Conversation
…2) (ansible#238) * Add inventory aap_ca_bundle for Gateway TLS verification Support control-node CA bundle paths via aap_ca_bundle (and aliases) so installers can slurp trust material from gateway hosts without per-task environment blocks or system CA store changes. Forward the path to manager subprocesses as REQUESTS_CA_BUNDLE when validate_certs is enabled. Related: ANSTRAT-2452 Co-authored-by: Cursor <cursoragent@cursor.com> * Fix requests_verify property for PlatformService test stubs Fall back to instance verify_ssl/ca_bundle attributes when config is absent. Unit tests construct PlatformService via object.__new__ without GatewayConfig, which caused AttributeError during TLS verify evaluation and masked failures as invalid except handlers. Co-authored-by: Cursor <cursoragent@cursor.com> * Address CodeRabbit review feedback on CA bundle inventory var. Fix shell-over-task REQUESTS_CA_BUNDLE precedence, strip CA bundle auth params before model init, map CA paths correctly for Ansible Request, restore integration test facts safely, and add unit tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix ruff format and document aap_ca_bundle auth-only stripping. Apply ruff formatting to the action plugin unit test and update auth doc fragment to describe _AUTH_PARAMS filtering and REQUESTS_CA_BUNDLE precedence. Co-authored-by: Cursor <cursoragent@cursor.com> * Include TLS trust policy in persistent manager identity hash. ca_bundle and verify_ssl are baked into the manager subprocess at spawn and were omitted from the socket key, so a later task changing aap_ca_bundle or aap_validate_certs reused a stale manager. Related: ANSTRAT-2452 Co-authored-by: Cursor <cursoragent@cursor.com> * Hash the effective CA bundle in persistent manager identity. Task-level REQUESTS_CA_BUNDLE outranks inventory aap_ca_bundle at spawn, so hashing gateway_config.ca_bundle alone still allowed two tasks with different trust stores to reuse one manager. Related: ANSTRAT-2452 Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
CasC NotificationThis PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration). Detected changes in CasC-monitored areas:
Please tag the CasC collections team in this PR so they are aware of the change.
|
* [AAP-76998] Add service_cluster outlier detection options Jewel added split_external_local_origin_errors and consecutive_local_origin_failure on ServiceCluster. Expose the same options in the collection so completeness CI passes and playbooks can set them. Co-authored-by: Cursor <cursoragent@cursor.com> * [AAP-76998] Omit YAML defaults on service_cluster outlier options DOCUMENTATION defaults are copied into the action-plugin argspec, so an omitted option would PATCH true/0 and overwrite a custom cluster value. Match the rest of this module: no YAML default, gateway default in the description. Co-authored-by: Cursor <cursoragent@cursor.com> * [AAP-76998] Add unit tests for service_cluster outlier local-origin options Cover create/update field lists, omit-vs-send of False/0, and from_api mapping so the gateway defaults are not patched when the options are unset. Co-authored-by: Cursor <cursoragent@cursor.com> * [AAP-76998] Add molecule coverage for service_cluster outlier options Prove create, idempotency, update, and exists round-trip split/consecutive values (including 0 and false) through all three connection modes. Co-authored-by: Cursor <cursoragent@cursor.com> * [AAP-76998] Fix yamllint on service_cluster molecule tests Shorten assert fail_msg lines to the 160-char limit and restore the document-end marker those playbooks require. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
CasC NotificationThis PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration). Detected changes in CasC-monitored areas:
Please tag the CasC collections team in this PR so they are aware of the change.
|
|
DVCS PR Check Results: PR appears valid (JIRA key(s) found) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Following PR is a devel to 2.7 backport of #238 + #241