Integration of Intel Device Plugins as a system app

This commit creates directory structure and changes for
python plugin for Intel Device Plugins.

This is basic system application python plugin for app lifecycle
management which is defined in the
python3-k8sapp-intel-device-plugins-operator directory within the
app-intel-device-plugins repo.

This enables the intel-device-plugins-operator which generates the
custom resource definitions (CRDs) for device plugins like QAT and
GPU. Based on that, QAT and GPU plugins will be enabled.

In the upcoming code review, app label, tolerations and affinity will
be implemented as part of Helm configuration for QAT and GPU plugins.

Test Plan:
PASSED: Build process is successful with creation of debian package.
PASSED: Extract the content of
        stx-intel-device-plugins-helm_1.0-1.stx.1_amd64.deb and check
	if the helm tar file is present.
PASSED: AIO-SX app upload using 'system application-upload' command.
PASSED: AIO-DX app upload using 'system application-upload' command.
PASSED: AIO-SX app apply using 'system application-apply' command.
PASSED: AIO-DX app apply using 'system application-apply' command.
PASSED: Tested app upload/apply/remove/delete in AIO-SX and AIO-DX.

Story: 2010604
Task: 48793

Change-Id: I0940704787035bfb250ab1b83f7156f150d84afc
Signed-off-by: Md Irshad Sheikh <mdirshad.sheikh@windriver.com>
This commit is contained in:
Md Irshad Sheikh 2023-10-13 10:00:57 +00:00 committed by msheikh
parent 6107e0160c
commit 8e8101b6a6
39 changed files with 1290 additions and 7 deletions

View File

@ -3,7 +3,62 @@
check:
jobs:
- openstack-tox-linters
- k8sapp-intel-device-plugins-operator-tox-py39
- k8sapp-intel-device-plugins-operator-tox-pylint
- k8sapp-intel-device-plugins-operator-tox-flake8
gate:
jobs:
- openstack-tox-linters
- k8sapp-intel-device-plugins-operator-tox-py39
- k8sapp-intel-device-plugins-operator-tox-pylint
- k8sapp-intel-device-plugins-operator-tox-flake8
- job:
name: k8sapp-intel-device-plugins-operator-tox-py39
parent: tox-py39
description: |
Run py39 for intel-device-plugins-operator app
nodeset: debian-bullseye
required-projects:
- starlingx/config
- starlingx/fault
- starlingx/update
- starlingx/utilities
- starlingx/root
files:
- python3-k8sapp-intel-device-plugins-operator/*
vars:
tox_envlist: py39
tox_extra_args: -c python3-k8sapp-intel-device-plugins-operator/k8sapp_intel_device_plugins_operator/tox.ini
tox_constraints_file: '{{ ansible_user_dir }}/src/opendev.org/starlingx/root/build-tools/requirements/debian/upper-constraints.txt'
- job:
name: k8sapp-intel-device-plugins-operator-tox-pylint
parent: tox
description: |
Run pylint test for k8sapp_intel_device_plugins_operator
required-projects:
- starlingx/config
- starlingx/fault
- starlingx/update
- starlingx/utilities
- starlingx/root
nodeset: debian-bullseye
files:
- python3-k8sapp-intel-device-plugins-operator/*
vars:
tox_envlist: pylint
tox_extra_args: -c python3-k8sapp-intel-device-plugins-operator/k8sapp_intel_device_plugins_operator/tox.ini
tox_constraints_file: '{{ ansible_user_dir }}/src/opendev.org/starlingx/root/build-tools/requirements/debian/upper-constraints.txt'
- job:
name: k8sapp-intel-device-plugins-operator-tox-flake8
parent: tox
description: |
Run flake8 for intel-device-plugins-operator
nodeset: debian-bullseye
files:
- python3-k8sapp-intel-device-plugins-operator/*
vars:
tox_envlist: flake8
tox_extra_args: -c python3-k8sapp-intel-device-plugins-operator/k8sapp_intel_device_plugins_operator/tox.ini

View File

@ -1,2 +1,3 @@
intel-device-plugins-operator-helm
python3-k8sapp-intel-device-plugins-operator
stx-intel-device-plugins-operator-helm

View File

@ -0,0 +1,27 @@
From: Md Irshad Sheikh <mdirshad.sheikh@windriver.com>
Date: Wed, 27 Sep 2023 03:55:02 -0500
Subject: [PATCH] app-intel-device-plugins
Signed-off-by: Md Irshad Sheikh <mdirshad.sheikh@windriver.com>
---
templates/operator.yaml | 3 +
1 file changed, 3 insertion(+)
diff --git a/templates/operator.yaml b/templates/operator.yaml
index 558ded6..8ce7e3b 100644
--- a/templates/operator.yaml
+++ b/templates/operator.yaml
@@ -420,10 +420,13 @@ spec:
selector:
matchLabels:
control-plane: controller-manager
+ strategy:
+ type: Recreate
template:
metadata:
labels:
control-plane: controller-manager
+ app.starlingx.io/component: {{ index .Values "app.starlingx.io/component" }}
spec:
{{- if .Values.privateRegistry.registrySecret }}
imagePullSecrets:

View File

@ -0,0 +1 @@
0001-intel-device-plugins-operator-add-label-app.starlingx.io-component.patch

View File

@ -0,0 +1,5 @@
python3-k8sapp-intel-device-plugins-operator (1.0-1) unstable; urgency=medium
* Initial release.
-- Md Irshad Sheikh <mdirshad.sheikh@windriver.com> Fri, 30 August 2023 10:57:54 +0000

View File

@ -0,0 +1,27 @@
Source: python3-k8sapp-intel-device-plugins-operator
Section: libs
Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
dh-python,
python3-all,
python3-pbr,
python3-setuptools,
python3-wheel
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io
Package: python3-k8sapp-intel-device-plugins-operator
Section: libs
Architecture: any
Depends: ${misc:Depends}, ${python3:Depends}
Description: StarlingX Sysinv intel-device-plugins-operator Extensions
This package contains sysinv plugins for the intel-device-plugins-operator K8S app.
Package: python3-k8sapp-intel-device-plugins-operator-wheels
Section: libs
Architecture: any
Depends: ${misc:Depends}, ${python3:Depends}, python3-wheel
Description: StarlingX Sysinv intel-device-plugins-operator Extension Wheels
This package contains python wheels for the intel-device-plugins-operator K8S app plugins.

View File

@ -0,0 +1,41 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: python3-k8sapp-intel-device-plugins-operator
Source: https://opendev.org/starlingx/app-intel-device-plugins/
Files: *
Copyright: (c) 2023 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'.
# If you want to use GPL v2 or later for the /debian/* files use
# the following clauses, or change it to suit. Delete these two lines
Files: debian/*
Copyright: 2023 Wind River Systems, Inc
License: Apache-2
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian-based systems the full text of the Apache version 2.0 license
can be found in `/usr/share/common-licenses/Apache-2.0'

View File

@ -0,0 +1 @@
usr/lib/python3/dist-packages/k8sapp_*

View File

@ -0,0 +1,34 @@
#!/usr/bin/make -f
#export DH_VERBOSE = 1
export APP_NAME = intel-device-plugins-operator
export PYBUILD_NAME = k8sapp_intel_device_plugins_operator
export DEB_VERSION = $(shell dpkg-parsechangelog | egrep '^Version:' | cut -f 2 -d ' ')
export MAJOR = $(shell echo $(DEB_VERSION) | cut -f 1 -d '-')
export MINOR_PATCH = $(shell echo $(DEB_VERSION) | cut -f 4 -d '.')
export PBR_VERSION = $(MAJOR).$(MINOR_PATCH)
export ROOT = $(CURDIR)/debian/tmp
export SKIP_PIP_INSTALL = 1
%:
dh $@ --with=python3 --buildsystem=pybuild
override_dh_auto_install:
python3 setup.py install \
--install-layout=deb \
--root $(ROOT)
python3 setup.py bdist_wheel \
--universal \
-d $(ROOT)/plugins
override_dh_python3:
dh_python3 --shebang=/usr/bin/python3
ifeq (,$(findstring nocheck, $(DEB_BUILD_OPTIONS)))
override_dh_auto_test:
# (tbogue) FIXME
PYTHONDIR=$(CURDIR) stestr run || true
endif

View File

@ -0,0 +1 @@
3.0 (quilt)

View File

@ -0,0 +1,9 @@
---
debname: python3-k8sapp-intel-device-plugins-operator
debver: 1.0-1
src_path: k8sapp_intel_device_plugins_operator
revision:
dist: $STX_DIST
GITREVCOUNT:
SRC_DIR: ${MY_REPO}/stx/app-intel-device-plugins/intel-device-plugins-operator-helm
BASE_SRCREV: 99a5c80d3cd9d07b695ed57fbd29c72f1844f66a

View File

@ -0,0 +1,35 @@
# Compiled files
*.py[co]
*.a
*.o
*.so
# Sphinx
_build
doc/source/api/
# Packages/installer info
*.egg
*.egg-info
dist
build
eggs
parts
var
sdist
develop-eggs
.installed.cfg
# Other
*.DS_Store
.stestr
.testrepository
.tox
.venv
.*.swp
.coverage
bandit.xml
cover
AUTHORS
ChangeLog
*.sqlite

View File

@ -0,0 +1,3 @@
[DEFAULT]
test_path=./k8sapp_intel_device_plugins_operator/tests
top_dir=./k8sapp_intel_device_plugins_operator

View File

@ -0,0 +1,202 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright 2022 Wind River Systems, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

View File

@ -0,0 +1,7 @@
k8sapp-intel-device-plugins-operator
=============
This project contains StarlingX Kubernetes application specific python plugins
for Intel Device Plugins. These plugins are required to integrate the Intel
Device Plugins application into the StarlingX application framework and to
support the various StarlingX deployments.

