feat: add playbooks for enterprise-access and enterprise-subsidy #7107

tecoholic · 2024-02-15T12:14:53Z

Configuration Pull Request

Make sure that the following steps are done before merging:

Have a Site Reliability Engineer review the PR if you don't own all of the services impacted.
If you are adding any new default values that need to be overridden when this change goes live, update internal repos and add an entry to the top of the CHANGELOG.
Performed the appropriate testing.
Think about how this change will affect Open edX operators and update the wiki page for the next Open edX release if needed

Description

This PR adds new playbooks and roles for deploying enterprise-access and enterprise-subsidy natively. The roles were created using the enterprise-catalog role as a reference.

Testing

The roles were tested following the Vagrant based testing instructions using VirtualBox as the backend on a Linux machine.

Set the role - export VAGRANT_ANSIBLE_ROLE=enterprise_access or export VAGRANT_ANSIBLE_ROLE=enterprise_subsidy

Put the following in a yml file

COMMON_CONFIG_NO_LOGGING: false
GIT_CLONE_NO_LOGGING: false
COMMON_GIT_PATH: open-craft
ENTERPRISE_ACCESS_VERSION: 'tecoholic/BB-8440-deployment-fixes'
ENTERPRISE_SUBSIDY_VERSION: 'tecoholic/BB-8440-deployment-fixes'
ENTERPRISE_SUBSIDY_MEMCACHE_BACKEND: 'django.core.cache.backends.locmem.LocMemCache'
ENTERPRISE_SUBSIDY_MEMCACHE: 'enterprise_subsidy'

Set the vars envvar export VAGRANT_ANSIBLE_VARS_FILE=/path/to/file-with-above-content
Run vagrant up and verify that the role completes successfully.

Verifying services are running correctly

For Enterprise Access, running vagrant ssh -- -NL 8270:localhost:8270 allows us to verify that the service is up. Visit http://localhost:8270/admin/ to get the login form. The static files won't load as they depend on the Nginx from the playbook.
For Enterprise Subsidy, with running vagrant ssh -- -NL 8280:localhost:8280 the admin page refuses to render because it tries to load a Waffle Flag from the database which isn't deployed by this role.

A new playbook and role have been added for deploying enterprise-access based on the existing enterprise_catalog playbook and role.

A new playbook and role have been added for deploying enterprise-subsidy based on the existing playbook and role for enterprise_catalog.

As enterprise-subsidy uses Django 4.2, it doesn't support the default MemchachedCache backend provided by edx_django_service. So, this sets the default memcached backend to PyMemcacheCache[1]. [1]: https://docs.djangoproject.com/en/4.2/topics/cache/#memcached

* Bump the Vagrant box from Xenial to Focal * Update the IP address of the Vagrant box based on the docs[1] > On Linux, macOS and Solaris Oracle VM VirtualBox will only allow IP addresses in 192.168.56.0/21 range to be assigned to host-only adapters. [1]: https://www.virtualbox.org/manual/ch06.html#network_hostonly

openedx-webhooks · 2024-02-15T12:14:57Z

Thanks for the pull request, @tecoholic! Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

supporting documentation
Open edX discussion forum threads
timeline information ("this must be merged by XX date", and why that is)
partner information ("this is a course on edx.org")
any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

…onfig

Agrendalath

@tecoholic, some of the comments apply to both roles. I didn't duplicate them for readability, though.

Also, we should update the CHANGELOG.md file.

Agrendalath · 2024-02-19T15:38:28Z

playbooks/enterprise_access.yml

+    - role: insightvm_agent
+      when: COMMON_ENABLE_INSIGHTVM_AGENT


Nit: why do we want this here and in the playbooks/enterprise_subsidy.yml playbook? Shouldn't it be installed explicitly with the insightvm_agent playbook?

@Agrendalath Since I created the playbooks and the roles using the enterprise-catalog playbook and role as a reference, these were carried over. These can be removed.

Removed these.

Agrendalath · 2024-02-19T15:41:20Z

playbooks/enterprise_subsidy.yml

+      nginx_default_sites:
+        - enterprise_subsidy
+    - role: memcache
+      when: ENTERPRISE_SUBSIDY_MEMCACHE_ENABLED


This seems to be undefined. Besides, do we need to deploy Memcached here?

