[rally] Add Rally role

.ansible-lint

@@ -18,6 +18,7 @@ exclude_paths:
   - roles/ci_gen_kustomize_values/molecule/default/converge.yml  # invalid due to calls to "lookup('file')"
   - roles/ci_gen_kustomize_values/molecule/default/prepare.yml  # import_playbook
   - roles/reproducer/files/cifmw-bootstrap.yml  # invalid due to calls to "lookup('file')"
+  - roles/rally/files/  # Rally task files, not Ansible YAML
   - roles/kustomize_deploy/molecule/flexible_loop/files/networking-environment-definition.yml  # Generated
   - roles/kustomize_deploy/molecule/flexible_loop/prepare.yml  # import_playbook
   - roles/*/molecule/*/side_effect.yml  # syntax-check[empty-playbook] https://github.com/ansible/molecule/issues/3617

docs/dictionary/en-custom.txt

@@ -77,6 +77,7 @@ baseimg
 baseurl
 bashrc
 bd
+benchmarking
 bgp
 blockquote
 bmaas
@@ -326,6 +327,7 @@ kerberos
 keycloak
 keypair
 keyring
+keystoneapi
 keystoneauth
 keystoneauth1
 keytab

hooks/playbooks/rally_cinder_prerequisites.yaml

@@ -0,0 +1,56 @@
+---
+- name: Ensure Cinder Rally prerequisites exist
+  hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Create m1.tiny flavor if missing
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack flavor show m1.tiny &>/dev/null || \
+            oc -n {{ namespace }} rsh openstackclient \
+            openstack flavor create m1.tiny \
+              --ram 512 --disk 1 --vcpus 1 --public
+
+    - name: Create lvmdriver-1 volume type if missing
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack volume type show lvmdriver-1 &>/dev/null || \
+            oc -n {{ namespace }} rsh openstackclient \
+            openstack volume type create lvmdriver-1 --public
+
+    - name: Check if cirros image already exists
+      ansible.builtin.shell: |
+        set -e -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack image list -f value -c Name | grep -q '^cirros'
+      register: _cirros_image_exists
+      failed_when: false
+
+    - name: Download cirros image to hypervisor
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.get_url:
+        url: "https://github.com/cirros-dev/cirros/releases/download/0.6.2/cirros-0.6.2-x86_64-disk.img"
+        dest: "/tmp/cirros-0.6.2-x86_64-disk.img"
+        mode: "0644"
+
+    - name: Copy cirros image to openstackclient pod
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.command: >-
+        oc cp /tmp/cirros-0.6.2-x86_64-disk.img
+        {{ namespace }}/openstackclient:/home/cloud-admin/cirros-0.6.2-x86_64-disk.img
+
+    - name: Upload cirros image for Rally if missing
+      when: _cirros_image_exists.rc != 0
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack image create cirros-0.6.2-x86_64-disk \
+              --disk-format qcow2 \
+              --container-format bare \
+              --file /home/cloud-admin/cirros-0.6.2-x86_64-disk.img \
+              --public

hooks/playbooks/rally_manila_prerequisites.yaml

@@ -0,0 +1,15 @@
+---
+- name: Ensure Manila Rally prerequisites exist
+  hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Create dhss_true share type if missing
+      ansible.builtin.shell: |
+        set -xe -o pipefail
+        oc -n {{ namespace }} rsh openstackclient \
+            openstack share type show dhss_true &>/dev/null || \
+            oc -n {{ namespace }} rsh openstackclient \
+            openstack share type create dhss_true False

hooks/playbooks/rally_run.yaml

@@ -0,0 +1,11 @@
+---
+- name: Run Rally benchmarks
+  hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+    PATH: "{{ cifmw_path }}"
+  tasks:
+    - name: Run rally role
+      ansible.builtin.include_role:
+        name: rally

roles/rally/OWNERS

@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://www.kubernetes.dev/docs/guide/owners/
+
+approvers:
+  - ciops-team
+
+reviewers:
+  - ciops-team

roles/rally/README.md

@@ -0,0 +1,81 @@
+# rally
+Role to setup and run Rally benchmarking tests against an OpenStack deployment.
+
+Rally is run inside the `quay.io/airshipit/xrally-openstack` container via podman.
+OpenStack credentials are discovered automatically from the Kubernetes KeystoneAPI resource,
+or can be supplied directly via `cifmw_rally_os_*` variables.
+
+## Prerequisites
+- `oc` CLI available and pointing to the target OpenStack cluster (used for credential and CA discovery).
+- `cifmw_openstack_namespace` must be set to the OpenStack namespace (typically `openstack`).
+
+## Privilege escalation
+become - Required to install podman and fix artifact directory ownership after the container run.
+
+## Parameters
+
+* `cifmw_rally_artifacts_basedir`: (String) Directory where all Rally artifacts are stored.
+  Default: `{{ cifmw_basedir }}/tests/rally`
+* `cifmw_rally_registry`: (String) Container registry. Default: `quay.io`
+* `cifmw_rally_namespace`: (String) Registry namespace. Default: `airshipit`
+* `cifmw_rally_container`: (String) Container image name. Default: `xrally-openstack`
+* `cifmw_rally_image`: (String) Full image reference. Composed from registry/namespace/container.
+* `cifmw_rally_image_tag`: (String) Container image tag. Default: `3.0.0`
+* `cifmw_rally_dry_run`: (Boolean) Skip actual container execution. Default: `false`
+* `cifmw_rally_remove_container`: (Boolean) Remove container after run. Default: `true`
+* `cifmw_rally_fail_on_task_failure`: (Boolean) Fail the play if Rally exits non-zero. Default: `true`
+* `cifmw_rally_deployment_name`: (String) Rally deployment name. Default: `cifmw`
+* `cifmw_rally_concurrency`: (Integer) Concurrency passed to the Rally task via `--task-args`. Default: `1`
+* `cifmw_rally_task_file`: (String) Absolute path to a custom Rally task YAML on the host.
+  Mutually exclusive with `cifmw_rally_openstack_tests`. Default: `""`
+* `cifmw_rally_task_extra_args`: (String) Extra arguments passed verbatim to `rally task start`. Default: `""`
+* `cifmw_rally_dns_servers`: (List) DNS servers used inside the Rally container. Default: `["192.168.122.10"]`
+* `cifmw_rally_os_auth_url`: (String) OpenStack auth URL. Auto-discovered from KeystoneAPI if unset.
+* `cifmw_rally_os_username`: (String) OpenStack username. Default: `admin`
+* `cifmw_rally_os_password`: (String) OpenStack password. Auto-discovered from Kubernetes secret if unset.
+* `cifmw_rally_os_project_name`: (String) OpenStack project. Default: `admin`
+* `cifmw_rally_os_user_domain_name`: (String) User domain. Default: `Default`
+* `cifmw_rally_os_project_domain_name`: (String) Project domain. Default: `Default`
+* `cifmw_rally_os_region_name`: (String) OpenStack region. Default: `regionOne`
+* `cifmw_rally_runs`: (List) List of run definitions for sequential multi-run mode.
+  When empty (default), the role runs once using the top-level `cifmw_rally_*` variables.
+  When non-empty, the role loops over the list; each entry may override any `cifmw_rally_*`
+  variable for that run and **must** include a `name` key used to namespace artifacts.
+  Default: `[]`
+
+## Standalone usage (single run)
+
+```yaml
+- hosts: hypervisor
+  roles:
+    - role: rally
+      vars:
+        cifmw_rally_openstack_tests: "cinder"
+        cifmw_rally_concurrency: 2
+        cifmw_rally_fail_on_task_failure: false
+```
+
+## Usage via hook (multiple runs)
+
+Add a `post_tests_*` hook in your job vars and define `cifmw_rally_runs`:
+
+```yaml
+post_tests_90_rally_run:
+  type: playbook
+  source: rally_run.yaml
+cifmw_rally_runs:
+  - name: cinder
+    cifmw_rally_openstack_tests: "cinder"
+    cifmw_rally_concurrency: 1
+  - name: nova
+    cifmw_rally_openstack_tests: "nova"
+    cifmw_rally_concurrency: 2
+    cifmw_rally_fail_on_task_failure: false
+```
+
+Each run stores its artifacts under `cifmw_rally_artifacts_basedir/<name>/`.
+
+## Custom task files
+
+To use a custom Rally task file, set `cifmw_rally_task_file` to the absolute path of the
+YAML on the hypervisor host (pre-stage it via an earlier hook if needed).

roles/rally/defaults/main.yml

@@ -0,0 +1,36 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+# All variables intended for modification should be placed in this file.
+# All variables within this role should have a prefix of "cifmw_rally"
+cifmw_rally_artifacts_basedir: "{{ cifmw_basedir }}/tests/rally"
+cifmw_rally_registry: "quay.io"
+cifmw_rally_namespace: "airshipit"
+cifmw_rally_container: "xrally-openstack"
+cifmw_rally_image: "{{ cifmw_rally_registry }}/{{ cifmw_rally_namespace }}/{{ cifmw_rally_container }}"
+cifmw_rally_image_tag: "3.0.0"
+cifmw_rally_dry_run: false
+cifmw_rally_remove_container: true
+cifmw_rally_fail_on_task_failure: true
+cifmw_rally_deployment_name: "cifmw"
+cifmw_rally_concurrency: 1
+cifmw_rally_task_file: ""
+cifmw_rally_openstack_tests: ""
+cifmw_rally_task_extra_args: ""
+cifmw_rally_dns_servers:
+  - "192.168.122.10"
+cifmw_rally_runs: []

roles/rally/meta/main.yml

@@ -0,0 +1,29 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+galaxy_info:
+  author: CI Framework
+  description: CI Framework Role -- rally
+  company: Red Hat
+  license: Apache-2.0
+  min_ansible_version: "2.14"
+  namespace: cifmw
+  galaxy_tags:
+    - cifmw
+    - rally
+
+dependencies: []

roles/rally/molecule/default/converge.yml

@@ -0,0 +1,24 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Converge
+  hosts: all
+  vars:
+    cifmw_rally_dry_run: true
+    cifmw_rally_openstack_tests: "cinder"
+  roles:
+    - role: "rally"

roles/rally/molecule/default/molecule.yml

@@ -0,0 +1,9 @@
+---
+# Mainly used to override the defaults set in .config/molecule/
+# By default, it uses the "config_podman.yml" - in CI, it will use
+# "config_local.yml".
+log: true
+
+provisioner:
+  name: ansible
+  log: true

roles/rally/molecule/default/prepare.yml

@@ -0,0 +1,28 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Prepare
+  hosts: all
+  vars:
+    cifmw_basedir: "{{ ansible_user_dir }}/ci-framework-data"
+    cifmw_install_yamls_tasks_out: "{{ ansible_user_dir }}/zuul-jobs/roles/install_yamls_makes/tasks"
+    cifmw_install_yamls_defaults:
+      NAMESPACE: openstack
+  roles:
+    - role: test_deps
+    - role: ci_setup
+    - role: install_yamls

roles/rally/tasks/create-deployment.yml

@@ -0,0 +1,55 @@
+---
+# Copyright Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Discover credentials from Kubernetes when not overridden
+  when: cifmw_rally_os_auth_url is not defined
+  block:
+    - name: Get keystone data
+      register: _cifmw_rally_keystone_data
+      environment:
+        KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+        PATH: "{{ cifmw_path }}"
+      ansible.builtin.command:
+        cmd: "oc get keystoneapi keystone -n {{ cifmw_openstack_namespace }} -o json"
+
+    - name: Set keystone vars
+      vars:
+        _keystone_json: "{{ _cifmw_rally_keystone_data.stdout | from_json }}"
+      ansible.builtin.set_fact:
+        _cifmw_rally_keystone_secret_name: "{{ _keystone_json['spec']['secret'] }}"
+        _cifmw_rally_keystone_passwd_select: "{{ _keystone_json['spec']['passwordSelectors']['admin'] }}"
+        _cifmw_rally_keystone_api: "{{ _keystone_json['status']['apiEndpoints']['public'] }}"
+
+    - name: Get credentials data
+      register: _cifmw_rally_os_password_data
+      environment:
+        KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"
+        PATH: "{{ cifmw_path }}"
+      ansible.builtin.command:
+        cmd: >-
+          oc get secret {{ _cifmw_rally_keystone_secret_name }}
+          -n {{ cifmw_openstack_namespace }} -o json
+
+    - name: Set OpenStack credentials facts
+      vars:
+        _pw_json: "{{ _cifmw_rally_os_password_data.stdout | from_json }}"
+      ansible.builtin.set_fact:
+        cifmw_rally_os_auth_url: "{{ _cifmw_rally_keystone_api }}"
+        cifmw_rally_os_password: >-
+          {{
+            _pw_json['data'][_cifmw_rally_keystone_passwd_select] |
+            ansible.builtin.b64decode
+          }}