AWX 13 broken due upstream issues

[ikke-t]

Permission issues:

• Permission denied for launch_awx.sh and launch_awx_task.sh ansible/awx#7545
• Missing module python-memcached in built-in venv awx ansible/awx#7544

So let's label awx_pod with 13.0 once those are fixed. This module is broken due those ATM at master branch. If you want to use a working module, select earlier version.

[Klaas-]

memcached was removed from awx in 12, I'd guess we need to change this role to reflect the upstream changes in kubernetes role; CCing @cfelder ansible/awx#7240

[Klaas-]

https://github.com/ikke-t/awx_pod/blob/master/templates/settings.py.j2
https://github.com/ansible/awx/blob/devel/installer/roles/kubernetes/templates/configmap.yml.j2#L128-L202

and

https://github.com/ansible/awx/blob/devel/installer/roles/kubernetes/templates/deployment.yml.j2
https://github.com/ikke-t/awx_pod/blob/master/templates/awx.yml.j2

don't have my test setup ready at the moment so I won't get around to that soon :D

[ikke-t]

I suppose the order of getting this back to work would be to submit PRs to awx about those two starter script execute bits. Then waiting to get the upstream containers being rebuilt to work with PR changes. Once having those in place, there is place to make and test the above changes to drop memcached and update settings.

Creating the PR is small job, I wonder if @cfelder already has the changes in his repo?

I have a bit quieter time at work than usual, I could also do some of this one day.

[cfelder]

I am already on it (removing memcache).

I'll also post an example playbook here to run with a derived container image which has already fixed executable bits.

If I'll find the correct spot in the awx repo I can make a PR as well for fixing those Dockerfiles.

[cfelder]

The following example uses a derived container with fixed acls and removed preloading data into awx as well.

- name: run AWX on host
  hosts: all
  become: yes
  vars:
    awx_pod_name: awx
  tasks:
    - include_role:
        name: awx_pod
      vars:
        awx_admin_user: admin
        awx_admin_password: foobar
        awx_podman_dir: /tmp
        awx_host_port: 8052
        awx_pod_label: awx
        awx_awx_image: quay.io/cfelder/awx:nopreload-{{ awx_awx_version }}

Dockerfile

FROM docker.io/ansible/awx:13.0.0
LABEL maintainer="Christian Felder"

USER root

RUN dnf update -y && \
  dnf clean all -y
RUN sed -i '/.*awx-manage.*create_preload_data.*/d' \
  /usr/bin/launch_awx_task.sh \
  && \
 chmod 755 /usr/bin/launch_awx*.sh

USER 1000

needs: #19

[Klaas-]

If I recall right awx assumes it runs priviledged, so you won't need to change the runscripts but add priviledged to the web container. With 11 it seems this was optional for the web container, now that they are not seperated anymore it seems mandatory.

[Klaas-]

and for the no preload, I am guessing you could just configmap a launch_awx_task.sh into the image, then you don't need to rebuild it. But that would make a fine upstream change, create a env variable that you can set to skip it :)

[ikke-t]

please review if these changes fix the issues, I could just press the PR button: ansible/awx@6c107db

[cfelder]

If I recall right awx assumes it runs priviledged

RunAsUser and RunAsGroup are not honoured in podman versions shipped with EL7 and EL8 you would need at least podman 1.7

[Klaas-]

@cfelder https://github.com/ikke-t/awx_pod/blob/master/templates/awx.yml.j2#L216-L217 that also for the web container, that should help :)

[cfelder]

@cfelder https://github.com/ikke-t/awx_pod/blob/master/templates/awx.yml.j2#L216-L217 that also for the web container, that should help :)

I am still getting

$ podman logs -f awx_awxtask
/bin/sh: /usr/bin/launch_awx_task.sh: Permission denied

$ podman logs -f awx_awxweb
/bin/sh: /usr/bin/launch_awx.sh: Permission denied

although I added securityContext...

Looks like privileged: True is not honored in kube play

when using

$ podman run --privileged=true --rm -it docker.io/ansible/awx:13.0.0 /usr/bin/launch_awx.sh

the shell script is executed correctly.

Nevertheless shouldn't running unprivileged containers be preferred?

[Klaas-]

It should be honoured, otherwise the tasks container should have never been working :)

but upstream also changed the security context to unpriviledged for all containers:
ansible/awx@b13a175

so maybe there is something else in the deployment that has changed (or the deployment really was never working for upstream 13)

[Koleon]

Hello guys,
I'm very interested in the latest AWX running on podman (RHEL8). Are there any options how to help with it?