anaeem/ansible-collection-discovery
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

VM→OpenShift build/run pipeline rework #9

Merged
anaeem merged 11 commits from rework/vm-to-openshift into main 2026-06-11 19:05:25 +00:00
Conversation 0 Commits 11 Files changed 191 +9259 -4251
anaeem commented 2026-06-11 19:05:20 +00:00
Owner
Copy link

Helm bundles, generated tests, MTA closed loop, post-merge build_run (AAP JT 133 verified green end-to-end). See docs/E2E_ACCEPTANCE.md.

Helm bundles, generated tests, MTA closed loop, post-merge build_run (AAP JT 133 verified green end-to-end). See docs/E2E_ACCEPTANCE.md.
The v5 happy path is AAP-only. RHDH integration was experimental on the
v4 'rhdh-integration' branch and is not part of v5's official surface.
Kai (LLM refinement add-on writing 'Containerfile.kai-refined') was tried
in v4 and explicitly rolled back per CHANGELOG. v5 has a single bounded
LLM call inside the containerize role and the LLM-authored Containerfile
IS the bundle Containerfile.

Scrubs RHDH / Kai / Backstage / kai_refine mentions across 17 showroom
pages (rewrites prose where mixed, drops standalone references). Deletes
'27-rhdh-integration.adoc' entirely + the nav entry that pointed at it.
Reframes pre-v5 incident notes inside '35-integration-gaps.adoc' as
historical context rather than active gaps.

Adds '36-real-fleet-validation.adoc' — a dedicated runbook capturing
the 6-VM / 8-app validation that proved v5 is bug-free against a
mixed real-workload fleet (Spring PetClinic, Apache Roller,
JPetStore-6, tackle-testapp-public on varied Tomcats + DayTrader 7 on
Liberty + Plants-by-WebSphere on tWAS-shim). Lists the 8 acceptance
checkpoints from JT 107 discover through the gitea bundle PR to the
MTA Quarkus analyzer, plus an anti-patterns table that maps observed
symptoms back to the 14 bug-catalogue entries on this branch.
Page 36 §line 22 already states "JT 107 discover green on every host" but
the flow-walkthrough at §line 136 called scan_fleet JT 113. JT 107 is the
stable legacy id of scan_fleet per playbooks/utils/apply-v5-to-aap.yml --
the bootstrap creates the *new* JTs (pair_apps, fan_out, perapp-analyze)
with instance-specific numeric ids (114/122/121 on this run) but does not
touch JT 107.

Also adds a NOTE making the JT-A vs instance-specific-id distinction
explicit, and reworks one stray "JT 121" reference to use the portable
label form (`JT-perapp-analyze`).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pages 12, 28, 32, 33 and the persona blurb on page 03 still described the
pre-v5 workflow shape (JT 97/98/107/108 as stable IDs with fan_out=JT 108
and per_app=JT 98). The actual v5 shape per playbooks/utils/apply-v5-to-aap.yml
and the validated real-fleet run is:

  JT-A scan_fleet (JT 107, stable)
  -> Approval
  -> JT-B pair_apps (noop placeholder, instance-specific id)
  -> JT-E fan_out (instance-specific id) -- passes app_fact_inline
  -> N x JT-perapp-analyze (instance-specific id)
  -> Gitea PR

Mermaid sequence/flow diagrams on those pages now include the approval +
pair_apps noop nodes, reference the new JTs by portable label, and call
out that only JT 97 and JT 107 carry stable numeric ids. Page 33's setup
runbook now distinguishes "hand-create JT 97 + JT 107" from "let the
bootstrap create JT-B / JT-E / JT-perapp-analyze". Page 32 also gains a
xref to the validated reference run (page 36).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two small nav-level moves:

1. nav.adoc: move 36-real-fleet-validation between 32-end-to-end and
   33-aap-setup. Page 32 is the generic VM-to-PR runbook; page 36 is the
   thorough validated sibling that proves 32 actually works end-to-end.
   Reading them adjacent matches the natural mental flow.

2. index.adoc: add a small TIP under "Where to go next" pointing SEs /
   engineers at the real-fleet runbook for a single-shot "see it all
   work" reference, without bloating the rest of the index.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
roles/mta_publish/tasks/main.yml Phase 7 + Phase 8b both called
include_role: name: analyze. The role on disk is mta_analyze (no
'analyze' alias exists), so any code path that hit either phase
would die at runtime with 'role analyze not found'.

The publish_to_mta_run_analyzer flag defaults to true — meaning every
production fleet-report-adhoc run with apps to publish would have
exploded at Phase 7. Surfaced during the role-usage audit; not
triggered in the v5 e2e validation because the e2e workflow does NOT
run mta_publish (only discover/per_app/deploy).
migration_catalog filter (roles/discover/filter_plugins/flatten_components.py)
takes scored hosts and produces mta_publish's per-Component catalog directly,
removing the fleet_report -> __catalog_* -> mta_publish bridge that existed
only because RHDH catalog YAML emission used to consume the same data.

mta_publish gains a Phase 0 that calls the filter on __fleet_report_scored
and populates __catalog_components / __catalog_hosts / _engagement_slug
itself; the remaining 40+ references inside the role keep working unchanged.

Net delta: -2,252 LOC across 47 files.

- delete rhdh/ (Backstage scaffolder templates + mta-card / scan-report
  dynamic plugins + install manifests; the product was dropped)
- delete eda/ (event-driven rulebooks that fired off RHDH webhooks)
- delete roles/fleet_report/tasks/build_catalog_data.yml (256 lines of
  Jinja that produced __catalog_components/_hosts/_libraries)
- delete playbooks/utils/noop.yml (deprecated JT 108 shim)
- drop links.rhdh_component MTA Fact and the catalog_owner default
- sweep stale references to RHDH, build_catalog_data, __catalog_libraries,
  kai_refine in role READMEs and comments

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
plugins/module_utils/mta_client.py — MTA hub HTTP client. Owns Keycloak
auth, per-host token caching at ~/.cache/migration-mta/<host>.json, and a
401-retry wrapper. One construct per call site replaces the per-task
uri: + register: + set_fact: triplet.

plugins/modules/mta_resource.py — idempotent CRUD across kinds
{tag_category, tag, business_service, identity, application, stakeholder}.
GET-by-name + POST-if-missing + PUT-if-different + 409 fallback in Python,
once, for every kind. The children: arg on tag_category replaces phases/
3_tags.yml's per-category create loops (lands in A2.b).

Wired into:
  - roles/mta_publish/tasks/phases/2_tag_categories.yml
    96 lines of list+diff+POST+relist → 58 lines of one mta_resource loop
  - roles/mta_publish/tasks/phases/4_business_service.yml
    83 lines of list+match+create+409-recheck → 33 lines of one mta_resource call

Both new phases still set the legacy _mta_cat_* / _mta_business_service_id
facts so phase 3 + upsert_application keep working unchanged. Phase 1's
_mta_token flow is preserved for downstream phases that still call uri:
directly; A2.b retires it.

Also: fix stale filter_plugins path in ansible.cfg (generate_manifests +
deep_inspect roles no longer exist; the python_literal filter now lives in
roles/discover/filter_plugins/).

After installing the collection (ansible-galaxy collection install --force .)
the existing tests/test-publish-mta.yml exercises the new module end-to-end
against the anaeem MTA hub.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reworks the pipeline so migrated apps actually build and run on OpenShift,
with evidence in every PR.

- discover: emit previously-dropped facts (process.user/command, PID-bound
  ports, environment, log_config, keystores, build_info, cron_jobs);
  unconditional secret redaction incl. XML attributes
- containerize: render the versioned migrated-app Helm chart's values.yaml
  (+ Chart.ref.yaml + rendered/ preview) instead of 7 Jinja manifest
  templates; multi-stage source-build Containerfile when a repo is paired,
  with multi-WAR awareness; deterministic (no scan-date churn)
- MTA closed loop: queue source-mode analysis at pairing, fetch insights
  into the LLM prompt + MTA_ANALYSIS.md, warn-only deploy gate
- testgen + verify role: per-app container-structure-test/goss/http_checks/
  run_local.sh + VERIFICATION.md evidence committed to the bundle PR
- build_run role + playbooks/build_run.yml: post-merge build→push (Harbor
  oci.arsalan.io/migrated-apps)→helm install on anaeem→per-app DB on shared
  PostgreSQL→cluster verify; bootstrap/anaeem manifests
- provision/: reproducible KubeVirt test fleet (classic-shop, report-factory,
  ledger-ejb, pricing-svc) + provision-fleet.yml
- EE: add helm + oc; docs: versionless architecture/overview.md, runbooks,
  E2E_ACCEPTANCE.md; gitignore vendored .ansible mirror + showroom artifacts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ci(aap): stop re-fetching EE-bundled collections on project sync (galaxy flakiness)
Some checks failed
APME static analysis / apme-check (pull_request) Has been cancelled
Details
b50dbb0010
anaeem merged commit cb11f01680 into main 2026-06-11 19:05:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
anaeem/ansible-collection-discovery!9
No description provided.