WIP Advanced vmedia deployment test ops

Adds an advanced operations standalone test which utilizes a new proposed
tempest test to execute against the API.

Adds related configuration to enable triggering of the tempest test, and
is reliant upon fixes in diskimage-builder, ironic-python-agent-builder
(for tinycore support), IPA itself, which contains the root bug fix for
the agent.

Depends-On: https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/915170
Depends-On: https://review.opendev.org/c/openstack/diskimage-builder/+/899886
Depends-On: https://review.opendev.org/c/openstack/ironic/+/915022
Change-Id: Ibb6f9228672966c3708227e37bead6a45648e177

devstack/lib/ironic

@@ -190,6 +190,12 @@ if [[ "$hostdomain" =~ "rax" ]] || [[ "$hostdomain" =~ "iweb" ]]; then
     # we should make a helper method...
 fi
 
+# DO NOT MODIFY/SET
+# NOTE(TheJulia): These settings are for virtual media based testing, and
+# the need to send traffic *back* to the host. The subnet ID is dynamic,
+# the IP needs to be within the floating IP range.
+PUBLIC_SUBNET_ID=""
+PUBLIC_SUBNET_IP="172.24.5.250"
 
 # Oslo Policy enforcement for Scope and new policy enforcement.
 IRONIC_ENFORCE_SCOPE=$(trueorfalse True IRONIC_ENFORCE_SCOPE)
@@ -299,12 +305,12 @@ fi
 # NOTE(TheJulia): If we ever run any arm64, we will need to consider doing
 # the same. Nested virt is not a thing there.
 # Prevent a case that will likely result in a failure.
-if [[ "$hostdomain" =~ "rax" ]] || [[ "$hostdomain" =~ "iweb" ]] || ! $(grep -q vmx /proc/cpuinfo) ; then
+#if [[ "$hostdomain" =~ "rax" ]] || [[ "$hostdomain" =~ "iweb" ]] || ! $(grep -q vmx /proc/cpuinfo) ; then
-    if [[ "$IRONIC_RAMDISK_TYPE" == "dib" ]]; then
+#    if [[ "$IRONIC_RAMDISK_TYPE" == "dib" ]]; then
-        echo "** WARNING ** - DIB based IPA images have been defined, however we are running devstack on an environment which does not support nested VMs. Due to virtualization constraints, we are automatically falling back to TinyIPA to ensure CI job passage."
+#        echo "** WARNING ** - DIB based IPA images have been defined, however we are running devstack on an environment which does not support nested VMs. Due to virtualization constraints, we are automatically falling back to TinyIPA to ensure CI job passage."
-        IRONIC_RAMDISK_TYPE="tinyipa"
+#        IRONIC_RAMDISK_TYPE="tinyipa"
-    fi
+#    fi
-fi
+#fi
 
 # Which deploy driver to use - valid choices right now
 # are ``ipmi``, ``snmp`` and ``redfish``.
@@ -331,6 +337,11 @@ IPA_DOWNLOAD_BRANCH=$(echo $IPA_DOWNLOAD_BRANCH | tr / -)
 IRONIC_DIB_RAMDISK_OS=${IRONIC_DIB_RAMDISK_OS:-centos9}
 IRONIC_DIB_RAMDISK_RELEASE=${IRONIC_DIB_RAMDISK_RELEASE:-}
 
+# OS for building images in CI
+IRONIC_DIB_OS=${IRONIC_DIB_RAMDISK_OS:-centos9}
+IRONIC_DIB_RELEASE=${IRONIC_DIB_RAMDISK_RELEASE:-}
+
+
 # Configure URLs required to download ramdisk if we're not building it, and
 # IRONIC_DEPLOY_RAMDISK/KERNEL or the RAMDISK/KERNEL_URLs have not been
 # preconfigured.
@@ -2303,6 +2314,12 @@ SUBSHELL
         # Route back to our test subnet. Static should be safe for a while.
         sudo ip -6 route add fd00::/8 via $IPV6_ROUTER_GW_IP
     fi
+
+    # NOTE(TheJulia): Getting the subnet_id might need additional logic
+    # behind it, should also just generally work.
+    PUBLIC_SUBNET_ID=$(openstack router show $Q_ROUTER_NAME -c external_gateway_info -f json | jq -r .external_gateway_info.external_fixed_ips[0].subnet_id)
+    # Add a route for dhcp-less return path traffic
+    sudo ip route add 10.0.6.0/24 via $PUBLIC_SUBNET_IP
 }
 
