ensure-docker: validate network connectivity

Verifies that installed docker can download and run containers
that need network access. This should prevent bugs where
service was installed but in a broken state.

Fixes bug which failed to run tests when tests were modified.

Change-Id: I309168719fd3cb7488bc2d0f4fec7785e1eb5d53
Story: https://storyboard.openstack.org/#!/story/2008215

test-playbooks/ensure-docker.yaml

@@ -4,3 +4,27 @@
     - name: Run ensure-docker role
       include_role:
         name: ensure-docker
+
+    - name: Validate docker pull
+      command: |
+        docker pull --quiet curlimages/curl:latest
+
+    - name: Validate docker host network containers have internet access
+      command: |
+        docker run --rm --network=host curlimages/curl:latest --no-progress-meter https://httpbin.org/get
+
+    # Two task approach that ignores known partial failures on specific plaforms:
+    # https://storyboard.openstack.org/#!/story/2008215
+    - name: Validate docker default network containers have internet access
+      command: |
+        docker run --rm curlimages/curl:latest --no-progress-meter https://httpbin.org/get
+      register: result
+      ignore_errors: true
+
+    - name: Fail if bug found on unknown platform
+      when:
+        - result.rc != 0
+        - ansible_distribution_release not in ['bionic', 'focal']
+        - ansible_architecture != 'aarch64'
+      fail:
+        msg: Bug 2008215 regression detected

zuul-tests.d/container-roles-jobs.yaml

@@ -3,7 +3,7 @@
     description: Tests ensure-docker role
     abstract: true
     files:
-      - roles/ensure-docker/.*
+      - .*ensure-docker.*
       - roles/ensure-package-repositories/.*
       - test-requirements.txt
     run: test-playbooks/ensure-docker.yaml