<commit_before>{% if not salt.caasp_cri.needs_docker() %}
include:
  - {{ salt['pillar.get']('cri:chosen', 'docker') }}
  - kubelet
  - container-feeder
{% endif %}

/etc/caasp/haproxy:
  file.directory:
    - name: /etc/caasp/haproxy
    - user:     root
    - group:    root
    - dir_mode: 755
    - makedirs: True

/etc/caasp/haproxy/haproxy.cfg:
  file.managed:
    - source: salt://haproxy/haproxy.cfg.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - makedirs: True
    - dir_mode: 755

haproxy:
  file.managed:
    - name: /etc/kubernetes/manifests/haproxy.yaml
    - source: salt://haproxy/haproxy.yaml.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - makedirs: True
    - dir_mode: 755
  caasp_retriable.retry:
    - name: iptables-haproxy
{% if "kube-master" in salt['grains.get']('roles', []) %}
    - target: iptables.append
{% else %}
    - target: iptables.delete
{% endif %}
    - retry:
        attempts: 2
    - table:      filter
    - family:     ipv4
    - chain:      INPUT
    - jump:       ACCEPT
    - match:      state
    - connstate:  NEW
    - dports:
      - {{ pillar['api']['ssl_port'] }}
    - proto:      tcp

# Send a SIGTERM to haproxy when the config changes
# TODO: There should be a better way to handle this, but currently, there is not. See
# kubernetes/kubernetes#24957
haproxy-restart:
  caasp_cri.stop_container_and_wait:
    - name: haproxy
    - namespace: kube-system
    - timeout: 60
    - onchanges:
      - file: /etc/caasp/haproxy/haproxy.cfg
    - require:
      - service: container-feeder


{% if 'admin' in salt['grains.get']('roles', []) %}
# The admin node is serving the internal API with the pillars. Wait for it to come back
# before going on with the orchestration/highstates.
wait-for-haproxy:
  http.wait_for_successful_query:
    - name:       https://localhost:444/internal-api/v1/pillar.json
    - wait_for:   300
    - status:     401
    - verify_ssl: False
    - onchanges:
      - haproxy-restart
{% endif %}<commit_msg>crio: fix upgrade orchestration<commit_after>{% if not salt.caasp_cri.needs_docker() %}
include:
  - {{ salt['pillar.get']('cri:chosen', 'docker') }}
  - kubelet
  - container-feeder
{% endif %}

/etc/caasp/haproxy:
  file.directory:
    - name: /etc/caasp/haproxy
    - user:     root
    - group:    root
    - dir_mode: 755
    - makedirs: True

/etc/caasp/haproxy/haproxy.cfg:
  file.managed:
    - source: salt://haproxy/haproxy.cfg.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - makedirs: True
    - dir_mode: 755

haproxy:
  file.managed:
    - name: /etc/kubernetes/manifests/haproxy.yaml
    - source: salt://haproxy/haproxy.yaml.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: 644
    - makedirs: True
    - dir_mode: 755
  caasp_retriable.retry:
    - name: iptables-haproxy
{% if "kube-master" in salt['grains.get']('roles', []) %}
    - target: iptables.append
{% else %}
    - target: iptables.delete
{% endif %}
    - retry:
        attempts: 2
    - table:      filter
    - family:     ipv4
    - chain:      INPUT
    - jump:       ACCEPT
    - match:      state
    - connstate:  NEW
    - dports:
      - {{ pillar['api']['ssl_port'] }}
    - proto:      tcp

# Send a SIGTERM to haproxy when the config changes
# TODO: There should be a better way to handle this, but currently, there is not. See
# kubernetes/kubernetes#24957
haproxy-restart:
  caasp_cri.stop_container_and_wait:
    - name: haproxy
    - namespace: kube-system
    - timeout: 60
    - onchanges:
      - file: /etc/caasp/haproxy/haproxy.cfg
{% if not salt.caasp_cri.needs_docker() %}
    - require:
      - service: container-feeder
{% endif %}


{% if 'admin' in salt['grains.get']('roles', []) %}
# The admin node is serving the internal API with the pillars. Wait for it to come back
# before going on with the orchestration/highstates.
wait-for-haproxy:
  http.wait_for_successful_query:
    - name:       https://localhost:444/internal-api/v1/pillar.json
    - wait_for:   300
    - status:     401
    - verify_ssl: False
    - onchanges:
      - haproxy-restart
{% endif %}
{'fraction_non_alphanumeric': 0.1322373123659757, 'fraction_numerical': 0.016202049082678104, 'mean_word_length': 2.305511811023622, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3475472', 'n_tokens_mistral': 1655, 'n_tokens_neox': 1543, 'n_words': 343}