Route AlmaLinux 10 x86_64 ALTS tasks to x86-64-v3 workers

inventories/alts/group_vars/scheduler.yml

@@ -9,7 +9,9 @@ test_system_vhost: alts
 test_system_password: some-another-secret-password
 test_system_config_dir: ~/.config/alts
 
-rabbitmq_host: localhost
+# Scheduler-specific so that rabbitmq_host/alts_redis_host from extra vars,
+# which carry the addresses the workers use, don't apply to the scheduler
+scheduler_rabbitmq_host: localhost
 rabbitmq_port: 5672
 rabbitmq_ssl_port: 5671
 
@@ -31,7 +33,7 @@ redis_port: 6379
 
 # Celery result backend configuration
 result_backend_name: redis
-alts_redis_host: localhost
+scheduler_redis_host: localhost
 alts_redis_port: 6379
 alts_redis_results_db: 1
 
@@ -52,6 +54,15 @@ scheduler_working_directory: /srv/alts/scheduler
 flower_port: 5555
 # flower_password: ""  # Required, pass via --extra-vars or a vaulted vars file
 jwt_secret: very-secret-on5
+# Route matching tasks to another queue architecture. Only workers whose
+# celery_queues include the target queue (e.g. docker-x86_64_v3-0) get them,
+# so deploy such a worker before enabling an override.
+# AlmaLinux 10 x86_64 images need an x86-64-v3 (AVX2) CPU
+queue_arch_overrides:
+  - dist_name: almalinux
+    dist_versions: ['10']
+    arch: x86_64
+    queue_arch: x86_64_v3
 broker_pool: 30
 worker_prefetch_multiplier: 1
 result_expires: 3600

inventories/alts/hosts.yml

@@ -12,6 +12,9 @@ all:
         x86_64-node01:
           celery_queues:
             - "docker-x86_64-0"
+            # AlmaLinux 10 x86_64 tasks (queue_arch_overrides in
+            # group_vars/scheduler.yml), only for x86-64-v3 capable CPUs
+            - "docker-x86_64_v3-0"
         aarch64-node01:
           terraform_arch: arm
           celery_queues:

playbooks/templates/alts_service_config.yaml.j2

@@ -1,4 +1,13 @@
 ---
+{# The scheduler reaches the broker and Redis over different addresses
+   than the workers, which get rabbitmq_host/alts_redis_host #}
+{% if alts_service | default('') == 'scheduler' %}
+{% set broker_host = scheduler_rabbitmq_host %}
+{% set redis_host = scheduler_redis_host %}
+{% else %}
+{% set broker_host = rabbitmq_host %}
+{% set redis_host = alts_redis_host | default('') %}
+{% endif %}
 {% if celery_ssl %}
 use_ssl: true
 ssl_config:
@@ -9,7 +18,7 @@ ssl_config:
 
 broker_config:
 {% if broker_type == 'rabbitmq' %}
-  rabbitmq_host: {{ rabbitmq_host }}
+  rabbitmq_host: {{ broker_host }}
   rabbitmq_port: {{ rabbitmq_port }}
 {% if celery_ssl %}
   use_ssl: true
@@ -18,8 +27,8 @@ broker_config:
   rabbitmq_user: {{ celery_rabbitmq_user | default(test_system_user, true) }}
   rabbitmq_password: {{ test_system_password }}
   rabbitmq_vhost: {{ test_system_vhost }}
-{% elif broker_type == 'redis' and alts_redis_host and alts_redis_port %}
-  redis_host: "{{ alts_redis_host }}"
+{% elif broker_type == 'redis' and redis_host and alts_redis_port %}
+  redis_host: "{{ redis_host }}"
   redis_port: {{ alts_redis_port }}
   redis_db_number: {{ alts_redis_results_db | default(0) }}
 {% if redis_requirepass %}
@@ -42,8 +51,8 @@ results_backend_config:
   s3_base_path: 'celery_result_backend/'
   s3_region: {{ s3_region }}
   s3_endpoint_url:
-{% elif result_backend_name == 'redis' and alts_redis_host and alts_redis_port %}
-  redis_host: "{{ alts_redis_host }}"
+{% elif result_backend_name == 'redis' and redis_host and alts_redis_port %}
+  redis_host: "{{ redis_host }}"
   redis_port: {{ alts_redis_port }}
   redis_db_number: {{ alts_redis_results_db | default(1) }}
 {% if redis_requirepass %}
@@ -61,6 +70,18 @@ worker_prefetch_multiplier: {{ worker_prefetch_multiplier }}
 result_expires: {{ result_expires }}
 {% if alts_service | default('') == 'scheduler' %}
 jwt_secret: "{{ jwt_secret }}"
+{% if queue_arch_overrides is defined %}
+queue_arch_overrides:
+{% for override in queue_arch_overrides %}
+  - dist_name: "{{ override.dist_name }}"
+    dist_versions:
+{% for version in override.dist_versions %}
+      - "{{ version }}"
+{% endfor %}
+    arch: "{{ override.arch }}"
+    queue_arch: "{{ override.queue_arch }}"
+{% endfor %}
+{% endif %}
 {% endif %}
 
 {% if buildsys_url | default('') %}

roles/alts_scheduler/tasks/main.yml

@@ -78,7 +78,7 @@
     owner: "{{ test_system_user }}"
     group: "{{ test_system_user }}"
     state: directory
-  when: scheduler_working_directory is defined and scheduler_working_directory
+  when: scheduler_working_directory | default('') | length > 0
 
 - name: Install firewalld
   yum:

roles/alts_terraform/tasks/main.yml

@@ -6,24 +6,43 @@
     state: present
   when: build_terraform is not defined
 
+- name: Get installed Terraform version
+  ansible.builtin.command: /usr/local/bin/terraform version -json
+  register: terraform_installed
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  when: build_terraform is not defined
+
+- name: Check whether Terraform needs to be installed
+  ansible.builtin.set_fact:
+    terraform_install_needed: >-
+      {{ terraform_installed.rc != 0
+         or (terraform_installed.stdout | from_json).terraform_version != terraform_version }}
+  when: build_terraform is not defined
+
 - name: Download Terraform
   ansible.builtin.get_url:
     url: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_{{ terraform_arch }}.zip"
     dest: /tmp/terraform.zip
-  when: build_terraform is not defined
+  when: build_terraform is not defined and terraform_install_needed | bool
 
+# get_url doesn't download in check mode, so there is nothing to unpack
 - name: Unpack Terraform
   ansible.builtin.unarchive:
     src: /tmp/terraform.zip
     dest: /usr/local/bin
     remote_src: yes
-  when: build_terraform is not defined
+  when:
+    - build_terraform is not defined
+    - terraform_install_needed | bool
+    - not ansible_check_mode
 
 - name: Delete archive
   ansible.builtin.file:
     path: /tmp/terraform.zip
     state: absent
-  when: build_terraform is not defined
+  when: build_terraform is not defined and terraform_install_needed | bool
 
 - name: Install golang
   ansible.builtin.yum: