERROR_MISSING_PASSWORD,
@@ -155,36 +155,26 @@ class TestAnalyticsGenericView:
     )
     @pytest.mark.django_db
     def test__send_to_analytics_credentials(self, settings_map, expected_auth, expected_error_keyword):
-        """
-        Test _send_to_analytics with various combinations of credentials.
-        """
         with override_settings(**settings_map):
             request = RequestFactory().post('/some/path')
             view = AnalyticsGenericView()
 
             if expected_auth:
-                with mock.patch('awx.api.views.analytics.OIDCClient') as mock_oidc_client:
-                    # Configure the mock OIDCClient instance and its make_request method
-                    mock_client_instance = mock.Mock()
-                    mock_oidc_client.return_value = mock_client_instance
-                    mock_client_instance.make_request.return_value = mock.Mock(status_code=200)
+                with mock.patch('requests.request') as mock_request:
+                    mock_request.return_value = mock.Mock(status_code=200)
 
                     analytic_url = view._get_analytics_url(request.path)
                     response = view._send_to_analytics(request, 'POST')
 
                     # Assertions
-                    # Assert OIDCClient instantiation
-                    expected_client_id, expected_client_secret = expected_auth
-                    mock_oidc_client.assert_called_once_with(expected_client_id, expected_client_secret)
-
-                    # Assert make_request call
-                    mock_client_instance.make_request.assert_called_once_with(
+                    mock_request.assert_called_once_with(
                         'POST',
                         analytic_url,
-                        headers=mock.ANY,
+                        auth=expected_auth,
                         verify=mock.ANY,
-                        params=mock.ANY,
+                        headers=mock.ANY,
                         json=mock.ANY,
+                        params=mock.ANY,
                         timeout=mock.ANY,
                     )
                     assert response.status_code == 200
@@ -196,64 +186,3 @@ class TestAnalyticsGenericView:
                 # mock_error_response.assert_called_once_with(expected_error_keyword, remote=False)
                 assert response.status_code == status.HTTP_403_FORBIDDEN
                 assert response.data['error']['keyword'] == expected_error_keyword
-
-    @pytest.mark.django_db
-    @pytest.mark.parametrize(
-        "settings_map, expected_auth",
-        [
-            # Test case 1: Username and password should be used for basic auth
-            (
-                {
-                    'INSIGHTS_TRACKING_STATE': True,
-                    'REDHAT_USERNAME': 'redhat_user',
-                    'REDHAT_PASSWORD': 'redhat_pass',  # NOSONAR
-                    'SUBSCRIPTIONS_CLIENT_ID': '',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': '',
-                },
-                ('redhat_user', 'redhat_pass'),
-            ),
-            # Test case 2: Client ID and secret should be used for basic auth
-            (
-                {
-                    'INSIGHTS_TRACKING_STATE': True,
-                    'REDHAT_USERNAME': '',
-                    'REDHAT_PASSWORD': '',
-                    'SUBSCRIPTIONS_CLIENT_ID': 'subs_user',
-                    'SUBSCRIPTIONS_CLIENT_SECRET': 'subs_pass',  # NOSONAR
-                },
-                None,
-            ),
-        ],
-    )
-    def test__send_to_analytics_fallback_to_basic_auth(self, settings_map, expected_auth):
-        """
-        Test _send_to_analytics with basic auth fallback.
-        """
-        with override_settings(**settings_map):
-            request = RequestFactory().post('/some/path')
-            view = AnalyticsGenericView()
-
-            with mock.patch('awx.api.views.analytics.OIDCClient') as mock_oidc_client, mock.patch(
-                'awx.api.views.analytics.AnalyticsGenericView._base_auth_request'
-            ) as mock_base_auth_request:
-                # Configure the mock OIDCClient instance and its make_request method
-                mock_client_instance = mock.Mock()
-                mock_oidc_client.return_value = mock_client_instance
-                mock_client_instance.make_request.side_effect = requests.RequestException("Incorrect credentials")
-
-                analytic_url = view._get_analytics_url(request.path)
-                view._send_to_analytics(request, 'POST')
-
-                if expected_auth:
-                    # assert mock_base_auth_request called with expected_auth
-                    mock_base_auth_request.assert_called_once_with(
-                        request,
-                        'POST',
-                        analytic_url,
-                        expected_auth[0],
-                        expected_auth[1],
-                        mock.ANY,
-                    )
-                else:
-                    # assert mock_base_auth_request not called
-                    mock_base_auth_request.assert_not_called()

awx/main/tests/functional/api/test_immutablesharedfields.py

@@ -0,0 +1,64 @@
+import pytest
+
+from awx.api.versioning import reverse
+from awx.main.models import Organization
+
+
+@pytest.mark.django_db
+class TestImmutableSharedFields:
+    @pytest.fixture(autouse=True)
+    def configure_settings(self, settings):
+        settings.ALLOW_LOCAL_RESOURCE_MANAGEMENT = False
+
+    def test_create_raises_permission_denied(self, admin_user, post):
+        orgA = Organization.objects.create(name='orgA')
+        resp = post(
+            url=reverse('api:team_list'),
+            data={'name': 'teamA', 'organization': orgA.id},
+            user=admin_user,
+            expect=403,
+        )
+        assert "Creation of this resource is not allowed" in resp.data['detail']
+
+    def test_perform_delete_raises_permission_denied(self, admin_user, delete):
+        orgA = Organization.objects.create(name='orgA')
+        team = orgA.teams.create(name='teamA')
+        resp = delete(
+            url=reverse('api:team_detail', kwargs={'pk': team.id}),
+            user=admin_user,
+            expect=403,
+        )
+        assert "Deletion of this resource is not allowed" in resp.data['detail']
+
+    def test_perform_update(self, admin_user, patch):
+        orgA = Organization.objects.create(name='orgA')
+        # allow patching non-shared fields
+        patch(
+            url=reverse('api:organization_detail', kwargs={'pk': orgA.id}),
+            data={"max_hosts": 76},
+            user=admin_user,
+            expect=200,
+        )
+        # prevent patching shared fields
+        resp = patch(url=reverse('api:organization_detail', kwargs={'pk': orgA.id}), data={"name": "orgB"}, user=admin_user, expect=403)
+        assert "Cannot change shared field" in resp.data['name']
+
+    @pytest.mark.parametrize(
+        'role',
+        ['admin_role', 'member_role'],
+    )
+    @pytest.mark.parametrize('resource', ['organization', 'team'])
+    def test_prevent_assigning_member_to_organization_or_team(self, admin_user, post, resource, role):
+        orgA = Organization.objects.create(name='orgA')
+        if resource == 'organization':
+            role = getattr(orgA, role)
+        elif resource == 'team':
+            teamA = orgA.teams.create(name='teamA')
+            role = getattr(teamA, role)
+        resp = post(
+            url=reverse('api:user_roles_list', kwargs={'pk': admin_user.id}),
+            data={'id': role.id},
+            user=admin_user,
+            expect=403,
+        )
+        assert f"Cannot directly modify user membership to {resource}." in resp.data['msg']

awx/main/tests/functional/api/test_inventory.py

@@ -8,7 +8,6 @@ from django.core.exceptions import ValidationError
 from awx.api.versioning import reverse
 
 from awx.main.models import InventorySource, Inventory, ActivityStream
-from awx.main.utils.inventory_vars import update_group_variables
 
