2015-04-07 15:00:25 +00:00
|
|
|
#!/usr/bin/env bash
|
2015-01-09 15:02:59 +00:00
|
|
|
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
|
# You may obtain a copy of the License at
|
|
|
|
#
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
#
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
|
|
# License for the specific language governing permissions and limitations
|
|
|
|
# under the License.
|
|
|
|
|
|
|
|
|
|
|
|
set -e
|
|
|
|
|
|
|
|
|
|
|
|
# Control variable used to determine whether to execute this script
|
|
|
|
# directly or allow the gate_hook to import.
|
|
|
|
IS_GATE=${IS_GATE:-False}
|
2015-12-25 23:27:03 +09:00
|
|
|
USE_CONSTRAINT_ENV=${USE_CONSTRAINT_ENV:-True}
|
2015-01-09 15:02:59 +00:00
|
|
|
|
|
|
|
|
|
|
|
if [[ "$IS_GATE" != "True" ]] && [[ "$#" -lt 1 ]]; then
|
|
|
|
>&2 echo "Usage: $0 /path/to/devstack [-i]
|
|
|
|
Configure a host to run Neutron's functional test suite.
|
|
|
|
|
2017-01-31 16:52:42 -06:00
|
|
|
-i Install Neutron's package dependencies. By default, it is assumed
|
|
|
|
that devstack has already been used to deploy neutron to the
|
|
|
|
target host and that package dependencies need not be installed.
|
2015-01-09 15:02:59 +00:00
|
|
|
|
|
|
|
Warning: This script relies on devstack to perform extensive
|
|
|
|
modification to the underlying host. It is recommended that it be
|
|
|
|
invoked only on a throw-away VM."
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
# Skip the first argument
|
|
|
|
OPTIND=2
|
|
|
|
while getopts ":i" opt; do
|
|
|
|
case $opt in
|
|
|
|
i)
|
|
|
|
INSTALL_BASE_DEPENDENCIES=True
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
|
|
|
|
done
|
|
|
|
|
|
|
|
# Default to environment variables to permit the gate_hook to override
|
|
|
|
# when sourcing.
|
2015-04-21 16:12:38 -04:00
|
|
|
VENV=${VENV:-dsvm-functional}
|
2015-01-09 15:02:59 +00:00
|
|
|
DEVSTACK_PATH=${DEVSTACK_PATH:-$1}
|
2015-04-21 16:12:38 -04:00
|
|
|
PROJECT_NAME=${PROJECT_NAME:-neutron}
|
|
|
|
REPO_BASE=${GATE_DEST:-$(cd $(dirname "$0")/../.. && pwd)}
|
2015-11-05 11:47:13 -05:00
|
|
|
INSTALL_MYSQL_ONLY=${INSTALL_MYSQL_ONLY:-False}
|
2015-04-21 16:12:38 -04:00
|
|
|
# The gate should automatically install dependencies.
|
2015-01-09 15:02:59 +00:00
|
|
|
INSTALL_BASE_DEPENDENCIES=${INSTALL_BASE_DEPENDENCIES:-$IS_GATE}
|
|
|
|
|
|
|
|
|
|
|
|
if [ ! -f "$DEVSTACK_PATH/stack.sh" ]; then
|
2017-01-31 16:52:42 -06:00
|
|
|
>&2 echo "Unable to find devstack at '$DEVSTACK_PATH'. Please verify that the specified path points to a valid devstack repo."
|
|
|
|
exit 1
|
2015-01-09 15:02:59 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
set -x
|
|
|
|
|
|
|
|
|
|
|
|
function _init {
|
|
|
|
# Subsequently-called devstack functions depend on the following variables.
|
|
|
|
HOST_IP=127.0.0.1
|
|
|
|
FILES=$DEVSTACK_PATH/files
|
|
|
|
TOP_DIR=$DEVSTACK_PATH
|
|
|
|
|
|
|
|
source $DEVSTACK_PATH/stackrc
|
|
|
|
|
|
|
|
# Allow the gate to override values set by stackrc.
|
|
|
|
DEST=${GATE_DEST:-$DEST}
|
|
|
|
STACK_USER=${GATE_STACK_USER:-$STACK_USER}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function _install_base_deps {
|
|
|
|
echo_summary "Installing base dependencies"
|
|
|
|
|
|
|
|
INSTALL_TESTONLY_PACKAGES=True
|
2015-11-11 07:59:38 +09:00
|
|
|
PACKAGES=$(get_packages general,neutron,q-agt,q-l3)
|
2015-01-09 15:02:59 +00:00
|
|
|
# Do not install 'python-' prefixed packages other than
|
|
|
|
# python-dev*. Neutron's functional testing relies on deployment
|
|
|
|
# to a tox env so there is no point in installing python
|
|
|
|
# dependencies system-wide.
|
|
|
|
PACKAGES=$(echo $PACKAGES | perl -pe 's|python-(?!dev)[^ ]*||g')
|
|
|
|
install_package $PACKAGES
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function _install_rpc_backend {
|
|
|
|
echo_summary "Installing rabbitmq"
|
|
|
|
|
|
|
|
RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
|
|
|
|
RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
|
|
|
|
RABBIT_PASSWORD=${RABBIT_HOST:-secretrabbit}
|
|
|
|
|
|
|
|
source $DEVSTACK_PATH/lib/rpc_backend
|
|
|
|
|
|
|
|
enable_service rabbit
|
|
|
|
install_rpc_backend
|
|
|
|
restart_rpc_backend
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2015-11-05 11:47:13 -05:00
|
|
|
# _install_databases [install_pg]
|
2015-01-09 15:02:59 +00:00
|
|
|
function _install_databases {
|
2015-11-05 11:47:13 -05:00
|
|
|
local install_pg=${1:-True}
|
|
|
|
|
2015-01-09 15:02:59 +00:00
|
|
|
echo_summary "Installing databases"
|
|
|
|
|
|
|
|
# Avoid attempting to configure the db if it appears to already
|
|
|
|
# have run. The setup as currently defined is not idempotent.
|
|
|
|
if mysql openstack_citest > /dev/null 2>&1 < /dev/null; then
|
|
|
|
echo_summary "DB config appears to be complete, skipping."
|
|
|
|
return 0
|
|
|
|
fi
|
|
|
|
|
|
|
|
MYSQL_PASSWORD=${MYSQL_PASSWORD:-secretmysql}
|
|
|
|
DATABASE_PASSWORD=${DATABASE_PASSWORD:-secretdatabase}
|
|
|
|
|
|
|
|
source $DEVSTACK_PATH/lib/database
|
|
|
|
|
|
|
|
enable_service mysql
|
|
|
|
initialize_database_backends
|
|
|
|
install_database
|
|
|
|
configure_database_mysql
|
|
|
|
|
2015-11-05 11:47:13 -05:00
|
|
|
if [[ "$install_pg" == "True" ]]; then
|
|
|
|
enable_service postgresql
|
|
|
|
initialize_database_backends
|
|
|
|
install_database
|
|
|
|
configure_database_postgresql
|
|
|
|
fi
|
2015-01-09 15:02:59 +00:00
|
|
|
|
|
|
|
# Set up the 'openstack_citest' user and database in each backend
|
|
|
|
tmp_dir=$(mktemp -d)
|
|
|
|
trap "rm -rf $tmp_dir" EXIT
|
|
|
|
|
|
|
|
cat << EOF > $tmp_dir/mysql.sql
|
|
|
|
CREATE DATABASE openstack_citest;
|
|
|
|
CREATE USER 'openstack_citest'@'localhost' IDENTIFIED BY 'openstack_citest';
|
|
|
|
CREATE USER 'openstack_citest' IDENTIFIED BY 'openstack_citest';
|
|
|
|
GRANT ALL PRIVILEGES ON *.* TO 'openstack_citest'@'localhost';
|
|
|
|
GRANT ALL PRIVILEGES ON *.* TO 'openstack_citest';
|
|
|
|
FLUSH PRIVILEGES;
|
|
|
|
EOF
|
|
|
|
/usr/bin/mysql -u root < $tmp_dir/mysql.sql
|
|
|
|
|
2015-11-05 11:47:13 -05:00
|
|
|
if [[ "$install_pg" == "True" ]]; then
|
|
|
|
cat << EOF > $tmp_dir/postgresql.sql
|
2015-01-09 15:02:59 +00:00
|
|
|
CREATE USER openstack_citest WITH CREATEDB LOGIN PASSWORD 'openstack_citest';
|
|
|
|
CREATE DATABASE openstack_citest WITH OWNER openstack_citest;
|
|
|
|
EOF
|
|
|
|
|
2015-11-05 11:47:13 -05:00
|
|
|
# User/group postgres needs to be given access to tmp_dir
|
|
|
|
setfacl -m g:postgres:rwx $tmp_dir
|
|
|
|
sudo -u postgres /usr/bin/psql --file=$tmp_dir/postgresql.sql
|
|
|
|
fi
|
2015-01-09 15:02:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function _install_agent_deps {
|
|
|
|
echo_summary "Installing agent dependencies"
