Skip to content

Commit 35374e3

Browse files
elezarelezar
committed
test(test-guest): support rootful Podman gateways
Signed-off-by: Evan Lezar <elezar@nvidia.com>
1 parent c93b2fa commit 35374e3

13 files changed

Lines changed: 281 additions & 95 deletions

File tree

‎nix/test-guest/configuration/podman-rootful.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
- name: Configure rootful Podman
6+
hosts: test_vm
7+
become: true
8+
gather_facts: true
9+
tasks:
10+
- name: Install common Podman prerequisites
11+
ansible.builtin.import_tasks: tasks/podman-common.yml
12+
13+
- name: Enable the rootful Podman API socket
14+
ansible.builtin.systemd_service:
15+
name: podman.socket
16+
enabled: true
17+
state: started
18+
19+
- name: Verify rootful Podman mode
20+
ansible.builtin.command:
21+
argv:
22+
- podman
23+
- --url
24+
- unix:///run/podman/podman.sock
25+
- info
26+
- --format
27+
- "{% raw %}{{.Host.Security.Rootless}}{% endraw %}"
28+
changed_when: false
29+
register: podman_rootless
30+
failed_when: podman_rootless.stdout != "false"

‎nix/test-guest/default.nix‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ let
2727

2828
configurations = {
2929
docker = ./configuration/docker.yml;
30+
podman-rootful = ./configuration/podman-rootful.yml;
3031
podman-rootless = ./configuration/podman-rootless.yml;
3132
selinux = ./configuration/selinux.yml;
3233
snapd = ./configuration/snapd.yml;
@@ -46,6 +47,8 @@ let
4647
"gateway-rootless-podman"
4748
"openshell-rpm-gateway-reinstall"
4849
"openshell-rpm-gateway-upgrade"
50+
"gateway-rootful-podman"
51+
"gateway-podman"
4952
];
5053

5154
mkDistroProfile =

nix/test-guest/provisioners/roles/gateway-rootless-podman/defaults/main.yml renamed to nix/test-guest/provisioners/roles/gateway-podman/defaults/main.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,7 @@
22
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
# SPDX-License-Identifier: Apache-2.0
44

5+
openshell_podman_service_user: openshell
6+
openshell_gateway_service_command: /home/openshell/.local/bin/openshell-test-guest-as-gateway-user
57
openshell_gateway_restart_command: /home/openshell/.local/bin/openshell-test-guest-gateway-restart
68
openshell_gateway_diagnostics_command: /home/openshell/.local/bin/openshell-test-guest-diagnostics

nix/test-guest/provisioners/roles/gateway-rootless-podman/tasks/development-gateway.yml renamed to nix/test-guest/provisioners/roles/gateway-podman/tasks/development-gateway.yml

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,40 @@
22
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
# SPDX-License-Identifier: Apache-2.0
44

5-
- name: Create development gateway state directories
5+
- name: Publish development gateway paths
6+
ansible.builtin.set_fact:
7+
openshell_gateway_state_root: "{{ openshell_gateway_service_home }}/.local/share/openshell-test-guest"
8+
openshell_gateway_config_home: "{{ openshell_gateway_service_home }}/.config"
9+
10+
- name: Create development gateway directories
611
ansible.builtin.file:
712
path: "{{ item }}"
813
state: directory
914
mode: "0700"
15+
owner: "{{ openshell_gateway_service_user }}"
16+
group: "{{ openshell_gateway_service_user }}"
1017
loop:
1118
- "{{ openshell_gateway_state_root }}"
1219
- "{{ openshell_gateway_state_root }}/xdg/config"
1320
- "{{ openshell_gateway_state_root }}/xdg/cache"
1421
- "{{ openshell_gateway_state_root }}/xdg/data"
1522
- "{{ openshell_gateway_state_root }}/xdg/state"
16-
- /home/openshell/.config/systemd/user
23+
- "{{ openshell_gateway_config_home }}/systemd/user"
24+
become: true
1725

18-
- name: Generate development gateway certificates
26+
- name: Generate development gateway credentials
1927
ansible.builtin.command:
2028
cmd: "{{ openshell_gateway_bin }} generate-certs --output-dir {{ openshell_gateway_state_root }}/pki"
2129
creates: "{{ openshell_gateway_state_root }}/pki/jwt/signing.pem"
30+
become: true
31+
become_user: "{{ openshell_gateway_service_user }}"
2232

23-
- name: Write rootless Podman gateway configuration
33+
- name: Write development Podman gateway configuration
2434
ansible.builtin.copy:
2535
dest: "{{ openshell_gateway_state_root }}/gateway.toml"
2636
mode: "0600"
37+
owner: "{{ openshell_gateway_service_user }}"
38+
group: "{{ openshell_gateway_service_user }}"
2739
content: |
2840
[openshell]
2941
version = 1
@@ -50,25 +62,32 @@
5062
image_pull_policy = "always"
5163
network_name = "openshell-test-guest"
5264
grpc_endpoint = "http://host.containers.internal:8080"
65+
become: true
5366

5467
- name: Check for the development supervisor image
5568
ansible.builtin.command:
5669
cmd: "podman image exists {{ openshell_supervisor_image }}"
5770
register: openshell_supervisor_image_exists
5871
changed_when: false
5972
failed_when: false
73+
become: true
74+
become_user: "{{ openshell_gateway_service_user }}"
6075

6176
- name: Import the development supervisor image
6277
ansible.builtin.command:
6378
cmd: >-
6479
podman import --change 'ENTRYPOINT ["/openshell-sandbox"]'
6580
{{ openshell_supervisor_archive }} {{ openshell_supervisor_image }}
6681
when: openshell_supervisor_image_exists.rc != 0
82+
become: true
83+
become_user: "{{ openshell_gateway_service_user }}"
6784

6885
- name: Install the development gateway user service
6986
ansible.builtin.copy:
70-
dest: "/home/openshell/.config/systemd/user/{{ openshell_gateway_service }}"
87+
dest: "{{ openshell_gateway_config_home }}/systemd/user/{{ openshell_gateway_service }}"
7188
mode: "0600"
89+
owner: "{{ openshell_gateway_service_user }}"
90+
group: "{{ openshell_gateway_service_user }}"
7291
content: |
7392
[Unit]
7493
Description=OpenShell development test guest gateway
@@ -84,3 +103,4 @@
84103
85104
[Install]
86105
WantedBy=default.target
106+
become: true

‎nix/test-guest/provisioners/roles/gateway-podman/tasks/lifecycle.yml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
- name: Publish gateway user-manager environment
6+
ansible.builtin.set_fact:
7+
openshell_gateway_user_environment:
8+
HOME: "{{ openshell_gateway_service_home }}"
9+
XDG_RUNTIME_DIR: "/run/user/{{ openshell_gateway_service_uid }}"
10+
DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus"
11+
12+
- name: Reload gateway user services
13+
ansible.builtin.systemd_service:
14+
daemon_reload: true
15+
scope: user
16+
environment: "{{ openshell_gateway_user_environment }}"
17+
become: true
18+
become_user: "{{ openshell_gateway_service_user }}"
19+
20+
- name: Start the gateway user service
21+
ansible.builtin.systemd_service:
22+
name: "{{ openshell_gateway_service }}"
23+
enabled: true
24+
state: started
25+
scope: user
26+
environment: "{{ openshell_gateway_user_environment }}"
27+
become: true
28+
become_user: "{{ openshell_gateway_service_user }}"
29+
30+
- name: Register the provisioned gateway with its service account
31+
ansible.builtin.command:
32+
cmd: "{{ openshell_cli_bin }} gateway add {{ openshell_gateway_endpoint }} --local --name test-guest"
33+
environment: "{{ openshell_gateway_user_environment }}"
34+
become: true
35+
become_user: "{{ openshell_gateway_service_user }}"
36+
37+
- name: Wait for gateway CLI health
38+
ansible.builtin.command:
39+
cmd: "{{ openshell_cli_bin }} status"
40+
environment: "{{ openshell_gateway_user_environment }}"
41+
become: true
42+
become_user: "{{ openshell_gateway_service_user }}"
43+
register: gateway_health
44+
changed_when: false
45+
retries: 60
46+
delay: 1
47+
until: gateway_health.rc == 0
48+
ignore_errors: true
49+
50+
- name: Collect failed gateway service status
51+
ansible.builtin.command:
52+
cmd: "systemctl --user status {{ openshell_gateway_service }} --no-pager"
53+
environment: "{{ openshell_gateway_user_environment }}"
54+
become: true
55+
become_user: "{{ openshell_gateway_service_user }}"
56+
register: gateway_service_status
57+
changed_when: false
58+
failed_when: false
59+
when: gateway_health is failed
60+
61+
- name: Collect failed gateway service journal
62+
ansible.builtin.command:
63+
cmd: "journalctl --user -u {{ openshell_gateway_service }} --no-pager -n 200"
64+
environment: "{{ openshell_gateway_user_environment }}"
65+
become: true
66+
become_user: "{{ openshell_gateway_service_user }}"
67+
register: gateway_service_journal
68+
changed_when: false
69+
failed_when: false
70+
when: gateway_health is failed
71+
72+
- name: Report failed gateway service diagnostics
73+
ansible.builtin.debug:
74+
msg: |
75+
{{ gateway_service_status.stdout }}
76+
{{ gateway_service_journal.stdout }}
77+
when: gateway_health is failed
78+
79+
- name: Require gateway CLI health
80+
ansible.builtin.assert:
81+
that: gateway_health is not failed
82+
fail_msg: The provisioned gateway did not become healthy.
83+
84+
- name: Create the target gateway-control command directory
85+
ansible.builtin.file:
86+
path: "{{ openshell_gateway_restart_command | dirname }}"
87+
state: directory
88+
mode: "0700"
89+
90+
- name: Install the gateway service-account command wrapper
91+
ansible.builtin.copy:
92+
dest: "{{ openshell_gateway_service_command }}"
93+
mode: "0700"
94+
content: |
95+
#!/usr/bin/env bash
96+
set -Eeuo pipefail
97+
exec sudo -H -u {{ openshell_gateway_service_user }} env \
98+
HOME={{ openshell_gateway_service_home }} \
99+
XDG_RUNTIME_DIR=/run/user/{{ openshell_gateway_service_uid }} \
100+
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus \
101+
"$@"
102+
103+
- name: Install the target gateway restart command
104+
ansible.builtin.copy:
105+
dest: "{{ openshell_gateway_restart_command }}"
106+
mode: "0700"
107+
content: |
108+
#!/usr/bin/env bash
109+
set -Eeuo pipefail
110+
sudo -H -u {{ openshell_gateway_service_user }} env \
111+
XDG_RUNTIME_DIR=/run/user/{{ openshell_gateway_service_uid }} \
112+
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus \
113+
systemctl --user restart {{ openshell_gateway_service }}
114+
for _ in $(seq 1 60); do
115+
if sudo -H -u {{ openshell_gateway_service_user }} {{ openshell_cli_bin }} status >/dev/null 2>&1; then
116+
exit 0
117+
fi
118+
sleep 1
119+
done
120+
sudo -H -u {{ openshell_gateway_service_user }} env \
121+
XDG_RUNTIME_DIR=/run/user/{{ openshell_gateway_service_uid }} \
122+
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus \
123+
systemctl --user status {{ openshell_gateway_service }} --no-pager >&2 || true
124+
exit 1
125+
126+
- name: Install the target gateway diagnostics command
127+
ansible.builtin.copy:
128+
dest: "{{ openshell_gateway_diagnostics_command }}"
129+
mode: "0700"
130+
content: |
131+
#!/usr/bin/env bash
132+
set -u
133+
sudo -H -u {{ openshell_gateway_service_user }} env \
134+
XDG_RUNTIME_DIR=/run/user/{{ openshell_gateway_service_uid }} \
135+
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus \
136+
systemctl --user status {{ openshell_gateway_service }} --no-pager || true
137+
sudo -H -u {{ openshell_gateway_service_user }} env \
138+
XDG_RUNTIME_DIR=/run/user/{{ openshell_gateway_service_uid }} \
139+
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ openshell_gateway_service_uid }}/bus \
140+
journalctl --user -u {{ openshell_gateway_service }} --no-pager -n 200 || true
141+
sudo -H -u {{ openshell_gateway_service_user }} podman info || true
142+
sudo -H -u {{ openshell_gateway_service_user }} podman ps --all || true
143+
if command -v getenforce >/dev/null 2>&1; then
144+
getenforce || true
145+
fi

‎nix/test-guest/provisioners/roles/gateway-podman/tasks/main.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
- name: Require an OpenShell installation
6+
ansible.builtin.assert:
7+
that:
8+
- openshell_install_source is defined
9+
- openshell_cli_bin is defined
10+
- openshell_gateway_bin is defined
11+
- openshell_gateway_service is defined
12+
- openshell_gateway_endpoint is defined
13+
- openshell_gateway_service_source in ['generated', 'package']
14+
- openshell_gateway_config_source in ['generated', 'package']
15+
- openshell_podman_mode in ['rootless', 'rootful']
16+
fail_msg: >-
17+
gateway-podman requires an earlier OpenShell installation role and a
18+
rootless or rootful Podman wrapper.
19+
20+
- name: Resolve the gateway service account
21+
ansible.builtin.getent:
22+
database: passwd
23+
key: "{{ openshell_podman_service_user }}"
24+
25+
- name: Publish the gateway service account
26+
ansible.builtin.set_fact:
27+
openshell_gateway_service_user: "{{ openshell_podman_service_user }}"
28+
openshell_gateway_service_uid: "{{ ansible_facts.getent_passwd[openshell_podman_service_user][1] }}"
29+
openshell_gateway_service_home: "{{ ansible_facts.getent_passwd[openshell_podman_service_user][4] }}"
30+
31+
- name: Configure a development gateway
32+
ansible.builtin.include_tasks: development-gateway.yml
33+
when:
34+
- openshell_gateway_service_source == 'generated'
35+
- openshell_gateway_config_source == 'generated'
36+
37+
- name: Enable the gateway service account user manager
38+
ansible.builtin.command:
39+
argv:
40+
- loginctl
41+
- enable-linger
42+
- "{{ openshell_gateway_service_user }}"
43+
become: true
44+
changed_when: false
45+
46+
- name: Start the gateway service account user manager
47+
ansible.builtin.systemd_service:
48+
name: "user@{{ openshell_gateway_service_uid }}.service"
49+
state: started
50+
become: true
51+
52+
- name: Run the gateway lifecycle
53+
ansible.builtin.include_tasks: lifecycle.yml
54+
55+
- name: Publish Podman gateway runtime
56+
ansible.builtin.set_fact:
57+
openshell_gateway_runtime: "{{ openshell_podman_mode }}-podman"

‎nix/test-guest/provisioners/roles/gateway-rootful-podman/tasks/main.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
- ansible.builtin.include_role:
6+
name: gateway-podman
7+
vars:
8+
openshell_podman_mode: rootful
9+
openshell_podman_service_user: root

0 commit comments

Comments
 (0)