View File

@ -0,0 +1,18 @@
#
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# Application Name
HELM_APP_INTEL_DEVICE_PLUGINS_OPERATOR = 'intel-device-plugins-operator'
# Namespace to deploy the application
HELM_NS_INTEL_DEVICE_PLUGINS_OPERATOR = 'intel-device-plugins-operator'
# Chart name
HELM_CHART_INTEL_DEVICE_PLUGINS_OPERATOR = 'intel-device-plugins-operator'
# Label
HELM_COMPONENT_LABEL_INTEL_DEVICE_PLUGINS_OPERATOR = 'app.starlingx.io/component'
HELM_COMPONENT_SUPPORTED_LABELS = ('platform', 'application')

View File

@ -0,0 +1,45 @@
#
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
from sysinv.common import exception
from sysinv.helm import base
from k8sapp_intel_device_plugins_operator.common import constants as app_constants
from oslo_log import log as logging
LOG = logging.getLogger(__name__)
class IntelDevicePluginsOperatorHelm(base.BaseHelm):
"""Class to encapsulate helm operations for the intel-device-plugins-operator chart."""
SUPPORTED_NAMESPACES = base.BaseHelm.SUPPORTED_NAMESPACES + \
[app_constants.HELM_NS_INTEL_DEVICE_PLUGINS_OPERATOR]
SUPPORTED_APP_NAMESPACES = {
app_constants.HELM_APP_INTEL_DEVICE_PLUGINS_OPERATOR:
base.BaseHelm.SUPPORTED_NAMESPACES +
[app_constants.HELM_NS_INTEL_DEVICE_PLUGINS_OPERATOR],
}
CHART = app_constants.HELM_CHART_INTEL_DEVICE_PLUGINS_OPERATOR
SERVICE_NAME = app_constants.HELM_APP_INTEL_DEVICE_PLUGINS_OPERATOR
def get_namespaces(self):
return self.SUPPORTED_NAMESPACES
def get_overrides(self, namespace=None):
overrides = {
app_constants.HELM_NS_INTEL_DEVICE_PLUGINS_OPERATOR: {}
}
if namespace in self.SUPPORTED_NAMESPACES:
return overrides[namespace]
elif namespace:
raise exception.InvalidHelmNamespace(
chart=self.CHART, namespace=namespace)
else:
return overrides

View File

@ -0,0 +1,99 @@
#
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# All Rights Reserved.
#
""" System inventory App lifecycle operator."""
from k8sapp_intel_device_plugins_operator.common import constants as app_constants
from oslo_log import log as logging
from sysinv.common import constants
from sysinv.helm import lifecycle_base as base
from sysinv.helm import lifecycle_utils
import yaml
LOG = logging.getLogger(__name__)
class IntelDevicePluginsAppLifecycleOperator(base.AppLifecycleOperator):
"""Class for app lifecycle management of app-intel-device-plugins."""
def app_lifecycle_actions(self, context, conductor_obj, app_op, app, hook_info):
"""
Perform lifecycle actions for an operation.
:param context: request context, can be None
:param conductor_obj: conductor object, can be None
:param app_op: AppOperator object
:param app: AppOperator.Application object
:param hook_info: LifecycleHookInfo object
"""
if hook_info.lifecycle_type == constants.APP_LIFECYCLE_TYPE_FLUXCD_REQUEST:
if hook_info.operation == constants.APP_APPLY_OP:
if hook_info.relative_timing == constants.APP_LIFECYCLE_TIMING_POST:
lifecycle_utils.create_local_registry_secrets(app_op, app, hook_info)
lifecycle_utils.add_pod_security_admission_controller_labels(
app_op, app, hook_info)
return self.add_component_label_in_pods(app_op, app)
elif hook_info.operation == constants.APP_REMOVE_OP and \
hook_info.relative_timing == constants.APP_LIFECYCLE_TIMING_POST:
return lifecycle_utils.delete_local_registry_secrets(app_op, app, hook_info)
super(IntelDevicePluginsAppLifecycleOperator, self).app_lifecycle_actions(
context, conductor_obj, app_op, app, hook_info
)
def add_component_label_in_pods(self, app_op, app):
"""
Adding component label in pods.
:param app_op: AppOperator object
:param app: AppOperator.Application object
"""
dbapi_instance = app_op._dbapi
db_app_id = dbapi_instance.kube_app_get(app.name).id
component_constant = app_constants.HELM_COMPONENT_LABEL_INTEL_DEVICE_PLUGINS_OPERATOR
# List all charts enabled
charts = self._get_charts_enabled(dbapi_instance, db_app_id)
for chart in charts:
# Loading user-overrides
user_overrides = chart['user_overrides']
# If user-overrides exists, checking if label was set by user.
if user_overrides and component_constant in user_overrides:
dict_chart_overrides = yaml.safe_load(user_overrides)
label = dict_chart_overrides[component_constant]
# Checking if it's a supported label. If not, set platform as default label.
if label not in app_constants.HELM_COMPONENT_SUPPORTED_LABELS:
dict_chart_overrides[component_constant] = 'platform'
LOG.warn(f'User override for core affinity {label} is not supported,' +
'using platform as default label.')
chart['user_overrides'] = yaml.safe_dump(dict_chart_overrides)
dbapi_instance.helm_override_update(
db_app_id,
chart['name'],
app_constants.HELM_NS_INTEL_DEVICE_PLUGINS_OPERATOR,
chart)
def _get_charts_enabled(self, dbapi_instance, db_app_id):
# Listing all helm charts from db_app_id
overrides = dbapi_instance.helm_override_get_all(
app_id=db_app_id
)
# Getting only charts enabled
charts = [{
"name": i.name,
"user_overrides": i.user_overrides,
"system_overrides": i.system_overrides
} for i in overrides if i.system_overrides['enabled'] is True]
return charts

