zuul-jobs/test-playbooks/registry/test-registry.yaml
Monty Taylor 63bd307e63 Support multi-arch image builds with docker buildx
Docker has experimental support for building multi-arch
container images with a buildx command. Currently it only
supports pushing to a registry after running and the images
don't end up in the local docker images list. To work around
that, push to the buildset registry then pull back. This
is the inverse of the normal case where we build, then
retag, then push. The end result should be the same.

Change-Id: I6a4c4f9e262add909d2d5c2efa33ec69b9d9364a
2020-05-04 14:02:13 -05:00

188 lines
7.4 KiB
YAML

# Run the intermediate registry on this host, and also build an image
# and place it in the registry to simulate an artifact from a previous
# build which has been passed to this one (so that we can test pulling
# from the intermediate registry in the correct order).
- hosts: intermediate-registry
name: Set up the intermediate registry and add a build
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Run the intermediate registry
include_role:
name: run-test-intermediate-registry
- name: Install the intermediate registry cert
include_role:
name: install-registry-cert
vars:
registry_host: localhost
registry_port: 5000
registry_cert: "{{ intermediate_registry_tls_cert }}"
- name: Set up user credentials for the intermediate registry
include_role:
name: intermediate-registry-user-config
- name: "Build a container image for the previous build"
include_role:
name: "build-{{ (container_command == 'docker') | ternary('docker', 'container') }}-image"
vars:
docker_images:
- context: test-playbooks/registry/docker
repository: "{{ previous_build_repository }}"
container_images: "{{ docker_images }}"
- name: Tag the previous build
command: "{{ container_command }} tag {{ previous_build_repository }}:latest localhost:5000/{{ previous_build_repository }}:{{ previous_build_uuid }}_latest"
- name: Push the previous build to the intermediate registry
command: "{{ container_command }} push localhost:5000/{{ previous_build_repository }}:{{ previous_build_uuid }}_latest"
# This is also essentially pre-configuration for the real test of the
# roles. This sets up a fake executor (since we can't run the
# necessary commands untrusted on the real one).
- hosts: executor
name: Set up a simulated executor
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Create simulated zuul work directory
become: true
file:
state: directory
path: "{{ zuul.executor.work_root }}"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
- name: Install the intermediate registry cert
include_role:
name: install-registry-cert
vars:
registry_host: "{{ intermediate_registry.host }}"
registry_port: "{{ intermediate_registry.port }}"
registry_cert: "{{ intermediate_registry_tls_cert }}"
- name: Make /etc/docker directory zuul-owned
become: true
file:
state: directory
path: "/etc/docker"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
recurse: true
- name: Configure /etc/hosts for intermediate registry
become: true
lineinfile:
path: /etc/hosts
state: present
regex: "^{{ hostvars['intermediate-registry'].nodepool.private_ipv4 }}\t{{ intermediate_registry.host }}$"
line: "{{ hostvars['intermediate-registry'].nodepool.private_ipv4 }}\t{{ intermediate_registry.host }}"
insertafter: EOF
# This begins the simulation of what we would expect to happen in a
# normal job.
- hosts: builder
name: Test the buildset registry roles
roles:
- run-buildset-registry
- use-buildset-registry
- hosts: executor
name: Test pulling from the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Prepare a replacement zuul variable
set_fact:
test_zuul: "{{ previous_build_zuul }}"
- name: Run pull-from-intermediate-registry role
include_role:
name: pull-from-intermediate-registry
vars:
zuul: "{{ test_zuul }}"
# This simulates a build actually using the previous build.
- hosts: builder
name: Test that the previous build is available
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Include previous build vars
include_vars: vars/previous-build.yaml
- name: Pull the previous build from buildset registry to the builder host
command: "{{ container_command }} pull {{ previous_build_repository }}:latest"
- name: "Show local container images for debugging"
command: "{{ container_command }} image ls"
- name: Verify previously built image is in buildset registry
command: "{{ container_command }} image inspect {{ previous_build_repository }}:latest"
# Back to straightforward use of the roles under test.
- hosts: builder
name: Test building a container image
tasks:
- name: Create fake sibling projects
command: >-
mkdir -p src/opendev.org/project/fake-sibling &&
mkdir -p src/openstack.org/project/fake-sibling &&
touch src/opendev.org/project/fake-sibling/file &&
touch src/openstack.org/project/fake-sibling/file
- name: Build docker image
include_role:
name: "build-{{ (container_command == 'docker') | ternary('docker', 'container') }}-image"
vars:
_normal_docker_images:
- context: test-playbooks/registry/docker-siblings
repository: downstream/image
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
_arch_docker_images:
- context: test-playbooks/registry/docker-siblings
repository: downstream/image
siblings:
- opendev.org/project/fake-sibling
- openstack.org/project/fake-sibling
arch: ['linux/amd64', 'linux/arm64']
docker_images: "{{ multiarch | ternary(_arch_docker_images, _normal_docker_images) }}"
container_images: "{{ docker_images }}"
- hosts: executor
name: Test pushing to the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Run push-to-intermediate-registry role
include_role:
name: push-to-intermediate-registry
vars:
_normal_docker_images:
- context: playbooks/registry/docker
repository: downstream/image
_arch_docker_images:
- context: playbooks/registry/docker
repository: downstream/image
arch: ['linux/amd64', 'linux/arm64']
docker_images: "{{ multiarch | ternary(_arch_docker_images, _normal_docker_images) }}"
container_images: "{{ docker_images }}"
# And finally an external verification step.
- hosts: executor
name: Test that the newly built image was pushed to the intermediate registry
tasks:
- name: Include intermediate registry vars
include_vars: vars/intermediate-registry-auth.yaml
- name: Fetch intermediate registry catalog
uri:
url: "https://{{ intermediate_registry.host }}:{{ intermediate_registry.port }}/v2/_catalog"
validate_certs: false
user: "{{ intermediate_registry.username }}"
password: "{{ intermediate_registry.password }}"
register: catalog
- name: Verify newly built image is in intermediate registry catalog
assert:
that: "'downstream/image' in catalog.json.repositories"