Skip to content

Commit af9a253

Browse files
ktsakalozosberkayoz
ktsakalozos
authored and
berkayoz
committed
Strict patch
1 parent 4711817 commit af9a253

File tree

15 files changed

+741
-101
lines changed

15 files changed

+741
-101
lines changed

‎.github/workflows/build-snap.yml‎

Lines changed: 74 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
name: Build MicroK8s snap on PR and push to master
22

33
on:
4-
push:
5-
branches:
6-
- master
7-
pull_request:
8-
branches:
9-
- master
4+
- push
5+
- pull_request
6+
7+
### While we work on the strict feature we want the tests to run even if we do put PRs against the master.
8+
### When this work get merged into master the following should be commented in.
9+
# push:
10+
# branches:
11+
# - master
12+
# pull_request:
13+
# branches:
14+
# - master
1015

1116
jobs:
1217
build:
@@ -43,24 +48,80 @@ jobs:
4348
- name: Running upgrade path test
4449
run: |
4550
set -x
46-
sudo -E UPGRADE_MICROK8S_FROM=latest/edge UPGRADE_MICROK8S_TO=`pwd`/`ls microk8s*.snap` pytest -s ./tests/test-upgrade-path.py
47-
sudo snap remove microk8s --purge
48-
- name: Running addons tests
51+
# Remove the snapd refresh as soon as v2.52 lands
52+
sudo snap refresh snapd --channel=latest/edge
53+
- name: Check branches
54+
run: |
55+
set -x
56+
(cd tests; pytest -s verify-branches.py)
57+
- name: Running addons tests in strict mode
4958
run: |
5059
set -x
51-
sudo snap install *.snap --classic --dangerous
60+
sudo snap install microk8s.snap --dangerous
61+
sudo ./tests/connect-all-interfaces.sh
5262
./tests/smoke-test.sh
5363
export UNDER_TIME_PRESSURE="True"
64+
export SKIP_OPENEBS="True"
5465
export SKIP_PROMETHEUS="False"
5566
(cd tests; pytest -s verify-branches.py)
5667
sudo -E bash -c "cd /var/snap/microk8s/common/addons/core/tests; pytest -s -ra test-addons.py"
5768
sudo microk8s enable community
5869
sudo -E bash -c "cd /var/snap/microk8s/common/addons/community/tests; pytest -s -ra test-addons.py"
70+
grep -Po "Report tarball is at \K.+" |
71+
sudo xargs -I {} mv {} inspection-report-strict-${{ strategy.job-index }}.tar.gz
5972
sudo snap remove microk8s --purge
60-
- name: Running upgrade tests
73+
sudo rm -rf $HOME/.kube
74+
sudo rm -rf $HOME/.config/helm
75+
sudo dmesg | grep 'apparmor="DENIED"' > ./denials-${{ strategy.job-index }}.log
76+
- name: Upload strict inspect tarball
77+
uses: actions/upload-artifact@v2
78+
with:
79+
name: inspection-report-strict-actions
80+
path: ./inspection-report-strict-${{ strategy.job-index }}.tar.gz
81+
- name: Upload AppArmor denials
82+
uses: actions/upload-artifact@v2
83+
with:
84+
name: apparmor-denials
85+
path: ./denials-${{ strategy.job-index }}.log
86+
- name: Running addons tests in devmode
6187
run: |
6288
set -x
63-
sudo snap install *.snap --classic --dangerous
89+
################ Until devmode of docker-support is fixed we skip this part of the tests #######
90+
exit 0
91+
sudo snap install microk8s.snap --devmode --dangerous
92+
sudo ./tests/connect-all-interfaces.sh
93+
./tests/smoke-test.sh
6494
export UNDER_TIME_PRESSURE="True"
65-
sudo -E bash -c "cd /var/snap/microk8s/common/addons/core/ ; UPGRADE_MICROK8S_FROM=latest/edge UPGRADE_MICROK8S_TO=`pwd`/`ls microk8s*.snap` pytest -s ./tests/test-upgrade.py"
95+
export SKIP_OPENEBS="False"
96+
export SKIP_PROMETHEUS="False"
97+
(cd tests; sudo -E pytest -s -ra test-addons.py)
98+
sudo microk8s inspect |
99+
grep -Po "Report tarball is at \K.+" |
100+
sudo xargs -I {} mv {} inspection-report-devmode-${{ strategy.job-index }}.tar.gz
66101
sudo snap remove microk8s --purge
102+
- name: Upload devmode inspect tarball
103+
uses: actions/upload-artifact@v2
104+
with:
105+
name: inspection-report-devmode-actions
106+
path: ./inspection-report-devmode-${{ strategy.job-index }}.tar.gz
107+
- name: Generate AppArmor on failure
108+
run: sudo dmesg | grep 'apparmor="DENIED"' > ./denials-${{ strategy.job-index }}.log
109+
if: failure()
110+
- name: Upload AppArmor denials failure
111+
uses: actions/upload-artifact@v2
112+
with:
113+
name: apparmor-denials
114+
path: ./denials-${{ strategy.job-index }}.log
115+
if: failure()
116+
- name: Generate inspect tarball
117+
run: >
118+
sudo microk8s inspect |
119+
grep -Po "Report tarball is at \K.+" |
120+
sudo xargs -I {} mv {} inspection-report-fail-${{ strategy.job-index }}.tar.gz
121+
if: failure()
122+
- name: Upload inspect tarball
123+
uses: actions/upload-artifact@v2
124+
with:
125+
name: inspection-report-actions
126+
path: ./inspection-report-fail-${{ strategy.job-index }}.tar.gz
127+
if: failure()

‎docs/build.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,16 @@ lxc file pull test-build/root/microk8s/microk8s_v1.9.6_amd64.snap .
8383
After copying it, you can install it with:
8484

8585
```shell
86-
snap install microk8s_*_amd64.snap --classic --dangerous
86+
sudo snap install microk8s_latest_amd64.snap --dangerous
8787
```
8888

89+
Finally, you need to connect the interfaces. To this end you can use the `connect-all-interfaces.sh` under the `tests` directory:
90+
91+
```shell
92+
sudo tests/connect-all-interfaces.sh
93+
```
94+
95+
8996
## Assembling the Calico CNI manifest
9097

9198
The calico CNI manifest can be found under `upgrade-scripts/000-switch-to-calico/resources/calico.yaml`.

‎microk8s-resources/default-args/kubelet‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
--client-ca-file=${SNAP_DATA}/certs/ca.crt
44
--anonymous-auth=false
55
--root-dir=${SNAP_COMMON}/var/lib/kubelet
6+
--log-dir=${SNAP_COMMON}/var/log
67
--fail-swap-on=false
78
--feature-gates=DevicePlugins=true
89
--eviction-hard="memory.available<100Mi,nodefs.available<1Gi,imagefs.available<1Gi"

‎scripts/cluster/common/utils.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ def try_set_file_permissions(file):
4040

4141
os.chmod(file, 0o660)
4242
try:
43-
shutil.chown(file, group="microk8s")
43+
shutil.chown(file, group="snap_microk8s")
4444
except LookupError:
4545
# not setting the group means only the current user can access the file
4646
pass

‎scripts/inspect.sh‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -224,14 +224,14 @@ function suggest_fixes {
224224
content+=' sudo ufw allow in on cali+ && sudo ufw allow out on cali+\n'
225225
fi
226226

227-
if [[ ! -z "$content" ]]
228-
then
229-
echo printing
230-
printf -- "$header"
231-
printf -- "$content"
232-
fi
233-
fi
234-
fi
227+
# if [[ ! -z "$content" ]]
228+
# then
229+
# echo printing
230+
# printf -- "$header"
231+
# printf -- "$content"
232+
# fi
233+
# fi
234+
# fi
235235

236236
# check for selinux. if enabled, print warning.
237237
if getenforce 2>&1 | grep 'Enabled' > /dev/null

‎snap/hooks/configure‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22

33
set -eux
44

5+
if [ ! -f "${SNAP_DATA}/var/lock/installed.lock" ]
6+
then
7+
exit 0
8+
fi
9+
510
source $SNAP/actions/common/utils.sh
611

712
if [ ! -f "${SNAP_DATA}/var/lock/installed.lock" ]
@@ -685,3 +690,4 @@ then
685690
fi
686691
fi
687692
fi
693+

‎snap/hooks/remove‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ then
1111
else
1212
snapctl stop ${SNAP_NAME}.daemon-kubelet 2>&1 || true
1313
fi
14-
snapctl stop ${SNAP_NAME}.daemon-docker 2>&1 || true
1514

1615
# Sym link the host's /var/lib/kubelet to the Snap's. This will be fixed with layouts when
1716
# this Snap is strictly confined.

0 commit comments

Comments
 (0)