View File

@ -0,0 +1,32 @@
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
from k8sapp_intel_device_plugins_operator.tests import test_plugins
from sysinv.db import api as dbapi
from sysinv.tests.db import base as dbbase
from sysinv.tests.db import utils as dbutils
from sysinv.tests.helm import base
class IntelDevicePluginsTestCase(
test_plugins.K8SAppIntelDevicePluginsAppMixin, base.HelmTestCaseMixin
):
"""Class for testing of intel-device-plugins-operator."""
def setUp(self):
super(IntelDevicePluginsTestCase, self).setUp()
self.app = dbutils.create_test_app(name='intel-device-plugins-operator')
self.dbapi = dbapi.get_instance()
class IntelDevicePluginsTestCaseDummy(
IntelDevicePluginsTestCase, dbbase.ProvisionedControllerHostTestCase
):
"""Dummy test case for intel-device-plugins-operator"""
# without a test zuul will fail
def test_dummy(self):
pass

View File

@ -0,0 +1,39 @@
#
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
from k8sapp_intel_device_plugins_operator.common import constants as app_constants
from sysinv.tests.db import base as dbbase
class K8SAppIntelDevicePluginsAppMixin(object):
app_name = app_constants.HELM_APP_INTEL_DEVICE_PLUGINS_OPERATOR
path_name = app_name + '.tgz'
def setUp(self):
super(K8SAppIntelDevicePluginsAppMixin, self).setUp()
# Test Configuration:
# - Controller
# - IPv6
# - Ceph Storage
# - intel-device-plugins-operator app
class K8SAppIntelDevicePluginsControllerTestCase(K8SAppIntelDevicePluginsAppMixin,
dbbase.BaseIPv6Mixin,
dbbase.BaseCephStorageBackendMixin,
dbbase.ControllerHostTestCase):
pass
# Test Configuration:
# - AIO
# - IPv4
# - Ceph Storage
# - intel-device-plugins-operator app
class K8SAppIntelDevicePluginsAIOTestCase(K8SAppIntelDevicePluginsAppMixin,
dbbase.BaseCephStorageBackendMixin,
dbbase.AIOSimplexHostTestCase):
pass

