Merge ~afreiberger/charm-elasticsearch:bug/1864169 into charm-elasticsearch:master

[Drew Freiberger]

Updated elasticsearch charm to continue trusty support

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[Drew Freiberger (afreiberger)]

original MR and comments:

https://code.launchpad.net/~addyess/charm-elasticsearch/+git/charm-elasticsearch/+merge/387557

[Xav Paice (xavpaice)]

Installs fine on Trusty, but on Bionic with a proxy it's not connecting.

2020-07-21 23:56:31 DEBUG install TASK [Add apt key.] ************************************************************
2020-07-21 23:58:42 DEBUG install fatal: [localhost]: FAILED! => {"changed": false, "msg": "Failed to connect to artifacts.elastic.co at port 443: [Errno 101] Network is unreachable"}
2020-07-21 23:58:42 DEBUG install to retry, use: --limit @/var/lib/juju/agents/unit-elast-bionic-0/charm/playbook.retry
2020-07-21 23:58:42 DEBUG install
2020-07-21 23:58:42 DEBUG install PLAY RECAP *********************************************************************
2020-07-21 23:58:42 DEBUG install localhost : ok=2 changed=1 unreachable=0 failed=1
2020-07-21 23:58:42 DEBUG install
2020-07-21 23:58:42 DEBUG install Traceback (most recent call last):
2020-07-21 23:58:42 DEBUG install File "/var/lib/juju/agents/unit-elast-bionic-0/charm/hooks/install", line 189, in <module>
2020-07-21 23:58:42 DEBUG install hooks.execute(sys.argv)
2020-07-21 23:58:42 DEBUG install File "/var/lib/juju/agents/unit-elast-bionic-0/charm/hooks/charmhelpers/contrib/ansible/__init__.py", line 229, in execute
2020-07-21 23:58:42 DEBUG install self.playbook_path, tags=[hook_name], extra_vars=extra_vars)
2020-07-21 23:58:42 DEBUG install File "/var/lib/juju/agents/unit-elast-bionic-0/charm/hooks/charmhelpers/contrib/ansible/__init__.py", line 161, in apply_playbook
2020-07-21 23:58:42 DEBUG install subprocess.check_call(call, env=env)
2020-07-21 23:58:42 DEBUG install File "/usr/lib/python3.6/subprocess.py", line 311, in check_call
2020-07-21 23:58:42 DEBUG install raise CalledProcessError(retcode, cmd)
2020-07-21 23:58:42 DEBUG install subprocess.CalledProcessError: Command '['ansible-playbook', '-c', 'local', 'playbook.yaml', '--tags', 'install']' returned non-zero exit status 2.
2020-07-21 23:58:42 ERROR juju.worker.uniter.operation runhook.go:136 hook "install" (via explicit, bespoke hook script) failed: exit status 1

The model has juju-http-proxy and juju-https-proxy set.

review: Needs Fixing

[Drew Freiberger (afreiberger)]

https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1433761
https://github.com/ansible/ansible/issues/31691

Looks like there may be other ways to work around this. Seems add-key is deprecated as of bionic and one should just download keys into trusted.gpg.d (per comments on the ubuntu bug link).

But there's a potential workaround mentioned in the ansible issue #31691 that lists use of environment variables in apt_key:

  - name: Ensure the Sensu APT repo GPG key is present
     apt_key:
       url: https://sensu.global.ssl.fastly.net/apt/pubkey.gpg
       state: present
     environment:
       http_proxy: 'http://172.31.255.254:8888'
       https_proxy: 'http://172.31.255.254:8888'

So we may be able to add environment https_proxy: {{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }} to apt_key for non-trusty.

[Drew Freiberger (afreiberger)]

Latest merge configures apt_key section of playbook for non-trusty to also use juju-https-proxy properly if it exists. I've tested with models with proxy set and unset with both models completing successful installs on all four supported distros.

Test model configs and status:
https://pastebin.canonical.com/p/4Hfb6fFfVT/

review: Needs Resubmitting

[Xav Paice (xavpaice)]

LGTM, tests well on Trusty plus others.

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Failed to merge change (unable to merge source repository due to conflicts), setting status to needs review.

diff --git a/.gitignore b/.gitignore
index 948c035..a9bc955 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,5 +7,7 @@ revision
 exec.d
 local.yaml
 
