zuul-jobs/test-playbooks/registry/test-registry.yaml
James E. Blair 509880073e Remove command.warn usage
This is no longer present in Ansible 9.

Removing these upsets ansible-lint, so those errors are ignored.

The base roles job has bitrotted on centos-7 and bionic due to
a bad voluptuous release used in an stestr test.  That is fixed in
this change as well.

Change-Id: I67886d5ad82ab590979f82bd102d6f974b9d4421
2024-02-14 15:17:52 -08:00

208 lines
8.2 KiB
YAML

# Run the intermediate registry on this host, and also build an image
# and place it in the registry to simulate an artifact from a previous
# build which has been passed to this one (so that we can test pulling
# from the intermediate registry in the correct order).
- hosts: intermediate-registry
name: Set up the intermediate registry and add a build
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Run the intermediate registry
include_role:
name: run-test-intermediate-registry
- name: Install the intermediate registry cert
include_role:
name: ensure-registry-cert
vars:
registry_host: localhost
registry_port: 5000
registry_cert: "{{ intermediate_registry_tls_cert }}"
- name: Set up user credentials for the intermediate registry
include_role:
name: intermediate-registry-user-config
- name: "Build a container image for the previous build with docker roles"
when: container_command == 'docker'
include_role:
name: "build-docker-image"
vars:
docker_images:
- context: test-playbooks/registry/docker
repository: "{{ previous_build_repository }}"
- name: "Build a container image for the previous build with container-image roles"
when: container_command != 'docker'
include_role:
name: "build-container-image"
vars:
container_images:
- context: test-playbooks/registry/docker
repository: "{{ previous_build_repository }}"
- name: Tag the previous build
command: "{{ container_command }} tag {{ previous_build_repository }}:latest localhost:5000/{{ previous_build_repository }}:{{ previous_build_uuid }}_latest"
- name: Push the previous build to the intermediate registry
command: "{{ container_command }} push localhost:5000/{{ previous_build_repository }}:{{ previous_build_uuid }}_latest"
# This is also essentially pre-configuration for the real test of the
# roles. This sets up a fake executor (since we can't run the
# necessary commands untrusted on the real one).
- hosts: executor
name: Set up a simulated executor
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Create simulated zuul work directory
become: true
file:
state: directory
path: "{{ zuul.executor.work_root }}"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
- name: Install the intermediate registry cert
include_role:
name: ensure-registry-cert
vars:
registry_host: "{{ intermediate_registry.host }}"
registry_port: "{{ intermediate_registry.port }}"
registry_cert: "{{ intermediate_registry_tls_cert }}"
- name: Make /etc/docker directory zuul-owned
become: true
file:
state: directory
path: "/etc/docker"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
recurse: true
- name: Configure /etc/hosts for intermediate registry
become: true
lineinfile:
path: /etc/hosts
state: present
regex: "^{{ hostvars['intermediate-registry'].nodepool.private_ipv4 }}\t{{ intermediate_registry.host }}$"
line: "{{ hostvars['intermediate-registry'].nodepool.private_ipv4 }}\t{{ intermediate_registry.host }}"
insertafter: EOF
# This begins the simulation of what we would expect to happen in a
# normal job.
- hosts: builder
name: Test the buildset registry roles
roles:
- run-buildset-registry
- use-buildset-registry
- hosts: executor
name: Test pulling from the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Run pull-from-intermediate-registry role
include_role:
name: pull-from-intermediate-registry
vars:
zuul_artifacts: "{{ previous_build_zuul.artifacts }}"
# This simulates a build actually using the previous build.
- hosts: builder
name: Test that the previous build is available
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Pull the previous build from buildset registry to the builder host
command: "{{ container_command }} pull {{ previous_build_repository }}:latest"
- name: "Show local container images for debugging"
command: "{{ container_command }} image ls"
- name: Verify previously built image is in buildset registry
command: "{{ container_command }} image inspect {{ previous_build_repository }}:latest"
# Back to straightforward use of the roles under test.
- hosts: builder
name: Test building a container image
tasks:
- name: Create fake sibling projects
command: >-
mkdir -p src/opendev.org/project/fake-sibling &&
mkdir -p src/openstack.org/project/fake-sibling &&
touch src/opendev.org/project/fake-sibling/file &&
touch src/openstack.org/project/fake-sibling/file
- name: Build docker image
include_role:
name: "build-{{ (container_command == 'docker') | ternary('docker', 'container') }}-image"
vars:
_normal_docker_images:
- context: test-playbooks/registry/docker-siblings
repository: downstream/image
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
target: first
- context: test-playbooks/registry/docker-siblings
repository: downstream/image2
target: second
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
_arch_docker_images:
- context: test-playbooks/registry/docker-siblings
repository: downstream/image
target: first
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
arch: ['linux/amd64', 'linux/arm64']
- context: test-playbooks/registry/docker-siblings
repository: downstream/image2
target: second
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
arch: ['linux/amd64', 'linux/arm64']
docker_images: "{{ multiarch | ternary(_arch_docker_images, _normal_docker_images) }}"
container_images: "{{ docker_images }}"
- hosts: executor
name: Test pushing to the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Run push-to-intermediate-registry role
include_role:
name: push-to-intermediate-registry
vars:
_normal_docker_images:
- context: playbooks/registry/docker
repository: downstream/image
_arch_docker_images:
- context: playbooks/registry/docker
repository: downstream/image
arch: ['linux/amd64', 'linux/arm64']
docker_images: "{{ multiarch | ternary(_arch_docker_images, _normal_docker_images) }}"
container_images: "{{ docker_images }}"
# And finally an external verification step.
- hosts: executor
name: Test that the newly built image was pushed to the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Fetch intermediate registry catalog
uri:
url: "https://{{ intermediate_registry.host }}:{{ intermediate_registry.port }}/v2/_catalog"
validate_certs: false
user: "{{ intermediate_registry.username }}"
password: "{{ intermediate_registry.password }}"
register: catalog
- name: Verify newly built image is in intermediate registry catalog
assert:
that: "'downstream/image' in catalog.json.repositories"