Skip to content

(IAC-824) Ability to exclude Apache MOD tests from unsupported platforms #2036

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

sanfrancrisko
Copy link
Contributor

@sanfrancrisko sanfrancrisko commented Jun 4, 2020

Description / Context

We have been battling a long running issue with tests that use Apache MODs failing on certain Linux platforms whenever the package or package dependencies become available on a specific platform. This has been defined in IAC-801. A number of recently raised JIRA tickets share the this root cause:

  • IAC-790: Missing dependencies for ldap_mod package on RHEL 7.x Docker containers
  • IAC-787: http-itk module not installing on RHEL 8.x systems
  • IAC-587: apache module failing with 'Cannot load /usr/lib64/apache2/mod_auth_openidc.so' on RHEL distros

Proposed Solution

Provide:

  • The ability to tag Apache MODs under manifests/mod with unsupported OSs and version(s).
  • A helper method to be used in conjunction with RSpec's conditional filtering during runtime to determine whether a test should be filtered out based on whether a given Apache MOD is supported on that platform.

Implementation Details

The ApacheModPlatformCompatibility class is initialised from spec_helper_acceptance_local.

The register_running_platform is called from within the RSpec.configure block, after PuppetLitmus.configure! has been called and the os variable has been correctly set with the parameters of the platform we're running the test on.

The generate_mod_platform_exclusions method is called after, in the RSpec.configure block, which will parse the files under manifests/mod, extracting all tags that follow the syntax:

# @note Unsupported platforms: OS: ver, ver; OS: ver, ver, ver; OS: all

The class definition for the Apache MOD will be extracted too. A concrete example would look something like this:

# @note Unsupported platforms: RedHat: 5, 6; Ubuntu: 14.04; SLES: all; Scientific: 11 SP1
class apache::mod::actions {
    apache::mod { 'actions': }
}

The rules for defining OS/Version pairs as as follows:

  • All OS/Version declarations must be preceded with @note Unsupported platforms:
  • The tag must be declared ABOVE the class declaration (i.e. not as footer at the bottom of the file)
  • Each OS/Version declaration must be separated by semicolons (;)
  • Each version must be separated by a comma (,)
  • Versions CANNOT be declared in ranges (e.g. RedHat:5-7), they should be explicitly declared (e.g. RedHat:5,6,7)
  • However, to declare all versions of an OS as unsupported, use the word all (e.g. SLES:all)
  • OSs with word characters as part of their versions are acceptable (e.g. Scientific: 11 SP1, 11 SP2, 12, 13). PLEASE NOTE: The "SP" value will be stripped and normalised to the major version (e.g. 11 SP1 -> 11). This is because Litmus (using serverspec underneath) will not report the SP level of Scientific Linux with the 'SP' tag. We could potentially map the SP level to the minor version equivalent reported by serverspec, but that seems more like a stretch goal.
  • Spaces are permitted between OS/Version declarations and version numbers within a declaration
  • Refer to the operatingsystem_support values in the metadata.json to find the acceptable OS name and version syntax:
    -- E.g. OracleLinux OR oraclelinux, not: [Oracle, OraLinux]
    -- E.g. RedHat OR redhat, not: [Red Hat Enterprise Linux, RHEL, Red Hat]
  • OS names defined in the metadata.json map to the names reported back by Litmus / serverspec in the os value.

There is now a mapping of class names to unsupported OSs, and using RSpec's conditional filtering, we can now use the mod_unsupported_on_platform method from within the tests to exclude it, if we're running against an unsupported platform:

describe 'auth_oidc', unless: mod_unsupported_on_platform('apache::mod::auth_openidc') do

Please note: The onus is still on the IAC Team / Contributor to determine what tests use what Apache MOD. As described in this document, there are a few tests you'll encounter in the module:

Still TODO

  • Unit tests for print_parsing_errors method
  • Unit tests for mod_unsupported_on_platform method
  • Manual integration testing in acceptance test run

Manual Test Scenarios

  • Acceptance tests execute without any Unsupported platform tags
  • Warning is printed for incorrectly formatted tag, but tests continue to execute
  • Test(s) can be excluded on a specific platform using an Unsupported platform tag
  • Test(s) continue to execute on platform versions that are not excluded
@codecov-commenter
Copy link

codecov-commenter commented Jun 4, 2020

Codecov Report

Merging #2036 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #2036   +/-   ##
=======================================
  Coverage   58.49%   58.49%           
=======================================
  Files          12       12           
  Lines         212      212           
=======================================
  Hits          124      124           
  Misses         88       88           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 51ce2ad...3c410f0. Read the comment docs.

@sanfrancrisko sanfrancrisko force-pushed the feat/IAC-824/mod_test_exclusion branch 3 times, most recently from 05224c6 to 79dbdaa Compare June 5, 2020 12:13
@sanfrancrisko sanfrancrisko marked this pull request as ready for review June 10, 2020 14:18
@sanfrancrisko sanfrancrisko force-pushed the feat/IAC-824/mod_test_exclusion branch 3 times, most recently from 7dbbf90 to 3c410f0 Compare July 1, 2020 22:32
@sanfrancrisko
Copy link
Contributor Author

sanfrancrisko commented Jul 1, 2020

Test example:

Using changes from #2046, cherry-picked to this branch, I then provisioned all systems in release_checks_6 and kicked off the following shell function to run spec/acceptance/vhost_spec:1203.rb against all the targets :

run_test_against_all_systems() {
  platforms=($(grep 'platform'  inventory.yaml | cut -d ':' -f 2 | sed 's/ //g'))
  hosts=($(grep -o '[a-z]\+.[a-z]\+.delivery.puppetlabs.net\|localhost:[0-9]\+' inventory.yaml))
  i=1
  for host in $hosts; do
    echo "Executing on $host ($platforms[$i])"
    TARGET_HOST=$host bundle exec rspec $1
    i=$(($i + 1))
  done
}

This verified that the platforms defined in this tag were filtered from execution:

➜  puppetlabs-apache git:(feat/IAC-824/mod_test_exclusion) run_test_against_all_systems spec/acceptance/vhost_spec.rb:1203
Executing on mawkish-sorcery.delivery.puppetlabs.net (redhat-6-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 16.62 seconds (files took 14.7 seconds to load)
0 examples, 0 failures

Executing on brief-infection.delivery.puppetlabs.net (redhat-7-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/httpd/conf.d/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 35.33 seconds (files took 15.88 seconds to load)
9 examples, 0 failures

Executing on fell-myth.delivery.puppetlabs.net (redhat-8-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 17.79 seconds (files took 8.28 seconds to load)
0 examples, 0 failures

Executing on olive-decline.delivery.puppetlabs.net (centos-6-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 19.29 seconds (files took 14.84 seconds to load)
0 examples, 0 failures

Executing on runaway-growth.delivery.puppetlabs.net (centos-7-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/httpd/conf.d/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 35.03 seconds (files took 8.67 seconds to load)
9 examples, 0 failures

Executing on wise-maze.delivery.puppetlabs.net (centos-8-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 16.79 seconds (files took 8.27 seconds to load)
0 examples, 0 failures

Executing on bum-motion.delivery.puppetlabs.net (oracle-6-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 16.78 seconds (files took 8.2 seconds to load)
0 examples, 0 failures

Executing on tolerant-copra.delivery.puppetlabs.net (oracle-7-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/httpd/conf.d/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 31.12 seconds (files took 8.52 seconds to load)
9 examples, 0 failures

Executing on correct-wartime.delivery.puppetlabs.net (scientific-6-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 21.87 seconds (files took 12 seconds to load)
0 examples, 0 failures

Executing on gold-patrimony.delivery.puppetlabs.net (scientific-7-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/httpd/conf.d/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 31.39 seconds (files took 15.94 seconds to load)
9 examples, 0 failures

Executing on dang-shirtfront.delivery.puppetlabs.net (debian-8-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 26.33 seconds (files took 7.39 seconds to load)
9 examples, 0 failures

Executing on sailorly-stable.delivery.puppetlabs.net (debian-9-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 27.06 seconds (files took 7.61 seconds to load)
9 examples, 0 failures

Executing on nastier-curtain.delivery.puppetlabs.net (debian-10-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 27.03 seconds (files took 7.09 seconds to load)
9 examples, 0 failures

Executing on sorry-charmer.delivery.puppetlabs.net (ubuntu-1404-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 12.4 seconds (files took 8.7 seconds to load)
0 examples, 0 failures

Executing on dull-irritation.delivery.puppetlabs.net (ubuntu-1604-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 26.55 seconds (files took 14.23 seconds to load)
9 examples, 0 failures

Executing on grey-finite.delivery.puppetlabs.net (ubuntu-1804-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 27.56 seconds (files took 14 seconds to load)
9 examples, 0 failures

Executing on renowned-fun.delivery.puppetlabs.net (ubuntu-2004-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

apache::vhost define
  auth_oidc
    applys cleanly
    File "/etc/apache2/sites-enabled/25-test.server.conf"
      is expected to be file
      is expected to contain "OIDCProviderMetadataURL https://login.example.com/.well-known/openid-configuration"
      is expected to contain "OIDCClientID test"
      is expected to contain "OIDCRedirectURI https://login.example.com/redirect_uri"
      is expected to contain "OIDCProviderTokenEndpointAuth client_secret_basic"
      is expected to contain "OIDCRemoteUserClaim sub"
      is expected to contain "OIDCClientSecret aae053a9-4abf-4824-8956-e94b2af335c8"
      is expected to contain "OIDCCryptoPassphrase 4ad1bb46-9979-450e-ae58-c696967df3cd"

Finished in 26.84 seconds (files took 7.38 seconds to load)
9 examples, 0 failures

Executing on trivial-toffee.delivery.puppetlabs.net (sles-12-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 13.43 seconds (files took 13.82 seconds to load)
0 examples, 0 failures

Executing on ladylike-buy.delivery.puppetlabs.net (sles-15-x86_64)
Run options: include {:locations=>{"./spec/acceptance/vhost_spec.rb"=>[1203]}}

All examples were filtered out

Finished in 14.8 seconds (files took 10.1 seconds to load)
0 examples, 0 failures
(IAC-824) Added more tests, refactoring and fixes

(IAC-824) Fix Rubocop violations

(IAC-824) Add guard for no tag scenario. Move init to RSpec.configure.

(IAC-824) Fixes from 1st integration test results

(IAC-824) Invert query and response for mods.

After discussion, it was determined that it read much better to have a method called 'mod_support_on_platform' than 'mod_unsupported_on_platform'

(IAC-824) Update README with Apache MOD test excl details

(IAC-824) Add ability to disable Apache MOD test exclusion functionality

(IAC-824) Tweak headingin README

(IAC-824) Some minor fixes discovered from testing

(IAC-824) Remove accidentally checked in binding.pry
@sanfrancrisko sanfrancrisko force-pushed the feat/IAC-824/mod_test_exclusion branch from 3c410f0 to 7c0d21d Compare July 2, 2020 00:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
3 participants