fix(delivery): add PostgreSQL rollback and CloudDM isolation

scripts/setup-postgresql-awx.sh

@@ -37,7 +37,8 @@ for variable_name in \
   AWX_HOST_NAME AWX_HOST_ADDRESS \
   AWX_MACHINE_CREDENTIAL_NAME AWX_SSH_PRIVATE_KEY_FILE \
   AWX_POSTGRES_CREDENTIAL_TYPE_NAME AWX_POSTGRES_CREDENTIAL_NAME \
-  AWX_JOB_TEMPLATE_NAME AWX_PLAYBOOK; do
+  AWX_JOB_TEMPLATE_NAME AWX_PLAYBOOK \
+  AWX_ROLLBACK_JOB_TEMPLATE_NAME AWX_ROLLBACK_PLAYBOOK; do
   require_value "${variable_name}"
 done
 
@@ -64,6 +65,7 @@ case ${PROJECT_SOURCE}/ in
   *) die "AWX_PROJECT_SOURCE_DIR must resolve inside the repository" ;;
 esac
 [[ -f ${PROJECT_SOURCE}/${AWX_PLAYBOOK} ]] || die "playbook not found: ${PROJECT_SOURCE}/${AWX_PLAYBOOK}"
+[[ -f ${PROJECT_SOURCE}/${AWX_ROLLBACK_PLAYBOOK} ]] || die "rollback playbook not found: ${PROJECT_SOURCE}/${AWX_ROLLBACK_PLAYBOOK}"
 
 if [[ -z ${AWX_TOKEN:-} && -z ${AWX_PASSWORD:-} ]]; then
   AWX_PASSWORD=$(kubectl get secret \
@@ -186,6 +188,10 @@ if ! awx_request GET "/api/v2/projects/${project_id}/playbooks/" | \
   jq -e --arg playbook "${AWX_PLAYBOOK}" 'index($playbook) != null' >/dev/null; then
   die "AWX project ${project_id} does not expose playbook ${AWX_PLAYBOOK}"
 fi
+if ! awx_request GET "/api/v2/projects/${project_id}/playbooks/" | \
+  jq -e --arg playbook "${AWX_ROLLBACK_PLAYBOOK}" 'index($playbook) != null' >/dev/null; then
+  die "AWX project ${project_id} does not expose rollback playbook ${AWX_ROLLBACK_PLAYBOOK}"
+fi
 
 inventory_payload=$(jq -nc \
   --arg name "${AWX_INVENTORY_NAME}" \
@@ -307,29 +313,57 @@ job_template_payload=$(jq -nc \
 job_template_id=$(upsert_named_object '/api/v2/job_templates/' \
   "${AWX_JOB_TEMPLATE_NAME}" "${job_template_payload}")
 