 
 @pytest.fixture
@@ -691,241 +690,3 @@ class TestConstructedInventory:
         assert inv_r.data['url'] != const_r.data['url']
         assert inv_r.data['related']['constructed_url'] == url_const
         assert const_r.data['related']['constructed_url'] == url_const
-
-
-@pytest.mark.django_db
-class TestInventoryAllVariables:
-
-    @staticmethod
-    def simulate_update_from_source(inv_src, variables_dict, overwrite_vars=True):
-        """
-        Update `inventory` with variables `variables_dict` from source
-        `inv_src`.
-        """
-        # Perform an update from source the same way it is done in
-        # `inventory_import.Command._update_inventory`.
-        new_vars = update_group_variables(
-            group_id=None,  # `None` denotes the 'all' group (which doesn't have a pk).
-            newvars=variables_dict,
-            dbvars=inv_src.inventory.variables_dict,
-            invsrc_id=inv_src.id,
-            inventory_id=inv_src.inventory.id,
-            overwrite_vars=overwrite_vars,
-        )
-        inv_src.inventory.variables = json.dumps(new_vars)
-        inv_src.inventory.save(update_fields=["variables"])
-        return new_vars
-
-    def update_and_verify(self, inv_src, new_vars, expect=None, overwrite_vars=True, teststep=None):
-        """
-        Helper: Update from source and verify the new inventory variables.
-
-        :param inv_src: An inventory source object with its inventory property
-            set to the inventory fixture of the called.
-        :param dict new_vars: The variables of the inventory source `inv_src`.
-        :param dict expect: (optional) The expected variables state of the
-            inventory after the update. If not set or None, expect `new_vars`.
-        :param bool overwrite_vars: The status of the inventory source option
-            'overwrite variables'. Default is `True`.
-        :raise AssertionError: If the inventory does not contain the expected
-            variables after the update.
-        """
-        self.simulate_update_from_source(inv_src, new_vars, overwrite_vars=overwrite_vars)
-        if teststep is not None:
-            assert inv_src.inventory.variables_dict == (expect if expect is not None else new_vars), f"Test step {teststep}"
-        else:
-            assert inv_src.inventory.variables_dict == (expect if expect is not None else new_vars)
-
-    def test_set_variables_through_inventory_details_update(self, inventory, patch, admin_user):
-        """
-        Set an inventory variable by changing the inventory details, simulating
-        a user edit.
-        """
-        # a: x
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'a: x'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"a": "x"}
-
-    def test_variables_set_by_user_persist_update_from_src(self, inventory, inventory_source, patch, admin_user):
-        """
-        Verify the special behavior that a variable which originates from a user
-        edit (instead of a source update), is not removed from the inventory
-        when a source update with overwrite_vars=True does not contain that
-        variable. This behavior is considered special because a variable which
-        originates from a source would actually be deleted.
-
-        In addition, verify that an existing variable which was set by a user
-        edit can be overwritten by a source update.
-        """
-        # Set two variables via user edit.
-        patch(
-            url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}),
-            data={'variables': '{"a": "a_from_user", "b": "b_from_user"}'},
-            user=admin_user,
-            expect=200,
-        )
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {'a': 'a_from_user', 'b': 'b_from_user'}
-        # Update from a source which contains only one of the two variables from
-        # the previous update.
-        self.simulate_update_from_source(inventory_source, {'a': 'a_from_source'})
-        # Verify inventory variables.
-        assert inventory.variables_dict == {'a': 'a_from_source', 'b': 'b_from_user'}
-
-    def test_variables_set_through_src_get_removed_on_update_from_same_src(self, inventory, inventory_source, patch, admin_user):
-        """
-        Verify that a variable which originates from a source update, is removed
-        from the inventory when a source update with overwrite_vars=True does
-        not contain that variable.
-
-        In addition, verify that an existing variable which was set by a user
-        edit can be overwritten by a source update.
-        """
-        # Set two variables via update from source.
-        self.simulate_update_from_source(inventory_source, {'a': 'a_from_source', 'b': 'b_from_source'})
-        # Verify inventory variables.
-        assert inventory.variables_dict == {'a': 'a_from_source', 'b': 'b_from_source'}
-        # Update from the same source which now contains only one of the two
-        # variables from the previous update.
-        self.simulate_update_from_source(inventory_source, {'b': 'b_from_source'})
-        # Verify the variable has been deleted from the inventory.
-        assert inventory.variables_dict == {'b': 'b_from_source'}
-
-    def test_overwrite_variables_through_inventory_details_update(self, inventory, patch, admin_user):
-        """
-        Set and update the inventory variables multiple times by changing the
-        inventory details via api, simulating user edits.
-
-        Any variables update by means of an inventory details update shall
-        overwright all existing inventory variables.
-        """
-        # a: x
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'a: x'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"a": "x"}
-        # a: x2
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'a: x2'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"a": "x2"}
-        # b: y
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'b: y'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"b": "y"}
-
-    def test_inventory_group_variables_internal_data(self, inventory, patch, admin_user):
-        """
-        Basic verification of how variable updates are stored internally.
-
-        .. Warning::
-
