From 64f915a5c7bdf7f730dcca627190ff2448aa9c56 Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Wed, 4 Oct 2023 14:01:51 -0600 Subject: [PATCH] feat: support for ostree systems Feature: Allow running and testing the role with ostree managed nodes. Reason: We have users who want to use the role to manage ostree systems. Result: Users can use the role to manage ostree managed nodes. Signed-off-by: Rich Megginson --- .ansible-lint | 2 + .ostree/README.md | 3 + .ostree/get_ostree_data.sh | 123 ++++++++++++++++++++++++ .ostree/packages-runtime-CentOS-7.txt | 1 + .ostree/packages-runtime-CentOS-8.txt | 1 + .ostree/packages-runtime-Fedora.txt | 1 + .ostree/packages-runtime-RedHat-7.txt | 1 + .ostree/packages-runtime-RedHat-8.txt | 1 + .ostree/packages-runtime-RedHat-9.txt | 1 + .ostree/packages-runtime.txt | 12 +++ .ostree/packages-testing-CentOS-7.txt | 1 + .ostree/packages-testing-CentOS-8.txt | 1 + .ostree/packages-testing-Fedora.txt | 1 + .ostree/packages-testing-RedHat-7.txt | 1 + .ostree/packages-testing-RedHat-8.txt | 1 + .ostree/packages-testing-RedHat-9.txt | 1 + .ostree/packages-testing.txt | 12 +++ .ostree/roles-runtime.txt | 3 + .ostree/roles-testing.txt | 1 + .sanity-ansible-ignore-2.12.txt | 1 + .sanity-ansible-ignore-2.13.txt | 1 + .sanity-ansible-ignore-2.14.txt | 1 + .sanity-ansible-ignore-2.15.txt | 1 + .sanity-ansible-ignore-2.9.txt | 1 + README-ostree.md | 66 +++++++++++++ README.md | 14 ++- defaults/main.yml | 2 +- meta/collection-requirements.yml | 2 + roles/rsyslog/tasks/main_core.yml | 51 +++++++--- roles/rsyslog/tasks/set_vars.yml | 18 ++++ roles/rsyslog/templates/rsyslog.conf.j2 | 9 ++ roles/rsyslog/vars/main.yml | 4 +- tests/tasks/create_tests_certs.yml | 60 ------------ tests/tasks/test_logger.yml | 34 ++++--- tests/tests_enabled.yml | 4 +- tests/tests_purge_reset.yml | 21 +++- 36 files changed, 365 insertions(+), 93 deletions(-) create mode 100644 .ostree/README.md create mode 100755 .ostree/get_ostree_data.sh create mode 100644 .ostree/packages-runtime-CentOS-7.txt create mode 100644 .ostree/packages-runtime-CentOS-8.txt create mode 100644 .ostree/packages-runtime-Fedora.txt create mode 100644 .ostree/packages-runtime-RedHat-7.txt create mode 100644 .ostree/packages-runtime-RedHat-8.txt create mode 100644 .ostree/packages-runtime-RedHat-9.txt create mode 100644 .ostree/packages-runtime.txt create mode 100644 .ostree/packages-testing-CentOS-7.txt create mode 100644 .ostree/packages-testing-CentOS-8.txt create mode 100644 .ostree/packages-testing-Fedora.txt create mode 100644 .ostree/packages-testing-RedHat-7.txt create mode 100644 .ostree/packages-testing-RedHat-8.txt create mode 100644 .ostree/packages-testing-RedHat-9.txt create mode 100644 .ostree/packages-testing.txt create mode 100644 .ostree/roles-runtime.txt create mode 100644 .ostree/roles-testing.txt create mode 100644 .sanity-ansible-ignore-2.12.txt create mode 100644 .sanity-ansible-ignore-2.13.txt create mode 100644 .sanity-ansible-ignore-2.14.txt create mode 100644 .sanity-ansible-ignore-2.15.txt create mode 100644 .sanity-ansible-ignore-2.9.txt create mode 100644 README-ostree.md delete mode 100644 tests/tasks/create_tests_certs.yml diff --git a/.ansible-lint b/.ansible-lint index 96e17227..4d6ee007 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -22,3 +22,5 @@ exclude_paths: - examples/roles/ mock_roles: - linux-system-roles.logging +mock_modules: + - ansible.utils.update_fact diff --git a/.ostree/README.md b/.ostree/README.md new file mode 100644 index 00000000..f5e6931b --- /dev/null +++ b/.ostree/README.md @@ -0,0 +1,3 @@ +*NOTE*: The `*.txt` files are used by `get_ostree_data.sh` to create the lists +of packages, and to find other system roles used by this role. DO NOT use them +directly. diff --git a/.ostree/get_ostree_data.sh b/.ostree/get_ostree_data.sh new file mode 100755 index 00000000..7c325241 --- /dev/null +++ b/.ostree/get_ostree_data.sh @@ -0,0 +1,123 @@ +#!/bin/bash + +set -euo pipefail + +role_collection_dir="${ROLE_COLLECTION_DIR:-fedora/linux_system_roles}" +ostree_dir="${OSTREE_DIR:-"$(dirname "$(realpath "$0")")"}" + +if [ -z "${4:-}" ] || [ "${1:-}" = help ] || [ "${1:-}" = -h ]; then + cat < 0) }}" + when: __rsyslog_generate_conf | bool + block: + - name: See if there are any config files + find: + paths: "{{ __rsyslog_config_dir }}" + patterns: "*.conf" + register: __rsyslog_find_result + when: is_ostree | bool + + - name: Get mode of rsyslog.conf if it exists + stat: + path: /etc/rsyslog.conf + register: __rsyslog_register_stat_conf + when: __rsyslog_generate_conf | bool + + - name: Generate main rsyslog configuration + template: + src: 'rsyslog.conf.j2' + dest: '/etc/rsyslog.conf' + mode: "{{ __rsyslog_register_stat_conf.stat.mode | d('0700') }}" + notify: Restart rsyslogd + when: __rsyslog_generate_conf | bool + vars: + __rsyslog_has_config_files: "{{ __rsyslog_find_result.matched > 0 + if is_ostree else true }}" diff --git a/roles/rsyslog/tasks/set_vars.yml b/roles/rsyslog/tasks/set_vars.yml index d6be3aaf..dbc28524 100644 --- a/roles/rsyslog/tasks/set_vars.yml +++ b/roles/rsyslog/tasks/set_vars.yml @@ -7,6 +7,24 @@ when: __logging_required_facts | difference(ansible_facts.keys() | list) | length > 0 +- name: Ensure correct package manager for ostree systems + vars: + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree + ostree_booted_file: /run/ostree-booted + when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Set package manager to use for ostree + ansible.utils.update_fact: + updates: + - path: ansible_facts.pkg_mgr + value: "{{ ostree_pkg_mgr }}" + when: __ostree_booted_stat.stat.exists + - name: Set platform/version specific variables include_vars: "{{ item }}" loop: diff --git a/roles/rsyslog/templates/rsyslog.conf.j2 b/roles/rsyslog/templates/rsyslog.conf.j2 index 3f988c74..a288cb58 100644 --- a/roles/rsyslog/templates/rsyslog.conf.j2 +++ b/roles/rsyslog/templates/rsyslog.conf.j2 @@ -3,4 +3,13 @@ # # Include all config files in {{ __rsyslog_config_dir }} # +{# it is an error to include files if the directory is empty #} +{% if __rsyslog_has_config_files %} $IncludeConfig {{ __rsyslog_config_dir }}/*.conf +{% else %} +{# must have something or rsyslog will fail to start #} +{# this will be overwritten the next time rsyslog is configured #} +{# with actual files #} +# Everybody gets emergency messages +*.emerg :omusrmsg:* +{% endif %} diff --git a/roles/rsyslog/vars/main.yml b/roles/rsyslog/vars/main.yml index ecae4b18..938b81a3 100644 --- a/roles/rsyslog/vars/main.yml +++ b/roles/rsyslog/vars/main.yml @@ -3,7 +3,9 @@ # __rsyslog_base_packages # # List of default rpm packages to install. -__rsyslog_base_packages: ['rsyslog'] +# NOTE: iproute is needed for the ip command which +# is needed for the default_ipv4 fact +__rsyslog_base_packages: ['iproute', 'rsyslog'] # rsyslog configuration directory __rsyslog_config_dir: /etc/rsyslog.d diff --git a/tests/tasks/create_tests_certs.yml b/tests/tasks/create_tests_certs.yml deleted file mode 100644 index f5f8be60..00000000 --- a/tests/tasks/create_tests_certs.yml +++ /dev/null @@ -1,60 +0,0 @@ ---- -- name: Ensure openssl exists - package: - name: - - openssl - state: present - -- name: Ensure /etc/pki/CA exists - file: - path: /etc/pki/CA - state: directory - mode: 0755 - -- name: Ensure /etc/pki/CA exists - file: - path: /etc/pki/CA/certs - state: directory - mode: 0755 - -- name: Ensure /etc/pki/CA exists - file: - path: /etc/pki/CA/private - state: directory - mode: 0755 - -- name: Generate a self signed CA cert and the CA key - command: >- - openssl req -x509 -newkey rsa:2048 -nodes - -keyout "{{ __test_ca_key }}" -out "{{ __test_ca_cert }}" - -subj "/CN=test-ca/OU=system-roles/DC=fedora/DC=org" - changed_when: false - -- name: Verify CA cert - command: >- - openssl x509 -text -in "{{ __test_ca_cert }}" -noout - changed_when: false - -- name: Generate a server/client key - command: openssl genrsa -out "{{ __test_key }}" - changed_when: false - -- name: Generate a server Certificate Signing Request - command: >- - openssl req -new -key "{{ __test_key }}" - -out "{{ __test_cert_csr }}" - -subj "/C=US/O=Fedora/DC=fedora/CN=logging.fedora.org" - changed_when: false - -- name: "Generate a server/client cert using the key, - and signed by the self signed CA" - command: >- - openssl x509 -req -in "{{ __test_cert_csr }}" - -CA "{{ __test_ca_cert }}" -CAkey "{{ __test_ca_key }}" - -CAcreateserial -out "{{ __test_cert }}" - changed_when: false - -- name: Verify the server/client cert - command: >- - openssl x509 -text -in "{{ __test_cert }}" -noout - changed_when: false diff --git a/tests/tasks/test_logger.yml b/tests/tasks/test_logger.yml index 239bf5fa..1964f641 100644 --- a/tests/tasks/test_logger.yml +++ b/tests/tasks/test_logger.yml @@ -1,18 +1,18 @@ --- -- name: Run logger to generate a test log message - vars: - __logging_tag: "testTag{{ __logging_index }}" - __logging_message: "testMessage{{ __logging_index }}" - command: "/bin/logger -i -p local6.info -t {{ __logging_tag }} - {{ __logging_message }}" - changed_when: false - - name: Check test log and check for errors + vars: + __logging_message: testMessage{{ __logging_index }} + __logging_tag: testTag{{ __logging_index }} block: + - name: Run logger to generate a test log message + command: >- + /bin/logger -i -p local6.info -t {{ __logging_tag | quote }} + {{ __logging_message | quote }} + changed_when: false + - name: Check the test log message in {{ __default_system_log }} - vars: - __logging_message: "testMessage{{ __logging_index }}" - command: /bin/grep "{{ __logging_message }}" "{{ __logging_file }}" + command: >- + /bin/grep {{ __logging_message | quote }} {{ __logging_file | quote }} register: __result until: __result is success retries: 60 @@ -20,7 +20,17 @@ changed_when: false rescue: - name: See what's in logging file if the test fails - command: tail -100 {{ __logging_file }} + command: tail -100 {{ __logging_file | quote }} + changed_when: false + + - name: Collect system information upon failure + shell: | + echo ############ + journalctl -u rsyslog + echo ############ + cat /etc/rsyslog.conf + echo ############ + ls -alrtF /etc/rsyslog.d changed_when: false - name: Fail if the message was not printed diff --git a/tests/tests_enabled.yml b/tests/tests_enabled.yml index ef555865..64cd1374 100644 --- a/tests/tests_enabled.yml +++ b/tests/tests_enabled.yml @@ -40,8 +40,10 @@ - name: Ensure config file size and counts vars: + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree __conf_count: 0 - __conf_size: more + __conf_size: "{{ 'less' if ansible_facts.pkg_mgr | d() == ostree_pkg_mgr + else 'more' }}" __conf_files: [] __check_systemctl_status: true include_tasks: tasks/check_daemon_config_files.yml diff --git a/tests/tests_purge_reset.yml b/tests/tests_purge_reset.yml index d07d1db1..ca98f239 100644 --- a/tests/tests_purge_reset.yml +++ b/tests/tests_purge_reset.yml @@ -6,7 +6,25 @@ hosts: all vars: __test_default_files_conf: /etc/rsyslog.d/30-output-files-default_files.conf + ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree tasks: + - name: Ensure correct package manager for ostree systems + vars: + ostree_booted_file: /run/ostree-booted + when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr + block: + - name: Check if system is ostree + stat: + path: "{{ ostree_booted_file }}" + register: __ostree_booted_stat + + - name: Set package manager to use for ostree + ansible.utils.update_fact: + updates: + - path: ansible_facts.pkg_mgr + value: "{{ ostree_pkg_mgr }}" + when: __ostree_booted_stat.stat.exists + - name: Ensure rsyslog is installed package: name: rsyslog @@ -100,7 +118,8 @@ - name: Ensure config file size and counts vars: __conf_count: 0 - __conf_size: more + __conf_size: "{{ 'less' if ansible_facts.pkg_mgr | d() == ostree_pkg_mgr + else 'more' }}" __check_systemctl_status: true include_tasks: tasks/check_daemon_config_files.yml