ansible-scylla-node: upgrade: don't allow downgrade by default

[vladzcloudius]

If you try to downgrade from 2021.1.6 to 2021.1.5 - it will succeed.

Forbid downgrading by default and allow only if an explicit flag/variable is set.

[ebenzecri]

When ansible-scylla-node role is used, the first file that is called is tasks/main.yml.

This file defines if the role will proceed with an installation or an upgrade. Currently, tasks/main.yml content is:

---

# Facts gathering
- name: Populate service facts
  service_facts:

- name: Populate package facts
  package_facts:
    manager: auto

# Upgrade
- name: Upgrade Scylla
  include_tasks: upgrade/main.yml
  when: upgrade_version

# Install
- name: os-specific tasks
  include_tasks: "{{ ansible_os_family }}.yml"
  when: not upgrade_version

- name: common tasks
  include_tasks: common.yml
  when: not upgrade_version and install_only|bool == false

This clearly shows, in order to run an upgrade, upgrade_version variable must be True. defaults/main.yaml has upgrade_version defined by default as False. In other words, if upgrade_version is not overridden, the upgrade won't happen.

This is part of a Jenkins job that uses this role (and when the bug was pointed):

17:41:13 TASK [ansible-scylla-node : Upgrade Scylla] ************************************
17:41:13 task path: .../ansible-scylla-node/tasks/main.yml:12
17:41:13 skipping: [xxxxxxxxxx-b-1] => {"changed": false, "skip_reason": "Conditional result was False"}
17:41:13 skipping: [xxxxxxxxxx-c-1] => {"changed": false, "skip_reason": "Conditional result was False"}
17:41:13 skipping: [xxxxxxxxxx-d-1] => {"changed": false, "skip_reason": "Conditional result was False"}

The upgrade is not being triggered.

A few lines below of the same console, these lines show the problem:

17:47:16 TASK [ansible-scylla-node : Install specified Enterprise Scylla] ***************
17:47:16 task path: .../ansible-scylla-node/tasks/RedHat.yml:107
17:47:31 changed: [xxxxxxxxxx-d-1] => {"changed": true, "msg": "", "rc": 0, "results": ["Installed: scylla-enterprise-server-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-kernel-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-tools-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-jmx-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-tools-core-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-2021.1.5-0.20210818.fc817c0cd.x86_64", "Removed: scylla-enterprise-2021.1.9-0.20220208.86e3ea4df.x86_64", "Removed: scylla-enterprise-conf-2021.1.9-0.20220208.86e3ea4df.x86_64", "Removed: scylla-enterprise-jmx-2021.1.9-0.20220208.86e3ea4df.noarch", "Removed: scylla-enterprise-kernel-conf-2021.1.9-0.20220208.86e3ea4df.x86_64", "Removed: scylla-enterprise-server-2021.1.9-0.20220208.86e3ea4df.x86_64", "Removed: scylla-enterprise-tools-2021.1.9-0.20220208.86e3ea4df.noarch", "Removed: scylla-enterprise-tools-core-2021.1.9-0.20220208.86e3ea4df.noarch"]}
17:47:36 changed: [xxxxxxxxxx-b-1] => {"changed": true, "msg": "", "rc": 0, "results": ["Installed: scylla-enterprise-jmx-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-tools-core-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-server-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-kernel-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-tools-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: scylla-enterprise-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Removed: scylla-enterprise-2021.1.6-0.20211006.5eee352bf.x86_64", "Removed: scylla-enterprise-conf-2021.1.6-0.20211006.5eee352bf.x86_64", "Removed: scylla-enterprise-jmx-2021.1.6-0.20211006.5eee352bf.noarch", "Removed: scylla-enterprise-kernel-conf-2021.1.6-0.20211006.5eee352bf.x86_64", "Removed: scylla-enterprise-server-2021.1.6-0.20211006.5eee352bf.x86_64", "Removed: scylla-enterprise-tools-2021.1.6-0.20211006.5eee352bf.noarch", "Removed: scylla-enterprise-tools-core-2021.1.6-0.20211006.5eee352bf.noarch"]}
17:52:40 changed: [xxxxxxxxxx-c-1] => {"changed": true, "msg": "", "rc": 0, "results": ["Installed: tzdata-java-2021e-1.el8.noarch", "Installed: scylla-enterprise-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-server-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-kernel-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: javapackages-filesystem-5.3.0-1.module_el8.0.0+11+5b8c10bd.noarch", "Installed: scylla-enterprise-tools-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: lua-5.3.4-12.el8.x86_64", "Installed: python2-pyyaml-3.12-16.module_el8.5.0+743+cd2f5d28.x86_64", "Installed: cups-libs-1:2.2.6-40.el8.x86_64", "Installed: scylla-enterprise-conf-2021.1.5-0.20210818.fc817c0cd.x86_64", "Installed: scylla-enterprise-jmx-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: java-1.8.0-openjdk-headless-1:1.8.0.312.b07-2.el8_5.x86_64", "Installed: lksctp-tools-1.0.18-3.el8.x86_64", "Installed: libjpeg-turbo-1.5.3-12.el8.x86_64", "Installed: scylla-enterprise-tools-core-2021.1.5-0.20210818.fc817c0cd.noarch", "Installed: copy-jdk-configs-4.0-2.el8.noarch", "Installed: scylla-enterprise-python3-2021.1.9-0.20220208.86e3ea4df.x86_64", "Installed: avahi-libs-0.7-20.el8.x86_64", "Removed: tuned-2.16.0-1.el8.noarch"]}

The downgrade here can be easily pointed because yum found a difference between the version specified vs. the version installed.

Inspecting tasks/RedHat.yml:

  - name: Install specified Enterprise Scylla
    yum:
      name: "scylla-enterprise-{{ scylla_version }}"
      state: present
      lock_timeout: 60
    when: scylla_version != 'latest' and scylla_edition == 'enterprise'

So, the installation will install the version specified no matter what the version selected is considered an update/upgrade or downgrade. This task, to be executed, only requires to have scylla_edition set as 'enterprise' and scylla_version set to a specific number.

[ebenzecri]

FYI @vladzcloudius @tarzanek

[vladzcloudius]

@ebenzecri hasn't this been resolved by now?