-            This test verifies a specific implementation of the inventory
-            variables update business logic. It may deliver false negatives if
-            the implementation changes.
-        """
-        # x: a
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'a: x'}, user=admin_user, expect=200)
-        igv = inventory.inventory_group_variables.first()
-        assert igv.variables == {'a': [[-1, 'x']]}
-        # b: y
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'b: y'}, user=admin_user, expect=200)
-        igv = inventory.inventory_group_variables.first()
-        assert igv.variables == {'b': [[-1, 'y']]}
-
-    def test_update_then_user_change(self, inventory, patch, admin_user, inventory_source):
-        """
-        1. Update inventory vars by means of an inventory source update.
-        2. Update inventory vars by editing the inventory details (aka a 'user
-           update'), thereby changing variables values and deleting variables
-           from the inventory.
-
-        .. Warning::
-
-            This test partly relies on a specific implementation of the
-            inventory variables update business logic. It may deliver false
-            negatives if the implementation changes.
-        """
-        assert inventory_source.inventory_id == inventory.pk  # sanity
-        # ---- Test step 1: Set variables by updating from an inventory source.
-        self.simulate_update_from_source(inventory_source, {'foo': 'foo_from_source', 'bar': 'bar_from_source'})
-        # Verify inventory variables.
-        assert inventory.variables_dict == {'foo': 'foo_from_source', 'bar': 'bar_from_source'}
-        # Verify internal storage of variables data. Note that this is
-        # implementation specific
-        assert inventory.inventory_group_variables.count() == 1
-        igv = inventory.inventory_group_variables.first()
-        assert igv.variables == {'foo': [[inventory_source.id, 'foo_from_source']], 'bar': [[inventory_source.id, 'bar_from_source']]}
-        # ---- Test step 2: Change the variables by editing the inventory details.
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'foo: foo_from_user'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        # Verify that variable `foo` contains the new value, and that variable
-        # `bar` has been deleted from the inventory.
-        assert inventory.variables_dict == {"foo": "foo_from_user"}
-        # Verify internal storage of variables data. Note that this is
-        # implementation specific
-        inventory.inventory_group_variables.count() == 1
-        igv = inventory.inventory_group_variables.first()
-        assert igv.variables == {'foo': [[-1, 'foo_from_user']]}
-
-    def test_monotonic_deletions(self, inventory, patch, admin_user):
-        """
-        Verify the variables history logic for monotonic deletions.
-
-        Monotonic in this context means that the variables are deleted in the
-        reverse order of their creation.
-
-        1. Set inventory variable x: 0, expect INV={x: 0}
-
-        (The following steps use overwrite_variables=False)
-
-        2. Update from source A={x: 1}, expect INV={x: 1}
-        3. Update from source B={x: 2}, expect INV={x: 2}
-        4. Update from source B={}, expect INV={x: 1}
-        5. Update from source A={}, expect INV={x: 0}
-        """
-        inv_src_a = InventorySource.objects.create(name="inv-src-A", inventory=inventory, source="ec2")
-        inv_src_b = InventorySource.objects.create(name="inv-src-B", inventory=inventory, source="ec2")
-        # Test step 1:
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'x: 0'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"x": 0}
-        # Test step 2: Source A overwrites value of var x
-        self.update_and_verify(inv_src_a, {"x": 1}, teststep=2)
-        # Test step 3: Source A overwrites value of var x
-        self.update_and_verify(inv_src_b, {"x": 2}, teststep=3)
-        # Test step 4: Value of var x from source A reappears
-        self.update_and_verify(inv_src_b, {}, expect={"x": 1}, teststep=4)
-        # Test step 5: Value of var x from initial user edit reappears
-        self.update_and_verify(inv_src_a, {}, expect={"x": 0}, teststep=5)
-
-    def test_interleaved_deletions(self, inventory, patch, admin_user, inventory_source):
-        """
-        Verify the variables history logic for interleaved deletions.
-
-        Interleaved in this context means that the variables are deleted in a
-        different order than the sequence of their creation.
-
-        1. Set inventory variable x: 0, expect INV={x: 0}
-        2. Update from source A={x: 1}, expect INV={x: 1}
-        3. Update from source B={x: 2}, expect INV={x: 2}
-        4. Update from source C={x: 3}, expect INV={x: 3}
-        5. Update from source B={}, expect INV={x: 3}
-        6. Update from source C={}, expect INV={x: 1}
-        """
-        inv_src_a = InventorySource.objects.create(name="inv-src-A", inventory=inventory, source="ec2")
-        inv_src_b = InventorySource.objects.create(name="inv-src-B", inventory=inventory, source="ec2")
-        inv_src_c = InventorySource.objects.create(name="inv-src-C", inventory=inventory, source="ec2")
-        # Test step 1. Set inventory variable x: 0
-        patch(url=reverse('api:inventory_detail', kwargs={'pk': inventory.pk}), data={'variables': 'x: 0'}, user=admin_user, expect=200)
-        inventory.refresh_from_db()
-        assert inventory.variables_dict == {"x": 0}
-        # Test step 2: Source A overwrites value of var x
-        self.update_and_verify(inv_src_a, {"x": 1}, teststep=2)
-        # Test step 3: Source B overwrites value of var x
-        self.update_and_verify(inv_src_b, {"x": 2}, teststep=3)
-        # Test step 4: Source C overwrites value of var x
-        self.update_and_verify(inv_src_c, {"x": 3}, teststep=4)
-        # Test step 5: Value of var x from source C remains unchanged
-        self.update_and_verify(inv_src_b, {}, expect={"x": 3}, teststep=5)
-        # Test step 6: Value of var x from source A reappears, because the
-        # latest update from source B did not contain var x.
-        self.update_and_verify(inv_src_c, {}, expect={"x": 1}, teststep=6)

