Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement dockerhost.yml playbook for systems running static docker containers for test #1925

Merged
merged 6 commits into from
Feb 19, 2021
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions ansible/playbooks/AdoptOpenJDK_Unix_Playbook/dockerhost.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
---
###################################
# AdoptOpenJDK - Ansible Playbook #
###################################
# Groups can be passed in as a command-line variable in Ansible playbook.
# It can be defined as 'all' or a specific group which the host belongs to.
# For example, it can be 'all' or 'x86' for when a host is in the group 'x86'.
#- hosts: "{{ Groups | default('localhost:docker:!*zos*:!*win*:!*aix*') }}"
- hosts: all
gather_facts: yes
tasks:
- block:
# Set standard variables
- name: Load AdoptOpenJDKs variable file
include_vars: group_vars/all/adoptopenjdk_variables.yml

#########
# Roles #
#########
roles:
- Debug
- Version
- adopt_etc
- Providers # AdoptOpenJDK Infrastructure
- Get_Vendor_Files
- Jenkins_User # AdoptOpenJDK Infrastructure
- Superuser # AdoptOpenJDK Infrastructure
- role: Swap_File
- role: Crontab
- role: adoptopenjdk_install
jdk_version: 11
- role: Nagios_Plugins # AdoptOpenJDK Infrastructure
tags: [nagios_plugins, adoptopenjdk]
- role: Nagios_Master_Config # AdoptOpenJDK Infrastructure
tags: [nagios_master_config, adoptopenjdk]
- role: Nagios_Tunnel # AdoptOpenJDK Infrastructure
tags: [nagios_tunnel, adoptopenjdk]
- Security
- Vendor
- IPv6
- Docker
- DockerStatic
1 change: 1 addition & 0 deletions ansible/playbooks/AdoptOpenJDK_Unix_Playbook/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
- role: Get_Vendor_Files
tags: [vendor_files, adoptopenjdk, jenkins_user, nagios_plugins, superuser]
- Version
- adopt_etc
- Common
- Providers # AdoptOpenJDK Infrastructure
- autoconf
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -89,5 +89,3 @@ Test_Tool_Packages:
- xorg-x11-xauth
- xorg-x11-server-Xorg
- xorg-x11-server-Xvfb

crontab_Patching: "/usr/bin/yum -y update"
Original file line number Diff line number Diff line change
Expand Up @@ -102,5 +102,3 @@ Test_Tool_Packages:

Test_Tool_Packages_x86_64:
- pulseaudio

crontab_Patching: "/usr/bin/apt-get update && /usr/bin/apt-get -y upgrade"
Original file line number Diff line number Diff line change
Expand Up @@ -43,5 +43,3 @@ Test_Tool_Packages:
- xorg
- xorg-vfbserver
- pulseaudio

crontab_Patching: "/usr/sbin/pkg update && /usr/sbin/pkg upgrade -y"
Original file line number Diff line number Diff line change
Expand Up @@ -98,5 +98,3 @@ Test_Tool_Packages:
- perl-devel
- expat-devel
- libcurl-devel

crontab_Patching: "/usr/bin/yum -y update && yum clean packages"
Original file line number Diff line number Diff line change
Expand Up @@ -77,5 +77,3 @@ Test_Tool_Packages:
- xorg-x11-server
- xorg-x11-server-extra
- glibc-locale # Internationalization tests

crontab_Patching: "/usr/bin/zypper refresh && /usr/bin/zypper -n up"
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,3 @@ Build_Tool_Packages:

Test_Tool_Packages:
- perl

crontab_Patching: "/opt/csw/bin/pkgutil --upgrade --yes"
Original file line number Diff line number Diff line change
Expand Up @@ -114,5 +114,3 @@ Test_Tool_Packages:

Test_Tool_Packages_x86_64:
- pulseaudio

crontab_Patching: "/usr/bin/apt-get update && /usr/bin/apt-get -y upgrade"
Original file line number Diff line number Diff line change
Expand Up @@ -65,5 +65,3 @@ Test_Tool_Packages:
- xorg-x11-server
- xorg-x11-server-extra
- glibc-locale # Internationalization tests

crontab_Patching: "/usr/bin/zypper refresh && /usr/bin/zypper -n up"
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,33 @@
###########
# Crontab #
###########
- name: Add cron job to check for updates
cron: name="Check for updates everyday at 1am"
weekday="*"
minute="0"
hour="1"
user=root
job="{{ crontab_Patching }}"
state=present

