e2e/isolation_podman_test.go
210 lines · 8186 bytes
1package e2e
2
3import (
4 "fmt"
5 "os"
6 "os/exec"
7 "path/filepath"
8 "strings"
9 "testing"
10)
11
12// havePodman reports whether a working rootless podman is on this
13// machine. The skip is loud on purpose: an isolation test that quietly
14// does not run is how isolation regresses (#144).
15// provisionedImage returns an image present on this host, since the
16// runner never pulls one (#144). Tests must use what is provisioned, the
17// same rule builds follow.
18func provisionedImage(t *testing.T) string {
19 t.Helper()
20 for _, img := range []string{"localhost/gitbay-ci:2", "docker.io/library/debian:stable-slim", "docker.io/library/alpine:latest"} {
21 if err := exec.Command("podman", "image", "exists", img).Run(); err == nil {
22 return img
23 }
24 }
25 t.Log("SKIPPING ISOLATION TEST: podman has no image this test can use. " +
26 "Provision one (podman build -t localhost/gitbay-ci:2 -f deploy/Containerfile.ci). " +
27 "The container path is NOT covered by this run.")
28 return ""
29}
30
31func havePodman(t *testing.T) bool {
32 t.Helper()
33 if _, err := exec.LookPath("podman"); err != nil {
34 t.Log("SKIPPING ISOLATION TEST: podman is not installed on this machine. " +
35 "The container path is NOT covered by this run.")
36 return false
37 }
38 if out, err := exec.Command("podman", "info", "--format", "{{.Host.Security.Rootless}}").CombinedOutput(); err != nil {
39 t.Logf("SKIPPING ISOLATION TEST: podman does not work here: %v\n%s", err, out)
40 return false
41 }
42 return true
43}
44
45// The fallback that must not exist: with -isolation podman and no podman,
46// the runner refuses to start rather than running a build on the host.
47// This one needs no podman, so it runs everywhere.
48func TestRunnerRefusesToStartWithoutPodman(t *testing.T) {
49 t.Parallel()
50 bin := buildRunner(t)
51 cmd := exec.Command(bin, "-once", "-remote", "git@127.0.0.1",
52 "-isolation", "podman", "-image", "localhost/whatever:1", "-workdir", t.TempDir())
53 // An empty PATH is the reliable way to make podman missing whether or
54 // not this machine has one.
55 cmd.Env = []string{"PATH=" + t.TempDir(), "HOME=" + t.TempDir()}
56 out, err := cmd.CombinedOutput()
57 if err == nil {
58 t.Fatalf("the runner started without podman:\n%s", out)
59 }
60 if !strings.Contains(string(out), "podman") {
61 t.Errorf("refusal does not say podman is the problem:\n%s", out)
62 }
63 if !strings.Contains(string(out), "runner-podman-setup.sh") {
64 t.Errorf("refusal does not say how to fix it:\n%s", out)
65 }
66}
67
68// An unknown mode is refused rather than guessed at.
69func TestRunnerRefusesUnknownIsolation(t *testing.T) {
70 t.Parallel()
71 bin := buildRunner(t)
72 cmd := exec.Command(bin, "-once", "-remote", "git@127.0.0.1",
73 "-isolation", "chroot", "-workdir", t.TempDir())
74 out, err := cmd.CombinedOutput()
75 if err == nil {
76 t.Fatalf("an unknown isolation mode started:\n%s", out)
77 }
78 if !strings.Contains(string(out), "podman or none") {
79 t.Errorf("refusal does not name the valid modes:\n%s", out)
80 }
81}
82
83// With podman, a step runs in a container: it cannot read the runner's
84// SSH key, and it does not see the runner's home.
85func TestPodmanStepCannotReachTheRunnersKey(t *testing.T) {
86 t.Parallel()
87 if !havePodman(t) {
88 t.Skip("no podman")
89 }
90 inst := startInstance(t)
91 inst.runner = buildRunner(t)
92 aliceKey := inst.newKey(t, "alice")
93 inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
94 runnerKey := inst.newKey(t, "ci")
95 inst.admin(t, "admin", "user", "create", "ci", "--key", runnerKey+".pub", "--admin")
96 inst.ssh(t, aliceKey, "", "repo", "create", "alice/app")
97
98 image := provisionedImage(t)
99 if image == "" {
100 t.Skip("no provisioned image")
101 }
102 env := inst.gitEnv(aliceKey)
103 work := t.TempDir()
104 mustGit(t, work, env, "clone", inst.sshURL("alice/app"), "w")
105 dir := filepath.Join(work, "w")
106 os.MkdirAll(filepath.Join(dir, ".gitbay"), 0o755)
107 // The step tries to read the key the runner authenticates with, and
108 // to list the runner's home. Both must fail inside the container.
109 os.WriteFile(filepath.Join(dir, ".gitbay", "ci.yml"), []byte(
110 "jobs:\n peek:\n image: "+image+"\n steps:\n"+
111 " - 'if cat "+runnerKey+" 2>/dev/null; then echo LEAKED-KEY; exit 1; fi; echo no-key'\n"+
112 " - 'echo HOME=$HOME; ls /workspace'\n"), 0o644)
113 mustGit(t, dir, env, "checkout", "-q", "-b", "main")
114 mustGit(t, dir, env, "add", ".")