|
|
|
|
|
2016-12-01 20:28:50 +09:00
|
|
|
ENABLED_SERVICES=q-agt,q-dhcp,q-l3
|
|
|
|
|
|
|
|
source $DEVSTACK_PATH/lib/neutron
|
2015-01-09 15:02:59 +00:00
|
|
|
|
|
|
|
install_neutron_agent_packages
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
# Set up the rootwrap sudoers for neutron to target the rootwrap
|
|
|
|
# configuration deployed in the venv.
|
|
|
|
function _install_rootwrap_sudoers {
|
|
|
|
echo_summary "Installing rootwrap sudoers file"
|
|
|
|
|
2015-04-21 16:12:38 -04:00
|
|
|
PROJECT_VENV=$REPO_BASE/$PROJECT_NAME/.tox/$VENV
|
|
|
|
ROOTWRAP_SUDOER_CMD="$PROJECT_VENV/bin/neutron-rootwrap $PROJECT_VENV/etc/neutron/rootwrap.conf *"
|
|
|
|
ROOTWRAP_DAEMON_SUDOER_CMD="$PROJECT_VENV/bin/neutron-rootwrap-daemon $PROJECT_VENV/etc/neutron/rootwrap.conf"
|
2015-01-09 15:02:59 +00:00
|
|
|
TEMPFILE=$(mktemp)
|
|
|
|
cat << EOF > $TEMPFILE
|
|
|
|
# A bug in oslo.rootwrap [1] prevents commands executed with 'ip netns
|
|
|
|
# exec' from being automatically qualified with a prefix from
|
|
|
|
# rootwrap's configured exec_dirs. To work around this problem, add
|
|
|
|
# the venv bin path to a user-specific secure_path.
|
|
|
|
#
|
|
|
|
# While it might seem preferable to set a command-specific
|
|
|
|
# secure_path, this would only ensure the correct path for 'ip netns
|
|
|
|
# exec' and the command targeted for execution in the namespace would
|
|
|
|
# not inherit the path.
|
|
|
|
#
|
|
|
|
# 1: https://bugs.launchpad.net/oslo.rootwrap/+bug/1417331
|
|
|
|
#
|
2016-12-22 09:42:11 +00:00
|
|
|
Defaults:$STACK_USER secure_path="$PROJECT_VENV/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
2015-01-09 15:02:59 +00:00
|
|
|
$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_SUDOER_CMD
|
Add rootwrap daemon mode support
This patch introduces support for rootwrap daemon mode. It adds
a new config option, AGENT.root_helper_daemon with no default. To
enable, set to something like:
root_helper_daemon = sudo neutron-rootwrap-daemon /etc/neutron/rootwrap.conf
The patch currently assumes that the root_helper_daemon value, and specifically
the rootwrap config, will not change once calls to execute() happen. While it
would not be hard to generate a rootwrap daemon client for each new config, I
couldn't think of a legitimate reason to support it and left it out as YAGNI.
This patch does change the behavior of the addl_env argument to create_process
and execute. Previously, an environment dict would be passed to Popen. If
a root helper was used, this environemnt would actually be passed to 'sudo'
which would filter it before passing it to the underlying command. In the case
of daemon mode, this would cause a problem as the enviornment is filtered by
sudo only once, at daemon startup. Any environment variables added at execute
time would then just be passed directly to the underyling command unfiltered.
oslo.rootwrap 1.6.0 fixes this issue by denying the passing of environment
variables to the daemon altogether. Instead, anything using rootwrap and needing
to pass additional environment variables should define an EnvFilter and run the
command with env var=val cmd. utils.execute/create_process have been modified to
run code in this way (which netns.execute already did).
No code in neutron currently uses both run_as_root=True and addl_env, so this
change does not require any change in code or filters.
DocImpact
Implements: blueprint rootwrap-daemon-mode
Change-Id: I567334bb611253c7b9d830d50c5be308a5153baf
2015-02-23 14:56:44 -06:00
|
|
|
$STACK_USER ALL=(root) NOPASSWD: $ROOTWRAP_DAEMON_SUDOER_CMD
|
2015-01-09 15:02:59 +00:00
|
|
|
EOF
|
|
|
|
chmod 0440 $TEMPFILE
|
|
|
|
sudo chown root:root $TEMPFILE
|
|
|
|
# Name the functional testing rootwrap to ensure that it will be
|
|
|
|
# loaded after the devstack rootwrap (50_stack_sh if present) so
|
|
|
|
# that the functional testing secure_path (a superset of what
|
|
|
|
# devstack expects) will not be overwritten.
|
|
|
|
sudo mv $TEMPFILE /etc/sudoers.d/60-neutron-func-test-rootwrap
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function _install_post_devstack {
|
|
|
|
echo_summary "Performing post-devstack installation"
|
|
|
|
|
|
|
|
_install_databases
|
|
|
|
_install_rootwrap_sudoers
|
|
|
|
|
2014-11-21 13:20:54 +01:00
|
|
|
if is_ubuntu; then
|
|
|
|
install_package isc-dhcp-client
|
2017-01-02 09:02:07 -05:00
|
|
|
install_package nmap
|
2014-11-21 13:20:54 +01:00
|
|
|
elif is_fedora; then
|
|
|
|
install_package dhclient
|
2017-01-02 09:02:07 -05:00
|
|
|
install_package nmap-ncat
|
2014-11-21 13:20:54 +01:00
|
|
|
else
|
2017-01-02 09:02:07 -05:00
|
|
|
exit_distro_not_supported "installing dhclient and ncat packages"
|
2014-11-21 13:20:54 +01:00
|
|
|
fi
|
|
|
|
|
2015-01-09 15:02:59 +00:00
|
|
|
# Installing python-openvswitch from packages is a stop-gap while
|
|
|
|
# python-openvswitch remains unavailable from pypi. This also
|
|
|
|
# requires that sitepackages=True be set in tox.ini to allow the
|
|
|
|
# venv to use the installed package. Once python-openvswitch
|
|
|
|
# becomes available on pypi, this will no longer be required.
|
|
|
|
#
|
|
|
|
# NOTE: the package name 'python-openvswitch' is common across
|
|
|
|
# supported distros.
|
|
|
|
install_package python-openvswitch
|
2016-09-29 13:36:07 +00:00
|
|
|
|
|
|
|
enable_kernel_bridge_firewall
|
2015-01-09 15:02:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2015-11-23 23:14:12 +00:00
|
|
|
function _configure_iptables_rules {
|
|
|
|
# For linuxbridge agent fullstack tests we need to add special rules to
|
|
|
|
# iptables for connection of agents to rabbitmq:
|
|
|
|
CHAIN_NAME="openstack-INPUT"
|
|
|
|
sudo iptables -n --list $CHAIN_NAME 1> /dev/null 2>&1 || CHAIN_NAME="INPUT"
|
|
|
|
sudo iptables -I $CHAIN_NAME -s 240.0.0.0/8 -p tcp -m tcp -d 240.0.0.0/8 --dport 5672 -j ACCEPT
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2015-01-09 15:02:59 +00:00
|
|
|
function configure_host_for_func_testing {
|
|
|
|
echo_summary "Configuring host for functional testing"
|
|
|
|
|
|
|
|
if [[ "$INSTALL_BASE_DEPENDENCIES" == "True" ]]; then
|
|
|
|
# Installing of the following can be achieved via devstack by
|
|
|
|
# installing neutron, so their installation is conditional to
|
|
|
|
# minimize the work to do on a devstack-configured host.
|
|
|
|
_install_base_deps
|
|
|
|
_install_agent_deps
|
|
|
|
_install_rpc_backend
|
|
|
|
fi
|
|
|
|
_install_post_devstack
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
_init
|
|
|
|
|
|
|
|
|
|
|
|
if [[ "$IS_GATE" != "True" ]]; then
|
2015-11-05 11:47:13 -05:00
|
|
|
if [[ "$INSTALL_MYSQL_ONLY" == "True" ]]; then
|
|
|
|
_install_databases nopg
|
|
|
|
else
|
|
|
|
configure_host_for_func_testing
|
|
|
|
fi
|
2015-01-09 15:02:59 +00:00
|
|
|
fi
|
2015-11-23 23:14:12 +00:00
|
|
|
|
|
|
|
if [[ "$VENV" =~ "dsvm-fullstack" ]]; then
|
|
|
|
_configure_iptables_rules
|
2016-11-24 12:32:55 -05:00
|
|
|
sudo modprobe ip_conntrack_proto_sctp
|
2015-11-23 23:14:12 +00:00
|
|
|
fi
|