* Fix ansible-test docker container detection.
* Attach test containers to the correct network.
* Do not assume `localhost` for accesing Docker.
* Look for containers on current network.
* Always map /var/run/docker.sock into containers.
This fixes issues when using a remote Docker host.
* Support container IP lookup from networks list.
* Fix container network attachment.
* Remove redundant container detection messages.
* Limit DOCKER_HOST parsing to TCP.
* Restore docker socket existence check.
The check is skipped if the docker hostname is not localhost.
* Correct changelog entry..
(cherry picked from commit 3c2e8b99be)
Co-authored-by: Matt Clay <mclay@redhat.com>.
(cherry picked from commit 6362232c30)
Co-authored-by: Matt Clay <mclay@redhat.com>.
(cherry picked from commit 7c83f1f045)
Co-authored-by: Matt Clay <mclay@redhat.com>
Change:
- This enables the inventory_kubevirt_conformance test to pass again on
freebsd.
- This was due to a google-auth version bump. The dep chain looks like
this: openshift -> kubernetes -> google-auth -> aiohttp -> multidict
Test Plan:
- ansible-test integration inventory_kubevirt_conformance --remote
freebsd/12.0
Signed-off-by: Rick Elrod <rick@elrod.me>
* Make Azure Pipelines resource_prefix lowercase.
* Make classification of CI files consistent.
* Update package-data sanity test for AZP..
(cherry picked from commit 92b66e3e31)
Co-authored-by: Matt Clay <mclay@redhat.com>
Change:
- This isn't a direct backport of #71949 because in stable-2.8,
setup_docker doesn't use handlers like more modern branches to clean
up after itself.
- Instead, here we just make sure the docker packages are gone before
the podman test runs.
Test Plan:
- CI
- ci_complete
Signed-off-by: Rick Elrod <rick@elrod.me>
Change:
- The docker-ce.repo file for centos does not work on RHEL since it uses
$releasever and on RHEL that is, e.g., "7Server".
- Instead, set up the repo manually.
- Additionally, the docker centos8 repo no longer has old versions, so
we use the (only) version in the repo instead.
Test Plan:
- CI
Signed-off-by: Rick Elrod <rick@elrod.me>
(cherry picked from commit 31ddca4c0d)
(cherry picked from commit 651c0a2d03)
The file test will no longer attempt to test attributes if `lsattr -vd` does not work on the system under test.
(cherry picked from commit 17765cd4e8)
Co-authored-by: Matt Clay <mclay@redhat.com>
The stat time granularity on macOS is one second. We recently upgraded
to faster macOS hosts, so some tests that run closely together to see if
something changed will have the same timestamp intermittently.
A recent update to cffi that was yanked is still being installed on our
Mac OS X 10.11 test image since the version of pip there is very old and
does not ignore yanked packages.
Pin the version of pyOpenSSL and its dependencies to fix this and avoid
future spontaneous failures..
(cherry picked from commit 65cdb86c8a)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Add types.py from devel to support backport.
* [stable-2.9] Backport ansible-test CI provider support. (#71614)
* Add encoding.py from devel to support backports.
* Add io.py from devel to support backports.
* Update ansible-test support for CI providers. (#69522)
Refactored CI provider code to simplify multiple provider support and addition of new providers.
(cherry picked from commit d8e0aadc0d)
* Add Shippable request signing to ansible-test. (#69526)
(cherry picked from commit e7c2eb519b)
* ansible-test local change detection: use --base-branch if specified (#69508)
(cherry picked from commit 43acd61901)
* Add Azure Pipelines support to ansible-test.
(cherry picked from commit 8ffaed00f8)
* Update ansible-test remote endpoint handling. (#71413)
* Request ansible-core-ci resources by provider.
* Remove obsolete us-east-2 CI endpoint.
* Add new --remote-endpoint option.
* Add warning for --remote-aws-region option.
* Update service endpoints.
* Allow non-standard remote stages.
* Add changelog fragment.
(cherry picked from commit d099591964)
* Fix ansible-test coverage traceback. (#71446)
* Add integration test for ansible-test coverage.
* Fix ansible-test coverage traceback.
* Fix coverage reporting on Python 2.6.
(cherry picked from commit f5b6df14ab)
* Use new endpoint for Parallels based instances.
(cherry picked from commit 98febab975)
* Add pause to avoid same mtime in test.
(cherry picked from commit 3d769f3a76)
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 417e408f59)
Change:
- By default the dnf API does not gpg-verify packages. This is a feature
that is executed in its CLI code. It never made it into Ansible's
usage of the API, so packages were previously not verified.
- This fixes CVE-2020-14365.
Test Plan:
- New integration tests
Signed-off-by: Rick Elrod <rick@elrod.me>
Change:
- Uses `hg serve` instead of a bitbucket repo for hg tests
- bitbucket no longer serves hg
Backport of #71398
Test Plan:
- CI, fixed integration tests
Signed-off-by: Rick Elrod <rick@elrod.me>
* [stable-2.8] Change default file permissions so they are not world readable (#70221)
* Change default file permissions so they are not world readable
CVE-2020-1736
Set the default permissions for files we create with atomic_move() to 0o0660. Track
which files we create that did not exist and warn if the module supports 'mode'
and it was not specified and the module did not call set_mode_if_different(). This allows the user to take action and specify a mode rather than using the defaults.
A code audit is needed to find all instances of modules that call atomic_move()
but do not call set_mode_if_different(). The findings need to be documented in
a changelog since we are not warning. Warning in those instances would be frustrating
to the user since they have no way to change the module code.
- use a set for storing list of created files
- just check the argument spac and params rather than using another property
- improve the warning message to include the default permissions.
(cherry picked from commit 5260527c4a)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Fix service test
* Fix lamdba_policy test
* Fix aws_lamdba test
* Fix warning for new default permissions when mode is not specified (#70976)
Follow up to #70221
Related to #67794
CVE-2020-1736
When set_mode_if_different() is called with mode of 'None', ensure we issue
a warning about the change in default permissions.
Add integration tests to ensure the warning works properly.
* Fix tests
- actually use custom module 🤦♂️
- verify file permission on created files
- use remote_tmp_dir so we're ready for split controller
- improve test module so we can skip the call to set_fs_attributes_if_different()
- fix tests for CentOS 6
(cherry picked from commit dc79528cc6)
* Use new category in changelog fragments
The repository names seem to have changed and no longer have the "rhui-" prefix.
(cherry picked from commit 6ac4439a6a)
Co-authored-by: Sam Doran <sdoran@redhat.com>
debconf module exposes sensitive information to logs, console.
Add a note to user about using no_log=True to hide such
information from console.
Fixes: #32386
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 84b4387702)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 9b9bc112d5)
A recent updated to psutil, which is a dependency of ansible-runner, fails
to install on older versions of pip.
Commit with the breaking change:
135628639b
(cherry picked from commit 9d27d7c8b1)
Co-authored-by: Sam Doran <sdoran@redhat.com>
Matt Clay