The docker-compose.yml file of enterprise-subsidy does run memcache as a service. So, I added this flag to make it available as an option.

You are right, I missed properly mapping the CACHE config to this flag.

Since both the services use memcache in their setup, I have added it to both the playbooks and used the default localhost:11211 in the config. Also included a comment that if the flag is turned off, then the other related settings need to be changed as well.

So, this should allow for disabling memcache installation and setting the config to a totally different backend, or pointing to a remote memcahce.

It makes sense to me, but I am not sure if this is the best way to do it. Kindly change it, if I am doing something wrong here.

playbooks/roles/enterprise_access/defaults/main.yml

Agrendalath · 2024-02-19T15:53:03Z

playbooks/roles/enterprise_access/defaults/main.yml

+enterprise_access_environment:
+  ENTERPRISE_ACCESS_CFG: '{{ COMMON_CFG_DIR }}/{{ enterprise_access_service_name }}.yml'


This must be overridden to specify more env variables. Why don't we add ENTERPRISE_ACCESS_ENVIRONMENT_EXTRA: {} and pass it like edx_django_service_environment_extra: '{{ enterprise_access_environment | combine(ENTERPRISE_ACCESS_ENVIRONMENT_EXTRA) }}'

Agrendalath · 2024-02-19T15:57:21Z

playbooks/roles/enterprise_access/defaults/main.yml

+MEDIA_ROOT: '{{ ENTERPRISE_ACCESS_MEDIA_ROOT }}'
+MEDIA_URL: '{{ ENTERPRISE_ACCESS_MEDIA_URL }}'
+
+# TODO: Let edx_django_service manage ENTERPRISE_ACCESS_STATIC_ROOT in phase 2.


Nit: I know it was copied from the license_manager, but I have no idea what "phase 2" is. Instead of adding more TODOs, maybe we could extend the comment in the license_manager to indicate that this also applies to two other roles?

I copied it from the enterprise_catalog. So I have added reference to these 2 services in the enterprise_catalog's comment and removed them here.

Agrendalath · 2024-02-19T16:10:45Z

playbooks/roles/enterprise_subsidy/meta/main.yml

+    edx_django_service_decrypt_config_enabled: '{{ ENTERPRISE_SUBSIDY_DECRYPT_CONFIG_ENABLED }}'
+    edx_django_service_copy_config_enabled: '{{ ENTERPRISE_SUBSIDY_COPY_CONFIG_ENABLED }}'
+    edx_django_service_migration_check_services: '{{ enterprise_subsidy_service_name }},{{ enterprise_subsidy_service_name }}_workers'
+    edx_django_service_enable_celery_workers: true


enterprise-subsidy does not seem to be using Celery:

enterprise-subsidy on  main via 🐍 v3.11.7 ➜ ag "celery" docs/decisions/0003-fulfillment-and-corrective-policies.rst 52:as an asynchronous celery task that retries indefinitely (or up to some fairly high maximum). The fulfillment action pylintrc 72:load-plugins = edx_lint.pylint,pylint_django,pylint_celery requirements/dev.txt 16: # pylint-celery 435: # pylint-celery 438:pylint-celery==0.3 449: # pylint-celery requirements/doc.txt 20: # pylint-celery 413: # pylint-celery 416:pylint-celery==0.3 427: # pylint-celery requirements/quality.txt 16: # pylint-celery 387: # pylint-celery 390:pylint-celery==0.3 401: # pylint-celery requirements/test.txt 15: # pylint-celery 317: # pylint-celery 320:pylint-celery==0.3 326: # pylint-celery requirements/validation.txt 18: # pylint-celery 493: # pylint-celery 496:pylint-celery==0.3 510: # pylint-celery enterprise-subsidy on  main via 🐍 v3.11.7 ➜ fd tasks enterprise-subsidy on  main via 🐍 v3.11.7 ➜

Great catch. 👍 Removed all celery/worker related config and set the relevant flag edx_django_service_enable_celery_workers to false. I remember thinking one of the services doesn't have a background worker when starting to work on these playbooks, but got lazy and forgot midway.