115 mustGit(t, dir, env, "commit", "-q", "-m", "base")
116 mustGit(t, dir, env, "push", "-q", "origin", "main")
117
118 runnerPodmanOnce(t, inst, runnerKey)
119 out, _, _ := inst.ssh(t, aliceKey, "", "build", "list", "alice/app")
120 log, _, _ := inst.ssh(t, aliceKey, "", "build", "log", "alice/app", "1")
121 if !strings.Contains(out, "success") {
122 // Without the log this says only "it failed", which cost two CI
123 // rounds to diagnose the first time.
124 t.Fatalf("the containerised build did not pass:\n%s\nbuild log:\n%s", out, log)
125 }
126 if strings.Contains(log, "LEAKED-KEY") {
127 t.Errorf("a step read the runner's ssh key:\n%s", log)
128 }
129 if !strings.Contains(log, "no-key") {
130 t.Errorf("the step did not run as expected:\n%s", log)
131 }
132}
133
134// An image this runner does not have fails the build and says an
135// operator must provision it, rather than pulling it.
136func TestPodmanMissingImageFailsTheBuild(t *testing.T) {
137 t.Parallel()
138 if !havePodman(t) {
139 t.Skip("no podman")
140 }
141 inst := startInstance(t)
142 inst.runner = buildRunner(t)
143 aliceKey := inst.newKey(t, "alice")
144 inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
145 runnerKey := inst.newKey(t, "ci")
146 inst.admin(t, "admin", "user", "create", "ci", "--key", runnerKey+".pub", "--admin")
147 inst.ssh(t, aliceKey, "", "repo", "create", "alice/app")
148
149 env := inst.gitEnv(aliceKey)
150 work := t.TempDir()
151 mustGit(t, work, env, "clone", inst.sshURL("alice/app"), "w")
152 dir := filepath.Join(work, "w")
153 os.MkdirAll(filepath.Join(dir, ".gitbay"), 0o755)
154 os.WriteFile(filepath.Join(dir, ".gitbay", "ci.yml"), []byte(
155 "jobs:\n nope:\n image: localhost/gitbay-no-such-image:v0\n steps:\n - echo unreachable\n"), 0o644)
156 mustGit(t, dir, env, "checkout", "-q", "-b", "main")
157 mustGit(t, dir, env, "add", ".")
158 mustGit(t, dir, env, "commit", "-q", "-m", "base")
159 mustGit(t, dir, env, "push", "-q", "origin", "main")
160
161 runnerPodmanOnce(t, inst, runnerKey)
162 out, _, _ := inst.ssh(t, aliceKey, "", "build", "list", "alice/app")
163 if !strings.Contains(out, "failure") {
164 t.Fatalf("a build with an unpullable image did not fail:\n%s", out)
165 }
166 log, _, _ := inst.ssh(t, aliceKey, "", "build", "log", "alice/app", "1")
167 if !strings.Contains(log, "gitbay-no-such-image") {
168 t.Errorf("the log does not name the missing image:\n%s", log)
169 }
170 if !strings.Contains(log, "does not pull images") {
171 t.Errorf("the log does not say an operator must provision it:\n%s", log)
172 }
173 if strings.Contains(log, "unreachable") {
174 t.Error("a step ran despite the image failing to start")
175 }
176}
177
178func runnerPodmanOnce(t *testing.T, inst *instance, key string) {
179 t.Helper()
180 opts := fmt.Sprintf("-p %d -i %s -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=%s -o BatchMode=yes",
181 inst.port, key, filepath.Join(inst.sshDir, "known_hosts"))
182 cmd := exec.Command(inst.runner, "-once",
183 "-remote", "git@127.0.0.1",
184 "-ssh-opts", opts,
185 "-isolation", "podman",
186 "-image", "localhost/gitbay-ci:2",
187 "-clone-base", fmt.Sprintf("ssh://git@127.0.0.1:%d", inst.port),
188 "-workdir", t.TempDir())
189 cmd.Env = append(os.Environ(), "XDG_CONFIG_HOME="+t.TempDir(), "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null")
190 if out, err := cmd.CombinedOutput(); err != nil {
191 t.Fatalf("runner: %v\n%s", err, out)
192 }
193}
194
195// Under podman the runner insists on a default image rather than
196// guessing one: with --pull=never an image the host does not have fails
197// every job that names none.
198func TestRunnerRefusesPodmanWithoutAnImage(t *testing.T) {
199 t.Parallel()
200 bin := buildRunner(t)
201 cmd := exec.Command(bin, "-once", "-remote", "git@127.0.0.1",
202 "-isolation", "podman", "-workdir", t.TempDir())
203 out, err := cmd.CombinedOutput()
204 if err == nil {
205 t.Fatalf("the runner started in podman mode with no -image:\n%s", out)
206 }
207 if !strings.Contains(string(out), "-image") {
208 t.Errorf("refusal does not name the missing flag:\n%s", out)
209 }
210}