RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/podman#d39daa9e872e111c03d8be9158f0273c336bc934

gating.yaml

@@ -0,0 +1,14 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_testing
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

sources

@@ -0,0 +1,2 @@
+SHA512 (dnsname-8a6a8a4.tar.gz) = 7ee1edd091264f804056c69d5eac0ef8e825cbdae268caeed12700c966724c57348a14aee509e9ab559be349025b0c5357f441c3b4e34c3c02568a51ae223401
+SHA512 (podman-d30b4b7.tar.gz) = a7046b545b6a7ef69d6fcf7392abe0f8205ba148b98f162ecda3825766f2b6aeb27a0fb2e03a69c7444b5bd2b97f46e7805d350e2a6d7dedde5e8c32bc788860

tests/README

@@ -0,0 +1,25 @@
+I'm sorry. The playbooks here are a much-too-complicated way of saying:
+
+   - test podman (root and rootless) under cgroups v2
+   - reboot into cgroups v1
+   - repeat the same podman tests
+
+We can't use standard-test-basic any more because, tl;dr, that has to
+be the last stanza in the playbook and it doesn't offer any mechanism
+for running a reboot in the middle of tests. (I actually found a way
+but it was even uglier than this approach).
+
+The starting point is tests.yml . From there:
+
+    tests.yml
+      \- test_podman.yml
+           |- roles/rootless_user_ready/
+           \- test_podman_cgroups_vn.yml    (runs twice: cgroups v2, v1)
+                |- roles/set_cgroups/
+                \- roles/run_bats_tests/    (runs tests: root, rootless)
+
+Principal result is the file 'artifacts/test.log'. It will contain
+one line for each test run, format will be '(PASS|FAIL|ERROR) <test name>'
+
+For each completed test there will also be a 'test.<name>.bats.log'
+containing some setup blurbs (RPMs, environment) and the full BATS log.

tests/check_results.yml

@@ -0,0 +1,36 @@
+---
+# Copied from standard-test-basic
+# ...and, 2020-05-13, updated, looks like they changed the whole thing around
+- name: Check the results
+  local_action:
+    module: shell
+    cmd: |
+      log="{{ artifacts }}/test.log"
+      if [ ! -f "$log" ]; then
+          echo ERROR
+          echo "Test results not found." 1>&2
+      elif grep ^ERROR "$log" 1>&2; then
+          echo ERROR
+      elif grep ^FAIL "$log" 1>&2; then
+          echo FAIL
+      elif grep -q ^PASS "$log"; then
+          echo PASS
+      else
+          echo ERROR
+          echo "No test results found." 1>&2
+      fi
+  register: test_results
+
+- name: Set role result
+  set_fact:
+    role_result: "{{ test_results.stdout }}"
+    role_message: "{{ test_results.stderr|d('test execution error.') }}"
+
+- name: display results
+  vars:
+    msg: |
+       role_result:  {{ role_result|d('Undefined') }}
+       {{ role_message|d('[No error messages found]') }}
+  debug:
+    msg: "{{ msg.split('\n') }}"
+  failed_when: role_message|d("") != ""

tests/roles/rootless_user_ready/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: make sure rootless account exists
+  user: name={{ rootless_user }}
+
+- name: rootless account | enable linger
+  shell: loginctl enable-linger {{ rootless_user }}

tests/roles/run_bats_tests/files/run_bats_tests.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# Run bats tests for a given $TEST_PACKAGE, e.g. buildah, podman
+#
+# This is invoked by the 'run_bats_tests' role; we assume that
+# the package foo has a foo-tests subpackage which provides the
+# directory /usr/share/foo/test/system, containing one or more .bats
+# test files.
+#
+# We create two files:
+#
+#    /tmp/test.summary.log - one-liner with FAIL, PASS, ERROR and a blurb
+#    /tmp/test.bats.log    - full log of this script, plus the BATS run
+#
+export PATH=/usr/local/bin:/usr/sbin:/usr/bin
+
+FULL_LOG=/tmp/test.bats.log
+rm -f $FULL_LOG
+touch $FULL_LOG
+
+# Preserve output to a log file, but also emit on stdout. This covers
+# RHEL (which preserves logfiles but runs ansible without --verbose)
+# and Fedora (which hides logfiles but runs ansible --verbose).
+exec &> >(tee -a $FULL_LOG)
+
+# Log program versions
+echo "Packages:"
+rpm -qa |\
+    egrep 'podman|conmon|crun|runc|iptable|slirp|systemd|container-selinux' |\
+    sort |\
+    sed -e 's/^/  /'
+
+divider='------------------------------------------------------------------'
+echo $divider
+printenv | sort
+echo $divider
+
+testdir=/usr/share/${TEST_PACKAGE}/test/system
+
+if ! cd $testdir; then
+    echo "FAIL ${TEST_NAME} : cd $testdir"      > /tmp/test.summary.log
+    exit 0
+fi
+
+echo "\$ bats ."
+bats .
+rc=$?
+
+echo $divider
+echo "bats completed with status $rc"
+
+status=PASS
+if [ $rc -ne 0 ]; then
+    status=FAIL
+fi
+
+echo "${status} ${TEST_NAME}" > /tmp/test.summary.log
+
+# FIXME: for CI purposes, always exit 0. This allows subsequent tests.
+exit 0

