diff options
| -rw-r--r-- | .rstcheck.cfg | 2 | ||||
| -rw-r--r-- | .yamllint | 4 | ||||
| -rw-r--r-- | docs/release/installation/deployment-guide.rst | 6 | ||||
| -rwxr-xr-x | functions.sh | 150 | ||||
| -rw-r--r-- | hw_config/libvirt-vms/pdf.yaml | 14 | ||||
| -rw-r--r-- | sw_config/bmra/patched_k8s.yml | 4 | ||||
| -rw-r--r-- | sw_config/bmra/patched_preflight.yml | 174 | ||||
| -rw-r--r-- | sw_config/bmra/patched_rhel_packages.yml | 72 | ||||
| -rw-r--r-- | sw_config/bmra/patched_sriov_cni_install.yml | 8 | ||||
| -rw-r--r-- | sw_config/bmra/patched_vfio.yml | 2 | ||||
| -rw-r--r-- | test-requirements.txt | 12 | ||||
| -rw-r--r-- | tox.ini | 9 |
12 files changed, 226 insertions, 231 deletions
diff --git a/.rstcheck.cfg b/.rstcheck.cfg index 86d167d..ada1524 100644 --- a/.rstcheck.cfg +++ b/.rstcheck.cfg @@ -3,5 +3,5 @@ # SPDX-License-Identifier: Apache-2.0 [rstcheck] -report=warning +report_level=ERROR ignore_substitutions=today @@ -7,6 +7,10 @@ extends: default ignore: | deployment.yaml + .tox/ rules: line-length: disable + truthy: disable + comments-indentation: disable + comments: disable diff --git a/docs/release/installation/deployment-guide.rst b/docs/release/installation/deployment-guide.rst index 283aa9d..fd0d11e 100644 --- a/docs/release/installation/deployment-guide.rst +++ b/docs/release/installation/deployment-guide.rst @@ -22,7 +22,7 @@ Anuket RI-2 workstream. Infrastructure Prerequisites ============================= -Please refer to Chapter 3 of `Anuket RI-2 Documentation <https://cntt.readthedocs.io/en/latest/ref_impl/cntt-ri2/chapters/chapter03.html>`_ +Please refer to Chapter 3 of `Anuket RI-2 Chapter 03 Documentation <https://cntt.readthedocs.io/projects/ri2/en/latest/chapters/chapter03.html>`_ for detailed information on the server and network specifications. Additionally, please make note of the following: @@ -125,7 +125,7 @@ Generate SSH keypair Deployment on Baremetal and Provider Infrastructure =================================================== -Please refer to Chapter 4 of `Anuket RI-2 Documentation <https://cntt.readthedocs.io/en/latest/ref_impl/cntt-ri2/chapters/chapter04.html>`_ +Please refer to Chapter 4 of `Anuket RI-2 Chapter 04 Documentation <https://cntt.readthedocs.io/projects/ri2/en/latest/chapters/chapter04.html>`_ for instructions to get started with the deployment. Deployment on Virtualized Infrastructure @@ -148,4 +148,4 @@ Validation of the Reference Implementation =========================================== Kuberef is validated by running test cases defined in Anuket RC-2 Cookbook. -For setting up RC-2 Conformance toolchain, please refer to `Anuket RC-2 Chapter 03 <https://cntt.readthedocs.io/en/latest/ref_cert/RC2/chapters/chapter03.html>`_. +For setting up RC-2 Conformance toolchain, please refer to `Anuket RC-2 Chapter 03 <https://cntt.readthedocs.io/projects/rc2/en/latest/chapters/chapter03.html>`_. diff --git a/functions.sh b/functions.sh index 4eaa281..3ca3e09 100755 --- a/functions.sh +++ b/functions.sh @@ -69,83 +69,83 @@ check_prerequisites() { #------------------------------------------------------------------------------- if [ "$OS_ID" == "ubuntu" ]; then - sudo apt update -y - ansible --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo apt-add-repository --yes --update ppa:ansible/ansible - sudo apt-get install -y ansible - fi - - yq --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq - sudo chmod +x /usr/bin/yq - fi - - virsh --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo apt-get install -y virsh - fi - - jq --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo apt-get install -y jq - fi - - virtualenv --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo apt-get install -y virtualenv - fi - - pip --version - if [ $RESULT -ne 0 ]; then - sudo apt-get install -y pip - fi + sudo apt update -y + ansible --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo apt-add-repository --yes --update ppa:ansible/ansible + sudo apt-get install -y ansible + fi + + yq --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq + sudo chmod +x /usr/bin/yq + fi + + virsh --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo apt-get install -y virsh + fi + + jq --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo apt-get install -y jq + fi + + virtualenv --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo apt-get install -y virtualenv + fi + + pip --version + if [ $RESULT -ne 0 ]; then + sudo apt-get install -y pip + fi elif [ "$OS_ID" == "centos" ]; then - sudo yum update -y - ansible --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo dnf install epel-release - sudo dnf install ansible - fi - - yq --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq - sudo chmod +x /usr/bin/yq - fi - - virsh --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo yum install -y virsh - fi - - jq --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo yum install -y jq - fi - - virtualenv --version - RESULT=$? - if [ $RESULT -ne 0 ]; then - sudo yum install -y virtualenv - fi - - pip --version - if [ $RESULT -ne 0 ]; then - sudo yum install -y pip - fi + sudo yum update -y + ansible --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo dnf install epel-release + sudo dnf install ansible + fi + + yq --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq + sudo chmod +x /usr/bin/yq + fi + + virsh --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo yum install -y virsh + fi + + jq --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo yum install -y jq + fi + + virtualenv --version + RESULT=$? + if [ $RESULT -ne 0 ]; then + sudo yum install -y virtualenv + fi + + pip --version + if [ $RESULT -ne 0 ]; then + sudo yum install -y pip + fi fi #------------------------------------------------------------------------------- @@ -421,7 +421,7 @@ creates_virtualenv() { if [ ! -d "$CURRENTPATH/.venv" ]; then virtualenv "$CURRENTPATH/.venv" fi - # shellcheck disable=SC1090 + # shellcheck disable=SC1090,SC1091 source "$CURRENTPATH/.venv/bin/activate" pip install -r "$CURRENTPATH/requirements.txt" } diff --git a/hw_config/libvirt-vms/pdf.yaml b/hw_config/libvirt-vms/pdf.yaml index 6686e02..4626d82 100644 --- a/hw_config/libvirt-vms/pdf.yaml +++ b/hw_config/libvirt-vms/pdf.yaml @@ -30,13 +30,13 @@ jumphost: disk_rotation: os: ubuntu1804 interfaces: - # NOTE (fdegir): The IPs listed below actually belong to the libvirt bridges - # we create & configure since this is virtual POD and its real IP has nothing - # to do with the deployment itself. - # interface connected to admin/pxe network - - address: 10.1.0.1 - # interface connected to public network - - address: 10.2.0.1 + # NOTE (fdegir): The IPs listed below actually belong to the libvirt bridges + # we create & configure since this is virtual POD and its real IP has nothing + # to do with the deployment itself. + # interface connected to admin/pxe network + - address: 10.1.0.1 + # interface connected to public network + - address: 10.2.0.1 ############################################################################## nodes: - name: node1 diff --git a/sw_config/bmra/patched_k8s.yml b/sw_config/bmra/patched_k8s.yml index fb0d43a..89aba6f 100644 --- a/sw_config/bmra/patched_k8s.yml +++ b/sw_config/bmra/patched_k8s.yml @@ -7,7 +7,7 @@ connection: local tasks: [] roles: - - { role: kubespray_install } + - {role: kubespray_install} environment: "{{ proxy_env | d({}) }}" any_errors_fatal: true @@ -77,7 +77,7 @@ kubelet_node_custom_flags: "{{ kubelet_node_custom_flags_prepare | from_yaml }}" kube_api_anonymous_auth: true kube_feature_gates: - - CPUManager=true # feature gate can be enabled by default, default policy is none in Kubernetes + - CPUManager=true # feature gate can be enabled by default, default policy is none in Kubernetes - TopologyManager={{ topology_manager_enabled | default(true) }} - RotateKubeletServerCertificate=true # Kubernetes cluster hardening diff --git a/sw_config/bmra/patched_preflight.yml b/sw_config/bmra/patched_preflight.yml index ae401f9..c83879e 100644 --- a/sw_config/bmra/patched_preflight.yml +++ b/sw_config/bmra/patched_preflight.yml @@ -130,98 +130,98 @@ # Early check if SELinux is configured properly - block: - - name: "Collect packages facts" - package_facts: - - debug: - msg: - - "Current SELinux status:" - - "status: {{ ansible_selinux.status | default('') }}" - - "policy version: {{ ansible_selinux.policyvers | default('') }}" - - "type: {{ ansible_selinux.type | default('') }}" - - "mode: {{ ansible_selinux.mode | default('') }}" - - "config_mode: {{ ansible_selinux.config_mode | default('') }}" - - - name: check selinux condition possibly causing system boot failure - debug: - msg: - - "Current SELinux setup might cause the system possibly will not boot up on next reboot." - - "Please, check SELinux settings and set it up according to the documentation." - when: - - "'selinux-policy' not in ansible_facts.packages" - - "'selinux-policy-targeted' not in ansible_facts.packages" + - name: "Collect packages facts" + package_facts: + - debug: + msg: + - "Current SELinux status:" + - "status: {{ ansible_selinux.status | default('') }}" + - "policy version: {{ ansible_selinux.policyvers | default('') }}" + - "type: {{ ansible_selinux.type | default('') }}" + - "mode: {{ ansible_selinux.mode | default('') }}" + - "config_mode: {{ ansible_selinux.config_mode | default('') }}" + + - name: check selinux condition possibly causing system boot failure + debug: + msg: + - "Current SELinux setup might cause the system possibly will not boot up on next reboot." + - "Please, check SELinux settings and set it up according to the documentation." + when: + - "'selinux-policy' not in ansible_facts.packages" + - "'selinux-policy-targeted' not in ansible_facts.packages" when: - ansible_os_family == "RedHat" # STORY: "cmk requires isolcpus to be configured" - block: - - debug: - msg: - - cmk_enabled = {{ cmk_enabled }} (group_vars/all.yml) - - cmk_use_all_hosts = {{ cmk_use_all_hosts }} (group_vars/all.yml) - - cmk_hosts_list = {{ cmk_hosts_list | default('') }} (group_vars/all.yml) - - cmk_shared_num_cores = {{ cmk_shared_num_cores }} (group_vars/all.yml) - - cmk_exclusive_num_cores = {{ cmk_exclusive_num_cores }} (group_vars/all.yml) - - isolcpus_enabled = {{ isolcpus_enabled }} (host_vars) - - isolcpus = {{ isolcpus }} (host_vars) - - ansible_processor_count = {{ ansible_processor_count }} - - ansible_processor_cores = {{ ansible_processor_cores }} - - ansible_processor_threads_per_core = {{ ansible_processor_threads_per_core }} - - ansible_processor_vcpus = {{ ansible_processor_vcpus }} - - CPUs Reserved for OS = 0...{{ ansible_processor_count - 1 }} -# - CPUs Reserved for OS = {{ lookup('sequence','0-{{ ansible_processor_count - 1 }}').split(',') }} # [E207] Nested jinja pattern - - - name: Check Intel CMK Config - assert: - that: ({{ cmk_enabled }} and {{ isolcpus_enabled }} and "{{ isolcpus }}" | length > 0) - msg: - - Incorrect configuration pertaining Intel CMK. Conflicting or improper values detected - - When Intel CMK is enabled, CPUs isolation ('isolcpus') must be set according to the example file for host_vars. Please correct the configuration - - - name: Split isolcpus Groups - set_fact: - isolcpus_groups: "{{ isolcpus.split(',') }}" - - - debug: msg="isolcpus_groups = {{ isolcpus_groups }}" - - - name: Filter isolcpus Ranges - set_fact: - isolcpus_ranges: "{{ isolcpus_ranges + [item] }}" - with_items: "{{ isolcpus_groups }}" - when: ("-" in item) - - - debug: msg="isolcpus_ranges = {{ isolcpus_ranges }}" - - - name: Filter isolcpus Discretes - set_fact: - isolcpus_discretes: "{{ isolcpus_discretes + [item] }}" - with_items: "{{ isolcpus_groups }}" - when: ("-" not in item) - - - debug: msg="isolcpus_discretes = {{ isolcpus_discretes }}" - - - name: Build isolcpus List - set_fact: - isolcpus_list: "{{ isolcpus_list | default([]) | union(isolcpus_discretes) | union([item]) }}" - with_sequence: "{{ isolcpus_ranges }}" - - - debug: msg="isolcpus_list = {{ isolcpus_list }}" - - - name: Check isolcpus Total - assert: - that: "{{ isolcpus_list | length }} <= ansible_processor_vcpus" - msg: - - Incorrect configuration pertaining isolcpus. Conflicting or improper values detected - - The number of isolcpus {{ isolcpus_list | length }}, exceeds total CPUs on target {{ ansible_processor_vcpus }}. Please correct the configuration - when: isolcpus is defined - - - name: Check isolcpus IDs - assert: - that: "item | int <= ansible_processor_vcpus" - msg: - - Incorrect configuration pertaining isolcpus. Conflicting or improper values detected - - The