 function wait_for_nova_resources {
@@ -2957,6 +2974,7 @@ function build_ipa_dib_ramdisk {
     fi
     git_clone $IRONIC_PYTHON_AGENT_BUILDER_REPO $IRONIC_PYTHON_AGENT_BUILDER_DIR $IRONIC_PYTHON_AGENT_BUILDER_BRANCH
     ELEMENTS_PATH="$IRONIC_PYTHON_AGENT_BUILDER_DIR/dib" \
+        DIB_CLOUD_INIT_DATASOURCES="ConfigDrive,openstack" \
         DIB_DHCP_TIMEOUT=$IRONIC_DIB_DHCP_TIMEOUT \
         DIB_RELEASE=$IRONIC_DIB_RAMDISK_RELEASE \
         DIB_REPOLOCATION_ironic_python_agent="$IRONIC_PYTHON_AGENT_DIR" \
@@ -2975,6 +2993,45 @@ function build_ipa_dib_ramdisk {
     rm -rf $tempdir
 }
 
+function build_wholedisk_image {
+    local img_path=$1
+    local tempdir
+    tempdir=$(mktemp -d --tmpdir=${DEST})
+
+    # install diskimage-builder if not present
+    if ! $(type -P disk-image-create > /dev/null); then
+        install_diskimage_builder
+    fi
+
+    echo "Building wholedisk DIB image options: $IRONIC_DIB_OPTIONS block-device-efi bootloader"
+    # Build a bootable UEFI image iniit tooling .
+    DIB_DHCP_TIMEOUT=$IRONIC_DIB_DHCP_TIMEOUT \
+        DIB_RELEASE=$IRONIC_DIB_RELEASE \
+        DIB_SIMPLE_INIT_NO_DHCP_FALLBACK=1 \
+        DIB_CLOUD_INIT_DATASOURCES="ConfigDrive,openstack" \
+        disk-image-create "$IRONIC_DIB_OPTIONS" block-device-efi bootloader \
+        -x -o  "$tempdir/wholedisk"
+    chmod -R +r $tempdir
+    mv "$tempdir/wholedisk.qcow2" "$img_path"
+    rm -rf $tempdir
+}
+
+function upload_baremetal_ironic_wholedisk {
+    disk_img=$1
+    disk_img_name=$2
+
+    if [[ "$HOST_TOPOLOGY_ROLE" != "subnode" ]]; then
+        echo_summary "Uploading baremetal images for ironic"
+        wholedisk_image_id=$(openstack --os-cloud devstack-admin \
+            image create \
+            $(basename $disk_img_name) \
+            --public --disk-format=qcow2 \
+            --container-format=bare \
+            < $disk_img  -f value -c id)
+        die_if_not_set $LINENO wholedisk_image_id "Failed to load wholedisk image into glance"
+    fi
+}
+
 function upload_image_if_needed {
     if [[ "$IRONIC_PARTITIONED_IMAGE_NAME" =~ cirros ]] && is_service_enabled glance; then
         echo Building a Cirros image suitable for local boot
@@ -3193,10 +3250,17 @@ function prepare_baremetal_basic_ops {
     if [[ "$IRONIC_BAREMETAL_BASIC_OPS" != "True" ]]; then
         return 0
     fi
-
+    if [[ "${IRONIC_BUILD_WHOLEDISK:-False}" == "True" ]]; then
+        local dib_file_path
+        dib_file_path=$FILES/ironic-wholedisk-image.qcow2
+        build_wholedisk_image $dib_file_path
+        echo "WARNING: Overriding supplied IRONIC_WHOLEDISK_IMAGE_NAME as we have built an image as requested."
+        IRONIC_WHOLEDISK_IMAGE_NAME="ironic-wholedisk-image.qcow2"
+        upload_baremetal_ironic_wholedisk $dib_file_path $IRONIC_WHOLEDISK_IMAGE_NAME
+    fi
     if ! is_service_enabled nova && is_http_server_required; then
         local image_file_path
-        if [[ ${IRONIC_WHOLEDISK_IMAGE_NAME} =~ \.img$ ]]; then
+        if [[ ${IRONIC_WHOLEDISK_IMAGE_NAME} =~ \.img$ ]] || [ -f $FILES/${IRONIC_WHOLEDISK_IMAGE_NAME} ]; then
             image_file_path=$FILES/${IRONIC_WHOLEDISK_IMAGE_NAME}
         else
             image_file_path=$FILES/${IRONIC_WHOLEDISK_IMAGE_NAME}.img
@@ -3401,6 +3465,10 @@ function ironic_configure_tempest {
         iniset $TEMPEST_CONFIG baremetal unrescue_timeout $IRONIC_TEMPEST_BUILD_TIMEOUT
     fi
 
