feat: support for ostree systems

Feature: Allow running and testing the role with ostree managed nodes.

Reason: We have users who want to use the role to manage ostree
systems.

Result: Users can use the role to manage ostree managed nodes.

Signed-off-by: Rich Megginson <rmeggins@redhat.com>

.ansible-lint

@@ -22,3 +22,5 @@ exclude_paths:
   - examples/roles/
 mock_roles:
   - linux-system-roles.logging
+mock_modules:
+  - ansible.utils.update_fact

.ostree/README.md

@@ -0,0 +1,3 @@
+*NOTE*: The `*.txt` files are used by `get_ostree_data.sh` to create the lists
+of packages, and to find other system roles used by this role.  DO NOT use them
+directly.

.ostree/get_ostree_data.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+
+set -euo pipefail
+
+role_collection_dir="${ROLE_COLLECTION_DIR:-fedora/linux_system_roles}"
+ostree_dir="${OSTREE_DIR:-"$(dirname "$(realpath "$0")")"}"
+
+if [ -z "${4:-}" ] || [ "${1:-}" = help ] || [ "${1:-}" = -h ]; then
+    cat <<EOF
+Usage: $0 packages [runtime|testing] DISTRO-MAJOR[.MINOR] [json|yaml|raw|toml]
+The script will use the packages and roles files in $ostree_dir to
+construct the list of packages needed to build the ostree image.  The script
+will output the list of packages in the given format
+- json is a JSON list like ["pkg1","pkg2",....,"pkgN"]
+- yaml is the YAML list format
+- raw is the list of packages, one per line
+- toml is a list of [[packages]] elements as in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/composing_installing_and_managing_rhel_for_edge_images/index#creating-an-image-builder-blueprint-for-a-rhel-for-edge-image-using-the-command-line-interface_composing-a-rhel-for-edge-image-using-image-builder-command-line
+The DISTRO-MAJOR.MINOR is the same format used by Ansible for distribution e.g. CentOS-8, RedHat-8.9, etc.
+EOF
+    exit 1
+fi
+category="$1"
+pkgtype="$2"
+distro_ver="$3"
+format="$4"
+pkgtypes=("$pkgtype")
+if [ "$pkgtype" = testing ]; then
+    pkgtypes+=(runtime)
+fi
+
+get_rolepath() {
+    local ostree_dir role rolesdir roles_parent_dir
+    ostree_dir="$1"
+    role="$2"
+    roles_parent_dir="$(dirname "$(dirname "$ostree_dir")")"
+    rolesdir="$roles_parent_dir/$role/.ostree"
+    # assumes collection format
+    if [ -d "$rolesdir" ]; then
+        echo "$rolesdir"
+        return 0
+    fi
+    # assumes legacy role format like linux-system-roles.$role/
+    for rolesdir in "$roles_parent_dir"/*-system-roles."$role"/.ostree; do
+        if [ -d "$rolesdir" ]; then
+          echo "$rolesdir"
+          return 0
+        fi
+    done
+    # look elsewhere
+    if [ -n "${ANSIBLE_COLLECTIONS_PATHS:-}" ]; then
+        for pth in ${ANSIBLE_COLLECTIONS_PATHS//:/ }; do
+            rolesdir="$pth/ansible_collections/$role_collection_dir/roles/$role/.ostree"
+            if [ -d "$rolesdir" ]; then
+                echo "$rolesdir"
+                return 0
+            fi
+        done
+    fi
+    return 1
+}
+
+get_packages() {
+    local ostree_dir pkgtype pkgfile rolefile
+    ostree_dir="$1"
+    for pkgtype in "${pkgtypes[@]}"; do
+        for suff in "" "-$distro" "-${distro}-${major_ver}" "-${distro}-${ver}"; do
+            pkgfile="$ostree_dir/packages-${pkgtype}${suff}.txt"
+            if [ -f "$pkgfile" ]; then
+                cat "$pkgfile"
+            fi
+        done
+        rolefile="$ostree_dir/roles-${pkgtype}.txt"
+        if [ -f "$rolefile" ]; then
+            local roles role rolepath
+            roles="$(cat "$rolefile")"
+            for role in $roles; do
+                rolepath="$(get_rolepath "$ostree_dir" "$role")"
+                get_packages "$rolepath"
+            done
+        fi
+    done | sort -u
+}
+
+format_packages_json() {
+    local comma pkgs pkg
+    comma=""
+    pkgs="["
+    while read -r pkg; do
+        pkgs="${pkgs}${comma}\"${pkg}\""
+        comma=,
+    done
+    pkgs="${pkgs}]"
+    echo "$pkgs"
+}
+
+format_packages_raw() {
+    cat
+}
+
+format_packages_yaml() {
+    while read -r pkg; do
+        echo "- $pkg"
+    done
+}
+
+format_packages_toml() {
+    while read -r pkg; do
+        echo "[[packages]]"
+        echo "name = \"$pkg\""
+        echo "version = \"*\""
+    done
+}
+
+distro="${distro_ver%%-*}"
+ver="${distro_ver##*-}"
+if [[ "$ver" =~ ^([0-9]*) ]]; then
+    major_ver="${BASH_REMATCH[1]}"
+else
+    echo ERROR: cannot parse major version number from version "$ver"
+    exit 1
+fi
+
+"get_$category" "$ostree_dir" | "format_${category}_$format"

.ostree/packages-runtime-CentOS-7.txt

@@ -0,0 +1 @@
+policycoreutils-python

.ostree/packages-runtime-CentOS-8.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-runtime-Fedora.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-runtime-RedHat-7.txt

@@ -0,0 +1 @@
+policycoreutils-python

.ostree/packages-runtime-RedHat-8.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-runtime-RedHat-9.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-runtime.txt

@@ -0,0 +1,12 @@
+ca-certificates
+iproute
+libestr
+libfastjson
+liblognorm
+librelp
+rsyslog
+rsyslog-elasticsearch
+rsyslog-gnutls
+rsyslog-mmjsonparse
+rsyslog-mmnormalize
+rsyslog-relp

.ostree/packages-testing-CentOS-7.txt

@@ -0,0 +1 @@
+policycoreutils-python

.ostree/packages-testing-CentOS-8.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-testing-Fedora.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-testing-RedHat-7.txt

@@ -0,0 +1 @@
+policycoreutils-python

.ostree/packages-testing-RedHat-8.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-testing-RedHat-9.txt

@@ -0,0 +1 @@
+policycoreutils-python-utils

.ostree/packages-testing.txt

@@ -0,0 +1,12 @@
+ca-certificates
+libestr
+libfastjson
+liblognorm
+librelp
+lsof
+rsyslog
+rsyslog-elasticsearch
+rsyslog-gnutls
+rsyslog-mmjsonparse
+rsyslog-mmnormalize
+rsyslog-relp

.ostree/roles-runtime.txt

@@ -0,0 +1,3 @@
+certificate
+firewall
+selinux

.ostree/roles-testing.txt

@@ -0,0 +1 @@
+selinux

.sanity-ansible-ignore-2.12.txt

@@ -0,0 +1 @@
+roles/logging/.ostree/get_ostree_data.sh shebang!skip

.sanity-ansible-ignore-2.13.txt

@@ -0,0 +1 @@
+roles/logging/.ostree/get_ostree_data.sh shebang!skip

.sanity-ansible-ignore-2.14.txt

@@ -0,0 +1 @@
+roles/logging/.ostree/get_ostree_data.sh shebang!skip

.sanity-ansible-ignore-2.15.txt

@@ -0,0 +1 @@
+roles/logging/.ostree/get_ostree_data.sh shebang!skip

.sanity-ansible-ignore-2.9.txt

@@ -0,0 +1 @@
+roles/logging/.ostree/get_ostree_data.sh shebang!skip

README-ostree.md

@@ -0,0 +1,66 @@
+# rpm-ostree
+
+The role supports running on [rpm-ostree](https://coreos.github.io/rpm-ostree/)
+systems. The primary issue is that the `/usr` filesystem is read-only, and the
+role cannot install packages. Instead, it will just verify that the necessary
+packages and any other `/usr` files are pre-installed. The role will change the
+package manager to one that is compatible with `rpm-ostree` systems.
+
+## Building
+
+To build an ostree image for a particular operating system distribution and
+version, use the script `.ostree/get_ostree_data.sh` to get the list of
+packages. If the role uses other system roles, then the script will include the
+packages for the other roles in the list it outputs.  The list of packages will
+be sorted in alphanumeric order.
+
+Usage:
+
+```bash
+.ostree/get_ostree_data.sh packages runtime DISTRO-VERSION FORMAT
+```
+
+`DISTRO-VERSION` is in the format that Ansible uses for `ansible_distribution`
+and `ansible_distribution_version` - for example, `Fedora-38`, `CentOS-8`,
+`RedHat-9.4`
+
+`FORMAT` is one of `toml`, `json`, `yaml`, `raw`
+
+* `toml` - each package in a TOML `[[packages]]` element
+
+```toml
+[[packages]]
+name = "package-a"
+version = "*"
+[[packages]]
+name = "package-b"
+version = "*"
+...
+```
+
+* `yaml` - a YAML list of packages
+
+```yaml
+- package-a
+- package-b
+...
+```
+
+* `json` - a JSON list of packages
+
+```json
+["package-a","package-b",...]
+```
+
+* `raw` - a plain text list of packages, one per line
+
+```bash
+package-a
+package-b
+...
+```
+
+What format you choose depends on which image builder you are using.  For
+example, if you are using something based on
+[osbuild-composer](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/composing_installing_and_managing_rhel_for_edge_images/index#creating-an-image-builder-blueprint-for-a-rhel-for-edge-image-using-the-command-line-interface_composing-a-rhel-for-edge-image-using-image-builder-command-line),
+you will probably want to use the `toml` output format.

README.md

@@ -25,7 +25,11 @@ If the `logging` is a role from the `fedora.linux_system_roles`
 collection or from the Fedora RPM package, the requirement is already
 satisfied.
 
-Otherwise, please run the following command line to install the collection.
+The role requires external collections for management of `rpm-ostree` nodes.
+These are listed in the `meta/collection-requirements.yml`.  You do not need
+them if you do not want to manage `rpm-ostree` systems.
+
+If you need to install additional collections based on the above, please run:
 
 ```bash
 ansible-galaxy collection install -r meta/collection-requirements.yml
@@ -421,7 +425,9 @@ These variables are set in the same level of the `logging_inputs`, `logging_outp
   If `/etc/rsyslog.conf` was modified, and you use `logging_purge_confs: true`,
   and you are not providing any `logging_inputs`, then the `rsyslog` package
   will be uninstalled and reinstalled in order to revert back to the original
-  system default configuration.
+  system default configuration.  On `ostree` systems, this does not work, so a minimal
+  rsyslog.conf will be used, which is *not* the same as the default rsyslog.conf provided
+  by the rpm package.  So please use caution if you use this option on `ostree` systems.
 * `logging_system_log_dir`: Directory where the local log output files are placed. Default to `/var/log`.
 * `logging_manage_firewall`: If set to `true` and ports are found in the logging role
   parameters, configure the firewall for the ports using the firewall role.
@@ -922,3 +928,7 @@ syslogd_port_t        udp   514, 601, 20514
 ## Tests
 
 tests/README.md - This documentation shows how to execute CI tests in the tests directory as well as how to debug when the test fails.
+
+## rpm-ostree
+
+See README-ostree.md

defaults/main.yml

@@ -113,7 +113,7 @@ __logging_required_facts:
   - distribution_major_version
   - distribution_version
   - os_family
-  - default_ipv4
+  - default_ipv4  # requires the iproute package for the ip command
 
 # the subsets of ansible_facts that need to be gathered in case any of the
 # facts in required_facts is missing; see the documentation of

meta/collection-requirements.yml

@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: MIT
 ---
 collections:
+  - ansible.posix
+  - ansible.utils
   - fedora.linux_system_roles

roles/rsyslog/tasks/main_core.yml

@@ -4,9 +4,12 @@
 # if inputs are given and rsyslog_enabled is true, rsyslog.conf will be
 # overwritten, so no need to reinstall package
 - name: Reinstall package to restore rsyslog config if purging
+  vars:
+    ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree
   when:
     - logging_purge_confs | bool | d(false)
     - not (rsyslog_inputs and __rsyslog_enabled | bool)
+    - not ansible_facts.pkg_mgr | d() == ostree_pkg_mgr
   block:
     # it is assumed that the only packages providing config files that might
     # be modified are the base packages - if this is not so, then additional
@@ -100,21 +103,6 @@
         group: 'root'
         mode: '0755'
 
-    - name: Get mode of rsyslog.conf if it exists
-      stat:
-        path: /etc/rsyslog.conf
-      register: __rsyslog_register_stat_conf
-
-    - name: Generate main rsyslog configuration
-      template:
-        src: 'rsyslog.conf.j2'
-        dest: '/etc/rsyslog.conf'
-        mode: "{{ __rsyslog_register_stat_conf.stat.mode | d('0700') }}"
-      when:
-        - __rsyslog_enabled | bool
-        - rsyslog_inputs | d([])
-      notify: Restart rsyslogd
-
     - name: Generate global rule to add to __rsyslog_common_rules
       vars:
         __rsyslog_global_common_rule:
@@ -394,3 +382,36 @@
   when:
     - __rsyslog_failed_validation | d(false)
     - rsyslog_in_image | default(false) | bool
+
+- name: Create or recreate main config file
+  vars:
+    ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree
+    is_ostree: "{{ ansible_facts.pkg_mgr | d() == ostree_pkg_mgr }}"
+    __rsyslog_generate_conf: "{{ is_ostree |
+      ternary(true,
+              __rsyslog_enabled and rsyslog_inputs | d([]) | length > 0) }}"
+  when: __rsyslog_generate_conf | bool
+  block:
+    - name: See if there are any config files
+      find:
+        paths: "{{ __rsyslog_config_dir }}"
+        patterns: "*.conf"
+      register: __rsyslog_find_result
+      when: is_ostree | bool
+
+    - name: Get mode of rsyslog.conf if it exists
+      stat:
+        path: /etc/rsyslog.conf
+      register: __rsyslog_register_stat_conf
+      when: __rsyslog_generate_conf | bool
+
+    - name: Generate main rsyslog configuration
+      template:
+        src: 'rsyslog.conf.j2'
+        dest: '/etc/rsyslog.conf'
+        mode: "{{ __rsyslog_register_stat_conf.stat.mode | d('0700') }}"
+      notify: Restart rsyslogd
+      when: __rsyslog_generate_conf | bool
+      vars:
+        __rsyslog_has_config_files: "{{ __rsyslog_find_result.matched > 0
+          if is_ostree else true }}"