Agrendalath · 2024-02-19T16:11:48Z

playbooks/roles/enterprise_access/defaults/main.yml

+  - queue: '{{ enterprise_access_celery_default_queue }}'
+    concurrency: 4
+    monitor: True
+enterprise_access_workers: "{{ ENTERPRISE_ACCESS_CELERY_WORKERS }}"


Nit: why don't we pass ENTERPRISE_ACCESS_CELERY_WORKERS directly to edx_django_service_workers?

Done. Removed the redundant variable.

Agrendalath · 2024-02-19T16:12:28Z

playbooks/roles/enterprise_access/defaults/main.yml

+# NOTE: These variables are only needed to create the demo site (e.g. for sandboxes)
+ENTERPRISE_ACCESS_LMS_URL_ROOT: !!null
+ENTERPRISE_ACCESS_DISCOVERY_API_URL:  !!null


Shouldn't these variables be used somewhere?

Removed these.

Agrendalath · 2024-02-19T16:12:43Z

playbooks/roles/enterprise_access/defaults/main.yml

+ENTERPRISE_ACCESS_SOCIAL_AUTH_EDX_OAUTH2_SECRET: 'enterprise-access-sso-secret'
+ENTERPRISE_ACCESS_BACKEND_SERVICE_EDX_OAUTH2_KEY: 'enterprise-access-backend-service-key'
+ENTERPRISE_ACCESS_BACKEND_SERVICE_EDX_OAUTH2_SECRET: 'enterprise-access-backend-service-secret'
+ENTERPRISE_ACCESS_SOCIAL_AUTH_REDIRECT_IS_HTTPS: false


This one also seems to be unused.

Agrendalath · 2024-02-19T16:13:44Z

vagrant/base/test_role/Vagrantfile

-  config.vm.box     = "xenial64"
-  config.vm.box_url = "http://files.vagrantup.com/xenial64.box"
+  config.vm.box     = "ubuntu/focal64"
+  # config.vm.box_url = "http://files.vagrantup.com/xenial64.box"

-  config.vm.network :private_network, ip: "192.168.33.20"
+  config.vm.network :private_network, ip: "192.168.56.20"


Are these changes expected?

@Agrendalath These were added for testing. Probably needed if you are running the Vagrant tests locally as VirtualBox only supports the 192.168.56.0/21 address space by default and Vagrant no longer seems to be using the files.vagrantup.com domain to serve the VM boxes.

These changes are in a separate commit 5cfa290. If these are not required for testing, we can just rebase and drop that one commit. I needed them for testing, so I am leaving it for now, in case someone else faces issues with the testing instructions, running Vagrant.

Co-authored-by: Piotr Surowiec <[email protected]>

Since enterprise_access's settings file doesn't load the URLs for other services like the LMS, discovery, enterprise-catalog..etc., from the environment variables, the extra variable introduced in this commit provides a way to set those values in the .yml config.

Setting the edx_django_service_cors_whitelist doesn't seem to be putting the values in the generated yml config file. So adding it to the config overrides of enterprise-access and enterprise-subsidy.

By default the edx_django_service puts only the user-profile URL in the EDX_DRF_EXTENSIONS value. This overrides the user attribute mapping for enterprise-access and enterprise-subsidy. This commit adds the user-attribute mappings to the config value.

Agrendalath

@tecoholic, a quick reminder about updating the changelog.

For some reason, I'm unable to resolve conversations in this PR, so I left +1s on your comments.