- name: Add cron job to apply OS updates on yum-based systems
cron: name="Check for updates everyday at 1am" weekday="*" minute="0" hour="1" user=root state=present
job="/usr/bin/yum -y update"
when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS")
tags: crontab

- name: Add cron job to apply OS updates on apt-based systems
cron: name="Check for updates everyday at 1am" weekday="*" minute="0" hour="1" user=root state=present
job="/usr/bin/apt-get update && /usr/bin/apt-get -y upgrade"
when: (ansible_distribution == "Debian" or ansible_distribution == "Ubuntu")
tags: crontab

- name: Add cron job to apply OS updates on zypper-based systems
cron: name="Check for updates everyday at 1am" weekday="*" minute="0" hour="1" user=root state=present
job="/usr/bin/zypper refresh && /usr/bin/zypper -n up"
when: (ansible_distribution == "SLES" or ansible_distribution == "openSUSE")
tags: crontab

- name: Add cron job to apply OS updates on FreeBSD systems
cron: name="Check for updates everyday at 1am" weekday="*" minute="0" hour="1" user=root state=present
job="/usr/sbin/pkg update && /usr/sbin/pkg upgrade -y"
when: (ansible_distribution == "FreeBSD")
tags: crontab

- name: Add cron job to apply OS updates on Solaris systems
cron: name="Check for updates everyday at 1am" weekday="*" minute="0" hour="1" user=root state=present
job="/opt/csw/bin/pkgutil --upgrade --yes"
when: (ansible_distribution == "Solaris")
tags: crontab
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
FROM centos:8

RUN dnf -y update && dnf install -y perl openssh-server unzip wget
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -P ""
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
# RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN dnf install -y git curl make gcc xorg-x11-server-Xvfb libXrender libXi libXtst
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
FROM fedora:33

RUN yum -y update && yum install -y perl openssh-server unzip wget
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -P ""
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
# RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN yum install -y git curl make gcc xorg-x11-server-Xvfb libXrender libXi libXtst procps
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
FROM ubuntu:16.04

RUN apt-get update && apt-get install -qq -y perl openssh-server unzip
karianna marked this conversation as resolved.
Show resolved Hide resolved
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
aahlenst marked this conversation as resolved.
Show resolved Hide resolved
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should predefine a UID/GID that does ideally not collide with a host UID/GID. One popular recommendation is to use 10000.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since these containers are fully isolated and not sharing the file system with the host (unlike the build ones) that shouldn't be a concern for these.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to my understanding, you can still escape from the container and end up with the same UID on the host as in the container as long as Docker user namespacing isn't active and configured. If I read the Dockerfile correctly, sshd is run as root, anyway, so it might make sense to tackle this in a separate PR if we really need sshd.

RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN apt-get install -qq -y git curl make gcc xvfb libxrender1 libxi6 libxtst6
karianna marked this conversation as resolved.
Show resolved Hide resolved
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
FROM ubuntu:18.04

RUN apt-get update && apt-get install -qq -y perl openssh-server unzip
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN apt-get install -qq -y git curl make gcc xvfb libxrender1 libxi6 libxtst6
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
FROM ubuntu:20.04

# Without noninteractive Ubuntu 20.04 waits installing tzdata packae
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -qq -y perl openssh-server unzip
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN apt-get install -qq -y git curl make gcc xvfb libxrender1 libxi6 libxtst6
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
FROM ubuntu:20.10

RUN apt-get update && apt-get install -qq -y perl openssh-server unzip
# Get java8
RUN wget -q 'https://api.adoptopenjdk.net/v2/binary/releases/openjdk8?openjdk_impl=hotspot&os=linux&arch=x64&release=latest&type=jdk' -O /tmp/jdk8.tar.gz
RUN mkdir -p /usr/lib/jvm/jdk8 && tar -xpzf /tmp/jdk8.tar.gz -C /usr/lib/jvm/jdk8 --strip-components=1
# Install ant
RUN wget -q -O /tmp/ant.zip 'https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.5-bin.zip'
RUN wget -q -O /tmp/ant-contrib.tgz https://sourceforge.net/projects/ant-contrib/files/ant-contrib/ant-contrib-1.0b2/ant-contrib-1.0b2-bin.tar.gz
RUN ln -s /usr/local/apache-ant-1.10.5/bin/ant /usr/bin/ant
RUN unzip -q -d /usr/local /tmp/ant.zip
RUN tar xpfz /tmp/ant-contrib.tgz -C /usr/local/apache-ant-1.10.5/lib --strip-components=2 ant-contrib/lib/ant-contrib.jar
# Clear up space
RUN rm /tmp/jdk8.tar.gz /tmp/ant.zip /tmp/ant-contrib.tgz
# Set up jenkins user
RUN useradd -m -d /home/jenkins jenkins
RUN mkdir /home/jenkins/.ssh
RUN echo "Jenkins_User_SSHKey" > /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins/.ssh
RUN chmod -R og-rwx /home/jenkins/.ssh
RUN service ssh start
CMD ["/usr/sbin/sshd","-D"]
RUN apt-get install -qq -y git curl make gcc xvfb libxrender1 libxi6 libxtst6
# ENTRYPOINT /usr/lib/jvm/jdk8/bin/java
EXPOSE 22
# Start with docker run -p 2222:22 UUID
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
---
#################################################
# Build basic test images for each distribution #
#################################################

- name: Send Dockerfiles to remote machine
copy:
src: Dockerfiles/
dest: /tmp/Dockerfiles/

- name: Collate all Dockerfile names
find:
paths: "/tmp/Dockerfiles/"
patterns: "Dockerfile.*"
register: dockerfiles

# Defaulting to x64 in Dockerfiles means no need to special case that one
# since API architecture = ansible_architecture everywhere else we use this
- name: Translate architecture name in dockerfiles
replace: dest={{ item.path }} regexp="arch=x64" replace="arch={{ ansible_architecture }}"
with_items: "{{ dockerfiles.files }}"
when: ansible_architecture != "x86_64"

- name: Set jenkins authorized_Key in dockerfiles
replace: dest={{ item.path }} regexp="Jenkins_User_SSHKey" replace="{{ Jenkins_User_SSHKey }}"
with_items: "{{ dockerfiles.files }}"

- name: Create docker images for each distribution for test
command: docker build --cpu-period=100000 --cpu-quota=800000 -t aqa_{{ item }} --memory=8G -f /tmp/Dockerfiles/Dockerfile.{{ item }} /tmp/Dockerfiles
with_items:
- u1604
- u1804
- u2004
- u2010
- f33

##############################################################
# Start the containers #
# If startallcontainers is skipped, only start three of them #
# ignore_errors simplest way to ignore if already started #
# #
# TODO: Check if started rather than ignore error? #
# TODO: Restart if already started? (Use galaxy role?) #
# TODO: Use a calculated value instead of 2 core/6Gb #
##############################################################

- name: Start Ubuntu 16.04 container if not already started
command: docker run --restart unless-stopped -p 2222:22 --cpus=2.0 --memory=6G --detach --name U1604_2222 aqa_u1604
tags: startcontainers
ignore_errors: yes

- name: Start Ubuntu 18.04 container if not already started
command: docker run --restart unless-stopped -p 2223:22 --cpus=4.0 --memory=6G --detach --name U1804_2223 aqa_u1804
tags: startcontainers, startallcontainers
ignore_errors: yes

- name: Start Ubuntu 20.04 container if not already started
command: docker run --restart unless-stopped -p 2224:22 --cpus=2.0 --memory=6G --detach --name U2004_2224 aqa_u2004
tags: startcontainers
ignore_errors: yes

- name: Start Ubuntu 20.10 container if not already started
command: docker run --restart unless-stopped -p 2225:22 --cpus=4.0 --memory=6G --detach --name U2010_2225 aqa_u2010
tags: startcontainers, startallcontainers
ignore_errors: yes

- name: Start fedora 33 container if not already started
command: docker run --restart unless-stopped -p 2227:22 --cpus=2.0 --memory=6G --detach --name f33.2227 aqa_f33
tags: startcontainers
ignore_errors: yes

# lineinfile does not work here - similar to the operation in /var/log in adopt_etc
# lineinfile: path /proc/sys/kernel/core_pattern state: present: regexp: . line: core.%p
# therefore the following section wil not become live prior to a reboot
#
- name: Make core file setting live immediately;
command: "echo core.%p > /proc/sys/kernel/core_pattern"

- name: Ensure core files are able to be created within docker containers on reboot
lineinfile:
path: /etc/sysctl.conf
state: present
regexp: kernel_core_pattern
line: kernel.core_pattern=core.%p
Loading