View File

@ -0,0 +1,336 @@
[MASTER]
# Specify a configuration file.
rcfile=pylint.rc
# Python code to execute, usually for sys.path manipulation such as
# pygtk.require().
#init-hook=
# Add files or directories to the blacklist. Should be base names, not paths.
ignore=
# Pickle collected data for later comparisons.
persistent=yes
# List of plugins (as comma separated values of python modules names) to load,
# usually to register additional checkers.
load-plugins=
# Use multiple processes to speed up Pylint.
jobs=4
# Allow loading of arbitrary C extensions. Extensions are imported into the
# active Python interpreter and may run arbitrary code.
unsafe-load-any-extension=no
# A comma-separated list of package or module names from where C extensions may
# be loaded. Extensions are loading into the active Python interpreter and may
# run arbitrary code
extension-pkg-whitelist=lxml.etree,greenlet
[MESSAGES CONTROL]
# Disable the message, report, category or checker with the given id(s). You
# can either give multiple identifier separated by comma (,) or put this option
# multiple time (only on the command line, not in the configuration file where
# it should appear only once).
# See "Messages Control" section of
# https://pylint.readthedocs.io/en/latest/user_guide
disable=
# C codes refer to Convention
C0103, # invalid-name
C0104, # disallowed-nameA
C0112, # empty-docstring
C0114, # missing-module-docstring
C0115, # missing-class-docstring
C0116, # missing-function-docstring
C0123, # unidiomatic-typecheck !!!
C0201, # consider-iterating-dictionary
C0202, # bad-classmethod-argument
C0206, # consider-using-dict-items
C0207, # use-maxsplit-arg
C0209, # consider-using-f-string
C0301, # line-too-long
C0302, # too-many-lines
C0325, # superfluous-parens
C0411, # wrong-import-order
C0412, # ungrouped-imports
C0413, # wrong-import-position
C0414, # useless-import-alias !!!
C0415, # import-outside-toplevel
C1802, # use-implicit-booleaness-not-len !!!
C2801, # unnecessary-dunder-call !!!
C3002, # unnecessary-direct-lambda-call !!!
# R codes refer to refactoring
R0022, # useless-option-value !!!
R0205, # useless-object-inheritance
R0402, # consider-using-from-import
R0901, # too-many-ancestors
R0902, # too-many-instance-attributes
R0903, # too-few-public-methods
R0904, # too-many-public-methods
R0911, # too-many-return-statements
R0912, # too-many-branches
R0913, # too-many-arguments
R0914, # too-many-locals
R0915, # too-many-statements
R0916, # too-many-boolean-expressions
R1702, # too-many-nested-blocks
R1703, # simplifiable-if-statement
R1704, # redefined-argument-from-local !!!
R1705, # no-else-return
R1707, # trailing-comma-tuple !!!
R1708, # stop-iteration-return !!!
R1710, # inconsistent-return-statements
R1711, # useless-return
R1714, # consider-using-in
R1717, # consider-using-dict-comprehension !!!
R1718, # consider-using-set-comprehension
R1719, # simplifiable-if-expression
R1720, # no-else-raise
R1721, # unnecessary-comprehension
R1722, # consider-using-sys-exit !!!
R1723, # no-else-break
R1724, # no-else-continue
R1725, # super-with-arguments
R1726, # simplifiable-condition !!!
R1728, # consider-using-generator
R1729, # use-a-generator
R1730, # consider-using-min-builtin !!!
R1731, # consider-using-max-builtin !!!
R1732, # consider-using-with
R1733, # unnecessary-dict-index-lookup !!
R1734, # use-list-literal
R1735, # use-dict-literal
# W codes are warnings
W0101, # unreachable
W0105, # pointless-string-statement
W0106, # expression-not-assigned
W0107, # unnecessary-pass
W0108, # unnecessary-lambda
W0109, # duplicate-key !!!
W0123, # eval-used
W0125, # using-constant-test !!!
W0133, # pointless-exception-statement !!!
W0143, # comparison-with-callable !!!
W0150, # lost-exception
W0201, # attribute-defined-outside-init
W0211, # bad-staticmethod-argument
W0212, # protected-access
W0221, # arguments-differ
W0223, # abstract-method
W0231, # super-init-not-called
W0235, # useless-super-delegation
W0237, # arguments-renamed !!!
W0311, # bad-indentation
W0402, # deprecated-module
W0404, # reimported
W0511, # fixme
W0602, # global-variable-not-assigned !!!
W0603, # global-statement
W0612, # unused-variable
W0613, # unused-argument
W0621, # redefined-outer-name
W0622, # redefined-builtin
W0631, # undefined-loop-variable
W0703, # broad-except (pylint 2.16 renamed to broad-except-caught)
W0706, # try-except-raise
W0707, # raise-missing-from
W0719, # broad-exception-raised
W1113, # keyword-arg-before-vararg
W1310, # format-string-without-interpolation !!!
W1401, # anomalous-backslash-in-string
W1406, # redundant-u-string-prefix
W1505, # deprecated-method
W1514, # unspecified-encoding
W3101, # missing-timeout
E0601, # used-before-assignment !!!
E0605, # invalid-all-format !!!
E1101, # no-member
E1111, # assignment-from-no-return
E1121, # too-many-function-args !!!
E1123, # unexpected-keyword-arg !!!
E1136, # unsubscriptable-object !!!
[REPORTS]
# Set the output format. Available formats are text, parseable, colorized, msvs
# (visual studio) and html
output-format=text
# Tells whether to display a full report or only the messages
reports=no
# Python expression which should return a note less than 10 (10 is the highest
# note). You have access to the variables errors warning, statement which
# respectively contain the number of errors / warnings messages and the total
# number of statements analyzed. This is used by the global evaluation report
# (RP0004).
evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
[SIMILARITIES]
# Minimum lines number of a similarity.
min-similarity-lines=4
# Ignore comments when computing similarities.
ignore-comments=yes
# Ignore docstrings when computing similarities.
ignore-docstrings=yes
[FORMAT]
# Maximum number of characters on a single line.
max-line-length=85
# Maximum number of lines in a module
max-module-lines=1000
# String used as indentation unit. This is usually 4 spaces or "\t" (1 tab).
indent-string=' '
[TYPECHECK]
# Tells whether missing members accessed in mixin class should be ignored. A
# mixin class is detected if its name ends with "mixin" (case insensitive).
ignore-mixin-members=yes
# List of module names for which member attributes should not be checked
# (useful for modules/projects where namespaces are manipulated during runtime
# and thus existing member attributes cannot be deduced by static analysis
ignored-modules=distutils,eventlet.green.subprocess,six,six.moves
# List of classes names for which member attributes should not be checked
# (useful for classes with attributes dynamically set).
# pylint is confused by sqlalchemy Table, as well as sqlalchemy Enum types
# ie: (unprovisioned, identity)
# LookupDict in requests library confuses pylint
ignored-classes=SQLObject, optparse.Values, thread._local, _thread._local,
Table, unprovisioned, identity, LookupDict
# List of members which are set dynamically and missed by pylint inference
# system, and so shouldn't trigger E0201 when accessed. Python regular
# expressions are accepted.
generated-members=REQUEST,acl_users,aq_parent
[BASIC]
# Regular expression which should only match correct module names
module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
# Regular expression which should only match correct module level names
const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
# Regular expression which should only match correct class names
class-rgx=[A-Z_][a-zA-Z0-9]+$
# Regular expression which should only match correct function names
function-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct method names
method-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct instance attribute names
attr-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct argument names
argument-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct variable names
variable-rgx=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match correct list comprehension /
# generator expression variable names
inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
# Good variable names which should always be accepted, separated by a comma
good-names=i,j,k,ex,Run,_
# Bad variable names which should always be refused, separated by a comma
bad-names=foo,bar,baz,toto,tutu,tata
# Regular expression which should only match functions or classes name which do
# not require a docstring
no-docstring-rgx=__.*__
[MISCELLANEOUS]
# List of note tags to take in consideration, separated by a comma.
notes=FIXME,XXX,TODO
[VARIABLES]
# Tells whether we should check for unused import in __init__ files.
init-import=no
# A regular expression matching the beginning of the name of dummy variables
# (i.e. not used).
dummy-variables-rgx=_|dummy
# List of additional names supposed to be defined in builtins. Remember that
# you should avoid to define new builtins when possible.
additional-builtins=
[IMPORTS]
# Deprecated modules which should not be used, separated by a comma
deprecated-modules=regsub,string,TERMIOS,Bastion,rexec
# Create a graph of every (i.e. internal and external) dependencies in the
# given file (report RP0402 must not be disabled)
import-graph=
# Create a graph of external dependencies in the given file (report RP0402 must
# not be disabled)
ext-import-graph=
# Create a graph of internal dependencies in the given file (report RP0402 must
# not be disabled)
int-import-graph=
[DESIGN]
# Maximum number of arguments for function / method
max-args=5
# Argument names that match this expression will be ignored. Default to name
# with leading underscore
ignored-argument-names=_.*
# Maximum number of locals for function / method body
max-locals=15
# Maximum number of return / yield for function / method body
max-returns=6
# Maximum number of branch for function / method body
max-branches=12
# Maximum number of statements in function / method body
max-statements=50
# Maximum number of parents for a class (see R0901).
max-parents=7
# Maximum number of attributes for a class (see R0902).
max-attributes=7
# Minimum number of public methods for a class (see R0903).
min-public-methods=2
# Maximum number of public methods for a class (see R0904).
max-public-methods=20
[CLASSES]
# List of method names used to declare (i.e. assign) instance attributes.
defining-attr-methods=__init__,__new__,setUp
# List of valid names for the first argument in a class method.
valid-classmethod-first-arg=cls
[EXCEPTIONS]
# Exceptions that will emit a warning when caught.
overgeneral-exceptions=builtins.BaseException,builtins.Exception

View File

@ -0,0 +1,2 @@
pbr>=2.0.0
PyYAML>=3.10

View File

@ -0,0 +1,43 @@
[metadata]
name = k8sapp-intel-device-plugins-operator
summary = StarlingX sysinv extensions for intel-device-plugins-operator
long_description = file: README.rst
long_description_content_type = text/x-rst
license = Apache 2.0
author = StarlingX
author-email = starlingx-discuss@lists.starlingx.io
home-page = https://www.starlingx.io/
classifier =
Environment :: OpenStack
Intended Audience :: Information Technology
Intended Audience :: System Administrators
License :: OSI Approved :: Apache Software License
Operating System :: POSIX :: Linux
Programming Language :: Python
Programming Language :: Python :: 2
Programming Language :: Python :: 2.7
Programming Language :: Python :: 3
Programming Language :: Python :: 3.4
Programming Language :: Python :: 3.5
Programming Language :: Python :: 3.9
[files]
packages =
k8sapp_intel_device_plugins_operator
[global]
setup-hooks =
pbr.hooks.setup_hook
[entry_points]
systemconfig.helm_applications =
intel-device-plugins-operator = systemconfig.helm_plugins.intel_device_plugins_operator
systemconfig.helm_plugins.intel_device_plugins_operator =
001_intel-device-plugins-operator = k8sapp_intel_device_plugins_operator.helm.intel_device_plugins_operator:IntelDevicePluginsOperatorHelm
systemconfig.app_lifecycle =
intel-device-plugins-operator = k8sapp_intel_device_plugins_operator.lifecycle.lifecycle_intel_device_plugins_operator:IntelDevicePluginsAppLifecycleOperator
[wheel]
universal = 1