👍

I tested this: we have already used these playbooks on Stage
I read through the code
I checked for accessibility issues: n/a
Includes documentation: ⚠️
I made sure any change in configuration variables is reflected in the corresponding client's configuration-secure repository: n/a

Agrendalath · 2024-04-15T20:43:06Z

playbooks/roles/enterprise_access/defaults/main.yml

@@ -55,7 +57,10 @@ ENTERPRISE_ACCESS_MYSQL_HOST: 'localhost'
 ENTERPRISE_ACCESS_MYSQL_USER: 'entaccess001'
 ENTERPRISE_ACCESS_MYSQL_PASSWORD: 'password'

-ENTERPRISE_ACCESS_MEMCACHE: [ 'memcache' ]
+ENTERPRISE_ACCESS_MEMCACHE: [ 'localhost:11211' ]
+# The memcache config of edx_django_service is overriden in defaults/main.yml to use PyMemcacheCache


Suggested change

# The memcache config of edx_django_service is overriden in defaults/main.yml to use PyMemcacheCache

# The memcache config of edx_django_service is overridden in defaults/main.yml to use PyMemcacheCache

tecoholic added 6 commits February 15, 2024 12:57

fix: correct the name for the enterprise_catalog playbook

977c2d6

feat: adds playbook and role for enterprise-access

ff833b7

A new playbook and role have been added for deploying enterprise-access based on the existing enterprise_catalog playbook and role.

feat: adds playbook and role for enterprise-subsidy

6713d96

A new playbook and role have been added for deploying enterprise-subsidy based on the existing playbook and role for enterprise_catalog.

fix: set the default branch of enterprise_access to "main"

4db709e

openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Feb 15, 2024

This was referenced Feb 15, 2024

build: fixes for native deployment openedx/enterprise-access#407

Merged

build: make pip_requirements a prereq for production-requirements openedx/enterprise-subsidy#206

Merged

fix: replace the hardcoded localhost in enterprise-subsidy memcache c…

eb838dd

…onfig

Agrendalath suggested changes Feb 19, 2024

View reviewed changes

tecoholic and others added 3 commits February 19, 2024 22:00

docs: fix link to the code style page

8d3d072

Co-authored-by: Piotr Surowiec <[email protected]>

refactor: clean up unused values, make memcache config explicit

c2fa6fc

docs: adds access and subsidy to the "Phase 2" comment

77210bf

tecoholic mentioned this pull request Feb 19, 2024

[BB-8440] Palm backport of the playbooks for enterprise-access and enterprise-subsidy open-craft/configuration#214

Merged

5 tasks

tecoholic added 6 commits March 15, 2024 12:27

fix: adds the CORS_ORIGIN_WHITELIST to config overrides

61a42df

Setting the edx_django_service_cors_whitelist doesn't seem to be putting the values in the generated yml config file. So adding it to the config overrides of enterprise-access and enterprise-subsidy.

fix: set the cors origin to url root instead of domain

99b46f0

feat: adds csrf trusted origins to ent-access config

5be8b1d

fix: adds csrf trusted origins for enterprise-subsidy

26efffd

Agrendalath approved these changes Apr 15, 2024

View reviewed changes

feanil closed this May 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add playbooks for enterprise-access and enterprise-subsidy #7107

feat: add playbooks for enterprise-access and enterprise-subsidy #7107

tecoholic commented Feb 15, 2024 •

edited

Loading

openedx-webhooks commented Feb 15, 2024

Agrendalath left a comment

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024 •

edited

Loading

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath Feb 19, 2024

tecoholic Feb 19, 2024

tecoholic Feb 19, 2024

Agrendalath left a comment •

edited

Loading

Agrendalath Apr 15, 2024

		enterprise_access_environment:
		ENTERPRISE_ACCESS_CFG: '{{ COMMON_CFG_DIR }}/{{ enterprise_access_service_name }}.yml'

	# The memcache config of edx_django_service is overriden in defaults/main.yml to use PyMemcacheCache
	# The memcache config of edx_django_service is overridden in defaults/main.yml to use PyMemcacheCache

feat: add playbooks for enterprise-access and enterprise-subsidy #7107

feat: add playbooks for enterprise-access and enterprise-subsidy #7107

Conversation

tecoholic commented Feb 15, 2024 • edited Loading

Configuration Pull Request

Description

Testing

Verifying services are running correctly

openedx-webhooks commented Feb 15, 2024

Agrendalath left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tecoholic Feb 19, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Agrendalath left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tecoholic commented Feb 15, 2024 •

edited

Loading

tecoholic Feb 19, 2024 •

edited

Loading

Agrendalath left a comment •

edited

Loading