-while IFS= read -r existing_group_id; do
-  [[ -z ${existing_group_id} || ${existing_group_id} == "${instance_group_id}" ]] && continue
-  awx_request POST "/api/v2/job_templates/${job_template_id}/instance_groups/" \
-    "$(jq -nc --argjson id "${existing_group_id}" '{id:$id,disassociate:true}')" >/dev/null
-done < <(awx_request GET "/api/v2/job_templates/${job_template_id}/instance_groups/" | jq -r '.results[].id')
+rollback_template_payload=$(jq -nc \
+  --arg name "${AWX_ROLLBACK_JOB_TEMPLATE_NAME}" \
+  --arg description "${AWX_ROLLBACK_JOB_TEMPLATE_DESCRIPTION:-PostgreSQL rollback template}" \
+  --arg playbook "${AWX_ROLLBACK_PLAYBOOK}" \
+  --argjson organization "${organization_id}" \
+  --argjson inventory "${inventory_id}" \
+  --argjson project "${project_id}" \
+  --argjson prevent_fallback "${prevent_fallback}" \
+  '{
+    name:$name,
+    description:$description,
+    organization:$organization,
+    inventory:$inventory,
+    project:$project,
+    playbook:$playbook,
+    job_type:"run",
+    ask_inventory_on_launch:true,
+    ask_variables_on_launch:true,
+    ask_limit_on_launch:true,
+    allow_simultaneous:true,
+    prevent_instance_group_fallback:$prevent_fallback
+  }')
+rollback_template_id=$(upsert_named_object '/api/v2/job_templates/' \
+  "${AWX_ROLLBACK_JOB_TEMPLATE_NAME}" "${rollback_template_payload}")
+
+for configured_template_id in "${job_template_id}" "${rollback_template_id}"; do
+  while IFS= read -r existing_group_id; do
+    [[ -z ${existing_group_id} || ${existing_group_id} == "${instance_group_id}" ]] && continue
+    awx_request POST "/api/v2/job_templates/${configured_template_id}/instance_groups/" \
+      "$(jq -nc --argjson id "${existing_group_id}" '{id:$id,disassociate:true}')" >/dev/null
+  done < <(awx_request GET "/api/v2/job_templates/${configured_template_id}/instance_groups/" | jq -r '.results[].id')
+
+  if ! awx_request GET "/api/v2/job_templates/${configured_template_id}/credentials/" | \
+    jq -e --argjson id "${machine_credential_id}" '.results | any(.id == $id)' >/dev/null; then
+    awx_request POST "/api/v2/job_templates/${configured_template_id}/credentials/" \
+      "$(jq -nc --argjson id "${machine_credential_id}" '{id:$id}')" >/dev/null
+  fi
+  if [[ -n ${instance_group_id} ]]; then
+    if ! awx_request GET "/api/v2/job_templates/${configured_template_id}/instance_groups/" | \
+      jq -e --argjson id "${instance_group_id}" '.results | any(.id == $id)' >/dev/null; then
+      awx_request POST "/api/v2/job_templates/${configured_template_id}/instance_groups/" \
+        "$(jq -nc --argjson id "${instance_group_id}" '{id:$id}')" >/dev/null
+    fi
+  fi
+done
 
-if ! awx_request GET "/api/v2/job_templates/${job_template_id}/credentials/" | \
-  jq -e --argjson id "${machine_credential_id}" '.results | any(.id == $id)' >/dev/null; then
-  awx_request POST "/api/v2/job_templates/${job_template_id}/credentials/" \
-    "$(jq -nc --argjson id "${machine_credential_id}" '{id:$id}')" >/dev/null
-fi
 if ! awx_request GET "/api/v2/job_templates/${job_template_id}/credentials/" | \
   jq -e --argjson id "${postgres_credential_id}" '.results | any(.id == $id)' >/dev/null; then
   awx_request POST "/api/v2/job_templates/${job_template_id}/credentials/" \
     "$(jq -nc --argjson id "${postgres_credential_id}" '{id:$id}')" >/dev/null
 fi
-if [[ -n ${instance_group_id} ]]; then
-  if ! awx_request GET "/api/v2/job_templates/${job_template_id}/instance_groups/" | \
-    jq -e --argjson id "${instance_group_id}" '.results | any(.id == $id)' >/dev/null; then
-    awx_request POST "/api/v2/job_templates/${job_template_id}/instance_groups/" \
-      "$(jq -nc --argjson id "${instance_group_id}" '{id:$id}')" >/dev/null
-  fi
-fi
 
 printf '\nPostgreSQL AWX configuration is ready:\n'
 printf '  Project:        %s (id=%s)\n' "${AWX_PROJECT_NAME}" "${project_id}"
@@ -338,6 +372,8 @@ printf '  Host:           %s -> %s (id=%s)\n' "${AWX_HOST_NAME}" "${AWX_HOST_ADD
 printf '  SSH credential: %s (id=%s)\n' "${AWX_MACHINE_CREDENTIAL_NAME}" "${machine_credential_id}"
 printf '  PG credential:  %s (id=%s)\n' "${AWX_POSTGRES_CREDENTIAL_NAME}" "${postgres_credential_id}"
 printf '  Job Template:   %s (id=%s)\n' "${AWX_JOB_TEMPLATE_NAME}" "${job_template_id}"
+printf '  Rollback:       %s (id=%s)\n' "${AWX_ROLLBACK_JOB_TEMPLATE_NAME}" "${rollback_template_id}"
+printf '  Server env:     DELIVERY_POSTGRESQL_ROLLBACK_TEMPLATE_ID=%s\n' "${rollback_template_id}"
 if [[ -n ${instance_group_id} ]]; then
   printf '  Instance Group: %s (id=%s)\n' "${AWX_INSTANCE_GROUP}" "${instance_group_id}"
 fi