ci: update integration and coverage workflow python version by brahmanim · Pull Request #190 · redhat-cop/cloud.aws_ops

brahmanim · 2026-07-07T12:45:36Z

Resolves

ACA-6690

SUMMARY

Updates Python version to 3.13 in integration and coverage test workflows.

Changes:

Set PYTHON_VERSION to 3.13 in coverage_test.yml
Set PYTHON_VERSION to 3.13 in integration.yml
Install community.general tests dependancy.
The AMI lookup for Fedora-Cloud-Base-39-* returned no images — those Fedora 39 AMIs are no longer available in AWS. Updated AMI filters Owner: 125523088429 (CentOS Community Platform Engineering)
Name: Fedora-Cloud-Base-.x86_64-4 (matches current Fedora 4x images, excludes ELN/Rawhide)
Update coverage_test to run only on push, instead of each pull_request.
Fix integration test test_backup_select_resources - update iam create role to include ansible-test prefix.
Fix integration test test_deploy_flask_app - Gather information about RDS engine version instead of using a constant var value.
Fix integration test test_deploy_flask_app - update bastion_host_iam_role iam create role to include ansible-test prefix.
Fix integration test test_move_objects_between_buckets - The failure comes from stricter validation in amazon.aws.s3_object: object keys must not start with /, the integration test was putting an object at /template/test.txt, but the rest of the test already expects template/test.txt (no leading slash)
Fix integration test test_customized_ami - use setup_rsa_keys__path with ansible.builtin.file instead of tempfile.
Update roles/deploy_flask_app - Move key path from /tmp/id_rsa → ~/.ssh/workers_id_rsa
Fix integration test test_deploy_flask_app - Fixing bastion user_data in test_deploy_flask_app to use dnf and Fedora-appropriate packages.
Update roles roles/customized_ami/tasks/create_ec2_resources.yaml and roles/deploy_flask_app/tasks/setup_infra.yaml - to install coverage on the bastion host for coverage collection.
Updated test_customized_ami to use a package we control, ngnix, instead of relying on podman being absent from the Fedora 4x base image.
Updated Sanity workflow - I added the missing { so the entry is valid JSON again. The matrix_exclude array now parses with all 13 entries.
Updated roles/manage_transit_gateway - updated debug message.

ISSUE TYPE

Test Pull Request

COMPONENT NAME

CI/CD workflows

Reported CI Issues

Integration tests #184

Assisted-by: Claude Sonnet 4.5 (claude-sonnet-4-5@20250929)

abikouo · 2026-07-15T07:20:52Z

  cancel-in-progress: true

 on:  # yamllint disable-line rule:truthy
-  pull_request:


why do you remove this?

We decided that the coverage test should run on a PR push, not on each PR commit.
Please see the Slack chat: https://redhat-internal.slack.com/archives/CGUMLTNLS/p1783492350136339?thread_ts=1783440020.417639&cid=CGUMLTNLS

abikouo · 2026-07-15T07:23:29Z

@@ -1,5 +1,5 @@
 ---
-deploy_flask_app_workers_ssh_private_key: /tmp/id_rsa


This appears to be a breaking change. Why are you changing this?

Integration tests target test_deploy_flask_app, failed with error:

TASK [cloud.aws_ops.deploy_flask_app : Ensure SSH directory exists on bastion host] *** [ERROR]: Task failed: Module failed: [Errno 1] Operation not permitted: b'/tmp' Origin: /Users/brahmani/.ansible/collections/ansible_collections/cloud/aws_ops/roles/deploy_flask_app/tasks/setup_infra.yaml:40:3 38 register: deploy_flask_app__keypair_result 39 40 - name: Ensure SSH directory exists on bastion host ^ column 3 fatal: [localhost -> ec2-18-212-199-252-bastion(18.212.199.252)]: FAILED! => {"changed": false, "msg": "Task failed: Module failed: [Errno 1] Operation not permitted: b'/tmp'"}

AI suggested changing the deploy_flask_app_workers_ssh_private_key value to ~/.ssh/workers_id_rsa.
Do you have a solution that won't be a breaking change ( I will try to find one)?

I override the integration test vars, tests/integration/targets/test_deploy_flask_app/roles/run_deploy_flask_app/vars/main.yaml, — not in role defaults — so existing consumers of /tmp/id_rsa are unchanged.

beeankha · 2026-07-16T14:53:02Z

+    path: "{{ deploy_flask_app_workers_ssh_private_key | dirname }}"
+    state: directory
+    mode: "0700"
+  delegate_to: "{{ deploy_flask_app__bastion_hostname }}"


Suggested change

delegate_to: "{{ deploy_flask_app__bastion_hostname }}"

ansible.builtin.file:

path: "{{ deploy_flask_app_workers_ssh_private_key | expanduser | dirname }}"

state: directory

mode: "0700"

when: (deploy_flask_app_workers_ssh_private_key | expanduser | dirname) not in ['/tmp', '/var/tmp', '/']

delegate_to: "{{ deploy_flask_app__bastion_hostname }}"

Potentially a nitpick, but with deploy_flask_app_workers_ssh_private_key: /tmp/id_rsa, this task was effectively chmod 0700 /tmp, which fails on Fedora. Skipping the ensure-dir step for system parents (/tmp, /var/tmp, /), and using expanduser would resolve ~/.ssh/... correctly.

You have a good point here. Althought the test does not use the default role dir /tmp; that will be good to skip the check if someone chooses to use the role default(not in the test).
I also added the /var/tmp dir as you suggested, althought usually this folder has 777 permissions.

