From 776f0a5cb00c78648b742d8db51f07cdcd01ef3f Mon Sep 17 00:00:00 2001 From: Mathieu Grzybek Date: Wed, 6 May 2026 17:22:43 +0200 Subject: [PATCH 1/4] helm(chores): remove deprecated AWX --- .../api/settings/07-disable-kubernetes.yaml | 4 - .../files/api/settings/07-feature-flags.yaml | 9 +++ chart/files/api/settings/08-awx.yaml | 55 ------------- chart/files/api/settings/09-awx-passwords.py | 8 -- chart/files/api/settings/10-disable-caas.yaml | 4 - chart/templates/api/deployment.yaml | 16 ---- chart/templates/api/settings.yaml | 12 +-- chart/values.yaml | 79 +------------------ 8 files changed, 13 insertions(+), 174 deletions(-) delete mode 100644 chart/files/api/settings/07-disable-kubernetes.yaml create mode 100644 chart/files/api/settings/07-feature-flags.yaml delete mode 100644 chart/files/api/settings/08-awx.yaml delete mode 100644 chart/files/api/settings/09-awx-passwords.py delete mode 100644 chart/files/api/settings/10-disable-caas.yaml diff --git a/chart/files/api/settings/07-disable-kubernetes.yaml b/chart/files/api/settings/07-disable-kubernetes.yaml deleted file mode 100644 index 19564192..00000000 --- a/chart/files/api/settings/07-disable-kubernetes.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- if not .Values.tags.kubernetes -}} -AZIMUTH: - CLUSTER_API_PROVIDER: null -{{- end }} diff --git a/chart/files/api/settings/07-feature-flags.yaml b/chart/files/api/settings/07-feature-flags.yaml new file mode 100644 index 00000000..c804cbd2 --- /dev/null +++ b/chart/files/api/settings/07-feature-flags.yaml @@ -0,0 +1,9 @@ +{{- if or (not .Values.tags.kubernetes) (not .Values.tags.clusters) -}} +AZIMUTH: + {{- if not .Values.tags.kubernetes }} + CLUSTER_API_PROVIDER: null + {{- end }} + {{- if not .Values.tags.clusters }} + CLUSTER_ENGINE: null + {{- end }} +{{- end }} diff --git a/chart/files/api/settings/08-awx.yaml b/chart/files/api/settings/08-awx.yaml deleted file mode 100644 index 4c80c6b2..00000000 --- a/chart/files/api/settings/08-awx.yaml +++ /dev/null @@ -1,55 +0,0 @@ -{{- if and .Values.tags.clusters (eq .Values.clusterEngine.type "awx") -}} -AZIMUTH: - AWX: - ENABLED: true - URL: {{ required "clusterEngine.awx.url is required" .Values.clusterEngine.awx.url | quote }} - VERIFY_SSL: {{ .Values.clusterEngine.awx.verifySsl }} - USERNAME: {{ .Values.clusterEngine.awx.username }} - CREATE_TEAMS: {{ .Values.clusterEngine.awx.createTeams }} - CREATE_TEAM_ALLOW_ALL_PERMISSION: {{ .Values.clusterEngine.awx.createTeamAllowAllPermission }} - {{- with .Values.clusterEngine.awx.adminUsername }} - ADMIN_USERNAME: {{ . }} - {{- end }} - {{- if .Values.clusterEngine.terraformBackend.enabled }} - {{- if (eq .Values.clusterEngine.terraformBackend.type "consul") }} - EXTRA_CREDENTIALS: - - NAME: CaaS Consul - TYPE: Hashicorp Consul - INPUTS: - address: {{ required "clusterEngine.terraformBackend.consul.address" .Values.clusterEngine.terraformBackend.consul.address | quote }} - {{- else }} - {{- fail (printf "Unsupported terraform backend '%s'" .Values.clusterEngine.terraformBackend.type) }} - {{- end }} - {{- end }} - {{- with .Values.clusterEngine.awx.executionEnvironment }} - EXECUTION_ENVIRONMENT: - IMAGE: {{ .image }} - {{- if .alwaysPull }} - ALWAYS_PULL: true - {{- end }} - {{- with .credentials }} - CREDENTIALS: - HOST: {{ .host }} - USERNAME: {{ quote .username }} - TOKEN: {{ quote .token }} - {{- end }} - {{- end }} - {{- with .Values.clusterEngine.awx.defaultProjects }} - DEFAULT_PROJECTS: - {{- range . }} - - NAME: {{ .name | quote }} - GIT_URL: {{ .gitUrl }} - GIT_VERSION: {{ .gitVersion }} - METADATA_ROOT: {{ .metadataRoot }} - {{- if .alwaysUpdate }} - ALWAYS_UPDATE: true - {{- end }} - {{- with .playbooks }} - PLAYBOOKS: {{ toYaml . | nindent 14 }} - {{- end }} - {{- with .extraVars }} - EXTRA_VARS: {{ toYaml . | nindent 14 }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/chart/files/api/settings/09-awx-passwords.py b/chart/files/api/settings/09-awx-passwords.py deleted file mode 100644 index b2f66d8e..00000000 --- a/chart/files/api/settings/09-awx-passwords.py +++ /dev/null @@ -1,8 +0,0 @@ -{{- if and .Values.tags.clusters (eq .Values.clusterEngine.type "awx") -}} -import os - -# Read the AWX password from an environment variable that is populated from the specified secret -AZIMUTH['AWX']['PASSWORD'] = os.environ['AWX_PASSWORD'] -if 'AWX_ADMIN_PASSWORD' in os.environ: - AZIMUTH['AWX']['ADMIN_PASSWORD'] = os.environ['AWX_ADMIN_PASSWORD'] -{{- end }} diff --git a/chart/files/api/settings/10-disable-caas.yaml b/chart/files/api/settings/10-disable-caas.yaml deleted file mode 100644 index 42e58b2c..00000000 --- a/chart/files/api/settings/10-disable-caas.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- if not .Values.tags.clusters -}} -AZIMUTH: - CLUSTER_ENGINE: null -{{- end }} diff --git a/chart/templates/api/deployment.yaml b/chart/templates/api/deployment.yaml index 6e14b1f3..5c8e1b22 100644 --- a/chart/templates/api/deployment.yaml +++ b/chart/templates/api/deployment.yaml @@ -1,6 +1,5 @@ {{- $component := "api" -}} {{- $values := get .Values $component -}} -{{- $clusterEngine := .Values.clusterEngine -}} apiVersion: apps/v1 kind: Deployment metadata: @@ -57,23 +56,8 @@ spec: (eq .Values.authentication.type "oidc") (hasPrefix "http://" .Values.authentication.oidc.issuerUrl) ) - (and .Values.tags.clusters (eq $clusterEngine.type "awx")) }} env: - {{- if and .Values.tags.clusters (eq $clusterEngine.type "awx") }} - - name: AWX_PASSWORD - valueFrom: - secretKeyRef: - name: {{ required "clusterEngine.awx.passwordSecretName is required" $clusterEngine.awx.passwordSecretName | quote }} - key: password - {{- with $clusterEngine.awx.adminPasswordSecretName }} - - name: AWX_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: {{ quote . }} - key: password - {{- end }} - {{- end }} {{- if $values.monitoring.enabled }} - name: GUNICORN_STATSD_HOST value: "localhost:9125" diff --git a/chart/templates/api/settings.yaml b/chart/templates/api/settings.yaml index 2be8b42c..824be99f 100644 --- a/chart/templates/api/settings.yaml +++ b/chart/templates/api/settings.yaml @@ -1,4 +1,4 @@ -{{- if not (has .Values.clusterEngine.type (list "crd" "awx")) -}} +{{- if ne .Values.clusterEngine.type "crd" -}} {{- fail (printf "Unsupported cluster engine '%s'" .Values.clusterEngine.type) }} {{- end }} @@ -23,14 +23,8 @@ data: {{- tpl (.Files.Get "files/api/settings/05-apps.yaml") . | b64enc | nindent 4 }} 06-ssh-key-store.yaml: | {{- tpl (.Files.Get "files/api/settings/06-ssh-key-store.yaml") . | b64enc | nindent 4 }} - 07-disable-kubernetes.yaml: | - {{- tpl (.Files.Get "files/api/settings/07-disable-kubernetes.yaml") . | b64enc | nindent 4 }} - 08-awx.yaml: | - {{- tpl (.Files.Get "files/api/settings/08-awx.yaml") . | b64enc | nindent 4 }} - 09-awx-passwords.py: | - {{- tpl (.Files.Get "files/api/settings/09-awx-passwords.py") . | b64enc | nindent 4 }} - 10-disable-caas.yaml: | - {{- tpl (.Files.Get "files/api/settings/10-disable-caas.yaml") . | b64enc | nindent 4 }} + 07-feature-flags.yaml: | + {{- tpl (.Files.Get "files/api/settings/07-feature-flags.yaml") . | b64enc | nindent 4 }} 11-scheduling.yaml: | {{- tpl (.Files.Get "files/api/settings/11-scheduling.yaml") . | b64enc | nindent 4 }} 12-apps-provider.yaml: | diff --git a/chart/values.yaml b/chart/values.yaml index f1974fa1..408d895b 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -314,85 +314,8 @@ apps: # The cluster engine to use for Cluster-as-a-Service support clusterEngine: - # The type of cluster engine to use - # Currently only CRD is functional, and AWX support is deprecated + # The type of cluster engine to use (only crd is supported) type: crd - # Parameters for the awx cluster engine - # By default, we use values that will work with the managed AWX - awx: - # The AWX or Ansible Tower URL - url: - # Whether to verify SSL with the AWX/Tower API - verifySsl: true - # The username to use for the AWX/Tower API - # This user must be at least an org admin for the CaaS organisation - username: admin - # The name of a secret to get the AWX password from - passwordSecretName: - # Indicates whether teams should be created automatically - createTeams: true - # Indicates whether automatically-created teams should be granted access - # to all cluster types - createTeamAllowAllPermission: true - # Indicates whether CaaS resources should be created in AWX - createResources: true - # Creating resources requires the admin user - # If the user specified above is not a global admin, a separate admin username and - # password secret should be specified - adminUsername: - adminPasswordSecretName: - # Definition of a custom execution environment for CaaS appliances - executionEnvironment: - # # The image to use for the execution environment (required) - # image: registry.example.com/azimuth/caas-ee: - # # Indicates if the image should be pulled for every job (defaults to false) - # # This can be useful in development, but in production the recommended method is - # # to set this to false and use immutable tags - # alwaysPull: false - # # Optional credentials if the image is in a private registry - # credentials: - # # The registry host - # host: registry.example.com - # # The username to use to authenticate - # username: - # # The token/password to use to authenticate - # token: - # Definition of the default projects and job templates. - # By default, the StackHPC demo appliances will be used - defaultProjects: - # - # The name of the project (required) - # name: My Site Appliances - # # The git URL of the project (required) - # gitUrl: https://github.com/myorg/site-appliances.git - # # The branch, tag or commit id to use (required) - # gitVersion: master - # # The base URL for cluster metadata files (required) - # metadataRoot: https://raw.githubusercontent.com/myorg/site-appliances/master/ui-meta - # ## - # # OPTIONAL KEYS - # ## - # # Indicates if the project should be updated to the latest version on each job launch - # # Can be useful during development but recommend to leave as false in production - # # Defaults to false if not given - # alwaysUpdate: true - # # List of playbooks to create job templates for - # # If not given, a job template is created for each playbook in the project - # playbooks: ['cluster1-playbook.yml', 'cluster2-playbook.yml'] - # # Map whose keys are the playbooks and whose values are maps of Ansible extra_vars for those playbooks - # extraVars: - # # This special key can be used to set common extra_vars for all playbooks in a project - # __ALL__: { var1: value1, var2: value2 } - # cluster1-playbook.yml: { var1: "override value1" } - # Configuration for the Terraform backend - terraformBackend: - # Indicates if the Terraform backend should be configured - enabled: true - # The type of the Terraform backend to use (currently only consul is supported) - type: consul - # Configuration for the consul backend - consul: - # The address, including port, of the Consul server to use - address: # The SSH key store to use # The portal asks this store for the SSH key for a user From 1c47b3249bac5c009b100cd3087d3237d56b1161 Mon Sep 17 00:00:00 2001 From: Mathieu Grzybek Date: Wed, 6 May 2026 17:31:16 +0200 Subject: [PATCH 2/4] chores: remode dead code - conditions never reached --- api/azimuth/views.py | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/api/azimuth/views.py b/api/azimuth/views.py index 9333f262..db5bbce3 100644 --- a/api/azimuth/views.py +++ b/api/azimuth/views.py @@ -1426,12 +1426,11 @@ def cluster_service(request, tenant, cluster, service): service_fqdn = None