From 83cd453dc56d2b14a2e5d95e789e20966d6525d4 Mon Sep 17 00:00:00 2001 From: omcgonag Date: Sat, 3 Apr 2021 17:01:20 -0400 Subject: [PATCH] Add validation to check DockerInsecureRegistryAddress matches the UC hostname MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One of the issues identified in the FFU testing was that the configured DockerInsecureRegistryAddress parameter was not pointing at the right UC hostname. Causing issues when retrieving the containers. This validation retrieve the value for DockerInsecureRegistryAddress configured in containers-prepare-parameter.yaml file and matches it to the UC hostname configured in the undercloud.conf. Co-Authored-By: Daniel Bengtsson Co-Authored-By: Gaël Chamoulaud Change-Id: Iab2e8823996d305d6d8807bb93f4d2f6e1c96906 (cherry picked from commit 5f375a6a0d697a5f5facf18bb7fe1bbbfba35aa5) --- doc/source/roles/role-check_uc_hostname.rst | 8 +++ playbooks/check-uc-hostname.yaml | 15 ++++ roles/check_uc_hostname/README.md | 39 ++++++++++ roles/check_uc_hostname/defaults/main.yml | 23 ++++++ .../molecule/default/Dockerfile | 35 +++++++++ .../molecule/default/converge.yml | 58 +++++++++++++++ .../molecule/default/molecule.yml | 49 +++++++++++++ .../molecule/default/prepare.yml | 72 +++++++++++++++++++ roles/check_uc_hostname/tasks/main.yml | 72 +++++++++++++++++++ zuul.d/molecule.yaml | 18 ++++- 10 files changed, 386 insertions(+), 3 deletions(-) create mode 100644 doc/source/roles/role-check_uc_hostname.rst create mode 100644 playbooks/check-uc-hostname.yaml create mode 100644 roles/check_uc_hostname/README.md create mode 100644 roles/check_uc_hostname/defaults/main.yml create mode 100644 roles/check_uc_hostname/molecule/default/Dockerfile create mode 100644 roles/check_uc_hostname/molecule/default/converge.yml create mode 100644 roles/check_uc_hostname/molecule/default/molecule.yml create mode 100644 roles/check_uc_hostname/molecule/default/prepare.yml create mode 100644 roles/check_uc_hostname/tasks/main.yml diff --git a/doc/source/roles/role-check_uc_hostname.rst b/doc/source/roles/role-check_uc_hostname.rst new file mode 100644 index 000000000..65c026e59 --- /dev/null +++ b/doc/source/roles/role-check_uc_hostname.rst @@ -0,0 +1,8 @@ +======================== +Role - check_uc_hostname +======================== + +.. include:: ../../../roles/check_uc_hostname/README.md + +.. ansibleautoplugin:: + :role: roles/check_uc_hostname diff --git a/playbooks/check-uc-hostname.yaml b/playbooks/check-uc-hostname.yaml new file mode 100644 index 000000000..6ac7c8a01 --- /dev/null +++ b/playbooks/check-uc-hostname.yaml @@ -0,0 +1,15 @@ +--- +- hosts: undercloud + gather_facts: false + vars: + metadata: + name: Check DockerInsecureRegistryAddress parameter points to correct UC hostname + description: | + This validation checks the DockerInsecureRegistryAddress parameter + points to the right UC hostname + groups: + - pre-overcloud-upgrade + - post-update + check_uc_hostname_debug: false + roles: + - check_uc_hostname diff --git a/roles/check_uc_hostname/README.md b/roles/check_uc_hostname/README.md new file mode 100644 index 000000000..b4d3ee955 --- /dev/null +++ b/roles/check_uc_hostname/README.md @@ -0,0 +1,39 @@ +Check-uc-hostname +================= + +Add Ansible role to check DockerInsecureRegistryAddress matches the UC hostname. + +Requirements +------------ + +This role will be executed pre Overcloud Update, and post Update + + +Role Variables +-------------- + +* `check_uc_hostname_debug`: <'false'> -- debugging mode. +* `check_uc_hostname_containers`: <'{{ansible_env.HOME}}/containers-prepare-parameter.yaml'> -- Sets the default path to the `containers-prepare-parameters.yaml` file on the Undercloud. +* `check_uc_hostname_undercloud`: <'{{ ansible_env.HOME }}/undercloud.conf'> -- Sets the default path to the `undercloud.conf` file on the Undercloud. + +Dependencies +------------ + +No Dependencies + +Example Playbook +---------------- + + - hosts: servers + roles: + - { role: check_uc_hostname, check_uc_hostname_debug: true } + +License +------- + +Apache + +Author Information +------------------ + +Red Hat TripleO DFG:Upgrades diff --git a/roles/check_uc_hostname/defaults/main.yml b/roles/check_uc_hostname/defaults/main.yml new file mode 100644 index 000000000..606490410 --- /dev/null +++ b/roles/check_uc_hostname/defaults/main.yml @@ -0,0 +1,23 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +# All variables intended for modification should place placed in this file. + +# All variables within this role should have a prefix of "check_uc_hostname" +check_uc_hostname_debug: false +check_uc_hostname_containers: "{{ ansible_env.HOME }}/containers-prepare-parameter.yaml" +check_uc_hostname_undercloud: "{{ ansible_env.HOME }}/undercloud.conf" diff --git a/roles/check_uc_hostname/molecule/default/Dockerfile b/roles/check_uc_hostname/molecule/default/Dockerfile new file mode 100644 index 000000000..792f46043 --- /dev/null +++ b/roles/check_uc_hostname/molecule/default/Dockerfile @@ -0,0 +1,35 @@ +# Molecule managed +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \ + elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install sudo python*-devel python*-dnf bash {{ item.pkg_extras | default('') }} && dnf clean all; \ + elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl python-setuptools bash {{ item.pkg_extras | default('') }} && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \ + elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml {{ item.pkg_extras | default('') }} && zypper clean -a; \ + elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates {{ item.pkg_extras | default('') }}; \ + elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates {{ item.pkg_extras | default('') }} && xbps-remove -O; fi + +{% for pkg in item.easy_install | default([]) %} +# install pip for centos where there is no python-pip rpm in default repos +RUN easy_install {{ pkg }} +{% endfor %} + +CMD ["sh", "-c", "while true; do sleep 10000; done"] diff --git a/roles/check_uc_hostname/molecule/default/converge.yml b/roles/check_uc_hostname/molecule/default/converge.yml new file mode 100644 index 000000000..c94da37c0 --- /dev/null +++ b/roles/check_uc_hostname/molecule/default/converge.yml @@ -0,0 +1,58 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + + +- name: Converge + hosts: all + tasks: + - name: Test working + block: + - include_role: + name: check_uc_hostname + vars: + check_uc_hostname_undercloud: "/tmp/undercloud.conf" + check_uc_hostname_containers: "/tmp/containers-prepare-parameter.yaml" + + - name: Test failing + block: + - name: populate undercloud.conf + copy: + dest: "/tmp/undercloud.conf" + content: | + [DEFAULT] + undercloud_public_host = 192.168.24.2 + + - include_role: + name: check_uc_hostname + vars: + check_uc_hostname_undercloud: "/tmp/undercloud.conf" + check_uc_hostname_containers: "/tmp/containers-prepare-parameter.yaml" + + rescue: + - name: Clear host errors + meta: clear_host_errors + + - debug: + msg: The validation works! End the playbook run + + - name: End play + meta: end_play + + - name: Fail the test + fail: + msg: | + The check-uc-hostname validation failed to check that the hostnames + did not match. diff --git a/roles/check_uc_hostname/molecule/default/molecule.yml b/roles/check_uc_hostname/molecule/default/molecule.yml new file mode 100644 index 000000000..5f17a6a39 --- /dev/null +++ b/roles/check_uc_hostname/molecule/default/molecule.yml @@ -0,0 +1,49 @@ +--- +driver: + name: podman + +log: true + +platforms: + - name: ubi8 + hostname: ubi8 + image: ubi8/ubi-init + registry: + url: registry.access.redhat.com + dockerfile: Dockerfile + pkg_extras: python*-setuptools python*-pyyaml + privileged: true + volumes: + - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro + - /etc/pki/rpm-gpg:/etc/pki/rpm-gpg + - /opt/yum.repos.d:/etc/yum.repos.d:rw + environment: &env + http_proxy: "{{ lookup('env', 'http_proxy') }}" + https_proxy: "{{ lookup('env', 'https_proxy') }}" + ulimits: &ulimit + - host + +provisioner: + name: ansible + inventory: + hosts: + all: + hosts: + ubi8: + ansible_python_interpreter: /usr/bin/python3 + log: true + env: + ANSIBLE_STDOUT_CALLBACK: yaml + ANSIBLE_LIBRARY: "${ANSIBLE_LIBRARY:-/usr/share/ansible/plugins/modules}" + +scenario: + test_sequence: + - destroy + - create + - prepare + - converge + - verify + - destroy + +verifier: + name: testinfra diff --git a/roles/check_uc_hostname/molecule/default/prepare.yml b/roles/check_uc_hostname/molecule/default/prepare.yml new file mode 100644 index 000000000..cb40dd2bf --- /dev/null +++ b/roles/check_uc_hostname/molecule/default/prepare.yml @@ -0,0 +1,72 @@ +--- +# Copyright 2021 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +- name: Prepare + hosts: all + gather_facts: false + tasks: + - name: populate undercloud.conf + copy: + dest: "/tmp/undercloud.conf" + content: | + [DEFAULT] + undercloud_public_host = 192.168.24.1 + + - name: populate containers-prepare-parameter.yaml + copy: + dest: "/tmp/containers-prepare-parameter.yaml" + content: | + parameter_defaults: + DockerInsecureRegistryAddress: + - 192.168.24.1:8787 + - docker.io + ContainerImagePrepare: + - push_destination: "192.168.24.1:8787" + set: + tag: "current-tripleo" + namespace: "docker.io/tripleomaster" + name_prefix: "openstack" + name_suffix: "" + rhel_containers: "false" + ceph_namespace: "quay.ceph.io/ceph-ci" + ceph_image: "daemon" + ceph_tag: "v5.0.7-stable-5.0-octopus-centos-8-x86_64" + openshift_tag: "v3.11.0" + +- name: Prepare localhost + hosts: localhost + gather_facts: false + tasks: + - name: populate containers-prepare-parameter.yaml + copy: + dest: "/tmp/containers-prepare-parameter.yaml" + content: | + parameter_defaults: + DockerInsecureRegistryAddress: + - 192.168.24.1:8787 + - docker.io + ContainerImagePrepare: + - push_destination: "192.168.24.1:8787" + set: + tag: "current-tripleo" + namespace: "docker.io/tripleomaster" + name_prefix: "openstack" + name_suffix: "" + rhel_containers: "false" + ceph_namespace: "quay.ceph.io/ceph-ci" + ceph_image: "daemon" + ceph_tag: "v5.0.7-stable-5.0-octopus-centos-8-x86_64" + openshift_tag: "v3.11.0" diff --git a/roles/check_uc_hostname/tasks/main.yml b/roles/check_uc_hostname/tasks/main.yml new file mode 100644 index 000000000..6ada64344 --- /dev/null +++ b/roles/check_uc_hostname/tasks/main.yml @@ -0,0 +1,72 @@ +--- +# Copyright 2020 Red Hat, Inc. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +- name: Ensure we get needed facts + setup: + gather_subset: + - '!all' + - '!any' + - '!min' + - env + +- name: Check undercloud.conf + stat: + path: "{{ check_uc_hostname_undercloud }}" + register: stat_result_uc_hostname_undercloud + +- name: Check containers-prepare-parameter + stat: + path: "{{ check_uc_hostname_containers }}" + register: stat_result_uc_hostname_containers + +- name: Fail if one of those files is missing + fail: + msg: | + The following configuration file(s) is/are missing: + {% if not stat_result_uc_hostname_undercloud.stat.exists %} + - "{{ check_uc_hostname_undercloud }}" + {% endif %} + {% if not stat_result_uc_hostname_containers.stat.exists %} + - "{{ check_uc_hostname_containers }}" + {% endif %} + when: not stat_result_uc_hostname_undercloud.stat.exists or not stat_result_uc_hostname_containers.stat.exists + +- when: + - stat_result_uc_hostname_undercloud.stat.exists + - stat_result_uc_hostname_containers.stat.exists + block: + - name: Get undercloud_public_host value from undercloud.conf file + validations_read_ini: + path: "{{ check_uc_hostname_undercloud }}" + section: DEFAULT + key: undercloud_public_host + register: uc_hostname_undercloud + + - name: Get DockerInsecureRegistryAddress value from containers file + set_fact: + uc_hostname_containers: "{{ item.split(':')[0] }}" + with_items: "{{ (lookup('template', '{{ check_uc_hostname_containers }}') + | from_yaml).parameter_defaults.DockerInsecureRegistryAddress + | list + | first }}" + + - name: Verify UC hostnames match + fail: + msg: | + The UC hostnames from undercloud.conf and containers-prepare-parameter.yaml must match + UC hostname from undercloud.conf is {{ uc_hostname_undercloud.value }} + UC hostname from containers-prepare-parameter.yaml is {{ uc_hostname_containers }} + failed_when: uc_hostname_undercloud.value != uc_hostname_containers diff --git a/zuul.d/molecule.yaml b/zuul.d/molecule.yaml index a2ebffb71..2178b2068 100644 --- a/zuul.d/molecule.yaml +++ b/zuul.d/molecule.yaml @@ -2,11 +2,11 @@ - project-template: check: jobs: - - tripleo-validations-centos-8-molecule-system_encoding - tripleo-validations-centos-8-molecule-ceph - tripleo-validations-centos-8-molecule-check_network_gateway - tripleo-validations-centos-8-molecule-check_rhsm_version - tripleo-validations-centos-8-molecule-check_undercloud_conf + - tripleo-validations-centos-8-molecule-check_uc_hostname - tripleo-validations-centos-8-molecule-controller_token - tripleo-validations-centos-8-molecule-controller_ulimits - tripleo-validations-centos-8-molecule-ctlplane_ip_range @@ -17,27 +17,28 @@ - tripleo-validations-centos-8-molecule-rabbitmq_limits - tripleo-validations-centos-8-molecule-repos - tripleo-validations-centos-8-molecule-stonith_exists + - tripleo-validations-centos-8-molecule-system_encoding - tripleo-validations-centos-8-molecule-tls_everywhere - tripleo-validations-centos-8-molecule-undercloud_debug - tripleo-validations-centos-8-molecule-undercloud_heat_purge_deleted - tripleo-validations-centos-8-molecule-undercloud_tokenflush gate: jobs: - - tripleo-validations-centos-8-molecule-system_encoding - tripleo-validations-centos-8-molecule-ceph - tripleo-validations-centos-8-molecule-check_network_gateway - tripleo-validations-centos-8-molecule-check_rhsm_version + - tripleo-validations-centos-8-molecule-check_uc_hostname - tripleo-validations-centos-8-molecule-check_undercloud_conf - tripleo-validations-centos-8-molecule-controller_token - tripleo-validations-centos-8-molecule-controller_ulimits - tripleo-validations-centos-8-molecule-ctlplane_ip_range - - tripleo-validations-centos-8-molecule-image_serve - tripleo-validations-centos-8-molecule-nova_status - tripleo-validations-centos-8-molecule-nova_svirt - tripleo-validations-centos-8-molecule-package_version - tripleo-validations-centos-8-molecule-rabbitmq_limits - tripleo-validations-centos-8-molecule-repos - tripleo-validations-centos-8-molecule-stonith_exists + - tripleo-validations-centos-8-molecule-system_encoding - tripleo-validations-centos-8-molecule-tls_everywhere - tripleo-validations-centos-8-molecule-undercloud_debug - tripleo-validations-centos-8-molecule-undercloud_heat_purge_deleted @@ -338,3 +339,14 @@ parent: tripleo-validations-centos-8-base vars: tripleo_validations_role_name: check_undercloud_conf + +- job: + files: + - ^roles/check_uc_hostname/.* + - ^tests/prepare-test-host.yml + - ^ci/playbooks/pre.yml + - ^ci/playbooks/run.yml + name: tripleo-validations-centos-8-molecule-check_uc_hostname + parent: tripleo-validations-centos-8-base + vars: + tripleo_validations_role_name: check_uc_hostname