awx/main/tests/functional/api/test_user.py

@@ -56,175 +56,6 @@ def test_user_create(post, admin):
     assert not response.data['is_system_auditor']
 
 
-# Disable local password checks to ensure that any ValidationError originates from the Django validators.
-@override_settings(
-    LOCAL_PASSWORD_MIN_LENGTH=1,
-    LOCAL_PASSWORD_MIN_DIGITS=0,
-    LOCAL_PASSWORD_MIN_UPPER=0,
-    LOCAL_PASSWORD_MIN_SPECIAL=0,
-)
-@pytest.mark.django_db
-def test_user_create_with_django_password_validation_basic(post, admin):
-    """Test if the Django password validators are applied correctly."""
-    with override_settings(
-        AUTH_PASSWORD_VALIDATORS=[
-            {
-                'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
-                'OPTIONS': {
-                    'min_length': 3,
-                },
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
-            },
-        ],
-    ):
-        # This user should fail the UserAttrSimilarity, MinLength and CommonPassword validators.
-        user_attrs = (
-            {
-                "password": "Password",  # NOSONAR
-                "username": "Password",
-                "is_superuser": False,
-            },
-        )
-        print(f"Create user with invalid password {user_attrs=}")
-        response = post(reverse('api:user_list'), user_attrs, admin, middleware=SessionMiddleware(mock.Mock()))
-        assert response.status_code == 400
-        # This user should pass all Django validators.
-        user_attrs = {
-            "password": "r$TyKiOCb#ED",  # NOSONAR
-            "username": "TestUser",
-            "is_superuser": False,
-        }
-        print(f"Create user with valid password {user_attrs=}")
-        response = post(reverse('api:user_list'), user_attrs, admin, middleware=SessionMiddleware(mock.Mock()))
-        assert response.status_code == 201
-
-
-@pytest.mark.parametrize(
-    "user_attrs,validators,expected_status_code",
-    [
-        # Test password similarity with username.
-        (
-            {"password": "TestUser1", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
-            ],
-            400,
-        ),
-        (
-            {"password": "abc", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
-            ],
-            201,
-        ),
-        # Test password min length criterion.
-        (
-            {"password": "TooShort", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': {'min_length': 9}},
-            ],
-            400,
-        ),
-        (
-            {"password": "LongEnough", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': {'min_length': 9}},
-            ],
-            201,
-        ),
-        # Test password is too common criterion.
-        (
-            {"password": "Password", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
-            ],
-            400,
-        ),
-        (
-            {"password": "aEArV$5Vkdw", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
-            ],
-            201,
-        ),
-        # Test if password is only numeric.
-        (
-            {"password": "1234567890", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
-            ],
-            400,
-        ),
-        (
-            {"password": "abc4567890", "username": "TestUser1", "is_superuser": False},  # NOSONAR
-            [
-                {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
-            ],
-            201,
-        ),
-    ],
-)
-# Disable local password checks to ensure that any ValidationError originates from the Django validators.
-@override_settings(
-    LOCAL_PASSWORD_MIN_LENGTH=1,
-    LOCAL_PASSWORD_MIN_DIGITS=0,
-    LOCAL_PASSWORD_MIN_UPPER=0,
-    LOCAL_PASSWORD_MIN_SPECIAL=0,
-)
-@pytest.mark.django_db
-def test_user_create_with_django_password_validation_ext(post, delete, admin, user_attrs, validators, expected_status_code):
-    """Test the functionality of the single Django password validators."""
-    #
-    default_parameters = {
-        # Default values for input parameters which are None.
-        "user_attrs": {
-            "password": "r$TyKiOCb#ED",  # NOSONAR
-            "username": "DefaultUser",
-            "is_superuser": False,
-        },
-        "validators": [
-            {
-                'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
-                'OPTIONS': {
-                    'min_length': 8,
-                },
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
-            },
-            {
-                'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
-            },
-        ],
-    }
-    user_attrs = user_attrs if user_attrs is not None else default_parameters["user_attrs"]
-    validators = validators if validators is not None else default_parameters["validators"]
-    with override_settings(AUTH_PASSWORD_VALIDATORS=validators):
-        response = post(reverse('api:user_list'), user_attrs, admin, middleware=SessionMiddleware(mock.Mock()))
-        assert response.status_code == expected_status_code
-        # Delete user if it was created succesfully.
-        if response.status_code == 201:
-            response = delete(reverse('api:user_detail', kwargs={'pk': response.data['id']}), admin, middleware=SessionMiddleware(mock.Mock()))
-            assert response.status_code == 204
-        else:
-            # Catch the unexpected behavior that sometimes the user is written
-            # into the database before the validation fails. This actually can
-            # happen if UserSerializer.validate instantiates User(**attrs)!
-            username = user_attrs['username']
-            assert not User.objects.filter(username=username)
-
-
 @pytest.mark.django_db
 def test_fail_double_create_user(post, admin):
     response = post(reverse('api:user_list'), EXAMPLE_USER_DATA, admin, middleware=SessionMiddleware(mock.Mock()))
@@ -251,10 +82,6 @@ def test_updating_own_password_refreshes_session(patch, admin):
     Updating your own password should refresh the session id.
     '''
     with mock.patch('awx.api.serializers.update_session_auth_hash') as update_session_auth_hash:
-        # Attention: If the Django password validator `CommonPasswordValidator`
-        # is active, this test case will fail because this validator raises on
-        # password 'newpassword'. Consider changing the hard-coded password to
-        # something uncommon.
         patch(reverse('api:user_detail', kwargs={'pk': admin.pk}), {'password': 'newpassword'}, admin, middleware=SessionMiddleware(mock.Mock()))
         assert update_session_auth_hash.called
 

awx/main/tests/functional/commands/test_callback_receiver.py

@@ -34,18 +34,40 @@ def test_wrapup_does_send_notifications(mocker):
     mock.assert_called_once_with('succeeded')
 
 
+class FakeRedis:
+    def keys(self, *args, **kwargs):
+        return []
+
+    def set(self):
+        pass
+
+    def get(self):
+        return None
+
+    @classmethod
+    def from_url(cls, *args, **kwargs):
+        return cls()
+
+    def pipeline(self):
+        return self
+
+
 class TestCallbackBrokerWorker(TransactionTestCase):
     @pytest.fixture(autouse=True)
-    def turn_off_websockets_and_redis(self, fake_redis):
+    def turn_off_websockets(self):
         with mock.patch('awx.main.dispatch.worker.callback.emit_event_detail', lambda *a, **kw: None):
             yield
 
+    def get_worker(self):
+        with mock.patch('redis.Redis', new=FakeRedis):  # turn off redis stuff
+            return CallbackBrokerWorker()
+
     def event_create_kwargs(self):
         inventory_update = InventoryUpdate.objects.create(source='file', inventory_source=InventorySource.objects.create(source='file'))
         return dict(inventory_update=inventory_update, created=inventory_update.created)
 
     def test_flush_with_valid_event(self):
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         events = [InventoryUpdateEvent(uuid=str(uuid4()), **self.event_create_kwargs())]
         worker.buff = {InventoryUpdateEvent: events}
         worker.flush()
@@ -53,7 +75,7 @@ class TestCallbackBrokerWorker(TransactionTestCase):
         assert InventoryUpdateEvent.objects.filter(uuid=events[0].uuid).count() == 1
 
