freeze version per site

[A1ve5]

A) update git_mirror through ansible-playbook install.yml and not with cron;
OR
B) completly freeze ansible playbooks and roles through commit or tag

[martbhell]

The problem scenario we are trying to fix is (please confirm this):

1. FGCI admins update the master branch ("stable") in https://github.com/CSC-IT-Center-for-Science/fgci-ansible with a new role in the playbook local.yml (used by ansible-pull on compute nodes)
2. git-mirror runs via a cronjob on the install node and gets the latest version of the fgci-ansible repo
3. ansible-pull runs via a cronjob on a compute node and gets the latest version of the fgci-ansible repo and tries to run the playbook. This fails because the requirements_mirror is not updated with the new role. Updating this is a manual task.

If we make the git mirror on install node automatically updated whenever fgci-ansible/requirements.yml is updated (and not when running the fgci-install role) - that would mean that the compute nodes get a newer "CSC ansible software stack" than install,admin,login, grid nodes - which is also not optimal.

A) would be a technical and documentational? solution and B) (if it works) might be doable with only information/documentation; if it's just to suggest that users use "git checkout v1.1.0" in their clone of fgci-ansible (and set ansible_pull_branch). Good testing and documentation is important here. Must test the upgrade procedure between versions. This could be a heavy workload.

[A1ve5]

Exactly.

One way to solve it is to drop the cron triggered git_mirror update and make any reconfiguration of the computes exclusively dependent on what is available on the install node, which by it's turn just get changed whenever site specific playbooks are ran against install node. This way if sites don't change their confs/roles/playbooks nothing gets changed on the whole cluster.