From eb28a76341ee30b10b436a29058420735edeaee0 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 16:44:28 +0200 Subject: [PATCH 1/4] Fix ALTS scheduler working directory condition on ansible-core 2.19 ansible-core 2.19 requires conditionals to evaluate to a boolean, so testing scheduler_working_directory (a string) directly fails the task. --- roles/alts_scheduler/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/alts_scheduler/tasks/main.yml b/roles/alts_scheduler/tasks/main.yml index 5aeeffc..bfaa065 100644 --- a/roles/alts_scheduler/tasks/main.yml +++ b/roles/alts_scheduler/tasks/main.yml @@ -78,7 +78,7 @@ owner: "{{ test_system_user }}" group: "{{ test_system_user }}" state: directory - when: scheduler_working_directory is defined and scheduler_working_directory + when: scheduler_working_directory | default('') | length > 0 - name: Install firewalld yum: From 8bd349e47f294157f5b8fbacde9a2a1820181e6f Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 16:44:46 +0200 Subject: [PATCH 2/4] Give the ALTS scheduler its own broker and Redis hosts The scheduler config used rabbitmq_host and alts_redis_host, the same variables as the workers. When the worker-facing addresses are passed as extra vars, they override the scheduler's group_vars, and the scheduler config gets addresses meant for the workers. The scheduler now uses scheduler_rabbitmq_host and scheduler_redis_host; the workers keep rabbitmq_host and alts_redis_host. Related: AlmaLinux/build-system#563 --- inventories/alts/group_vars/scheduler.yml | 6 ++++-- .../templates/alts_service_config.yaml.j2 | 19 ++++++++++++++----- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/inventories/alts/group_vars/scheduler.yml b/inventories/alts/group_vars/scheduler.yml index 19c0f94..22052aa 100644 --- a/inventories/alts/group_vars/scheduler.yml +++ b/inventories/alts/group_vars/scheduler.yml @@ -9,7 +9,9 @@ test_system_vhost: alts test_system_password: some-another-secret-password test_system_config_dir: ~/.config/alts -rabbitmq_host: localhost +# Scheduler-specific so that rabbitmq_host/alts_redis_host from extra vars, +# which carry the addresses the workers use, don't apply to the scheduler +scheduler_rabbitmq_host: localhost rabbitmq_port: 5672 rabbitmq_ssl_port: 5671 @@ -31,7 +33,7 @@ redis_port: 6379 # Celery result backend configuration result_backend_name: redis -alts_redis_host: localhost +scheduler_redis_host: localhost alts_redis_port: 6379 alts_redis_results_db: 1 diff --git a/playbooks/templates/alts_service_config.yaml.j2 b/playbooks/templates/alts_service_config.yaml.j2 index 3033a61..ced9ccd 100644 --- a/playbooks/templates/alts_service_config.yaml.j2 +++ b/playbooks/templates/alts_service_config.yaml.j2 @@ -1,4 +1,13 @@ --- +{# The scheduler reaches the broker and Redis over different addresses + than the workers, which get rabbitmq_host/alts_redis_host #} +{% if alts_service | default('') == 'scheduler' %} +{% set broker_host = scheduler_rabbitmq_host %} +{% set redis_host = scheduler_redis_host %} +{% else %} +{% set broker_host = rabbitmq_host %} +{% set redis_host = alts_redis_host | default('') %} +{% endif %} {% if celery_ssl %} use_ssl: true ssl_config: @@ -9,7 +18,7 @@ ssl_config: broker_config: {% if broker_type == 'rabbitmq' %} - rabbitmq_host: {{ rabbitmq_host }} + rabbitmq_host: {{ broker_host }} rabbitmq_port: {{ rabbitmq_port }} {% if celery_ssl %} use_ssl: true @@ -18,8 +27,8 @@ broker_config: rabbitmq_user: {{ celery_rabbitmq_user | default(test_system_user, true) }} rabbitmq_password: {{ test_system_password }} rabbitmq_vhost: {{ test_system_vhost }} -{% elif broker_type == 'redis' and alts_redis_host and alts_redis_port %} - redis_host: "{{ alts_redis_host }}" +{% elif broker_type == 'redis' and redis_host and alts_redis_port %} + redis_host: "{{ redis_host }}" redis_port: {{ alts_redis_port }} redis_db_number: {{ alts_redis_results_db | default(0) }} {% if redis_requirepass %} @@ -42,8 +51,8 @@ results_backend_config: s3_base_path: 'celery_result_backend/' s3_region: {{ s3_region }} s3_endpoint_url: -{% elif result_backend_name == 'redis' and alts_redis_host and alts_redis_port %} - redis_host: "{{ alts_redis_host }}" +{% elif result_backend_name == 'redis' and redis_host and alts_redis_port %} + redis_host: "{{ redis_host }}" redis_port: {{ alts_redis_port }} redis_db_number: {{ alts_redis_results_db | default(1) }} {% if redis_requirepass %} From e9771562cf5b249f5d13db8ff649021ddddc4927 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 16:44:49 +0200 Subject: [PATCH 3/4] Route AlmaLinux 10 x86_64 ALTS tasks to x86-64-v3 workers The AlmaLinux 10 linux/amd64 image needs an x86-64-v3 CPU. Render the new scheduler setting queue_arch_overrides and enable it in the scheduler group_vars, so AlmaLinux 10 x86_64 tasks go to the docker-x86_64_v3-* queues. Only x86-64-v3 capable workers should list docker-x86_64_v3-0 in celery_queues; the example x86_64 worker does. Resolves: AlmaLinux/build-system#563 --- inventories/alts/group_vars/scheduler.yml | 9 +++++++++ inventories/alts/hosts.yml | 3 +++ playbooks/templates/alts_service_config.yaml.j2 | 12 ++++++++++++ 3 files changed, 24 insertions(+) diff --git a/inventories/alts/group_vars/scheduler.yml b/inventories/alts/group_vars/scheduler.yml index 22052aa..8355734 100644 --- a/inventories/alts/group_vars/scheduler.yml +++ b/inventories/alts/group_vars/scheduler.yml @@ -54,6 +54,15 @@ scheduler_working_directory: /srv/alts/scheduler flower_port: 5555 # flower_password: "" # Required, pass via --extra-vars or a vaulted vars file jwt_secret: very-secret-on5 +# Route matching tasks to another queue architecture. Only workers whose +# celery_queues include the target queue (e.g. docker-x86_64_v3-0) get them, +# so deploy such a worker before enabling an override. +# AlmaLinux 10 x86_64 images need an x86-64-v3 (AVX2) CPU +queue_arch_overrides: + - dist_name: almalinux + dist_versions: ['10'] + arch: x86_64 + queue_arch: x86_64_v3 broker_pool: 30 worker_prefetch_multiplier: 1 result_expires: 3600 diff --git a/inventories/alts/hosts.yml b/inventories/alts/hosts.yml index c0eeb16..088f335 100644 --- a/inventories/alts/hosts.yml +++ b/inventories/alts/hosts.yml @@ -12,6 +12,9 @@ all: x86_64-node01: celery_queues: - "docker-x86_64-0" + # AlmaLinux 10 x86_64 tasks (queue_arch_overrides in + # group_vars/scheduler.yml), only for x86-64-v3 capable CPUs + - "docker-x86_64_v3-0" aarch64-node01: terraform_arch: arm celery_queues: diff --git a/playbooks/templates/alts_service_config.yaml.j2 b/playbooks/templates/alts_service_config.yaml.j2 index ced9ccd..681d261 100644 --- a/playbooks/templates/alts_service_config.yaml.j2 +++ b/playbooks/templates/alts_service_config.yaml.j2 @@ -70,6 +70,18 @@ worker_prefetch_multiplier: {{ worker_prefetch_multiplier }} result_expires: {{ result_expires }} {% if alts_service | default('') == 'scheduler' %} jwt_secret: "{{ jwt_secret }}" +{% if queue_arch_overrides is defined %} +queue_arch_overrides: +{% for override in queue_arch_overrides %} + - dist_name: "{{ override.dist_name }}" + dist_versions: +{% for version in override.dist_versions %} + - "{{ version }}" +{% endfor %} + arch: "{{ override.arch }}" + queue_arch: "{{ override.queue_arch }}" +{% endfor %} +{% endif %} {% endif %} {% if buildsys_url | default('') %} From cd50fc7b8f9e21bd762c534beb33e47a8fe4e4f0 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Tue, 27 Oct 2026 17:06:48 +0200 Subject: [PATCH 4/4] Install Terraform on ALTS workers only when the version differs The role downloaded and unpacked Terraform on every run, so it always reported changes. In check mode get_url doesn't download, and the unpack failed with "Source '/tmp/terraform.zip' does not exist". Read the installed version first and download, unpack and clean up only when Terraform is missing or a different version; skip the unpack in check mode. --- roles/alts_terraform/tasks/main.yml | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/roles/alts_terraform/tasks/main.yml b/roles/alts_terraform/tasks/main.yml index 0ebf18f..5627e4e 100644 --- a/roles/alts_terraform/tasks/main.yml +++ b/roles/alts_terraform/tasks/main.yml @@ -6,24 +6,43 @@ state: present when: build_terraform is not defined +- name: Get installed Terraform version + ansible.builtin.command: /usr/local/bin/terraform version -json + register: terraform_installed + changed_when: false + failed_when: false + check_mode: false + when: build_terraform is not defined + +- name: Check whether Terraform needs to be installed + ansible.builtin.set_fact: + terraform_install_needed: >- + {{ terraform_installed.rc != 0 + or (terraform_installed.stdout | from_json).terraform_version != terraform_version }} + when: build_terraform is not defined + - name: Download Terraform ansible.builtin.get_url: url: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_{{ terraform_arch }}.zip" dest: /tmp/terraform.zip - when: build_terraform is not defined + when: build_terraform is not defined and terraform_install_needed | bool +# get_url doesn't download in check mode, so there is nothing to unpack - name: Unpack Terraform ansible.builtin.unarchive: src: /tmp/terraform.zip dest: /usr/local/bin remote_src: yes - when: build_terraform is not defined + when: + - build_terraform is not defined + - terraform_install_needed | bool + - not ansible_check_mode - name: Delete archive ansible.builtin.file: path: /tmp/terraform.zip state: absent - when: build_terraform is not defined + when: build_terraform is not defined and terraform_install_needed | bool - name: Install golang ansible.builtin.yum: