Skip to content

feat(validate): add migration validation role - #108

Open
vvaldez wants to merge 7 commits into
redhat-cop:v2from
vvaldez:postflight-role
Open

feat(validate): add migration validation role#108
vvaldez wants to merge 7 commits into
redhat-cop:v2from
vvaldez:postflight-role

Conversation

@vvaldez

@vvaldez vvaldez commented Oct 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

validate_migration validates migration outcomes after vmf_migrate completes and performs the fail-closed source power-off. Every check runs in one invocation; the summary fails the play when any ran check failed.

The preflight role rename to validate_environment lands in companion PR #110.

Checks

validate_migration Severity
Migration plan status (latest Migration CR reports Succeeded) fatal
Migrated VMs present and Running fatal, per-VM
Target list match (expected subset; extras warn) fatal
Guest agent responsive warn
IP addresses match source vCenter warn
Disk topology (source disk count vs target volumes) fatal
Source power-off (the only mutation) fail-closed gate

VMware module decisions

Decision Reason
Power-off uses certified vmware.vmware.vm_powerstate (>=1.11.0) community.vmware.vmware_guest_powerstate is tombstoned in community.vmware 7.0.0
Gathering stays on community.vmware.vmware_guest_info Certified vmware.vmware.vm_info initializes a REST client even for schema: vsphere. Old vCenters and the demo emulator require SOAP-only gathering. Documented tier-3 exception.
validate_migration_vcenter_datacenter required when power-off is enabled The certified module requires it. Report-only mode allows empty.

NOTE: SOAP transport is not a vCenter 6.x support claim. No version compatibility is asserted; verify per environment. See docs/research/validate-migration-vmware-powerstate.md.

Also included

  • playbooks/utility_v2v_nofstrim_shim.yml: field workaround for MTV 2.11/2.12 on pre-x86-64-v3 CPUs. The controller passes --no-fstrim; shipped rhel9 images predate the flag; rhel10 images SIGILL on those CPUs. The playbook builds a shim from the installed MTV's own rhel9 image, pushes it to the integrated registry, and pins ForkliftController. Tested end-to-end on pool1; the migration succeeded with it.
  • 29 offline test scenarios through the real Ansible executor with module doubles: no network, no credentials. Passing on ansible-core 2.16 and 2.20.
  • Installed-module contract guard (scripts/check-validate-migration-vmware.py) wired into pre-commit, fail-closed on both VMware modules.

Validation

  • 29 offline scenarios, core 2.16 and 2.20
  • ansible-lint production profile (strict), full pre-commit
  • Live pool1 run: failed migration, stopped VM, running VM. Verdicts and messages verified in all three states.
  • Contract guard against the installed collection

Changelog

changelogs/fragments/108-validate-migration-role.yml

Attribution: created using opencode (session: ses_ed904e798ffeTYJVsSCQP9sbvM)

@vvaldez vvaldez self-assigned this Oct 17, 2026
@sabre1041

sabre1041 commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

@vvaldez As discussed, we are going to hold off on this type of feature until we get more information from the field on the types of pre/post flight activities

@vvaldez vvaldez changed the title feat(postflight): add post-migration validation role feat(validate): add environment and migration validation roles Oct 20, 2026
@vvaldez
feat(validate): add migration validation role
b6e08f3 
validate_migration validates outcomes after vmf_migrate: migration
status, VM presence and running state, target list, guest agent, IP
addresses, disk topology, and the per-VM fail-closed source power-off
(docs/adr/0001). The source power-off uses certified
vmware.vmware.vm_powerstate; gathering stays on SOAP-only
community.vmware.vmware_guest_info (documented tier-3 exception).
Adds utility_v2v_nofstrim_shim.yml for MTV 2.11/2.12 on pre-x86-64-v3
CPUs. Validated live on pool1 across failed, stopped, and running
states.

Assisted-by: opencode:enmaas/rits/zai-org/glm-5-3
@vvaldez vvaldez mentioned this pull request Oct 23, 2026
Merged
3 tasks done
vvaldez added a commit to vvaldez/openshift_virtualization_migration that referenced this pull request Oct 23, 2026
@vvaldez
refactor: rename preflight role to validate_environment
ad00eee 
Pair symmetry with validate_migration (companion PR redhat-cop#108, post-only).
Clean break: v2 is unreleased and nothing in-repo consumed the old
names. Role dirs, playbooks (vmf_validate_environment.yml), variable
prefixes, test targets, docs, and the changelog fragment all use the
new name.

Assisted-by: opencode:enmaas/rits/zai-org/glm-5-3
@vvaldez vvaldez changed the title feat(validate): add environment and migration validation roles feat(validate): add migration validation role Oct 23, 2026
@vvaldez
fix(validate): match the codebase's tag conventions
502d4bb 
Drop the task-level tags (always/plan/validate/vms/list/agent/ip/
disks/poweroff/action) from validate_migration — no other role in the
collection uses task tags, and all checks already run on every
invocation regardless. Add the empty galaxy_tags key to meta/main.yml
to match the existing roles' metadata shape.

Assisted-by: opencode:enmaas/rits/zai-org/glm-5-3
@vvaldez
docs(validate): drop removed-tag instructions
5827833 
The tag-convention commit removed the task-level tags, but the role's
docs still advertised per-check tags and --tags debug runs — update the
README, argument_specs, and task comments to describe the one-off CLI
run (-e validate_migration_secure_logging=false) instead.

Assisted-by: opencode:enmaas/rits/zai-org/glm-5-3
@vvaldez
docs(validate): drop stale tagged-run wording from report test
7b798c0 
The task-level tags are removed; the regression test comment still
described an 'isolated tagged run' summary path. Rename it to 'isolated
partial run'.

Assisted-by: opencode:enmaas/rits/zai-org/glm-5-3
@vvaldez
fix(validate): apply dual-review and audit fixes
11e3695 
- Report suspended sources correctly: a suspended VM is a valid lookup
  result (read-only mode reports its state instead of "lookup failed"),
  and an enabled power-off applies the same hard stop to a suspended
  source.
- Dedup the gather blocks: the SOAP vmware_guest_info gather (3x) and
  the OpenShift Virtualization k8s query (3x) collapse into shared
  includes (gather_source_vm.yml, gather_target_k8s.yml) with one
  register per family; the module tier justification lives in the
  shared include.
- Add regression tests: the 0/0 disk-lookup gate case (a failed lookup
  must never open the gate even with a 0-volume target), suspended
  read-only and suspended power-off paths; rename the duplicate
  "plan failed" subtest.
- Fix the ADR cross-reference path in defaults (underscore to hyphen).

Validated: pytest 64 passed + 32 subtests, integration ok=48/rescued=3
(unchanged), VMware contract guard, full pre-commit green.

Assisted-by: opencode:publishers/prelude-maas/models/glm-53-flash
@vvaldez
docs(validate): regenerate README with md-toc in the docsible env
61a0194 
The local docsible venv was rebuilt without md-toc (pinned in
requirements-ci.txt), so the TOC step silently no-opped and the
committed README diverged from what CI regenerates. Regenerated with
the complete environment.

Assisted-by: opencode:publishers/prelude-maas/models/glm-53-flash
@vvaldez
vvaldez marked this pull request as ready for review October 26, 2026 15:26
@vvaldez
vvaldez requested a review from sabre1041 as a code owner October 26, 2026 15:26
@vvaldez
docs(validate_migration): pin-range safety for vmware_guest_info
c99e5e6 
Issue redhat-cop#121 requires community-module use to document which module, why
it is required over a command, and why the pin range is safe. The
existing justification covered the first two; add the pin-range note:
community.vmware is pinned >=5.5.0, every option in use predates the
pin floor and is unchanged across 5.x. Also note the pyVmomi
requirement.

Assisted-by: opencode:publishers/prelude-maas/models/glm-53-flash
This was referenced Oct 26, 2026
Open
Open

This branch is waiting to be deployed

1 waiting (outdated) deployment
external-ci — 5a5978b3 Waiting Oct 17, 2026 by vvaldez via external-approval #744
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sabre1041 sabre1041 Awaiting requested review from sabre1041 sabre1041 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@vvaldez vvaldez

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vvaldez @sabre1041