     def test_flush_with_invalid_event(self):
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         kwargs = self.event_create_kwargs()
         events = [
             InventoryUpdateEvent(uuid=str(uuid4()), stdout='good1', **kwargs),
@@ -68,7 +90,7 @@ class TestCallbackBrokerWorker(TransactionTestCase):
         assert worker.buff == {InventoryUpdateEvent: [events[1]]}
 
     def test_duplicate_key_not_saved_twice(self):
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         events = [InventoryUpdateEvent(uuid=str(uuid4()), **self.event_create_kwargs())]
         worker.buff = {InventoryUpdateEvent: events.copy()}
         worker.flush()
@@ -82,7 +104,7 @@ class TestCallbackBrokerWorker(TransactionTestCase):
         assert worker.buff.get(InventoryUpdateEvent, []) == []
 
     def test_give_up_on_bad_event(self):
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         events = [InventoryUpdateEvent(uuid=str(uuid4()), counter=-2, **self.event_create_kwargs())]
         worker.buff = {InventoryUpdateEvent: events.copy()}
 
@@ -95,7 +117,7 @@ class TestCallbackBrokerWorker(TransactionTestCase):
         assert InventoryUpdateEvent.objects.filter(uuid=events[0].uuid).count() == 0  # sanity
 
     def test_flush_with_empty_buffer(self):
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         worker.buff = {InventoryUpdateEvent: []}
         with mock.patch.object(InventoryUpdateEvent.objects, 'bulk_create') as flush_mock:
             worker.flush()
@@ -105,7 +127,7 @@ class TestCallbackBrokerWorker(TransactionTestCase):
         # In postgres, text fields reject NUL character, 0x00
         # tests use sqlite3 which will not raise an error
         # but we can still test that it is sanitized before saving
-        worker = CallbackBrokerWorker()
+        worker = self.get_worker()
         kwargs = self.event_create_kwargs()
         events = [InventoryUpdateEvent(uuid=str(uuid4()), stdout="\x00", **kwargs)]
         assert "\x00" in events[0].stdout  # sanity

awx/main/tests/functional/conftest.py

@@ -63,33 +63,6 @@ def swagger_autogen(requests=__SWAGGER_REQUESTS__):
     return requests
 
 
-class FakeRedis:
-    def keys(self, *args, **kwargs):
-        return []
-
-    def set(self):
-        pass
-
-    def get(self):
-        return None
-
-    @classmethod
-    def from_url(cls, *args, **kwargs):
-        return cls()
-
-    def pipeline(self):
-        return self
-
-    def ping(self):
-        return
-
-
-@pytest.fixture
-def fake_redis():
-    with mock.patch('redis.Redis', new=FakeRedis):  # turn off redis stuff
-        yield
-
-
 @pytest.fixture
 def user():
     def u(name, is_superuser=False):

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -1,5 +1,6 @@
 import pytest
 
+from django.contrib.contenttypes.models import ContentType
 from django.urls import reverse as django_reverse
 
 from awx.api.versioning import reverse
@@ -7,14 +8,13 @@ from awx.main.models import JobTemplate, Inventory, Organization
 from awx.main.access import JobTemplateAccess, WorkflowJobTemplateAccess
 
 from ansible_base.rbac.models import RoleDefinition
-from ansible_base.rbac import permission_registry
 
 
 @pytest.mark.django_db
 def test_managed_roles_created(setup_managed_roles):
     "Managed RoleDefinitions are created in post_migration signal, we expect to see them here"
     for cls in (JobTemplate, Inventory):
-        ct = permission_registry.content_type_model.objects.get_for_model(cls)
+        ct = ContentType.objects.get_for_model(cls)
         rds = list(RoleDefinition.objects.filter(content_type=ct))
         assert len(rds) > 1
         assert f'{cls.__name__} Admin' in [rd.name for rd in rds]
@@ -26,20 +26,17 @@ def test_managed_roles_created(setup_managed_roles):
 def test_custom_read_role(admin_user, post, setup_managed_roles):
     rd_url = django_reverse('roledefinition-list')
     resp = post(
-        url=rd_url,
-        data={"name": "read role made for test", "content_type": "awx.inventory", "permissions": ['awx.view_inventory']},
-        user=admin_user,
-        expect=201,
+        url=rd_url, data={"name": "read role made for test", "content_type": "awx.inventory", "permissions": ['view_inventory']}, user=admin_user, expect=201
     )
     rd_id = resp.data['id']
     rd = RoleDefinition.objects.get(id=rd_id)
-    assert rd.content_type == permission_registry.content_type_model.objects.get_for_model(Inventory)
+    assert rd.content_type == ContentType.objects.get_for_model(Inventory)
 