View File

@ -0,0 +1,9 @@
#
# Copyright (c) 2023 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
import setuptools
setuptools.setup(setup_requires=["pbr>=2.0.0"], pbr=True)

View File

@ -0,0 +1,20 @@
# The order of packages is significant, because pip processes them in the order
# of appearance. Changing the order has an impact on the overall integration
# process, which may cause wedges in the gate later.
hacking>=1.1.0,<=2.0.0 # Apache-2.0
astroid
bandit<1.7.2;python_version>="3.0"
coverage>=3.6
fixtures>=3.0.0 # Apache-2.0/BSD
mock>=2.0.0 # BSD
python-subunit>=0.0.18
requests-mock>=0.6.0 # Apache-2.0
sphinx
oslosphinx
oslotest>=3.2.0 # Apache-2.0
stestr>=1.0.0 # Apache-2.0
testrepository>=0.0.18
testtools!=1.2.0,>=0.9.36
isort<5;python_version>="3.0"
pylint
pycryptodomex

View File

@ -0,0 +1,181 @@
[tox]
envlist = flake8,py39,pylint
minversion = 1.6
skipsdist = True
# tox does not work if the path to the workdir is too long, so move it to /tmp
# tox 3.1.0 adds TOX_LIMITED_SHEBANG
toxworkdir = /tmp/{env:USER}_k8sappinteldevicepluginsoperatortox
stxdir = {toxinidir}/../../..
distshare={toxworkdir}/.tox/distshare
[testenv]
basepython = python3.9
usedevelop = True
# tox is silly... these need to be separated by a newline....
allowlist_externals = bash
find
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
# Note the hash seed is set to 0 until can be tested with a
# random hash seed successfully.
setenv = VIRTUAL_ENV={envdir}
PYTHONHASHSEED=0
PIP_RESOLVER_DEBUG=1
PYTHONDONTWRITEBYTECODE=1
OS_TEST_PATH=./k8sapp_intel_device_plugins_operator/tests
LANG=en_US.UTF-8
LANGUAGE=en_US:en
LC_ALL=C
EVENTS_YAML=./k8sapp_intel_device_plugins_operator/tests/events_for_testing.yaml
SYSINV_TEST_ENV=True
TOX_WORK_DIR={toxworkdir}
PYLINTHOME={toxworkdir}
deps = -r{toxinidir}/requirements.txt
-r{toxinidir}/test-requirements.txt
-e{[tox]stxdir}/config/tsconfig/tsconfig
-e{[tox]stxdir}/fault/fm-api/source
-e{[tox]stxdir}/fault/python-fmclient/fmclient
-e{[tox]stxdir}/config/controllerconfig/controllerconfig
-e{[tox]stxdir}/update/sw-patch/cgcs-patch
-e{[tox]stxdir}/utilities/ceph/python-cephclient/python-cephclient
-e{[tox]stxdir}/config/sysinv/sysinv/sysinv
commands =
find . -type f -name "*.pyc" -delete
[flake8]
# H series are hacking
# H101 is TODO
# H102 is apache license
# H104 file contains only comments (ie: license)
# H105 author tags
# H306 imports not in alphabetical order
# H401 docstring should not start with a space
# H403 multi line docstrings should end on a new line
# H404 multi line docstring should start without a leading new line
# H405 multi line docstring summary not separated with an empty line
# H701 Empty localization string
# H702 Formatting operation should be outside of localization method call
# H703 Multiple positional placeholders
# B series are bugbear
# B006 Do not use mutable data structures for argument defaults. Needs to be FIXED.
# B007 Loop control variable not used within the loop body.
# B009 Do not call getattr with a constant attribute value
# B010 Do not call setattr with a constant attribute value
# B012 return/continue/break inside finally blocks cause exceptions to be silenced
# B014 Redundant exception types
# B301 Python 3 does not include `.iter*` methods on dictionaries. (this should be suppressed on a per line basis)
# W series are warnings
# W503 line break before binary operator
# W504 line break after binary operator
# W605 invalid escape sequence
# E series are pep8
# E117 over-indented
# E126 continuation line over-indented for hanging indent
# E127 continuation line over-indented for visual indent
# E128 continuation line under-indented for visual indent
# E402 module level import not at top of file
# E741 ambiguous variable name
ignore = H101,H102,H104,H105,H306,H401,H403,H404,H405,H701,H702,H703,
B006,B007,B009,B010,B012,B014,B301
W503,W504,W605,
E117,E126,E127,E128,E402,E741
exclude = build,dist,tools,.eggs
max-line-length=120
[testenv:flake8]
deps = -r{toxinidir}/test-requirements.txt
commands =
flake8 {posargs} .
[testenv:py39]
commands =
stestr run {posargs}
stestr slowest
[testenv:pep8]
# testenv:flake8 clone
deps = -r{toxinidir}/test-requirements.txt
commands = {[testenv:flake8]commands}
[testenv:venv]
commands = {posargs}
[bandit]
# The following bandit tests are being skipped:
# B101: Test for use of assert
# B103: Test for setting permissive file permissions
# B104: Test for binding to all interfaces
# B105: Test for use of hard-coded password strings
# B108: Test for insecure usage of tmp file/directory
# B110: Try, Except, Pass detected.
# B303: Use of insecure MD2, MD4, MD5, or SHA1 hash function.
# B307: Blacklisted call to eval.
# B310: Audit url open for permitted schemes
# B311: Standard pseudo-random generators are not suitable for security/cryptographic purposes
# B314: Blacklisted calls to xml.etree.ElementTree
# B318: Blacklisted calls to xml.dom.minidom
# B320: Blacklisted calls to lxml.etree
# B404: Import of subprocess module
# B405: import xml.etree
# B408: import xml.minidom
# B410: import lxml
# B506: Test for use of yaml load
# B602: Test for use of popen with shell equals true
# B603: Test for use of subprocess without shell equals true
# B604: Test for any function with shell equals true
# B605: Test for starting a process with a shell
# B607: Test for starting a process with a partial path
# B608: Possible SQL injection vector through string-based query
#
# Note: 'skips' entry cannot be split across multiple lines
#
skips = B101,B103,B104,B105,B108,B110,B303,B307,B310,B311,B314,B318,B320,B404,B405,B408,B410,B506,B602,B603,B604,B605,B607,B608
exclude = tests
[testenv:bandit]
deps = -r{toxinidir}/test-requirements.txt
commands = bandit --ini tox.ini -n 5 -r k8sapp_intel_device_plugins_operator
[testenv:pylint]
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
commands =
pylint {posargs} k8sapp_intel_device_plugins_operator --rcfile=./pylint.rc
[testenv:cover]
# not sure is passenv is still needed
passenv = CURL_CA_BUNDLE
deps = {[testenv]deps}
setenv = {[testenv]setenv}
PYTHON=coverage run --parallel-mode
commands =
{[testenv]commands}
coverage erase
stestr run {posargs}
coverage combine
coverage html -d cover
coverage xml -o cover/coverage.xml
coverage report
[testenv:pip-missing-reqs]
# do not install test-requirements as that will pollute the virtualenv for
# determining missing packages
# this also means that pip-missing-reqs must be installed separately, outside
# of the requirements.txt files
deps = pip_missing_reqs
-rrequirements.txt
commands=pip-missing-reqs -d --ignore-file=/k8sapp_intel_device_plugins_operator/tests k8sapp_intel_device_plugins_operator

View File

@ -0,0 +1 @@
# Override upstream constraints based on StarlingX load

View File

@ -0,0 +1 @@
# Nothing

View File

@ -4,6 +4,8 @@ Priority: optional
Maintainer: StarlingX Developers <starlingx-discuss@lists.starlingx.io>
Build-Depends: debhelper-compat (= 13),
helm,
python3-k8sapp-intel-device-plugins-operator,
python3-k8sapp-intel-device-plugins-operator-wheels,
intel-device-plugins-operator-helm
Standards-Version: 4.5.1
Homepage: https://www.starlingx.io

View File

@ -34,6 +34,7 @@ override_dh_auto_build:
# Copy the plugins: installed in the buildroot
mkdir -p $(STAGING)/plugins
cp /plugins/*.whl $(STAGING)/plugins
# Generate checksum file and package the tarball
cd $(STAGING) && find . -type f ! -name '*.md5' -print0 | xargs -0 md5sum > checksum.md5

View File

@ -3,6 +3,9 @@
#
# SPDX-License-Identifier: Apache-2.0
#
app.starlingx.io/component: platform
image:
repository: docker.io/intel/intel-deviceplugin-operator
tag: 0.27.1

View File

@ -1,3 +1,3 @@
# hacking pulls in flake8
hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
hacking>=1.1.0,<=2.0.0 # Apache-2.0
bashate >= 0.2

13
tox.ini
View File

@ -1,16 +1,14 @@
[tox]
envlist = linters
minversion = 4.0
minversion = 2.9
skipsdist = True
sitepackages=False
[testenv]
basepython = python3
usedevelop = True
install_command = pip install -U \
{opts} {packages} \
-c{env:TOX_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt}
install_command = pip install -v -v -v \
-c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/starlingx/root/raw/branch/master/build-tools/requirements/debian/upper-constraints.txt} \
{opts} {packages}
setenv =
VIRTUAL_ENV={envdir}
OS_STDOUT_CAPTURE=1
@ -44,10 +42,13 @@ commands =
{[testenv:bashate]commands}
[testenv:flake8]
basepython = python3
description = Dummy environment to allow flake8 to be run in subdir tox
[testenv:pylint]
basepython = python3
description = Dummy environment to allow pylint to be run in subdir tox
[testenv:bandit]
basepython = python3
description = Dummy environment to allow bandit to be run in subdir tox