Adding loki and minio roles by lnatapov · Pull Request #3793 · openstack-k8s-operators/ci-framework

lnatapov · 2026-03-24T12:19:38Z

Adding loki and minio roles

openshift-ci · 2026-03-24T12:19:49Z

Hi @lnatapov. Thanks for your PR.

I'm waiting for a openstack-k8s-operators member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

softwarefactory-project-zuul · 2026-03-24T14:26:04Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/31a8ffddf00f47b0b5c670e611539d7d

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 02m 36s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 22m 17s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 27m 18s
✔️ cifmw-crc-podified-edpm-baremetal-minor-update SUCCESS in 1h 49m 01s
❌ cifmw-pod-zuul-files FAILURE in 4m 26s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 14s
✔️ cifmw-pod-pre-commit SUCCESS in 8m 40s
✔️ cifmw-molecule-deploy_loki SUCCESS in 1m 40s
✔️ cifmw-molecule-deploy_minio SUCCESS in 2m 07s

openshift-ci · 2026-03-24T15:31:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign valkyrie00 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

michburk

Would it be possible to use kubernetes.core.k8s and kubernetes.core.k8s_info in place of running oc commands through anisble.builtin.shell/ansible.builtin.command?

Additionally, README files for each role would help explain the usage and purpose of each role. In particular, explaining how the deploy_loki role can deploy minio itself, and expectations around which vars are passed/set and where when using pre-deployed minio vs having the deploy_loki role deploy minio.

roles/deploy_loki/defaults/main.yml

roles/deploy_minio/defaults/main.yml

roles/deploy_minio/meta/main.yml

stuggi · 2026-03-25T07:22:46Z

roles/deploy_minio/tasks/main.yml

+- name: Render MinIO manifests for CloudKitty / Loki
+  ansible.builtin.template:
+    src: minio_for_ck.yaml.j2


same. I think we should rename it to not reference CloudKitty or Loki

stuggi · 2026-03-25T07:32:50Z

roles/deploy_minio/templates/minio_for_ck.yaml.j2

+        - /bin/bash
+        - -c
+        - |
+          mkdir -p /data/loki && \


I think there should be a parameter to the role with a list of buckets to be created. could default to loki for now, or already create one we then use for backup, like [loki, velero] or [loki, backup]

stuggi · 2026-03-25T07:36:11Z

roles/deploy_minio/templates/minio.yaml.j2

+    name: {{ cifmw_deploy_minio_namespace }}
+---
+apiVersion: v1
+kind: Pod


I think we should use a deployment so the pod gets re-created when terminate for some reason

roles/deploy_minio/templates/minio_for_ck.yaml.j2

stuggi · 2026-03-25T08:14:05Z

roles/deploy_minio/templates/minio.yaml.j2

+    weight: 100
+  port:
+    targetPort: console
+  wildcardPolicy: None


maybe add tls?

tls: termination: edge insecureEdgeTerminationPolicy: Redirect

stuggi · 2026-03-25T08:14:46Z

roles/deploy_minio/templates/minio.yaml.j2

+    weight: 100
+  port:
+    targetPort: api
+  wildcardPolicy: None


same, maybe add tls?

tls: termination: edge insecureEdgeTerminationPolicy: Redirect

abays · 2026-03-25T09:12:23Z

We need to get this merged as soon as possible, because openstack-k8s-operators/architecture#721 was not given a "depends-on" pointing to this PR (or an equivalent hold to prevent merging prior to this PR). Without this merged, uni03gamma job now fails.

softwarefactory-project-zuul · 2026-03-25T12:25:53Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/0fbd359b8d334c0587d8e282ff5a393b

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 17m 59s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 24m 03s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 30m 00s
✔️ cifmw-crc-podified-edpm-baremetal-minor-update SUCCESS in 2h 04m 47s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 44s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 42s
❌ cifmw-pod-pre-commit FAILURE in 8m 12s
✔️ cifmw-molecule-deploy_loki SUCCESS in 2m 06s
✔️ cifmw-molecule-deploy_minio SUCCESS in 3m 17s

Add deploy_loki and deploy_minio Ansible roles, the deploy-loki-for-ck hook playbook, and ci/config fragment so cifmw-molecule-deploy_loki runs when roles/deploy_minio changes. Regenerate zuul.d/molecule.yaml with the role_molecule script. Signed-off-by: Leonid Natapov <lnatapov@redhat.com> Made-with: Cursor

michburk · 2026-03-25T14:52:05Z

hooks/playbooks/deploy-loki-for-ck.yaml

+    - name: Deploy MinIO for CloudKitty / Loki object storage
+      ansible.builtin.import_role:
+        name: deploy_minio
+      vars:
+        cifmw_deploy_minio_namespace: "{{ cifmw_deploy_loki_minio_namespace }}"
+        cifmw_deploy_minio_root_user: "{{ cifmw_deploy_loki_minio_access_key }}"
+        cifmw_deploy_minio_root_password: "{{ cifmw_deploy_loki_minio_secret_key }}"


If you're going to enable deploying minio from within the deploy_loki role, it would make sense to avoid an explicit call to deploy_minio here, and instead call deploy_loki without supplying cifmw_deploy_loki_deploy_minio: false.

This way you can avoid referencing the cifmw_deploy_loki_minio_* default values from outside of the deploy_loki role.