 
 @pytest.mark.django_db
 def test_custom_system_roles_prohibited(admin_user, post):
     rd_url = django_reverse('roledefinition-list')
-    resp = post(url=rd_url, data={"name": "read role made for test", "content_type": None, "permissions": ['awx.view_inventory']}, user=admin_user, expect=400)
+    resp = post(url=rd_url, data={"name": "read role made for test", "content_type": None, "permissions": ['view_inventory']}, user=admin_user, expect=400)
     assert 'System-wide roles are not enabled' in str(resp.data)
 
 
@@ -74,7 +71,7 @@ def test_assign_custom_delete_role(admin_user, rando, inventory, delete, patch):
     rd, _ = RoleDefinition.objects.get_or_create(
         name='inventory-delete',
         permissions=['delete_inventory', 'view_inventory', 'change_inventory'],
-        content_type=permission_registry.content_type_model.objects.get_for_model(Inventory),
+        content_type=ContentType.objects.get_for_model(Inventory),
     )
     rd.give_permission(rando, inventory)
     inv_id = inventory.pk
@@ -88,9 +85,7 @@ def test_assign_custom_delete_role(admin_user, rando, inventory, delete, patch):
 @pytest.mark.django_db
 def test_assign_custom_add_role(admin_user, rando, organization, post, setup_managed_roles):
     rd, _ = RoleDefinition.objects.get_or_create(
-        name='inventory-add',
-        permissions=['add_inventory', 'view_organization'],
-        content_type=permission_registry.content_type_model.objects.get_for_model(Organization),
+        name='inventory-add', permissions=['add_inventory', 'view_organization'], content_type=ContentType.objects.get_for_model(Organization)
     )
     rd.give_permission(rando, organization)
     url = reverse('api:inventory_list')

awx/main/tests/functional/dab_rbac/test_translation_layer.py

@@ -3,6 +3,8 @@ import json
 
 import pytest
 
+from django.contrib.contenttypes.models import ContentType
+
 from crum import impersonate
 
 from awx.main.fields import ImplicitRoleField
@@ -58,7 +60,7 @@ def test_role_migration_matches(request, model, setup_managed_roles):
             new_codenames = set(rd.permissions.values_list('codename', flat=True))
             # all the old roles should map to a non-Compat role definition
             if 'Compat' not in rd.name:
-                model_rds = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get_for_model(obj))
+                model_rds = RoleDefinition.objects.filter(content_type=ContentType.objects.get_for_model(obj))
                 rd_data = {}
                 for rd in model_rds:
                     rd_data[rd.name] = list(rd.permissions.values_list('codename', flat=True))
@@ -74,7 +76,7 @@ def test_role_migration_matches(request, model, setup_managed_roles):
 
 @pytest.mark.django_db
 def test_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='dmin')
+    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='dmin')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Admin'
@@ -84,7 +86,7 @@ def test_role_naming(setup_managed_roles):
 
 @pytest.mark.django_db
 def test_action_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='ecute')
+    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ecute')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Execute'
@@ -96,7 +98,7 @@ def test_action_role_naming(setup_managed_roles):
 def test_compat_role_naming(setup_managed_roles, job_template, rando, alice):
     with impersonate(alice):
         job_template.read_role.members.add(rando)
-    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='ompat')
+    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ompat')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Read Compat'
@@ -104,17 +106,6 @@ def test_compat_role_naming(setup_managed_roles, job_template, rando, alice):
     assert rd.created_by is None
 
 
-@pytest.mark.django_db
-def test_organization_admin_has_audit(setup_managed_roles):
-    """This formalizes a behavior change from old to new RBAC system
-
-    Previously, the auditor_role did not list admin_role as a parent
-    this made various queries hard to deal with, requiring adding 2 conditions
-    The new system should explicitly list the auditor permission in org admin role"""
-    rd = RoleDefinition.objects.get(name='Organization Admin')
-    assert 'audit_organization' in rd.permissions.values_list('codename', flat=True)
-
-
 @pytest.mark.django_db
 def test_organization_level_permissions(organization, inventory, setup_managed_roles):
     u1 = User.objects.create(username='alice')