support RHEL and Rocky 9 (#344)

* #243 initial Rocky 9 support * #243 revert changes made for testing which shouldn't have been committed/pushed. * #243 use RockyLinux 9.0 official AMI in us-east-1 * #243 add Rocky 9 RPM repo * #243 better comment SELinux changes by major version * #243 bump EC2-create to use official Rocky 9.1 AMI * #243 correct typo * #243 tidy up rserve typo, psycopg2 condition * use current rocky 9.1 ami-0fe64c0692c69d851 * #243 update ec2-create.sh for Rocky 9.1 * #243 bump to payara6 to match develop, disabled test suite in vagrant for now * undo configurable java home until templating issue is resolved * #243 updating to 6.0 release * #328 initial commit of localstack rewrite * #328 add podman.yml * #328 create buckets as localstack service account * #328 create minio service account * #328 docker compose is now podman compose * #328 podman-compose wants the dash, whoops * #328 rewrite localstack/minio, keep docker, initial commit * #328 add localstack aws templates * #328 correct service account variables * #328 add service accounts to docker group * #328 correct localstack bucket creation by localstack service account * #328 let's not use the Ansible docker-compose module due to RHEL9 conflicts * #328 correct minio_compose.yml location * #328 MinIO S3Access requires hard-coded credentials * #243 update rocky 9.3 AMI * #328 why is rocky9 failing on python3-docutils * #243 rocky9 needs CRB for AWS CLI * #243 let's stick with Rocky 8 for EC2 until integration tests pass on Rocky 9 * #243 undo rserve testing change to vagrant.yml * #243 revert spurious changes to minio/localstack/docker/podman * #243 correct more spurious commits * #243 some final corrections per Phil --------- Co-authored-by: don sizemore <[email protected]>
gdcc · Feb 14, 2024 · dbc658a · dbc658a
1 parent b0ec117
commit dbc658a
Show file tree

Hide file tree

Showing 14 changed files with 110 additions and 32 deletions.
diff --git a/Vagrantfile b/Vagrantfile
@@ -4,7 +4,7 @@
 VAGRANTFILE_API_VERSION = "2"
 
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
-  config.vm.box = "bento/rockylinux-8"
+  config.vm.box = "bento/rockylinux-9"
 
   config.vm.synced_folder ".", "/vagrant"
   config.vm.synced_folder ".", "/etc/ansible/roles/dataverse"

diff --git a/ec2/ec2-create-instance.sh b/ec2/ec2-create-instance.sh
@@ -8,8 +8,10 @@ BRANCH_DEFAULT="develop"
 PEM_DEFAULT=${HOME}
 VERBOSE_ARG=""
 
-# rocky linux 8.8 official, us-east-1
-AWS_AMI_DEFAULT='ami-093bfdaaa5ea85b41'
+# rocky linux 9.3 official, us-east-1
+#AWS_AMI_DEFAULT='ami-06b7b440778b965d8'
+# let's stick with rocky 8.9 until ITs pass
+AWS_AMI_DEFAULT='ami-0408f4c4a072e3fb9'
 
 usage() {
   echo "Usage: $0 -b <branch> -r <repo> -p <pem_path> -g <group_vars> -a <dataverse-ansible branch> -i aws_image -u aws_user -s aws_size -t aws_tag -f aws_security group -e aws_profile -l local_log_path -d -v" 1>&2

diff --git a/files/shibboleth.rocky9.repo b/files/shibboleth.rocky9.repo
@@ -0,0 +1,9 @@
+[shibboleth]
+name=Shibboleth (rockylinux9)
+# Please report any problems to https://shibboleth.atlassian.net/jira
+type=rpm-md
+mirrorlist=https://shibboleth.net/cgi-bin/mirrorlist.cgi/rockylinux9
+gpgcheck=1
+gpgkey=https://shibboleth.net/downloads/service-provider/RPMS/repomd.xml.key
+        https://shibboleth.net/downloads/service-provider/RPMS/cantor.repomd.xml.key
+enabled=1
diff --git a/tasks/aws_cli.yml b/tasks/aws_cli.yml
@@ -7,6 +7,10 @@
 #  when: (ansible_os_family == "RedHat") and
 #        (ansible_distribution_major_version) == "8"
 
+- name: rocky9 needs codereadybuilder
+  ansible.builtin.shell:
+    cmd: 'dnf config-manager --set-enabled crb'
+
 - name: just use OS-included binary for now
   ansible.builtin.package:
     name: awscli

diff --git a/tasks/dataverse-apache.yml b/tasks/dataverse-apache.yml
@@ -103,13 +103,14 @@
     mode: 0644
   notify: enable and restart apache
 
-- name: this package provides semanage on RHEL / Rocky 8
-  package:
+- name: this package provides semanage on RHEL / Rocky 8 and 9
+  ansible.builtin.package:
     name: policycoreutils-python-utils
     state: latest
   when:
     - ansible_os_family == "RedHat"
     - ansible_distribution_major_version == "8"
+      or ansible_distribution_major_version == "9"
 
 - name: remove unnecessary mod_cgi
   ansible.builtin.file:

diff --git a/tasks/dataverse-counter.yml b/tasks/dataverse-counter.yml
@@ -4,10 +4,21 @@
   debug:
     msg: '##### MAKE DATA COUNT #####'
 
-- name: ensure python3-pip. Ansible on RHEL/Rocky now requires 3.8
-  yum:
+- name: ensure python3-pip. Ansible on RHEL/Rocky 8 now requires 3.8
+  ansible.builtin.package:
     name: python38-pip
     state: latest
+  when:
+  - ansible_os_family == "RedHat"
+  - ansible_distribution_major_version == "8"
+
+- name: ensure python39-pip on RHEL/Rocky 9
+  ansible.builtin.package:
+    name: python3-pip
+    state: latest
+  when:
+  - ansible_os_family == "RedHat"
+  - ansible_distribution_major_version == "9"
 
 - name: ensure counter user exists
   user:

diff --git a/tasks/dataverse-install.yml b/tasks/dataverse-install.yml
@@ -137,8 +137,8 @@
   set_fact:
     python_bin: '/usr/bin/python3'
   when:
-  - ansible_os_family == "RedHat"
-  - ansible_distribution_major_version == "8"
+  - ansible_os_family == "RedHat" and
+    (ansible_distribution_major_version == "8") or (ansible_distribution_major_version == "9")
 
 - name: Debian only offers Python3 nowadays
   set_fact:

diff --git a/tasks/dataverse-prereqs.yml b/tasks/dataverse-prereqs.yml
@@ -46,16 +46,23 @@
     name: ['bash-completion', 'git', 'jq', 'mlocate', 'net-tools', 'sudo', 'unzip', 'python3-psycopg2', 'zip', 'tar']
     state: latest
 
-- name: "RHEL/Rocky 8.6 provides Ansible 5.4 which wants Python-3.8"
+- name: "RHEL/Rocky 8.6-packaged Ansible wants Python-3.8"
   ansible.builtin.package:
     name: ['python38-psycopg2']
     state: latest
   when: ansible_os_family == "RedHat" and
         ansible_distribution_major_version == "8"
 
+- name: "RHEL/Rocky 9 provides Python-3.9"
+  ansible.builtin.package:
+    name: python3-psycopg2
+    state: latest
+  when: ansible_os_family == "RedHat" and
+        ansible_distribution_major_version == "9"
+
 - name: install java-nnn-openjdk and other packages for RedHat/Rocky
   yum:
-    name: ['java-{{ java.version }}-openjdk-devel', 'tzdata-java', 'python38', 'vim-enhanced']
+    name: ['java-{{ java.version }}-openjdk-devel', 'tzdata-java', 'vim-enhanced']
     state: latest
   when: ansible_os_family == "RedHat"
 
@@ -70,7 +77,7 @@
     name: GraphicsMagick
   when:
     - ansible_os_family == "RedHat"
-    - ansible_distribution_major_version == "8"
+    - ansible_distribution_major_version == "8" or ansible_distribution_major_version == "9"
     - dataverse.thumbnails
 
 - name: install GraphicsMagic on Debian/Ubuntu for thumbnail generation

diff --git a/tasks/rserve.yml b/tasks/rserve.yml
@@ -10,17 +10,22 @@
     state: latest
   when: ansible_os_family == "RedHat"
 
-- name: RHEL8 needs codeready-builder
+- name: RHEL8/9 need codeready-builder
   rhsm_repository:
     name: codeready-builder-for-rhel-8-x86_64-rpms
-  when: ansible_distribution == "RedHat" and
-        ansible_distribution_major_version == "8"
+  when: (ansible_distribution == "RedHat" and ansible_distribution_major_version == "8") or
+        (ansible_distribution == "RedHat" and ansible_distribution_major_version == "9")
 
-- name: Rocky needs powertools
+- name: Rocky 8 needs powertools
   shell: "dnf config-manager --enable powertools"
   when: ansible_distribution == "Rocky" and
         ansible_distribution_major_version == "8"
 
+- name: Rocky 9 calls it crb
+  shell: "dnf config-manager --enable crb"
+  when: ansible_distribution == "Rocky" and
+        ansible_distribution_major_version == "9"
+
 - name: install base packages
   yum:
     name: "{{ packages }}"

diff --git a/tasks/sampledata.yml b/tasks/sampledata.yml
@@ -14,6 +14,17 @@
   ansible.builtin.package:
     name: python38-pip
     state: latest
+  when:
+    - ansible_os_family == "RedHat"
+    - ansible_distribution_major_version == "8"
+
+- name: "RHEL/Rocky 9 packages Python-3.9"
+  ansible.builtin.package:
+    name: python3-pip
+    state: latest
+  when:
+    - ansible_os_family == "RedHat"
+    - ansible_distribution_major_version == "9"
 
 - name: clone sampledata repo
   git:

diff --git a/tasks/sanity-checks.yml b/tasks/sanity-checks.yml
@@ -7,6 +7,13 @@
         ansible_distribution_major_version == "8" and
         db.postgres.version < 10
 
+- name: RHEL9 and RockyLinux likely require PG13
+  set_fact:
+    die: "RHEL/Rocky 9 packages PostgresQL 13 and likely won't work with earlier versions."
+  when: ansible_os_family == "RedHat" and
+        ansible_distribution_major_version == "9" and
+        db.postgres.version < 13
+
 - name: Shibboleth requires AJP
   set_fact:
     die: "Shibboleth requires AJP"

diff --git a/tasks/selinux.yml b/tasks/selinux.yml
@@ -10,29 +10,34 @@
       - policycoreutils
   when: ansible_os_family == 'RedHat'
 
-# Ansible seboolean module is broken on RHEL/Rocky 8.6. dls 20220602
-#- name: set httpd_can_network_connect on and keep it persistent across reboots
-#  seboolean:
-#    name: httpd_can_network_connect
-#    state: yes
-#    persistent: yes
-#  when: ansible_os_family == 'RedHat'
+# Ansible seboolean works on Rocky 9, 8.6 handled below.
+- name: set httpd_can_network_connect on and keep it persistent across reboots
+  seboolean:
+    name: httpd_can_network_connect
+    state: yes
+    persistent: yes
+  when:
+  - ansible_os_family == 'RedHat'
+  - ansible_distribution_major_version == "9"
 
+# Ansible seboolean module is broken on RHEL/Rocky 8.6, use shell cmd instead.
 - name: allow apache to make outbound connections
   shell: '/usr/sbin/setsebool -P httpd_can_network_connect 1'
   when:
     - ansible_os_family == "RedHat"
     - ansible_distribution_major_version == "8"
 
-# Ansible seboolean module is broken on RHEL/Rocky 8.6. dls 20220602
-#- name: allow apache to read user content by default
-#  seboolean:
-#    name: httpd_read_user_content
-#    state: yes
-#    persistent: yes
-#  when:
-#  - ansible_os_family == "RedHat"
+# Ansible seboolean works on Rocky 9, 8.6 handled below.
+- name: allow apache to read user content by default
+  seboolean:
+    name: httpd_read_user_content
+    state: yes
+    persistent: yes
+  when:
+  - ansible_os_family == "RedHat"
+  - ansible_distribution_major_version == "9"
 
+# Ansible seboolean module is broken on RHEL/Rocky 8.6. dls 20220602
 - name: allow apache to read user content by default
   shell: 'setsebool -P httpd_read_user_content 1'
   when:

diff --git a/tasks/shibboleth.yml b/tasks/shibboleth.yml
@@ -16,7 +16,18 @@
     owner: root
     group: root
     mode: 0644
-  when: ansible_distribution == "Rocky"
+  when: ansible_distribution == "Rocky" and
+        ansible_distribution_major_version == "8"
+
+- name: install shibboleth repo for Rocky 9
+  ansible.builtin.copy:
+    src: 'shibboleth.rocky9.repo'
+    dest: /etc/yum.repos.d/shibboleth.repo
+    owner: root
+    group: root
+    mode: 0644
+  when: ansible_distribution == "Rocky" and
+        ansible_distribution_major_version == "9"
 
 - name: install shibboleth repo for RHEL/CentOS 8
   ansible.builtin.copy:

diff --git a/tests/group_vars/vagrant.yml b/tests/group_vars/vagrant.yml
@@ -301,6 +301,11 @@ grafana:
   grafana_user: 'admin'
   grafana_password: 'admin'
 
+harvest:
+  oaiserver:
+    maxidentifiers: 2
+    maxrecords: 2
+
 java:
   version: 17