tests/roles/run_bats_tests/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+# Create empty results file, world-writable
+- name: initialize test.log file
+  copy: dest=/tmp/test.log content='' force=yes mode=0666
+
+- name: execute tests
+  include: run_one_test.yml
+  with_items: "{{ tests }}"
+  loop_control:
+    loop_var: test

tests/roles/run_bats_tests/tasks/run_one_test.yml

@@ -0,0 +1,87 @@
+---
+- name: "{{ test.name }} | install test packages"
+  dnf: name="{{ test.package }}-tests" state=installed
+
+- name: "{{ test.name }} | define helper variables"
+  set_fact:
+    test_name_oneword: "{{ test.name | replace(' ','-') }}"
+
+# UGH. This is necessary because our caller sets some environment variables
+# and we need to set a few more based on other caller variables; then we
+# need to combine the two dicts when running the test. This seems to be
+# the only way to do it in ansible.
+- name: "{{ test.name }} | define local environment"
+  set_fact:
+    local_environment:
+      TEST_NAME:    "{{ test.name }}"
+      TEST_PACKAGE: "{{ test.package }}"
+      TEST_ENV:     "{{ test.environment }}"
+
+- name: "{{ test.name }} | setup/teardown helper | see if exists"
+  local_action: stat path={{ role_path }}/files/helper.{{ test_name_oneword }}.sh
+  register: helper
+
+- name: "{{ test.name }} | setup/teardown helper | install"
+  copy: src=helper.{{ test_name_oneword }}.sh dest=/tmp/helper.sh
+  when: helper.stat.exists
+
+# This is what runs the BATS tests.
+- name: "{{ test.name }} | run test"
+  script: ./run_bats_tests.sh
+  args:
+    chdir: /usr/share/{{ test.package }}/test/system
+  become: "{{ true if test.become is defined else false }}"
+  become_user: "{{ rootless_user }}"
+  environment: "{{ local_environment | combine(test.environment) }}"
+
+# BATS tests will always exit zero and should leave behind two files:
+# a full log (test.bats.log) and a one-line PASS/FAIL file (.summary.log)
+- name: "{{ test.name }} | pull logs"
+  fetch:
+    src: "/tmp/test.{{ item }}.log"
+    dest: "{{ artifacts }}/test.{{ test_name_oneword }}.{{ item }}.log"
+    flat: yes
+  with_items:
+    - bats
+    - summary
+
+# Collect all the one-line PASS/FAIL results in one file, test.log
+# Write the same thing, in a different format, to results.yml
+#   https://docs.fedoraproject.org/en-US/ci/standard-test-interface/
+- name: "{{ test.name }} | keep running tally of test results"
+  local_action:
+    module: shell
+    cmd: |
+      cd {{ artifacts }}
+      cat "test.{{ test_name_oneword }}.summary.log" >>test.log
+
+      status=$(awk '{print $1}' <test.{{ test_name_oneword }}.summary.log | tr A-Z a-z)
+      echo "- test: {{ test.name }}"                        >>results.yml
+      echo "  result: $status"                              >>results.yml
+      echo "  logs: test.{{ test_name_oneword }}.bats.log"  >>results.yml
+
+      # delete the oneliner file, to keep artifacts dir clean
+      rm -f test.{{ test_name_oneword }}.summary.log
+
+- name: "{{ test.name }} | remove remote logs and helpers"
+  file:
+    dest=/tmp/{{ item }}
+    state=absent
+  with_items:
+    - test.bats.log
+    - test.summary.log
+    - helper.sh
+
+# AAAAARGH!
+#
+# Fedora gating tests are failing, because str-common-final/tasks/main.yml
+# tries to pull test.log and other logs from $remote_host:/tmp/artifacts .
+# Those don't exist, because I track status and artifacts locally, because
+# with the reboot I can't rely on /tmp being preserved.
+# I see no way to tell str-common-final to skip this step; so let's just
+# push logs over upon completion of each subtest.
+- name: keep remote artifacts synced
+  synchronize:
+    src:  "{{ artifacts }}/"
+    dest: "{{ remote_artifacts|d('/tmp/artifacts') }}/"
+    mode: push

tests/roles/set_cgroups/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+# Check the CURRENT cgroup level; we get this from /proc/cmdline
+- name: check current kernel options
+  shell: fgrep systemd.unified_cgroup_hierarchy=0 /proc/cmdline
+  register: result
+  ignore_errors: true
+
+- name: determine current cgroups | assume v2
+  set_fact: current_cgroups=2
+
+- name: determine current cgroups | looks like v1
+  set_fact: current_cgroups=1
+  when: result is succeeded
+
+- debug:
+    msg: "want: v{{ want_cgroups }}  actual: v{{ current_cgroups }}"
+
+- name: grubenv, pre-edit, cat
+  shell: cat /boot/grub2/grubenv
+  register: grubenv
+
+- name: grubenv, pre-edit, show
+  debug:
+    msg: "{{ grubenv.stdout_lines }}"
+
+# Update grubenv file to reflect the desired cgroup level
+- name: remove cgroup option from kernel flags
+  shell:
+    cmd: sed -i -e "s/^\(kernelopts=.*\)systemd\.unified_cgroup_hierarchy=.\(.*\)/\1 \2/" /boot/grub2/grubenv
+    warn: false
+
+- name: add it with the desired value
+  shell:
+    cmd: sed -i -e "s/^\(kernelopts=.*\)/\1 systemd.unified_cgroup_hierarchy=0/" /boot/grub2/grubenv
+    warn: false
+  when: want_cgroups == 1
+
+- name: grubenv, post-edit, cat
+  shell: cat /boot/grub2/grubenv
+  register: grubenv
+
+- name: grubenv, post-edit, show
+  debug:
+    msg: "post: {{ grubenv.stdout_lines }}"
+
+# If want != have, reboot
+- name: reboot and wait
+  block:
+    - name: reboot
+      reboot:
+        reboot_timeout: 900
+      ignore_errors: yes
+    - name: wait and reconnect
+      wait_for_connection:
+        timeout: 900
+  when: want_cgroups|int != current_cgroups|int
+
+- set_fact:
+    expected_fstype:
+      - none
+      - tmpfs
+      - cgroup2fs
+
+- name: confirm cgroups setting
+  shell: stat -f -c "%T" /sys/fs/cgroup
+  register: fstype
+
+- debug:
+    msg: "stat(/sys/fs/cgroup) = {{ fstype.stdout }}"
+
+- name: system cgroups is the expected type
+  assert:
+    that:
+      - fstype.stdout == expected_fstype[want_cgroups|int]
+    fail_msg: "stat(/sys/fs/cgroup) = {{ fstype.stdout }} (expected {{ expected_fstype[want_cgroups|int] }})"

tests/test_podman.yml

@@ -0,0 +1,44 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+    - container
+  vars:
+  - artifacts: ./artifacts
+    rootless_user: testuser
+  roles:
+  - role: rootless_user_ready
+
+  tasks:
+  # At the start of a run, clean up state. Useful for test reruns.
+  - name: local artifacts directory exists
+    local_action: file path="{{ artifacts }}" state=directory
+
+  - name: remove stale log files
+    local_action: shell rm -f {{ artifacts }}/test*.log
+
+  - name: clear test results (test.log)
+    local_action: command truncate --size=0 {{ artifacts }}/test.log
+
+  - name: clear test results (results.yml)
+    local_action: copy content="results:\n" dest={{ artifacts }}/results.yml
+
+  # These are the actual tests: set cgroups vN, then run root/rootless tests.
+  #
+  # FIXME FIXME FIXME: 2020-05-21: 'loop' should be '2, 1' but there's some
+  # nightmarish bug in CI wherein reboots hang forever. There's a bug open[1]
+  # but it seems dead. Without a working reboot, there's no way to test v1.
+  #  [1] https://redhat.service-now.com/surl.do?n=PNT0808530
+  # I'm leaving this as a 'loop' in (foolish? vain?) hope that the bug will
+  # be fixed. Let's revisit this after, say, 2020-08. If the bug persists
+  # then let's just revert the entire cgroups v1 change, and go back to
+  # using standard-test-basic.
+  - name: set cgroups and run podman tests
+    include_tasks: test_podman_cgroups_vn.yml
+    loop: [ 2 ]
+    loop_control:
+      loop_var: want_cgroups
+
+  # Postprocessing: check for FAIL or ERROR in any test, exit 1 if so
+  - name: check results
+    include_tasks: check_results.yml

tests/test_podman_cgroups_vn.yml

@@ -0,0 +1,19 @@
+---
+# Requires: 'want_cgroups' variable set to 1 or 2
+- include_role:
+    name: set_cgroups
+- include_role:
+    name: run_bats_tests
+  vars:
+    tests:
+    # Yes, this is horrible duplication, but trying to refactor in ansible
+    # yields even more horrible unreadable code. This is the lesser evil.
+    - name: podman root cgroupsv{{ want_cgroups }}
+      package: podman
+      environment:
+        PODMAN: /usr/bin/podman
+    - name: podman rootless cgroupsv{{ want_cgroups }}
+      package: podman
+      environment:
+        PODMAN: /usr/bin/podman
+      become: true

tests/tests.yml

@@ -0,0 +1 @@
+- import_playbook: test_podman.yml