+repo-info
+.idea/
 *.pyc
 __pycache__
diff --git a/Makefile b/Makefile
index 50fc07f..c81f7cd 100644
--- a/Makefile
+++ b/Makefile
@@ -1,13 +1,27 @@
 #!/usr/bin/make
 PYTHON := /usr/bin/env python3
-
-build: sync-charm-helpers-stable test
-
-lint:
+CHARM_HELPERS = charm-helpers/.gitignore
+PYTHON := /usr/bin/python3
+export PYTHONPATH := hooks
+PROJECTPATH = $(dir $(realpath $(MAKEFILE_LIST)))
+METADATA_FILE = "metadata.yaml"
+CHARM_NAME = $(shell cat ${PROJECTPATH}/${METADATA_FILE} | grep -E '^name:' | awk '{print $$2}')
+ifndef CHARM_BUILD_DIR
+    CHARM_BUILD_DIR := /tmp/charm-builds
+    $(warning Warning CHARM_BUILD_DIR was not set, defaulting to $(CHARM_BUILD_DIR))
+endif
+
+build: test
+	@echo "Building charm to base directory $(CHARM_BUILD_DIR)/$(CHARM_NAME)"
+	@-git describe --tags > ./repo-info
+	@mkdir -p $(CHARM_BUILD_DIR)/$(CHARM_NAME)
+	@cp -r * $(CHARM_BUILD_DIR)/$(CHARM_NAME)
+
+lint: $(CHARM_HELPERS)
 	@tox -e pep8
 	@charm proof
 
-test:
+test: $(CHARM_HELPERS)
 	@echo Starting unit tests...
 	@tox -e py3
 
@@ -18,7 +32,10 @@ deploy:
 health:
 	juju ssh elasticsearch/0 "curl http://localhost:9200/_cluster/health?pretty=true"
 
-sync-charm-helpers-stable:
+.PHONY: sync-charm-helpers-stable
+sync-charm-helpers-stable: $(CHARM_HELPERS)
+
+$(CHARM_HELPERS): .gitmodules
 	@git submodule update --init
 
 sync-charm-helpers-master:
diff --git a/charm-helpers b/charm-helpers
index 068fa70..a9810ba 160000
--- a/charm-helpers
+++ b/charm-helpers
@@ -1 +1 @@
-Subproject commit 068fa70b4604b4247811691d31bd057cad9ab8c8
+Subproject commit a9810baa1d34b30f20f0a97b577b0ceaee3a66dd
diff --git a/hooks/hooks.py b/hooks/hooks.py
index 483065c..3a483b0 100755
--- a/hooks/hooks.py
+++ b/hooks/hooks.py
@@ -4,16 +4,21 @@ import os
 import shutil
 import sys
 import json
-import requests
-
 import charmhelpers.contrib.ansible
 import charmhelpers.payload.execd
 import charmhelpers.core.host
 from charmhelpers.core import hookenv
-from charmhelpers.fetch import add_source
-from charmhelpers.fetch import apt_update
+from charmhelpers.fetch import add_source, apt_update, install
 from charmhelpers.contrib.charmsupport import nrpe
 
+
+try:
+    import requests
+except ImportError:
+    install(['python3-requests'])
+    import requests
+
+
 mountpoint = '/srv/elasticsearch'
 
 hooks = charmhelpers.contrib.ansible.AnsibleHooks(
diff --git a/playbook.yaml b/playbook.yaml
index 311542d..d1333ad 100644
--- a/playbook.yaml
+++ b/playbook.yaml
@@ -62,6 +62,7 @@
         - install
         - upgrade-charm
         - client-relation-joined
+        - update-status
       shell: apt-cache policy elasticsearch | grep -oe 'Installed:.*' | cut -d' ' -f2
       register: es_version
 
diff --git a/tasks/install-elasticsearch.yml b/tasks/install-elasticsearch.yml
index c0f2b8b..2a18b97 100644
--- a/tasks/install-elasticsearch.yml
+++ b/tasks/install-elasticsearch.yml
@@ -8,13 +8,23 @@
   command: gpgconf --kill gpg-agent
   ignore_errors: yes
 
+- name: Add apt key (trusty).
+  tags:
+    - install
+    - upgrade-charm
+    - config-changed
+  shell: HTTPS_PROXY={{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }} curl -s {{ apt_key_url }} | apt-key add -
+  when: (apt_key_url != "" and gpg_key == "" and ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'trusty')
+
 - name: Add apt key.
   tags:
     - install
     - upgrade-charm
     - config-changed
   apt_key: url={{ apt_key_url }} state=present id={{gpg_key_id}}
-  when: (apt_key_url != "" and gpg_key == "")
+  environment:
+    https_proxy: "{{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }}"
+  when: (apt_key_url != "" and gpg_key == "" and ansible_distribution == 'Ubuntu' and ansible_distribution_release != 'trusty')
 
 - name: Add an apt key in a raw format.
   tags:
diff --git a/tasks/setup-ufw.yml b/tasks/setup-ufw.yml
index 9d64353..32c74a7 100644
--- a/tasks/setup-ufw.yml
+++ b/tasks/setup-ufw.yml
@@ -49,4 +49,4 @@
 
 - name: Deny all incoming requests on 9300 once unit is part of cluster
   ufw: rule=deny port=9300
-  when: firewall_enabled and cluster_health is success and cluster_health.json.number_of_nodes > 1
+  when: firewall_enabled and cluster_health is defined and cluster_health is success and cluster_health.json.number_of_nodes > 1