CPU ID {{ item }} set for isolcpus is NOT actually present on target. Please correct the configuration - with_items: "{{ isolcpus_list }}" - when: isolcpus is defined + - debug: + msg: + - cmk_enabled = {{ cmk_enabled }} (group_vars/all.yml) + - cmk_use_all_hosts = {{ cmk_use_all_hosts }} (group_vars/all.yml) + - cmk_hosts_list = {{ cmk_hosts_list | default('') }} (group_vars/all.yml) + - cmk_shared_num_cores = {{ cmk_shared_num_cores }} (group_vars/all.yml) + - cmk_exclusive_num_cores = {{ cmk_exclusive_num_cores }} (group_vars/all.yml) + - isolcpus_enabled = {{ isolcpus_enabled }} (host_vars) + - isolcpus = {{ isolcpus }} (host_vars) + - ansible_processor_count = {{ ansible_processor_count }} + - ansible_processor_cores = {{ ansible_processor_cores }} + - ansible_processor_threads_per_core = {{ ansible_processor_threads_per_core }} + - ansible_processor_vcpus = {{ ansible_processor_vcpus }} + - CPUs Reserved for OS = 0...{{ ansible_processor_count - 1 }} +# - CPUs Reserved for OS = {{ lookup('sequence','0-{{ ansible_processor_count - 1 }}').split(',') }} # [E207] Nested jinja pattern + + - name: Check Intel CMK Config + assert: + that: ({{ cmk_enabled }} and {{ isolcpus_enabled }} and "{{ isolcpus }}" | length > 0) + msg: + - Incorrect configuration pertaining Intel CMK. Conflicting or improper values detected + - When Intel CMK is enabled, CPUs isolation ('isolcpus') must be set according to the example file for host_vars. Please correct the configuration + + - name: Split isolcpus Groups + set_fact: + isolcpus_groups: "{{ isolcpus.split(',') }}" + + - debug: msg="isolcpus_groups = {{ isolcpus_groups }}" + + - name: Filter isolcpus Ranges + set_fact: + isolcpus_ranges: "{{ isolcpus_ranges + [item] }}" + with_items: "{{ isolcpus_groups }}" + when: ("-" in item) + + - debug: msg="isolcpus_ranges = {{ isolcpus_ranges }}" + + - name: Filter isolcpus Discretes + set_fact: + isolcpus_discretes: "{{ isolcpus_discretes + [item] }}" + with_items: "{{ isolcpus_groups }}" + when: ("-" not in item) + + - debug: msg="isolcpus_discretes = {{ isolcpus_discretes }}" + + - name: Build isolcpus List + set_fact: + isolcpus_list: "{{ isolcpus_list | default([]) | union(isolcpus_discretes) | union([item]) }}" + with_sequence: "{{ isolcpus_ranges }}" + + - debug: msg="isolcpus_list = {{ isolcpus_list }}" + + - name: Check isolcpus Total + assert: + that: "{{ isolcpus_list | length }} <= ansible_processor_vcpus" + msg: + - Incorrect configuration pertaining isolcpus. Conflicting or improper values detected + - The number of isolcpus {{ isolcpus_list | length }}, exceeds total CPUs on target {{ ansible_processor_vcpus }}. Please correct the configuration + when: isolcpus is defined + + - name: Check isolcpus IDs + assert: + that: "item | int <= ansible_processor_vcpus" + msg: + - Incorrect configuration pertaining isolcpus. Conflicting or improper values detected + - The CPU ID {{ item }} set for isolcpus is NOT actually present on target. Please correct the configuration + with_items: "{{ isolcpus_list }}" + when: isolcpus is defined #TODO relationship between cmk shared/exclusive cores and isolcpus diff --git a/sw_config/bmra/patched_rhel_packages.yml b/sw_config/bmra/patched_rhel_packages.yml index ec54dc9..0107076 100644 --- a/sw_config/bmra/patched_rhel_packages.yml +++ b/sw_config/bmra/patched_rhel_packages.yml @@ -175,8 +175,8 @@ - name: update to the latest kernel and kernel headers on the Red Hat OS family package: name: - - kernel - - kernel-devel + - kernel + - kernel-devel state: latest # noqa 403 notify: - reboot server @@ -188,15 +188,15 @@ - name: ensure selinux is installed on CentOS/RHEL 7 package: name: - - policycoreutils - - policycoreutils-python - - selinux-policy - - selinux-policy-targeted - - libselinux-utils - - setools - - setools-console - - shtool - - lshw + - policycoreutils + - policycoreutils-python + - selinux-policy + - selinux-policy-targeted + - libselinux-utils + - setools + - setools-console + - shtool + - lshw state: present when: - ansible_distribution in ["RedHat", "CentOS"] @@ -224,36 +224,36 @@ - name: install command line tools to collect hardware details package: name: - - hwinfo - - inxi - - jq + - hwinfo + - inxi + - jq state: present when: ansible_distribution in ["RedHat", "CentOS"] - name: Add kubic yum repo and install updated version of podman block: - - name: disable container-tools module - # noqa 305 - shell is used intentionally here - shell: dnf -y module disable container-tools - - name: enable rhcontainerbot/container-selinux repository - # noqa 305 - shell is used intentionally here - shell: dnf -y copr enable rhcontainerbot/container-selinux - - name: Add kubic yum repo - yum_repository: - name: devel_kubic_libcontainers_stable - description: Stable Releases of Upstream github.com/containers packages (CentOS_$releasever) - baseurl: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/ - gpgcheck: yes - gpgkey: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/repodata/repomd.xml.key - keepcache: '0' - - name: install runc - dnf: - name: runc - state: present - - name: install podman package - package: - name: podman - state: present + - name: disable container-tools module + # noqa 305 - shell is used intentionally here + shell: dnf -y module disable container-tools + - name: enable rhcontainerbot/container-selinux repository + # noqa 305 - shell is used intentionally here + shell: dnf -y copr enable rhcontainerbot/container-selinux + - name: Add kubic yum repo + yum_repository: + name: devel_kubic_libcontainers_stable + description: Stable Releases of Upstream github.com/containers packages (CentOS_$releasever) + baseurl: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/ + gpgcheck: yes + gpgkey: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/repodata/repomd.xml.key + keepcache: '0' + - name: install runc + dnf: + name: runc + state: present + - name: install podman package + package: + name: podman + state: present when: - ansible_os_family == "RedHat" and ansible_distribution_version >= '8.2' - '"docker" not in container_runtime' diff --git a/sw_config/bmra/patched_sriov_cni_install.yml b/sw_config/bmra/patched_sriov_cni_install.yml index ab0dc52..5ac93e5 100644 --- a/sw_config/bmra/patched_sriov_cni_install.yml +++ b/sw_config/bmra/patched_sriov_cni_install.yml @@ -31,10 +31,10 @@ - name: create /opt/cni/bin file: - path: "/opt/cni/bin" - state: directory - recurse: yes - mode: 0755 + path: "/opt/cni/bin" + state: directory + recurse: yes + mode: 0755 - name: install sriov-cni binary to /opt/cni/bin directory copy: diff --git a/sw_config/bmra/patched_vfio.yml b/sw_config/bmra/patched_vfio.yml index f4b7a1d..e79a976 100644 --- a/sw_config/bmra/patched_vfio.yml +++ b/sw_config/bmra/patched_vfio.yml @@ -35,7 +35,7 @@ loop_control: loop_var: vf extended: yes - when: ansible_loop.index < (item.sriov_numvfs | default(0) | int ) + when: ansible_loop.index < (item.sriov_numvfs | default(0) | int ) # get a list of VFs PCI addresses and save the configuration - name: attach VFs driver diff --git a/test-requirements.txt b/test-requirements.txt index 53c91d2..7e8223d 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -2,15 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - -yamllint # LGPLv3 bashate # Apache-2.0 +yamllint # LGPLv3 rstcheck # MIT -molecule # MIT -molecule-docker # MIT -docker # Apache-2.0 -testinfra # Apache-2.0 -ansible-lint # MIT +sphinx @@ -5,14 +5,13 @@ [tox] minversion = 3.5 skipsdist = True -envlist = lint,docs +envlist = lint,docs,docs-linkcheck [testenv] passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY [testenv:lint] -deps = - -r{toxinidir}/test-requirements.txt +deps = -r{toxinidir}/test-requirements.txt whitelist_externals = bash commands = bash -c "find {toxinidir} \ -not -path {toxinidir}/.tox/\* \ @@ -25,12 +24,12 @@ commands = bash -c "find {toxinidir} \ -name \*.rst | xargs rstcheck" [testenv:docs] -deps = -rdocs/requirements.txt +deps = -r{toxinidir}/docs/requirements.txt commands = sphinx-build -b html -n -d {envtmpdir}/doctrees ./docs/ {toxinidir}/docs/_build/html echo "Generated docs available in {toxinidir}/docs/_build/html" whitelist_externals = echo [testenv:docs-linkcheck] -deps = -rdocs/requirements.txt +deps = -r{toxinidir}/docs/requirements.txt commands = sphinx-build -b linkcheck -d {envtmpdir}/doctrees ./docs/ {toxinidir}/docs/_build/linkcheck |