system-config/testinfra/test_base.py
Ian Wienand d232403e79 base-server: disable install of suggests and recommends packages
The options to disable installing suggests and recommended packages
has been in diskimage-builder based images for a long time [1].
However we have no setting for it in our base-server role, meaning
that when launching nodes from cloud-provider images we can be out of
sync on this option.

I6d69ac0bd2ade95fede33c5f82e7df218da9458b is an example where packages
pulled in by suggestions can fail (arguably a packaging issue, but
anyway...)

By enabling this here, we make our control plane servers homogenous
with our diskimage-builder based testing nodes, which is better for
general sanity.  Overall it gives us more control over what's
installed.

[1] https://opendev.org/openstack/diskimage-builder/src/branch/master/diskimage_builder/elements/dpkg/pre-install.d/00-disable-apt-recommends

As I6d69ac0bd2ade95fede33c5f82e7df218da9458b showed, installing
suggested or recommended packages might result in

Change-Id: Id6dcc158944a46fc0ae03b6f1ff372dacd67c2e6
2019-07-31 16:21:08 +10:00

173 lines
5.7 KiB
Python

# Copyright 2018 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
import socket
testinfra_hosts = ['all']
def get_ips(value, family=None):
ret = set()
try:
addr_info = socket.getaddrinfo(value, None, family)
except socket.gaierror:
return ret
for addr in addr_info:
ret.add(addr[4][0])
return ret
def test_exim_is_installed(host):
if host.system_info.distribution in ['ubuntu', 'debian']:
exim = host.package("exim4-base")
else:
exim = host.package("exim")
assert exim.is_installed
cmd = host.run("exim -bt root")
assert cmd.rc == 0
def test_iptables(host):
rules = host.iptables.rules()
rules = [x.strip() for x in rules]
needed_rules = [
'-P INPUT ACCEPT',
'-P FORWARD DROP',
'-P OUTPUT ACCEPT',
'-N openstack-INPUT',
'-A INPUT -j openstack-INPUT',
'-A openstack-INPUT -i lo -j ACCEPT',
'-A openstack-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT',
'-A openstack-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT',
'-A openstack-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT',
'-A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited'
]
for rule in needed_rules:
assert rule in rules
# Make sure that the zuul console stream rule is still present
zuul = ('-A openstack-INPUT -p tcp -m state --state NEW'
' -m tcp --dport 19885 -j ACCEPT')
assert zuul in rules
# Ensure all IPv4+6 addresses for cacti are allowed
for ip in get_ips('cacti.openstack.org', socket.AF_INET):
snmp = ('-A openstack-INPUT -s %s/32 -p udp -m udp'
' --dport 161 -j ACCEPT' % ip)
assert snmp in rules
# TODO(ianw) add ip6tables support to testinfra iptables module
ip6rules = host.check_output('ip6tables -S')
for ip in get_ips('cacti.openstack.org', socket.AF_INET6):
snmp = ('-A openstack-INPUT -s %s/128 -p udp -m udp'
' --dport 161 -j ACCEPT' % ip)
assert snmp in ip6rules
def test_ntp(host):
package = host.package("ntp")
assert package.is_installed
if host.system_info.codename != 'bionic':
if host.system_info.distribution in ['ubuntu', 'debian']:
service = host.service("ntp")
else:
service = host.service("ntpd")
assert service.is_running
assert service.is_enabled
else:
service = host.service('systemd-timesyncd')
assert service.is_running
cmd = host.run("timedatectl status")
assert 'systemd-timesyncd.service active: yes' in cmd.stdout
def test_snmp(host):
service = host.service("snmpd")
assert service.is_running
assert service.is_enabled
def test_timezone(host):
tz = host.check_output('date +%Z')
assert tz == "UTC"
def test_unbound(host):
output = host.check_output('host opendev.org')
assert 'has address' in output
def test_unattended_upgrades(host):
if host.system_info.distribution in ['ubuntu', 'debian']:
package = host.package("unattended-upgrades")
assert package.is_installed
package = host.package("mailutils")
assert package.is_installed
cfg_file = host.file("/etc/apt/apt.conf.d/10periodic")
assert cfg_file.exists
assert cfg_file.contains('^APT::Periodic::Enable "1"')
assert cfg_file.contains('^APT::Periodic::Update-Package-Lists "1"')
assert cfg_file.contains('^APT::Periodic::Download-Upgradeable-Packages "1"')
assert cfg_file.contains('^APT::Periodic::AutocleanInterval "5"')
assert cfg_file.contains('^APT::Periodic::Unattended-Upgrade "1"')
assert cfg_file.contains('^APT::Periodic::RandomSleep "1800"')
cfg_file = host.file("/etc/apt/apt.conf.d/50unattended-upgrades")
assert cfg_file.contains('^Unattended-Upgrade::Mail "root"')
else:
package = host.package("yum-cron")
assert package.is_installed
service = host.service("crond")
assert service.is_enabled
assert service.is_running
cfg_file = host.file("/etc/yum/yum-cron.conf")
assert cfg_file.exists
assert cfg_file.contains('apply_updates = yes')
def test_logrotate(host):
'''Check for log rotation configuration files
The magic number here is [0:5] of the sha1 hash of the full
path to the rotated logfile; the role adds this for uniqueness.
'''
ansible_vars = host.ansible.get_variables()
if ansible_vars['inventory_hostname'] == 'bridge.openstack.org':
cfg_file = host.file("/etc/logrotate.d/ansible.log.37237.conf")
assert cfg_file.exists
assert cfg_file.contains('/var/log/ansible/ansible.log')
cfg_file = host.file("/etc/logrotate.d/run_all_cron.log.1a953.conf")
assert cfg_file.exists
assert cfg_file.contains('/var/log/ansible/run_all_cron.log')
def test_no_recommends(host):
if host.system_info.distribution in ['ubuntu', 'debian']:
cfg_file = host.file("/etc/apt/apt.conf.d/95disable-recommends")
assert cfg_file.exists
assert cfg_file.contains('^APT::Install-Recommends "0"')
assert cfg_file.contains('^APT::Install-Suggests "0"')