service_label = None try: - if cloud_settings.CLUSTER_ENGINE: - with request.auth.scoped_session(tenant) as session: - with cloud_settings.CLUSTER_ENGINE.create_manager( - session - ) as cluster_manager: - cluster = cluster_manager.find_cluster(cluster) + with request.auth.scoped_session(tenant) as session: + with cloud_settings.CLUSTER_ENGINE.create_manager( + session + ) as cluster_manager: + cluster = cluster_manager.find_cluster(cluster) service_obj = next(s for s in cluster.services if s.name == service) service_fqdn = service_obj.fqdn service_label = service_obj.label @@ -1834,9 +1833,8 @@ def kubernetes_cluster_service(request, tenant, cluster, service): service_fqdn = None service_label = None try: - if cloud_settings.CLUSTER_API_PROVIDER: - with cloud_settings.CLUSTER_API_PROVIDER.session(session) as capi_session: - cluster = capi_session.find_cluster(cluster) + with cloud_settings.CLUSTER_API_PROVIDER.session(session) as capi_session: + cluster = capi_session.find_cluster(cluster) service_obj = next(s for s in cluster.services if s.name == service) service_fqdn = service_obj.fqdn service_label = service_obj.label From fa433e3171a1072a7aa61fea9244d42d0006fb23 Mon Sep 17 00:00:00 2001 From: Mathieu Grzybek Date: Thu, 7 May 2026 11:47:37 +0200 Subject: [PATCH 3/4] chores(docker): add apt options --no-install-{recommandes,suggests} Signed-off-by: Mathieu Grzybek --- api/Dockerfile | 2 +- ui/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/api/Dockerfile b/api/Dockerfile index ec17f473..568a416b 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -1,7 +1,7 @@ FROM ubuntu:24.04 AS python-builder RUN apt-get update && \ - apt-get install -y git python3 python3-venv && \ + apt-get install --no-install-recommends --no-install-suggests -y git python3 python3-venv && \ rm -rf /var/lib/apt/lists/* RUN python3 -m venv /venv && \ diff --git a/ui/Dockerfile b/ui/Dockerfile index a0e4ae61..1bc9c290 100644 --- a/ui/Dockerfile +++ b/ui/Dockerfile @@ -20,7 +20,7 @@ FROM ubuntu:24.04 AS nginx-gpg-key ENV NGINX_GPG_KEY="2FD21310B49F6B46" RUN apt-get update && \ - apt-get install -y gnupg2 && \ + apt-get install --no-install-recommends --no-install-suggests -y gnupg2 && \ rm -rf /var/lib/apt/lists/* RUN gpg2 --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options timeout=10 --recv-keys "$NGINX_GPG_KEY" && \ From 61e2371afa0da9756832727760d3af5a183d6be8 Mon Sep 17 00:00:00 2001 From: Mathieu Grzybek Date: Thu, 7 May 2026 14:16:15 +0200 Subject: [PATCH 4/4] test: update the chart snapshot Signed-off-by: Mathieu Grzybek --- chart/tests/__snapshot__/snapshot_test.yaml.snap | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/chart/tests/__snapshot__/snapshot_test.yaml.snap b/chart/tests/__snapshot__/snapshot_test.yaml.snap index 531e1675..af95746d 100755 --- a/chart/tests/__snapshot__/snapshot_test.yaml.snap +++ b/chart/tests/__snapshot__/snapshot_test.yaml.snap @@ -158,7 +158,7 @@ templated manifests should match snapshot: template: metadata: annotations: - azimuth.stackhpc.com/settings-checksum: ba9764bba470b2cacf65a4646a795dd5a62707a4879baac5749a8884af5dc0cd + azimuth.stackhpc.com/settings-checksum: 65ccb797a35210f0ae53ea1af4483f357627b78cc7c97b321de04fb78bdd6ed8 azimuth.stackhpc.com/theme-checksum: ec0f36322392deee39d80b7f77ecd634df60358857af9dc208077860c4e174ab kubectl.kubernetes.io/default-container: api labels: @@ -261,13 +261,7 @@ templated manifests should match snapshot: Cg== 06-ssh-key-store.yaml: | QVpJTVVUSDoKICBTU0hfS0VZX1NUT1JFOgogICAgRkFDVE9SWTogYXppbXV0aC5rZXlzdG9yZS5wcm92aWRlci5Qcm92aWRlcktleVN0b3JlCg== - 07-disable-kubernetes.yaml: | - Cg== - 08-awx.yaml: | - Cg== - 09-awx-passwords.py: | - Cg== - 10-disable-caas.yaml: | + 07-feature-flags.yaml: | QVpJTVVUSDoKICBDTFVTVEVSX0VOR0lORTogbnVsbAo= 11-scheduling.yaml: | QVpJTVVUSDoKICBTQ0hFRFVMSU5HOgogICAgRU5BQkxFRDogZmFsc2UK