If you want to deploy minio and loki separately, you should define some other variables and pass both the deploy loki and deploy minio roles these values, ie:

# ... assume some task(s) or a `vars` block on the play these tasks are in # defines the _example_minio_* vars here - name: deploy minio vars: cifmw_deploy_minio_namespace: "{{ _example_minio_namespace }}" cifmw_deploy_minio_root_user: "{{ _example_minio_user }}" cifmw_deploy_minio_root_password: "{{ _example_minio_password }}" ansible.builtin.import_role: name: deploy_minio # whatever arbitrary other tasks can be here - name: deploy loki vars: cifmw_deploy_loki_minio_namespace: "{{ _example_minio_namespace }}" cifmw_deploy_loki_minio_access_key: "{{ _example_minio_user }}" cifmw_deploy_loki_minio_secret_key: "{{ _example_minio_password }}" cifmw_deploy_loki_deploy_minio: false ansible.builtin.import_role: name: deploy_loki

This way both roles clearly share the same source of truth without needing to reference/interfere with default variables from each other.

michburk · 2026-03-25T14:53:11Z

roles/deploy_loki/defaults/main.yml

+cifmw_deploy_loki_parent_dir: "{{ ansible_user_dir }}/ci-framework-data"
+cifmw_deploy_loki_base_dir: "{{ cifmw_deploy_loki_parent_dir }}"


I don't understand the cifmw_deploy_loki_parent_dir variable - wouldn't

cifmw_deploy_loki_base_dir: "{{ cifmw_basedir }}"

be sufficient?

Also this is a small consistency nitpick, but most other *_basedir variables don't include an underscore between base and dir

Regardless, cifmw_deploy_loki_parent_dir shouldn't be defined in group_vars/all.yml

This same comment applies to the cifmw_deploy_minio_parent_dir and cifmw_deploy_minio_base_dir vars

michburk · 2026-03-25T14:56:39Z

roles/deploy_loki/README.md

+3. Applies that manifest with **`kubernetes.core.k8s`**.
+4. Optionally waits until the **ClusterServiceVersion** for the Loki subscription reports phase **`Succeeded`** (when **`cifmw_deploy_loki_wait_for_csv`** is true).
+
+If you should not run Loki at all, do **not** import this role—or use **`when:`** on **`import_role` / `include_role`** (see **Skipping the role** below). There is no in-role master toggle.


Unnecessary, see below comment.

michburk · 2026-03-25T14:57:36Z

roles/deploy_loki/README.md

+## Skipping the role
+
+Calling **`import_role: deploy_loki`** or **`include_role: deploy_loki`** is the signal that you want this deployment. To make execution conditional, put **`when`** on that task (or omit the task). Example:
+
+```yaml
+- ansible.builtin.import_role:
+    name: deploy_loki
+  when: my_condition | default(false) | bool
+```


As far as I'm concerned, this should go without saying. No need to document the fact that if you don't want to deploy loki, you shouldn't be calling the deploy_loki role.

evallesp · 2026-03-26T09:43:48Z

(non-blocking) question: could this be splitten in two differents MRs and commits?

openshift-ci · 2026-03-26T12:51:03Z

Adding label do-not-merge/contains-merge-commits because PR contains merge commits, which are not allowed in this repository.
Use git rebase to reapply your commits on top of the target branch. Detailed instructions for doing so can be found here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added the needs-ok-to-test label Mar 24, 2026

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch from c27b274 to 234412e Compare March 24, 2026 12:22

stuggi added ok-to-test and removed needs-ok-to-test labels Mar 24, 2026

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch 2 times, most recently from 92166c4 to dad3cd0 Compare March 24, 2026 15:37

openshift-ci bot added the do-not-merge/contains-merge-commits label Mar 24, 2026

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch from 283cab5 to f950d83 Compare March 24, 2026 16:08

openshift-ci bot removed the do-not-merge/contains-merge-commits label Mar 24, 2026

github-actions bot added the Ready For Review label Mar 24, 2026

michburk reviewed Mar 24, 2026

View reviewed changes

roles/deploy_loki/defaults/main.yml Outdated Show resolved Hide resolved

roles/deploy_loki/defaults/main.yml Outdated Show resolved Hide resolved

roles/deploy_minio/defaults/main.yml Show resolved Hide resolved

stuggi reviewed Mar 25, 2026

View reviewed changes

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch from f950d83 to f4eff0a Compare March 25, 2026 10:06

github-actions bot removed the Ready For Review label Mar 25, 2026

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch 2 times, most recently from e59193e to 8684b5d Compare March 25, 2026 12:57

abays mentioned this pull request Mar 25, 2026

Adding loki deployment hook openstack-k8s-operators/architecture#729

Open

lnatapov force-pushed the Adding_Loki_and_Minio_roles branch from 8684b5d to 475d513 Compare March 25, 2026 13:40

michburk reviewed Mar 25, 2026

View reviewed changes

github-actions bot added the Ready For Review label Mar 25, 2026

Merge branch 'main' into Adding_Loki_and_Minio_roles

d38da93

openshift-ci bot added the do-not-merge/contains-merge-commits label Mar 26, 2026

github-actions bot removed the Ready For Review label Mar 26, 2026

		cifmw_deploy_loki_parent_dir: "{{ ansible_user_dir }}/ci-framework-data"
		cifmw_deploy_loki_base_dir: "{{ cifmw_deploy_loki_parent_dir }}"

Conversation

lnatapov commented Mar 24, 2026

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

softwarefactory-project-zuul bot commented Mar 24, 2026

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

michburk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abays commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

softwarefactory-project-zuul bot commented Mar 25, 2026

Uh oh!

michburk Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evallesp commented Mar 26, 2026

Uh oh!

openshift-ci bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

abays commented Mar 25, 2026 •

edited

Loading

michburk Mar 25, 2026 •

edited

Loading