I chose not to use Jinja | expanduser here. And keep the tilde and skip only with | dirname.
The integration tests were failing with permission denied while using Jinja | expanduser.
The | expanduser runs on the controller, not the bastion, so:
~/.ssh/workers_id_rsa → /root/.ssh/workers_id_rsa
That absolute path is then delegate_to’d to the bastion as user fedora, which cannot create /root/.ssh.
Without expanduser, the path stays ~/.ssh. The file module expands ~ on the remote to /home/fedora/.ssh, which works.

alinabuzachis · 2026-07-16T15:02:01Z

    ansible_ssh_common_args: -o "UserKnownHostsFile=/dev/null" -o StrictHostKeyChecking=no -i {{ customized_ami_private_key_file }}
    ansible_python_interpreter: auto

+- name: Install coverage on remote host for coverage collection


Why is this needed? This modifies the behaviour of the role.

When integration tests are running with --coverage flag, Ansible-core injects the coverage module into every Ansible module executed on remote hosts.
When tasks delegate_to EC2/bastion instances, those Fedora cloud hosts have Python 3.13 but no coverage package:

TASK [cloud.aws_ops.customized_ami : Gather facts from ec2 instance] *********** [WARNING]: Host 'testhost' is using the discovered Python interpreter at '/usr/bin/python3.13', but future installation of another Python interpreter could cause a different interpreter to be discovered. See https://docs.ansible.com/ansible-core/devel/reference_appendices/interpreter_discovery.html for more information. [ERROR]: Task failed: Module failed: No module named 'coverage' Origin: /root/ansible_collections/cloud/aws_ops/roles/customized_ami/tasks/create_ec2_resources.yaml:88:3 86 ansible_python_interpreter: auto 87 88 - name: Gather facts from ec2 instance ^ column 3 fatal: [testhost -> ec2(32.192.24.200)]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3.13"}, "changed": false, "msg": "Task failed: Module failed: No module named 'coverage'"}

In case installing the coverage package on the new Fedora instance changes the role behaviour, I can remove it from this PR, but we should find a solution for coverage integration tests in another PR.
I would love to have your opinion about that.

I do not think this step should be into the role that a user will be using. Can't we add " Install coverage on remote host for coverage collection" as an additional step to the integration role instead?

alinabuzachis · 2026-07-16T15:02:15Z

+    ansible_python_interpreter: /usr/bin/python3
    ansible_ssh_common_args: '-o "UserKnownHostsFile=/dev/null" -o StrictHostKeyChecking=no -i {{ deploy_flask_app_bastion_ssh_private_key_path }}'

+- name: Install coverage on bastion host for coverage collection


sonarqubecloud · 2026-07-16T19:00:33Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

ci: update integration and coverage workflow python version

7ce9a96

brahmanim added the skip-changelog label Jul 7, 2026

brahmanim added 2 commits July 7, 2026 16:00

update commit SHA

88d7615

install community.general test requirement

e09e21d

brahmanim added backport-3 backport-4 labels Jul 7, 2026

brahmanim marked this pull request as ready for review July 7, 2026 13:48

github-actions Bot added the needs_triage label Jul 7, 2026

brahmanim removed the needs_triage label Jul 7, 2026

test: update Fedora AMI filters for integration tests

7e2ce7a

brahmanim added the test-all-the-targets label Jul 8, 2026

brahmanim force-pushed the ACA-5132_update_integration_python_version branch from 077a5ae to 124720d Compare July 8, 2026 13:05

Fix integration tests

cc939fe

brahmanim force-pushed the ACA-5132_update_integration_python_version branch from 124720d to cc939fe Compare July 8, 2026 15:07

brahmanim added 4 commits July 9, 2026 13:19

Update roles to install coverage on the EC2/bastion hosts

dea7deb

Fix linter issue

702c901

Update roles coverage installation

508ab02

test_deploy_flask_app use dnf instead of yum

4d992dd

brahmanim force-pushed the ACA-5132_update_integration_python_version branch from 135348c to 4d992dd Compare July 12, 2026 11:43

brahmanim added 4 commits July 12, 2026 19:17

disable coverage collection during integration tests run

e6678cc

test_customized_ami use ngnix instead of podman

09e20c4

Update Sanity workflow matrix_exclude

633a924

Fix issue with gateway VPM attachment

844038a

brahmanim requested review from GomathiselviS, abikouo, alinabuzachis and beeankha and removed request for abikouo and alinabuzachis July 14, 2026 09:35

brahmanim requested review from Romi1495, abikouo, chynasan, mandar242 and mjohns91 July 14, 2026 09:36

abikouo requested changes Jul 15, 2026

View reviewed changes

overrides test_deploy_flask_app role vars instead of main role

d53a316

brahmanim requested a review from abikouo July 15, 2026 13:28

beeankha reviewed Jul 16, 2026

View reviewed changes

alinabuzachis reviewed Jul 16, 2026

View reviewed changes

brahmanim added 2 commits July 16, 2026 18:23

Skip ensure ssh dir exist for system dir

3604f4b

Skip ensure ssh dir exist without using expanduser

1ae5554

brahmanim requested review from alinabuzachis and beeankha July 17, 2026 05:10

		@@ -1,5 +1,5 @@
		---
		deploy_flask_app_workers_ssh_private_key: /tmp/id_rsa

Uh oh!

Conversation

brahmanim commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resolves

SUMMARY

ISSUE TYPE

COMPONENT NAME

Reported CI Issues

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

brahmanim commented Jul 7, 2026 •

edited

Loading