instance_group module is trying to change values without user setting them.

[marekzebro]

Please confirm the following

• [X] I agree to follow this project's code of conduct.
• [X] I have checked the current issues for duplicates.
• [X] I understand that AWX is open source software provided for free and that I might not receive a timely response.

Summary

awx.awx.instance_group module fails by trying to make "any" changes when AWX resides in Kubernetes cluster with AWX Operator. AWX API responds with message "default instance group policy_instance_percentage may not be changed from the initial value set by the installer." This happens because defaults for policy_instance_percentage & policy_instance_minimum are set to "0" instead of None in this file: instance_group.py

AWX version

20.1.0

Select the relevant components

• [X] UI
• [X] API
• [ ] Docs

Installation method

kubernetes

Modifications

no

Ansible version

No response

Operating system

No response

Web browser

No response

Steps to reproduce

Create a playbook by using instance_group module and try modify any configuration option, without using policy_instance_percentage or policy_instance_minimum.

Versions used: AWX: 20.1.0 AWX Operator: 0.21.0 AWX.AWX collection: 20.1.0

Expected results

Making changes to instance_group without changes or setting any value to policy_instance_percentage or policy_instance_minimum should work correctly.

Actual results

"msg": "Unable to update instance_group default, see response", "response": {"json": {"policy_instance_percentage": ["default instance group policy_instance_percentage may not be changed from the initial value set by the installer."]}, "status_code": 400}}

Additional information

No response

[tu-doan]

@shanemcd Hi Shane, I have found the root cause for this issue. https://github.com/ansible/awx/blob/21.3.0/awx/api/serializers.py#L4934-L4941

Briefly describe:

• policy_instance_percentage of default container instance group is 100.
• There are 2 cases that we can do:

1. When we update the pod override spec of this instance group, without params policy_instance_percentage: Then the value of policy_instance_percentage will be null (or None) -> failed the first IF clause, whose value is different from default (default is 100, said above). Error:

instance group policy_instance_percentage may not be changed from the initial value set by the installer

2. Edit instance group, with params policy_instance_percentage=100: The second IF clause failed, because we try to edit the policy_instance_percentage of container group..... Error:

Containerized instances may not be managed via the API

To summarize: we update instance group and do not change or touch to policy_instance_percentage value -> It failed... We send and update with exactly the same as default value -> It still failed, but different message :)

[ghost]

Hi,

I was hitting this exact same issue but was able to work around it with setting policy_instance_percentage to null.

E.g.

- name: Ensure AWX default container group is configured
  local_action:
    module: awx.awx.instance_group
    name: default
    credential: cluster-16
    is_container_group: true
    policy_instance_percentage: null
    pod_spec_override: |
      apiVersion: v1
      kind: Pod
      metadata:
        namespace: awx
      spec:
        serviceAccountName: sa-awx
        automountServiceAccountToken: false
        containers:
          - image: 'registry.dummy.invalid/ansible/common-ee:latest'
            name: worker
            args:
              - ansible-runner
              - worker
              - '--private-data-dir=/runner'
            resources:
              requests:
                cpu: 250m
                memory: 100Mi
    validate_certs: false
    state: present
  run_once: true

[morla10111]

Hello! Having the same problem. I need to update the pod_spec_override to set a host_alias but it fails because of policy_instance_percentage.

setting it to null did not help... I am using the controller configuration collection

---
controller_instance_groups:
  - name: default
    is_container_group: true
    policy_instance_percentage: null
    pod_spec_override: |
      apiVersion: v1
      kind: Pod
      metadata:
        namespace: awx
        spec:
          serviceAccountName: default
          automountServiceAccountToken: false
          containers:
            - image: quay.io/ansible/awx-ee:latest
              name: worker
              args:
                - ansible-runner
                - worker
                - '--private-data-dir=/runner'
              resources:
                requests:
                  cpu: 250m
                  memory: 100Mi
                  hostAliases:
                    - ip: 192.168.1.1
                      hostnames:
                        - some.host

This gives:

failed: [localhost] (item={'started': 1, 'finished': 0, 'ansible_job_id': '820111931758.2099', 'results_file': '/tmp/.ansible_async/820111931758.2099', 'changed': False, 'failed': False, '__controller_instance_group_item': {'name': 'default', 'is_container_group': True, 'policy_instance_percentage': None, 'pod_spec_override': "apiVersion: v1\nkind: Pod\nmetadata:\n  namespace: awx\n  spec:\n    serviceAccountName: default\n    automountServiceAccountToken: false\n    containers:\n      - image: quay.io/ansible/awx-ee:latest\n        name: worker\n        args:\n          - ansible-runner\n          - worker\n          - '--private-data-dir=/runner'\n        resources:\n          requests:\n            cpu: 250m\n            memory: 100Mi\n            hostAliases:\n              - ip: 192.168.1.1\n                hostnames:\n                  - 
 some.host\n"}, 'ansible_loop_var': '__controller_instance_group_item'}) => {"__instance_groups_job_async_results_item": {"__controller_instance_group_item": {"is_container_group": true, "name": "default", "pod_spec_override": "apiVersion: v1\nkind: Pod\nmetadata:\n  namespace: awx\n  spec:\n    serviceAccountName: default\n    automountServiceAccountToken: false\n    containers:\n      - image: quay.io/ansible/awx-ee:latest\n        name: worker\n        args:\n          - ansible-runner\n          - worker\n          - '--private-data-dir=/runner'\n        resources:\n          requests:\n            cpu: 250m\n            memory: 100Mi\n            hostAliases:\n              - ip: 172.20.6.126\n                hostnames:\n                  - adpgit01.smn.bdr.de\n                  - adpgit01\n", "policy_instance_percentage": null}, "ansible_job_id": "820111931758.2099", "ansible_loop_var": "__controller_instance_group_item", "changed": false, "failed": false, "finished": 0, "results_file": "/tmp/.ansible_async/820111931758.2099", "started": 1}, "ansible_job_id": "820111931758.2099", "ansible_loop_var": "__instance_groups_job_async_results_item", "attempts": 2, "changed": false, "finished": 1, "msg": "Unable to update instance_group default, see response", "response": {"json": {"policy_instance_percentage": ["default instance group policy_instance_percentage may not be changed from the initial value set by the installer."]}, "status_code": 400}}

[liad5h]

I had the same problem.

In the documentation, there are two methods to update an Instance Group: HTTP PATCH and PUT

https://docs.ansible.com/ansible-tower/latest/html/towerapi/api_ref.html#/operations/Instance%20Groups/Instance_Groups_instance_groups_update

https://docs.ansible.com/ansible-tower/latest/html/towerapi/api_ref.html#/operations/Instance%20Groups/Instance_Groups_instance_groups_partial_update

I noticed that when I update the default instance group from the AWX UI, HTTP PATCH is used. When I changed my call (python) from PUT to PATCH and removed the policy_instance_percentage key from my request everything worked.