Error using CONNATTR_ with tomcat v9.0.90.0 and ssl disabled

[gillfimj]

Running a tomcat 9 podman container on OEL 8, with CONNATTR_ environment variables being set and receiving the following error:

TASK [sig-ansible.tomcat : Remove SSL connector] *******************************
fatal: [localhost]: FAILED! => changed=false
  msg: 'Couldn''t delete xpath target: /Server/Service/Connector[@SSLEnabled="true"] (module ''lxml.etree'' has no attribute ''_ElementStringResult'')'

The interested part of the Dockerfile reads as follows:

ENV TOMCAT_MEMORY_ARGS="-Xms2G -Xmx4G -XX:MaxMetaspaceSize=512m" \
    TOMCAT_EXTRA_ARGS="-Doracle.jdbc.autoCommitSpecCompliant=false -Dbanner.logging.dir=/app_logs -DBANNER_APP_CONFIG=/mnt/tomcat/config/shared_configuration/banner_configuration.groovy -Duser.timezone=America/Chicago" \
    CONNATTR_maxThreads="150" \
    CONNATTR_MinSpareThreads="2" \
    CONNATTR_proxyName="banapi-test.domain.edu" \
    CONNATTR_proxyPort=443 \
    CONNATTR_scheme="https"

The error is occurring in this section of code in the server_xml.yaml

- name: Remove SSL connector
  xml:
    path: "{{ tomcat_server_xml_path }}"
    pretty_print: yes
    backup: yes
    xpath: /Server/Service/Connector[@SSLEnabled="true"]
    state: absent
  when: not tomcat_ssl_enabled
  tags: tomcat_conf

If I'm reading this correctly, it is attempting to remove an attribute that is expecting to exist. I believe this value is getting added in the following step which occurs before the above step:

- name: Set extra connector attributes
  xml:
    path: "{{ tomcat_server_xml_path }}"
    xpath: "{{ item[1] }}"
    attribute: "{{ item[0].attribute }}"
    value: "{{ item[0].value | string }}"
    pretty_print: yes
    backup: yes
  when: tomcat_connector_extra_attrs is defined
  loop: "{{ tomcat_connector_extra_attrs | product(tomcat_all_connectors_xpath) | list }}"
  tags: tomcat_conf

The value of tomcat_all_connectors_xpath is the following list:

tomcat_all_connectors_xpath:
  - /Server/Service/Connector[starts-with(@protocol,'HTTP/')]
  - /Server/Service/Connector[@SSLEnabled="true"]

Theoretically, the value that is attempting to be removed should be present, but the error indicates it is not. The better question is why are we forcing the include of the SSLEnabled attribute when we don't need to unless tomcat_ssl_enabled is set to true/yes which, in this case, it is not?

This does not appear to be a problem in the previous Linux 7/tomcat 8/docker environment.

I'm not sure if this is an ansible quirk, an environmental issue or a weird syntax thing. The trail of backup files this process leaves behind shows that this error should NOT be happening.

I have the CONNATTR_ variables set in the StudentApi and IntegrationApi applications. At this point I cannot migrate them to the new host/new tomcat environment.

Relevant versions:

cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="8.10"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.10"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:8:10:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://github.com/oracle/oracle-linux"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 8"
ORACLE_BUGZILLA_PRODUCT_VERSION=8.10
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=8.10

podman --version
podman version 4.9.4-rhel

Tomcat:
Server version: Apache Tomcat/9.0.90
Server built:   Jun 14 2024 14:45:13 UTC
Server number:  9.0.90.0
OS Name:        Linux
OS Version:     5.15.0-208.159.3.2.el8uek.x86_64
Architecture:   amd64
JVM Version:    11.0.23+9
JVM Vendor:     Eclipse Adoptium

[gillfimj]

Found the resolution to this issue at: https://github.com/jdum/odfdo/issues/39

Apparently, the new release v5.1.1 of lxml removed the _ElementStringResult class. So, with lxml >= 5.1.0, odfdo 3.7.5 is now required if you want to process xml properly with Ansible. To fix the issue, I added odfdo to the pip install line of the tomcat image Dockerfile:

RUN rm -Rf $CATALINA_HOME/webapps.dist \
 && mkdir -p $APP_LOGS \
 && apt-get update -y  \
 && apt-get upgrade -y \
 && apt-get install -y python3-pip locales xtail less gawk unzip gettext-base fontconfig fonts-dejavu \
 && pip3 install ansible==8.7.0 lxml odfdo \  <---this line changed
 && apt-get remove -y build-essential subversion mercurial git openssh-client 'libfreetype*' curl \
 && apt-get purge -y openssh-client \
 && apt-get clean autoclean -y \
 && apt-get autoremove -y \
 && rm -rf /var/lib/apt/lists/* /root/.cache/pip/* \
 && ln -sf /usr/share/zoneinfo/US/Central /etc/localtime \
 && mkdir -p /run.d \
 && cd /ansible \
 && mkdir -p galaxy \
 && ansible-galaxy install --roles-path galaxy -r tomcat-requirements.yml --force

This is not an ansible-tomcat issue, but more of a tomcat image build problem.