feat(argo-workflows): load post_inspection_runbooks from enroll-server-config configmap

docs/deploy-guide/components/argo-events-workflows.md

@@ -47,20 +47,26 @@ Optional additions:
 
 ## Enrollment Workflow Configuration
 
-Each enrollment workflow can run site-specific templates after it enrolls an
-Ironic node. Configure a workflow by creating its ConfigMap in the `argo-events`
-namespace:
+Configure enrollment runbooks and post-enrollment templates through ConfigMaps
+in the `argo-events` namespace:
 
 | Workflow | ConfigMap |
 | --- | --- |
 | `enroll-server` | `enroll-server-config` |
 | `enroll-fw` | `enroll-fw-config` |
 | `enroll-netdev` | `enroll-netdev-config` |
 
-The `post_enroll_workflows` value is a JSON array of `WorkflowTemplate` names.
-For example, the server configuration is:
+Configuration values are JSON arrays:
 
-```yaml title="enroll-server-config.yaml"
+| Key | Values | When it runs |
+| --- | --- | --- |
+| `post_inspection_runbooks` (`enroll-server` only) | Ironic runbook names or UUIDs | In list order after inspection and BIOS configuration, before RAID configuration, firmware updates, and making the node available. A failure stops enrollment. |
+| `post_enroll_workflows` | `WorkflowTemplate` names | In parallel after enrollment. A failure fails the post-enrollment step. |
+
+Create the ConfigMap in your deployment overlay. Replace the example names with
+your runbooks and workflow templates; keep the parameter-source label.
+
+```yaml title="configmap-enroll-server-config.yaml"
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -69,12 +75,21 @@ metadata:
   labels:
     workflows.argoproj.io/configmap-type: Parameter
 data:
+  post_inspection_runbooks: |
+    [
+      "first-runbook",
+      "second-runbook"
+    ]
   post_enroll_workflows: |
-    ["notify-enrollment", "configure-monitoring"]
+    [
+      "notify-enrollment",
+      "configure-monitoring"
+    ]
 ```
 
-The `workflows.argoproj.io/configmap-type: Parameter` label is required so the
-Argo Workflows controller discovers the ConfigMap as a parameter source.
+Missing ConfigMaps or keys default to `[]`. Set a value to `[]` to disable it.
+For a single server enrollment, override the runbooks with
+`-p post_inspection_runbooks='["runbook"]'`, or pass `[]` to skip them.
 
 Each named `WorkflowTemplate` must be in the same namespace and expose a `run`
 template that accepts the enrolled server's `node_uuid`:
@@ -101,11 +116,6 @@ spec:
 
 {% endraw %}
 
-The hooks run in parallel as steps of the existing enrollment workflow; they do
-not create child `Workflow` resources. A failed hook fails the post-enrollment
-step. If the ConfigMap or its key is absent, the hook list defaults to empty and
-enrollment completes without running hooks.
-
 Only the referenced `run` template is imported by `templateRef`. Put required
 pod configuration on that template, or arrange for it on the parent enrollment
 workflow; settings elsewhere in the referenced `WorkflowTemplate` spec are not

python/understack-workflows/README.md

@@ -9,21 +9,18 @@ This script takes an OpenStack Project ID and ensures the proper
 operation happens against the Nautobot Tenants. Operations include
 create, update and delete.
 
+## enroll-server
 
-## enroll-server post-inspection runbooks
+Enrolls servers in Ironic. Optional runbooks run in order after inspection and
+BIOS configuration, before RAID configuration, firmware updates, and making
+the node available. A runbook failure stops enrollment.
 
-Optionally pass an ordered JSON array of runbook names or UUIDs:
+Pass runbook names or UUIDs as a JSON array:
 
 ```sh
 enroll-server --ip-address 192.0.2.10 \
   --post-inspection-runbooks '["first-runbook", "second-runbook"]'
 ```
 
-For Argo, use the `enroll-server` WorkflowTemplate parameter
-`post_inspection_runbooks` with the same JSON array. It defaults to `[]`.
-
-Runbooks execute sequentially after agent inspection and final BIOS
-configuration, before RAID configuration, firmware updates, and `provide`.
-Each requires at least one matching node/runbook trait (Ironic API 1.112 or
-newer), uses the runbook's ramdisk setting, and waits for `manageable`.
-A failed lookup, trait check, or cleaning operation stops enrollment.
+For Argo, pass the same JSON array with `-p post_inspection_runbooks='["runbook"]'`.
+Use `-p post_inspection_runbooks='[]'` to skip runbooks.

workflows/argo-events/workflowtemplates/enroll-server.yaml

@@ -8,8 +8,9 @@ metadata:
       Defined in `workflows/argo-events/workflowtemplates/enroll-server.yaml`
 
       The workflow reads site-specific configuration from the
-      `enroll-server-config` ConfigMap. After enrollment, it runs the templates
-      listed in `post_enroll_workflows`.
+      `enroll-server-config` ConfigMap. During enrollment, it runs
+      `post_inspection_runbooks` before providing the node. After enrollment,
+      it runs the templates listed in `post_enroll_workflows`.
 kind: WorkflowTemplate
 spec:
   serviceAccountName: workflow
@@ -30,7 +31,11 @@ spec:
     parameters:
       - name: ip_address
       - name: post_inspection_runbooks
-        value: "[]"
+        valueFrom:
+          configMapKeyRef:
+            name: enroll-server-config
+            key: post_inspection_runbooks
+          default: "[]"
       - name: firmware_update
         value: "false"
       - name: raid_configure
@@ -43,6 +48,8 @@ spec:
     - name: main
       inputs:
         parameters:
+          - name: post_inspection_runbooks
+            value: "{{workflow.parameters.post_inspection_runbooks}}"
           # A site can configure this value with a JSON array of
           # WorkflowTemplate names. Each WorkflowTemplate must expose a `run`
           # template that accepts `node_uuid`. If the ConfigMap is absent, no
@@ -61,6 +68,10 @@ spec:
       steps:
         - - name: enroll-server
             template: enroll-server
+            arguments:
+              parameters:
+                - name: post_inspection_runbooks
+                  value: "{{inputs.parameters.post_inspection_runbooks}}"
         - - name: post-enroll
             templateRef:
               name: "{{item}}"
@@ -71,6 +82,9 @@ spec:
                   value: "{{steps.enroll-server.outputs.parameters.node_uuid}}"
             withParam: "{{inputs.parameters.post_enroll_workflows}}"
     - name: enroll-server
+      inputs:
+        parameters:
+          - name: post_inspection_runbooks
       outputs:
         parameters:
           - name: node_uuid
@@ -86,7 +100,7 @@ spec:
           - --ip-address
           - "{{workflow.parameters.ip_address}}"
           - --post-inspection-runbooks
-          - "{{workflow.parameters.post_inspection_runbooks}}"
+          - "{{inputs.parameters.post_inspection_runbooks}}"
           - --firmware-update
           - "{{workflow.parameters.firmware_update}}"
           - --raid-configure