feat: add cleanup playbooks for migration test environments

README.md

@@ -41,6 +41,7 @@ See [CHANGELOG.md](CHANGELOG.md) for release history and changes.
 This collection includes the following roles for managing OpenShift Virtualization migrations:
 
 <!--ROLES_LIST_START-->
+* [aap_cleanup](roles/aap_cleanup/README.md) - Remove AAP resources seeded by the aap_seed role
 * [aap_deploy](roles/aap_deploy/README.md) - Deploys an instance of Ansible Automation Platform.
 * [aap_machine_credentials](roles/aap_machine_credentials/README.md) - Management of Machine Credentials.
 * [aap_seed](roles/aap_seed/README.md) - Populates an Ansible Automation Platform instance.
@@ -50,6 +51,7 @@ This collection includes the following roles for managing OpenShift Virtualizati
 * [mtv_management](roles/mtv_management/README.md) - Management of the Migration Toolkit for Virtualization (MTV).
 * [mtv_migrate](roles/mtv_migrate/README.md) - Migration of Virtual Machines from Source to Destination.
 * [network_mgmt](roles/network_mgmt/README.md) - Management of network related components.
+* [ocp_cleanup](roles/ocp_cleanup/README.md) - Remove OpenShift migration artifacts created during virtualization migration testing
 * [operator_management](roles/operator_management/README.md) - Management of OpenShift Operators.
 * [validate_migration](roles/validate_migration/README.md) - Verification of an Ansible for OpenShift Virtualization Migration environment.
 * [vm_backup_restore](roles/vm_backup_restore/README.md) - Virtual Machine backup and restore capabilities.

extensions/molecule/cleanup_aap/molecule.yml

@@ -0,0 +1,22 @@
+---
+platforms:
+  - name: na
+
+provisioner:
+  name: ansible
+  playbooks:
+    cleanup: ../utils/playbooks/noop.yml
+    converge: ../utils/playbooks/converge.yml
+    destroy: ../utils/playbooks/noop.yml
+    prepare: ../utils/playbooks/noop.yml
+  config_options:
+    defaults:
+      collections_path: ${ANSIBLE_COLLECTIONS_PATH}
+
+scenario:
+  test_sequence:
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+...

extensions/molecule/cleanup_ocp_artifacts/molecule.yml

@@ -0,0 +1,22 @@
+---
+platforms:
+  - name: na
+
+provisioner:
+  name: ansible
+  playbooks:
+    cleanup: ../utils/playbooks/noop.yml
+    converge: ../utils/playbooks/converge.yml
+    destroy: ../utils/playbooks/noop.yml
+    prepare: ../utils/playbooks/noop.yml
+  config_options:
+    defaults:
+      collections_path: ${ANSIBLE_COLLECTIONS_PATH}
+
+scenario:
+  test_sequence:
+    - prepare
+    - converge
+  destroy_sequence:
+    - destroy
+...

playbooks/cleanup_all.yml

@@ -0,0 +1,33 @@
+---
+- name: Cleanup OCP migration artifacts
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  tasks:
+    - name: Run OCP cleanup
+      block:
+        - name: Include OCP cleanup role
+          ansible.builtin.include_role:
+            name: infra.openshift_virtualization_migration.ocp_cleanup
+      rescue:
+        - name: OCP cleanup failed
+          ansible.builtin.debug:
+            msg: "OCP migration artifact cleanup failed — continuing with AAP cleanup"
+
+- name: Cleanup Migration AAP
+  hosts: migration_aap
+  connection: local
+  gather_facts: false
+  tasks:
+    - name: Run Migration AAP cleanup
+      block:
+        - name: Include AAP cleanup role
+          ansible.builtin.include_role:
+            name: infra.openshift_virtualization_migration.aap_cleanup
+          vars:
+            aap_cleanup_job_history_purge: true
+      rescue:
+        - name: Migration AAP cleanup failed
+          ansible.builtin.debug:
+            msg: "Migration AAP cleanup failed"
+...

playbooks/cleanup_migration_aap.yml

@@ -0,0 +1,11 @@
+---
+- name: Remove seeded AAP content from Migration Factory instance
+  hosts: migration_aap
+  connection: local
+  gather_facts: false
+
+  roles:
+    - role: infra.openshift_virtualization_migration.aap_cleanup
+      vars:
+        aap_cleanup_job_history_purge: true
+...

playbooks/cleanup_ocp_migration_artifacts.yml

@@ -0,0 +1,9 @@
+---
+- name: Remove OpenShift migration artifacts
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  roles:
+    - role: infra.openshift_virtualization_migration.ocp_cleanup
+...

roles/aap_cleanup/defaults/main.yml

@@ -0,0 +1,56 @@
+---
+# AAP Controller connection
+aap_cleanup_controller_hostname: >-
+  {{ controller_hostname | default(aap_hostname)
+  | default(lookup('ansible.builtin.env', 'CONTROLLER_HOSTNAME')) }}
+aap_cleanup_controller_username: >-
+  {{ controller_username | default(aap_username)
+  | default(lookup('ansible.builtin.env', 'CONTROLLER_USERNAME')) }}
+aap_cleanup_controller_password: >-
+  {{ controller_password | default(aap_password)
+  | default(lookup('ansible.builtin.env', 'CONTROLLER_PASSWORD')) }}
+aap_cleanup_controller_token: >-
+  {{ controller_oauthtoken | default(aap_token)
+  | default(lookup('ansible.builtin.env', 'CONTROLLER_TOKEN')) }}
+aap_cleanup_controller_validate_certs: >-
+  {{ controller_validate_certs | default(aap_validate_certs)
+  | default(lookup('ansible.builtin.env', 'CONTROLLER_VERIFY_SSL'))
+  | default(true, true) | bool }}
+aap_cleanup_secure_logging: "{{ secure_logging | default(true) }}"
+
+# AAP version-aware collection selection
+aap_cleanup_cac_collection: >-
+  {{ 'infra.controller_configuration' if aap_version is defined and aap_version is version('2.5', '<')
+  else 'infra.aap_configuration' }}
+
+# Organization context
+aap_cleanup_aap_org_name: "{{ aap_org_name }}"
+
+# API base path (AAP 2.5+ uses /api/controller/v2, 2.4 uses /api/v2)
+aap_cleanup_api_base: >-
+  {{ '/api/controller/v2'
+  if aap_version is not defined
+  or (aap_version is defined and aap_version is version('2.5', '>='))
+  else '/api/v2' }}
+
+# Scope toggles — which resource types to remove
+aap_cleanup_workflows_remove: true
+aap_cleanup_job_templates_remove: true
+aap_cleanup_hosts_remove: true
+aap_cleanup_inventories_remove: true
+aap_cleanup_projects_remove: true
+aap_cleanup_execution_environments_remove: true
+aap_cleanup_credentials_remove: true
+aap_cleanup_credential_types_remove: true
+aap_cleanup_organization_remove: false
+aap_cleanup_job_history_purge: false
+
+# Provider filtering
+aap_cleanup_providers: "{{ cleanup_providers | default(['vmware', 'ovirt']) }}"
+
+# Dry-run mode — query and report only, no deletions
+aap_cleanup_dry_run: false
+
+# Async configuration
+aap_cleanup_controller_configuration_async_retries: 60
+...

roles/aap_cleanup/meta/main.yml

@@ -0,0 +1,18 @@
+---
+galaxy_info:
+  author: Red Hat
+  description: Remove AAP resources seeded by the aap_seed role
+  license: GPL-3.0-or-later
+  min_ansible_version: "2.15"
+  platforms:
+    - name: EL
+      versions:
+        - "9"
+  galaxy_tags:
+    - aap
+    - cleanup
+    - migration
+    - openshift
+    - virtualization
+dependencies: []
+...

roles/aap_cleanup/tasks/_build_absent_resources.yml

@@ -0,0 +1,76 @@
+---
+- name: "_build_absent_resources | Query resources from AAP API — {{ _aap_cleanup_resource_type }}"
+  ansible.builtin.uri:
+    url: >-
+      https://{{ aap_cleanup_controller_hostname }}{{ aap_cleanup_api_base }}/{{ _aap_cleanup_resource_type }}/?{{
+      'organization=' ~ _aap_cleanup_org_id ~ '&' if (_aap_cleanup_use_org_filter | default(true)) else ''
+      }}page_size=200
+    method: GET
+    headers: "{{ _aap_cleanup_auth_headers }}"
+    user: "{{ aap_cleanup_controller_username if _aap_cleanup_force_basic_auth else omit }}"
+    password: "{{ aap_cleanup_controller_password if _aap_cleanup_force_basic_auth else omit }}"
+    force_basic_auth: "{{ _aap_cleanup_force_basic_auth }}"
+    validate_certs: "{{ aap_cleanup_controller_validate_certs }}"
+    body_format: json
+    status_code: [200]
+  register: _aap_cleanup_query_result
+  no_log: "{{ aap_cleanup_secure_logging }}"
+
+- name: "_build_absent_resources | Filter out managed/built-in credential types"
+  when: _aap_cleanup_filter_managed | default(false) | bool
+  ansible.builtin.set_fact:
+    _aap_cleanup_filtered_results: >-
+      {{ _aap_cleanup_query_result.json.results
+      | selectattr('managed', 'equalto', false)
+      | list }}
+
+- name: "_build_absent_resources | Set results for non-filtered resources"
+  when: not (_aap_cleanup_filter_managed | default(false) | bool)
+  ansible.builtin.set_fact:
+    _aap_cleanup_filtered_results: "{{ _aap_cleanup_query_result.json.results }}"
+
+- name: "_build_absent_resources | Report resources found — {{ _aap_cleanup_resource_type }}"
+  ansible.builtin.debug:
+    msg: >-
+      {{ _aap_cleanup_resource_type }}: found {{ _aap_cleanup_filtered_results | length }} resource(s)
+      {{ '— DRY RUN, skipping deletion' if aap_cleanup_dry_run else '— removing' }}
+    verbosity: 0
+
+- name: "_build_absent_resources | Display resources to remove"
+  when: _aap_cleanup_filtered_results | length > 0
+  ansible.builtin.debug:
+    msg: "{{ _aap_cleanup_filtered_results | map(attribute='name') | list }}"
+    verbosity: 0
+
+- name: "_build_absent_resources | Build and dispatch absent resources — {{ _aap_cleanup_resource_type }}"
+  when:
+    - _aap_cleanup_filtered_results | length > 0
+    - not (aap_cleanup_dry_run | bool)
+  block:
+    - name: "_build_absent_resources | Build absent resource list — {{ _aap_cleanup_resource_type }}"
+      ansible.builtin.set_fact:
+        _aap_cleanup_absent_list: >-
+          {{ _aap_cleanup_filtered_results | map('combine', {'state': 'absent'})
+          | map('dict2items')
+          | map('selectattr', 'key', 'in',
+            ['name', 'organization', 'state']
+            + (_aap_cleanup_extra_fields | default([])))
+          | map('items2dict')
+          | list }}
+
+    - name: "_build_absent_resources | Set dispatch variable — {{ _aap_cleanup_dispatch_var }}"
+      ansible.builtin.set_fact:
+        "{{ _aap_cleanup_dispatch_var }}": "{{ _aap_cleanup_absent_list }}"
+        controller_dependency_check: false  # noqa: var-naming[no-role-prefix]
+
+    - name: "_build_absent_resources | Dispatch removal — {{ _aap_cleanup_resource_type }}"
+      ansible.builtin.include_role:
+        name: "{{ aap_cleanup_cac_collection }}.dispatch"
+      vars:
+        controller_configuration_async_delay: 5
+        aap_configuration_async_delay: 5
+
+    - name: "_build_absent_resources | Clear dispatch variable — {{ _aap_cleanup_dispatch_var }}"
+      ansible.builtin.set_fact:
+        "{{ _aap_cleanup_dispatch_var }}": []
+...

roles/aap_cleanup/tasks/_cleanup_job_history.yml

@@ -0,0 +1,41 @@
+---
+- name: "_cleanup_job_history | Query completed jobs"
+  ansible.builtin.uri:
+    url: >-
+      https://{{ aap_cleanup_controller_hostname
+      }}{{ aap_cleanup_api_base }}/jobs/?status=successful&page_size=200&order_by=-finished
+    method: GET
+    headers: "{{ _aap_cleanup_auth_headers }}"
+    user: "{{ aap_cleanup_controller_username if _aap_cleanup_force_basic_auth else omit }}"
+    password: "{{ aap_cleanup_controller_password if _aap_cleanup_force_basic_auth else omit }}"
+    force_basic_auth: "{{ _aap_cleanup_force_basic_auth }}"
+    validate_certs: "{{ aap_cleanup_controller_validate_certs }}"
+    body_format: json
+    status_code: [200]
+  register: _aap_cleanup_jobs_result
+  no_log: "{{ aap_cleanup_secure_logging }}"
+
+- name: "_cleanup_job_history | Report job history count"
+  ansible.builtin.debug:
+    msg: >-
+      Job history: found {{ _aap_cleanup_jobs_result.json.count }} completed job(s)
+      {{ '— DRY RUN, skipping purge' if aap_cleanup_dry_run else '— purging' }}
+
+- name: "_cleanup_job_history | Delete completed jobs"
+  when:
+    - _aap_cleanup_jobs_result.json.count > 0
+    - not (aap_cleanup_dry_run | bool)
+  ansible.builtin.uri:
+    url: "https://{{ aap_cleanup_controller_hostname }}{{ aap_cleanup_api_base }}/jobs/{{ item.id }}/"
+    method: DELETE
+    headers: "{{ _aap_cleanup_auth_headers }}"
+    user: "{{ aap_cleanup_controller_username if _aap_cleanup_force_basic_auth else omit }}"
+    password: "{{ aap_cleanup_controller_password if _aap_cleanup_force_basic_auth else omit }}"
+    force_basic_auth: "{{ _aap_cleanup_force_basic_auth }}"
+    validate_certs: "{{ aap_cleanup_controller_validate_certs }}"
+    status_code: [202, 204, 404]
+  loop: "{{ _aap_cleanup_jobs_result.json.results }}"
+  loop_control:
+    label: "{{ item.name | default(item.id) }} ({{ item.id }})"
+  no_log: "{{ aap_cleanup_secure_logging }}"
+...