+    # Set networking parameters for dhcp-less vmedia testing
+    iniset $TEMPEST_CONFIG baremetal public_subnet_id $PUBLIC_SUBNET_ID
+    iniset $TEMPEST_CONFIG baremetal public_subnet_ip $PUBLIC_SUBNET_IP
+
     if [[ $IRONIC_VM_VOLUME_COUNT -gt 1 ]]; then
         iniset $TEMPEST_CONFIG baremetal_feature_enabled software_raid True
         iniset $TEMPEST_CONFIG baremetal_feature_enabled deploy_time_raid True

zuul.d/ironic-jobs.yaml

@@ -962,6 +962,100 @@
         # as OVMF/E2DK does not support stateless.
         IRONIC_BOOT_MODE: bios
 
+- job:
+    name: ironic-tempest-standalone-advanced
+    description: ironic-tempest-standalone-advanced test cases
+    parent: ironic-base
+    required-projects:
+      - opendev.org/openstack/diskimage-builder
+      - opendev.org/openstack/networking-generic-switch
+      - opendev.org/openstack/ironic-python-agent-builder
+    vars:
+      tempest_test_timeout: 2400
+      devstack_services:
+        # NOTE(TheJulia): We could likely change this over to OVN,
+        # but it really doesn't matter. We're using vmedia here.
+        q-agt: True
+        q-dhcp: True
+        q-l3: True
+        q-meta: False
+        q-metering: False
+        q-svc: True
+        swift: True
+        s-account: True
+        s-container: True
+        s-object: True
+        s-proxy: True
+        n-api: False
+        n-api-meta: False
+        n-cauth: False
+        n-cond: False
+        n-cpu: False
+        n-novnc: False
+        n-obj: False
+        n-sch: False
+        nova: False
+        placement-api: False
+      devstack_plugins:
+        ironic: https://opendev.org/openstack/ironic
+        networking-generic-switch: https://opendev.org/openstack/networking-generic-switch
+      # NOTE(TheJulia): Nova default behavior is to rely upon stack defaults, v6 needs to
+      # be explicit. This is the best place to wire it in.
+      tempest_test_regex: ironic_standalone.test_advanced_ops
+      devstack_localrc:
+        IRONIC_RAMDISK_TYPE: dib
+        IRONIC_DIB_RAMDISK_OPTIONS: centos simple-init
+        IRONIC_DIB_OPTIONS: centos cloud-init-datasources
+        # known working path
+        # IRONIC_DIB_RAMDISK_OPTIONS: centos simple-init
+        # IRONIC_DIB_OPTIONS: centos simple-init
+        IRONIC_BUILD_DEPLOY_RAMDISK: True
+        IRONIC_BUILD_WHOLEDISK: True
+        IRONIC_DIB_RAMDISK_OS: centos9
+        IRONIC_DIB_OS: centos9
+        IRONIC_DIB_RAMDISK_RELEASE: 9-stream
+        IRONIC_DIB_RELEASE: 9-stream
+        IRONIC_DEPLOY_DRIVER: redfish
+        IRONIC_ENABLED_HARDWARE_TYPES: redfish
+        IRONIC_ENABLED_POWER_INTERFACES: redfish
+        IRONIC_ENABLED_MANAGEMENT_INTERFACES: redfish
+        IRONIC_AUTOMATED_CLEAN_ENABLED: False
+        IRONIC_ENABLED_BOOT_INTERFACES: redfish-virtual-media
+        SWIFT_ENABLE_TEMPURLS: False
+        IRONIC_CALLBACK_TIMEOUT: 800
+        IRONIC_GRUB2_SHIM_FILE: https://mirror.iad3.inmotion.opendev.org/centos-stream/9-stream/BaseOS/x86_64/os/EFI/BOOT/BOOTX64.EFI
+        IRONIC_GRUB2_FILE: https://mirror.iad3.inmotion.opendev.org/centos-stream/9-stream/BaseOS/x86_64/os/EFI/BOOT/grubx64.efi
+        IRONIC_GRUB2_CONFIG_PATH: EFI/BOOT/grub.cfg
+        IRONIC_PROVISION_NETWORK_NAME: ironic-provision
+        # Cache the image locally so we convert it to raw,
+        # allowing it to be streamed. Otherwise the ramdisk
+        # will run out of RAM.
+        IRONIC_AGENT_IMAGE_DOWNLOAD_SOURCE: local
+        OVS_PHYSICAL_BRIDGE: brbm
+        PHYSICAL_NETWORK: mynetwork
+        TENANT_VLAN_RANGE: 100:150
+        IRONIC_ENABLED_NETWORK_INTERFACES: neutron
+        IRONIC_NETWORK_INTERFACE: neutron
+        IRONIC_DEFAILT_RESCUE_INTERFACE: no-rescue
+        IRONIC_USE_LINK_LOCAL: True
+        IRONIC_TEMPEST_WHOLE_DISK_IMAGE: True
+        IRONIC_VM_EPHEMERAL_DISK: 0
+        IRONIC_VM_INTERFACE_COUNT: 1
+        # This will swap and needs to get to tinycore soon.
+        IRONIC_VM_SPECS_CPU: 2
+        IRONIC_VM_SPECS_DISK: 8
+        Q_PLUGIN: ml2
+        ENABLE_TENANT_VLANS: True
+        Q_ML2_TENANT_NETWORK_TYPE: vlan
+        OVS_BRIDGE_MAPPINGS: "public:br-ex,mynetwork:brbm"
+        USE_PROVIDER_NETWORKING: True
+        PUBLIC_PHYSICAL_NETWORK: public
+        PUBLIC_PROVIDERNET_TYPE: flat
+        Q_USE_PROVIDERNET_FOR_PUBLIC: True
+        BUILD_TIMEOUT: 2000
+        IRONIC_TEMPEST_BUILD_TIMEOUT: 2000
+        IRONIC_PING_TIMEOUT: 1440
+
 
 # NOTE(rpittau): OLD TINYIPA JOBS
 # Those jobs are used by other projects, we leave them here until

zuul.d/project.yaml

@@ -17,64 +17,7 @@
         - ironic-tox-unit-with-driver-libs
         - ironic-cross-sushy:
             voting: false
-        - ironic-tempest-functional-python3
+        - ironic-tempest-standalone-advanced
-        # NOTE(rpittau) moving to non-voting until we fix the tests
-        # see also https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/882312
-        - ironic-tempest-functional-rbac-scope-enforced:
-            voting: false
-        # NOTE(TheJulia): Disabling grenade job on 20240227 from voting
-        # because we need to backport the same fix to the prior release branch.
-        - ironic-grenade:
-            voting: false
-        - ironic-grenade-skip-level:
-            voting: false
-        - ironic-standalone-redfish:
-            voting: false
-        - ironic-tempest-bios-redfish-pxe
-        - ironic-tempest-uefi-redfish-vmedia
-        - ironic-tempest-ramdisk-bios-snmp-pxe
-        - ironic-tempest-uefi-redfish-https
-        - ironic-tempest-ovn-uefi-ipmi-pxe
-        # NOTE(TheJulia) Marking multinode non-voting on 20210311
-        # Due to a high failure rate on limestone where the compute1
-        # machine never appears to be able to communicate across the
-        # vxlan tunnel, possible mtu issue, but non-voting until we
-        # understand it in mind for the upcoming release.
-        - ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode:
-            voting: false
-        - ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode-shard:
-            voting: false
-        - ironic-tempest-bios-ipmi-direct-tinyipa
-        - ironic-tempest-bfv
-        - ironic-tempest-ipa-partition-uefi-pxe-grub2
-        # NOTE(rpittau): Currently broken because of an issue with parted
-        - metalsmith-integration-glance-centos9-legacy:
-            voting: false
-        # NOTE(TheJulia): At present, metal3 doesn't leverage
-        # stable branches, and as far as we are aware these jobs
-        # can be removed once this branch is made stable.
-        - metal3-integration
-        # Non-voting jobs
-        - ironic-inspector-tempest:
-            voting: false
-        - ironic-inspector-tempest-uefi-redfish-vmedia:
-            voting: false
-        - ironic-tempest-ipa-wholedisk-bios-ipmi-direct-dib:
-            voting: false
-        - ironic-tempest-ipxe-ipv6:
-            voting: false
-        - ironic-standalone-anaconda:
-            voting: false
-        - ironic-inspector-tempest-rbac-scope-enforced:
-            voting: false
-        - bifrost-integration-tinyipa-ubuntu-jammy:
-            voting: false
-        - bifrost-integration-redfish-vmedia-uefi-centos-9:
-            voting: false
-        - ironic-tempest-pxe_ipmitool-postgres:
-            voting: false
-        - bifrost-benchmark-ironic:
-            voting: false
     gate:
       jobs:
         - ironic-tox-bandit
@@ -107,6 +50,7 @@
         # NOTE(TheJulia): At present, metal3 doesn't leverage
         # stable branches, and as far as we are aware these jobs
         # can be removed once this branch is made stable.
+        - ironic-tempest-standalone-advanced
         - metal3-integration
     experimental:
       jobs: