RHEL, role fails to remove "pre-docker-ce" packages

[sfuerte]

A playbook is set to detect and remove old Docker packages:

- hosts: all
  name: OS configuration and tuning
  become: true
  tags:
    - os-setup
  roles:
    ...
    - haxorof.docker_ce
    ...
  vars:
...
    docker_remove_pre_ce: true
...

A target system, i.e. Ansible client, has the following Docker packages installed:

# rpm -qa |grep docker
docker-rhel-push-plugin-1.13.1-94.gitb2f74b2.el7.x86_64
docker-client-1.13.1-94.gitb2f74b2.el7.x86_64
docker-1.13.1-94.gitb2f74b2.el7.x86_64
docker-common-1.13.1-94.gitb2f74b2.el7.x86_64

# docker version | grep Version | awk '{print $2}'
1.13.1
1.13.1

When running the playbook, it fails to detect the old package and consecutively fails to install docker-ce:

TASK [haxorof.docker_ce : Set fact if old Docker installation shall be removed] **********************************************************************************************************************************
ok: [l17555]

TASK [haxorof.docker_ce : Check if Docker is running] ************************************************************************************************************************************************************
skipping: [l17555]

TASK [haxorof.docker_ce : Stop Docker service] *******************************************************************************************************************************************************************
skipping: [l17555]

TASK [haxorof.docker_ce : Remove old Docker installation before Docker CE] ***************************************************************************************************************************************
skipping: [l17555] => (item=docker)
skipping: [l17555] => (item=docker-client)
skipping: [l17555] => (item=docker-client-latest)
skipping: [l17555] => (item=docker-common)
skipping: [l17555] => (item=docker-latest)

TASK [haxorof.docker_ce : Install Docker] ************************************************************************************************************************************************************************
included: /etc/ansible/roles/haxorof.docker_ce/tasks/install-docker.yml for ...

TASK [haxorof.docker_ce : Set version string] ********************************************************************************************************************************************************************
skipping: [l17555]

TASK [haxorof.docker_ce : Set packages state to latest] **********************************************************************************************************************************************************
ok: [l17555]

TASK [haxorof.docker_ce : Filter out packages to match older Docker CE versions] *********************************************************************************************************************************
skipping: [l17555]

TASK [haxorof.docker_ce : Ensure some kind of compatibility for no longer officially supported distributions since Docker CE 18.09] ******************************************************************************
skipping: [l17555]

TASK [haxorof.docker_ce : Ensure Docker CE is installed] *********************************************************************************************************************************************************
FAILED - RETRYING: Ensure Docker CE is installed (3 retries left).
failed: [l17555] (item=docker-ce-cli) => {"attempts": 3, "changed": true, "item": "docker-ce-cli", "msg": "Error: docker-ce-cli conflicts with 2:docker-1.13.1-94.gitb2f74b2.el7.x86_64\n", "rc": 1, "results": ["Loaded plugins: aliases, changelog, langpacks, product-id, search-disabled-\n              : repos, tmprepo, verify, versionlock\nResolving Dependencies\n--> Running transaction check\n---> Package docker-ce-cli.x86_64 1:18.09.6-3.el7 will be installed\n--> Processing Conflict: 1:docker-ce-cli-18.09.6-3.el7.x86_64 conflicts docker\n--> Processing Conflict: 1:docker-ce-cli-18.09.6-3.el7.x86_64 conflicts docker-io\n--> Finished Dependency Resolution\n You could try using --skip-broken to work around the problem\n You could try running: rpm -Va --nofiles --nodigest\n"]}

Environment

# ansible --version
ansible 2.7.10
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Mar 26 2019, 22:13:06) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]

# ansible-galaxy list  | grep docker
- haxorof.docker_ce, 2.3.0

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)

Server OS version is the same on Ansible master and client.

[haxorof]

Could you run the following command on the machine you are targeting: docker version | grep Version | awk '{print $2}'

I think the mechanism I once added to avoid it to remove pre CE everytime might not work as expected. I will spin up a Redhat again next week to see if it works for me or not.

Just as a note, I am planning to remove this removal feature of pre Docker CE in next major release of this role.

Cheers!

[haxorof]

Sorry for my last comment about running the docker version command. Could you run the playbook with -vvv instead?

[sfuerte]

Another debugging info, in tasks/remove-pre-docker-ce.yml, there is a definition:

- name: Set fact if old Docker installation shall be removed
  set_fact:
    _remove_old_docker: "{{ docker_remove_pre_ce | bool }} and not \
      {{ _cmd_docker_version.stdout_lines[0] is search('-ce') }}"
  when: _cmd_docker_version.stdout_lines is defined and _cmd_docker_version.stdout_lines[0] is defined

that is set to False even though it should not:

TASK [haxorof.docker_ce : Set fact if old Docker installation shall be removed] **********************************************************************************************************************************
task path: /etc/ansible/roles/haxorof.docker_ce/tasks/remove-pre-docker-ce.yml:9
ok: [l17547] => {
    "ansible_facts": {
        "_remove_old_docker": "True and not False"
    },
    "changed": false
}

TASK [haxorof.docker_ce : Check if Docker is running] ************************************************************************************************************************************************************
task path: /etc/ansible/roles/haxorof.docker_ce/tasks/remove-pre-docker-ce.yml:15
skipping: [l17547] => {
    "changed": false,
    "skip_reason": "Conditional result was False"
}

[sfuerte]

Changing code to the following fixes the issue:

- name: Set fact if old Docker installation shall be removed
  set_fact:
    _remove_old_docker: "{{ docker_remove_pre_ce | bool }}"
  when: _cmd_docker_version.stdout_lines is defined and _cmd_docker_version.stdout_lines[0] is defined and
        _cmd_docker_version.stdout_lines[0] is not search('-ce')

The main reason - Ansible doesn't do proper "if" of "True and not False" or "True and True" and simply treats them as strings.

[sfuerte]

Btw, another search shall be done to determine whether it's a community edition or not. It simply doesn't show suffix -ce:

# docker version
Client:
 Version:           18.09.6
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        481bc77156
 Built:             Sat May  4 02:34:58 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.6
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.8
  Git commit:       481bc77
  Built:            Sat May  4 02:02:43 2019
  OS/Arch:          linux/amd64
  Experimental:     false


$ docker -v
Docker version 18.09.6, build 481bc77156

$ rpm -qa | grep docker
docker-ce-cli-18.09.6-3.el7.x86_64
docker-ce-18.09.6-3.el7.x86_64

[sfuerte]

Also, when deleting old versions, the plugins shall be deleted also:

$ rpm -qa | grep docker-
docker-rhel-push-plugin-1.13.1-94.gitb2f74b2.el7.x86_64
docker-ce-18.09.6-3.el7.x86_64
docker-ce-cli-18.09.6-3.el7.x86_64

adding - docker-rhel-*-plugin to docker_old_packages variable for RedHat in vars/main.yml will do the job

[haxorof]

Thanks @sfuerte!
My plan was to remove this kind of removal feature because I never got any feedback on it of noticed someone using it until now. 😄 I will incorporate changes you suggest and noticed now when you wrote it that they have removed the "-ce" in the version, it was there in the first versions anyway.

Cheers!

[haxorof]

Just want to let you know that I have done some fixes on master for this. I quickly tested it on RHEL 7 yesterday so would be great if you could test it too.

Cheers!

[sfuerte]

@haxorof, thanks for the update and fix. Will try it whenever I have another instance with RHEL and older docker on it. The current ones are all have latest already and in use.

The only question is about this line

shell: "docker version --format='{{ '{{' }} .Client.Version {{ '}}' }}' 2>/dev/null"

Are sure that it's correct? Gives an error:

# docker version --format="{{ '{{' }} .Client.Version {{ '}}' }}"
Template parsing error: template: version:1: malformed character constant: '{{'

As you per https://docs.docker.com/engine/reference/commandline/version/, believe you want to have

shell: "docker version --format '{{.Client.Version}}'"

or even this docker version --format '{{.Client.Version}}' | awk -F\. '{ print $1 }'

[haxorof]

@sfuerte Thanks! Let me know of the result when you get a hold of another instance with old docker on.

Regarding the strange syntax with curly brackets is a way to ensure that Ansible do not interpret the {{ and }} so the end result will be as you write in the bottom. Here is some example where others had similar problems: https://stackoverflow.com/a/32283447/9506788

Cheers!