Skip to content

Commit 2829bf8

Browse files
jovialjovial
committed
CI: Test kayobe_control_host_become
This change adds support for the kayobe_control_host_become variable to CI jobs. This variable will cause any uses of become on localhost to fail. This allows us to test that the kayobe_control_host_become configuration variable has successfully removed all uses of become. I've enabled this on a subset of jobs to get good test coverage. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/949758 Change-Id: I6da98e055714f75112cf08ff8aa53dd84de2e425
1 parent 3efadf3 commit 2829bf8

File tree

18 files changed

+234
-30
lines changed

18 files changed

+234
-30
lines changed

‎dev/functions‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,14 @@ function to_bool {
909909
fi
910910
}
911911

912+
function is_absolute_path {
913+
path="$1"
914+
case "$path" in
915+
/*) true ;;
916+
*) false ;;
917+
esac
918+
}
919+
912920
function configure_iptables {
913921
# NOTE(wszumski): adapted from the ironic devstack plugin, see:
914922
# https://github.com/openstack/ironic/blob/36e87dc5b472d79470b783fbba9ce396e3cbb96e/devstack/lib/ironic#L2132

‎dev/kayobe-control-host-become-sudo-checker‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
3+
IFS='' read -r -d '' ERR_MSG <<"EOF"
4+
This task tried to use become, but kayobe_control_host_become is set to false. Please change become: true, to become: "{{ kayobe_control_host_become | bool }}", e.g:
5+
6+
- name: Run a command
7+
command: echo hi
8+
become: true
9+
10+
Should be:
11+
12+
- name: Run a command
13+
command: echo hi
14+
become: "{{ kayobe_control_host_become | bool }}"
15+
16+
Hint: You may need to write any files to a user controlled directory.
17+
ErrorCode: CONTROL_HOST_BECOME_VIOLATION
18+
EOF
19+
20+
21+
>&2 echo "$ERR_MSG"
22+
exit 1

‎dev/kolla-control-host-become-sudo-checker‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
IFS='' read -r -d '' ERR_MSG <<"EOF"
4+
This task tried to use become, but kolla_ansible_control_host_become is set to false.
5+
6+
The task will need to be changed in kolla-ansible to support running as an
7+
unprivileged user.
8+
9+
Hint: You may need to write any files to a user controlled directory.
10+
ErrorCode: CONTROL_HOST_BECOME_VIOLATION
11+
EOF
12+
13+
14+
>&2 echo "$ERR_MSG"
15+
exit 1

‎dev/playbook-run.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
3+
set -eu
4+
set -o pipefail
5+
6+
# Script to run a custom playbook
7+
8+
PARENT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
10+
source "${PARENT}/functions"
11+
12+
function main {
13+
local playbook_path
14+
playbook=$1
15+
args=("${@:2}")
16+
shift $#
17+
config_init
18+
environment_setup
19+
# Use eval so we can do something like: playbook-run.sh '$KAYOBE_CONFIG_PATH/ansible/test.yml'
20+
# NOTE: KAYOBE_CONFIG_PATH gets defined by kayobe_init
21+
playbook_path="$(eval echo $playbook)"
22+
if ! is_absolute_path "$playbook_path"; then
23+
# Default to a path relative to repository root
24+
playbook_path="$KAYOBE_CONFIG_ROOT/$playbook_path"
25+
fi
26+
if [ ! -f "$playbook_path" ]; then
27+
die $LINENO "Playbook path does not exist: $playbook_path"
28+
fi
29+
run_kayobe playbook run "$playbook_path" "${args[@]}"
30+
}
31+
32+
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
33+
if [ "$#" -lt 1 ]; then
34+
die $LINENO "Error: You must provide a playbook to run." \
35+
"Usage: playbook-run.sh <playbook>"
36+
fi
37+
main "${@:1}"
38+
fi

‎playbooks/kayobe-base/overrides.yml.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
# Test support for not escalating privileges
3+
kayobe_control_host_become: "{{ kayobe_control_host_become }}"

‎playbooks/kayobe-base/post.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,32 @@
11
---
2+
- hosts: primary
3+
environment:
4+
KAYOBE_CONFIG_SOURCE_PATH: "{{ kayobe_config_src_dir }}"
5+
tasks:
6+
# Checks become validator was correctly configured in pre.yml.
7+
- block:
8+
- name: Create a playbook to test become validator was configured
9+
copy:
10+
content: |
11+
---
12+
- hosts: localhost
13+
tasks:
14+
- name: Testing become fails
15+
command: "true"
16+
become: true
17+
register: result
18+
failed_when: '"CONTROL_HOST_BECOME_VIOLATION" not in result.module_stderr'
19+
dest: /tmp/test-control-host-become.yml
20+
21+
- name: Check that that kayobe become validator was correctly configured
22+
shell:
23+
cmd: "{{ kayobe_src_dir }}/dev/playbook-run.sh /tmp/test-control-host-become.yml &> {{ logs_dir }}/ansible/kayobe-test-control-host-become"
24+
executable: /bin/bash
25+
failed_when: false
26+
register: become_check_result
27+
28+
when: not kayobe_control_host_become | bool
29+
230
- hosts: all
331
roles:
432
- role: kayobe-diagnostics
@@ -7,3 +35,11 @@
735
kayobe_diagnostics_config_dir: "{{ kayobe_config_src_dir }}"
836
kayobe_diagnostics_previous_config_dir: "{{ previous_kayobe_config_src_dir }}"
937
kayobe_diagnostics_executor_log_dir: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}"
38+
39+
- hosts: primary
40+
tasks:
41+
# Fail after logs have been posted
42+
- name: Fail run if "Check that that kayobe become validator was correctly configured" failed
43+
assert:
44+
that: become_check_result.rc == 0
45+
when: become_check_result is not skipped

‎playbooks/kayobe-base/pre.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,49 @@
8888
kayobe_galaxy_requirements_src_dir: "{{ kolla_ansible_src_dir }}"
8989
kayobe_galaxy_requirements_dest_path: "/tmp/kolla-ansible-requirements.yml"
9090

91+
# NOTE(wszumski): I explored running as an unprivileged user, but it looked like
92+
# a world of pain, so I've gone for this simpler approach (for now).
93+
- block:
94+
- name: Ensure inventory host_vars directories exist
95+
file:
96+
state: directory
97+
path: "{{ item }}"
98+
loop:
99+
- "{{ kayobe_config_src_dir }}/etc/kayobe/inventory/host_vars/"
100+
- "{{ kayobe_config_src_dir }}/etc/kayobe/kolla/inventory/host_vars/"
101+
102+
- name: Configure the become checker for localhost (kayobe)
103+
# NOTE(wszumski): This will cause all uses of become to fail when running
104+
# kayobe playbooks against localhost. This should not happen since we
105+
# have disabled escalation of privileges with kayobe_control_host_become.
106+
# If you hit this error you will need to change your task to respect
107+
# that variable.
108+
copy:
109+
content: |
110+
ansible_become_exe: "{{ kayobe_src_dir }}/dev/kayobe-control-host-become-sudo-checker"
111+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/inventory/host_vars/localhost"
112+
113+
- name: Configure the become checker for localhost (kolla)
114+
# NOTE(wszumski): This will cause all uses of become to fail when running
115+
# kolla playbooks against localhost. This should not happen since we
116+
# have disabled escalation of privileges with kayobe_control_host_become.
117+
# If you hit this error you will need to change kolla-ansible to not use
118+
# become unless necessary.
119+
copy:
120+
content: |
121+
ansible_become_exe: "{{ kayobe_src_dir }}/dev/kolla-control-host-become-sudo-checker"
122+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/kolla/inventory/host_vars/localhost"
123+
124+
when: not kayobe_control_host_become | bool
125+
126+
# NOTE(wszumski): Use the name zz-10-overrides.yml to ensure this takes
127+
# precedence over the standard config files, but can control order with the
128+
# priority (number after zz).
129+
- name: Ensure kayobe-config override config file exists
130+
template:
131+
src: overrides.yml.j2
132+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-10-overrides.yml"
133+
91134
- block:
92135
- name: Ensure previous kayobe directory exists
93136
file:

‎playbooks/kayobe-infra-vm-base/pre.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,13 @@
3232
value: 1
3333
become: true
3434

35-
# NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes
36-
# precedence over the standard config files.
35+
# NOTE(mgoddard): Use the name zz-20-overrides.yml to ensure this takes
36+
# precedence over the standard config files, but can control order with the
37+
# priority (number after zz).
3738
- name: Ensure kayobe-config override config file exists
3839
template:
3940
src: overrides.yml.j2
40-
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-overrides.yml"
41+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-20-overrides.yml"
4142

4243
- name: Ensure infra-vms group variables exist
4344
template:

‎playbooks/kayobe-overcloud-base/pre.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,13 @@
1313
bridge_prefix: 24
1414
bridge_port_interface: dummy1
1515

16-
# NOTE(mgoddard): Use the name zz-overrides.yml to ensure this takes
17-
# precedence over the standard config files.
16+
# NOTE(mgoddard): Use the name zz-20-overrides.yml to ensure this takes
17+
# precedence over the standard config files, but can control order with the
18+
# priority (number after zz).
1819
- name: Ensure kayobe-config override config file exists
1920
template:
2021
src: overrides.yml.j2
21-
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-overrides.yml"
22+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-20-overrides.yml"
2223

2324
- name: Ensure kolla-ansible globals.yml override config file exists
2425
template:

‎playbooks/kayobe-overcloud-host-configure-base/pre.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@
2828
virtualenv: "{{ testinfra_venv }}"
2929
virtualenv_command: "{{ cmd }}"
3030

31-
# NOTE(mgoddard): Use the name zzz-overrides.yml to ensure this takes
32-
# precedence over the standard config files and zz-overrides.yml from
31+
# NOTE(mgoddard): Use the name zz-30-overrides.yml to ensure this takes
32+
# precedence over the standard config files and zz-20-overrides.yml from
3333
# kayobe-overcloud-base.
3434
- name: Ensure kayobe-config override config file exists
3535
template:
3636
src: overrides.yml.j2
37-
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zzz-overrides.yml"
37+
dest: "{{ kayobe_config_src_dir }}/etc/kayobe/zz-30-overrides.yml"
3838

3939
# NOTE(mgoddard): Create two loopback devices backed by files. These will
4040
# be added to a software RAID volume, then added to an LVM volume group.

0 commit comments

Comments
 (0)