def add_manifest_features(manifest, runtime, tm_env): """Configure optional container features.""" for feature in manifest.get('features', []): if not features.feature_exists(feature): _LOGGER.error('Unable to load feature: %s', feature) raise exc.ContainerSetupError( msg='Unsupported feature: {}'.format(feature), reason='feature', ) feature_mod = features.get_feature(feature)(tm_env) if not feature_mod.applies(manifest, runtime): _LOGGER.error('Feature does not apply: %s', feature) raise exc.ContainerSetupError( msg='Unsupported feature: {}'.format(feature), reason='feature', ) try: feature_mod.configure(manifest) except Exception: _LOGGER.exception('Error configuring feature: %s', feature) raise exc.ContainerSetupError( msg='Error configuring feature: {}'.format(feature), reason='feature', )
def test_warpgate_feature(self): """Test warpgate feature. """ manifest = { 'services': [], 'system_services': [], 'features': ['warpgate'], 'proid': 'foo', 'environ': [], } tm_env = mock.Mock( cell='testcell', zkurl='zookeeper://foo@foo:123', apps_dir='apps', root='/var/tmp/treadmill', ) self.assertTrue(features.feature_exists('warpgate')) feature_mod = features.get_feature('warpgate')(tm_env) feature_mod.configure(manifest) self.assertEqual(len(manifest['system_services']), 1) self.assertEqual(manifest['system_services'][0]['name'], 'warpgate') self.assertTrue(manifest['system_services'][0]['root']) self.assertEqual(manifest['system_services'][0]['command'], 'exec $TREADMILL/bin/treadmill sproc warpgate')
def test_warpgate_configure(self): """Test warpgate feature configure. """ feature_mod = features.get_feature('warpgate')(self.tm_env) self.assertTrue( feature_mod.applies( manifest={ 'features': ['warpgate'], 'proid': 'foo', 'tickets': ['foo@realm'], 'environ': [ {'name': 'WARPGATE_POLICY', 'value': 'foo'}, ], }, runtime='linux' ) ) self.assertFalse( feature_mod.applies( manifest={ 'features': ['warpgate'], 'proid': 'foo', 'tickets': ['foo@realm'], 'environ': [ {'name': 'WARPGATE_POLICY', 'value': 'foo'}, ], }, runtime='notlinux' ), 'Must use "linux" runtime' ) self.assertFalse( feature_mod.applies( manifest={ 'features': ['warpgate'], 'proid': 'foo', 'tickets': [], 'environ': [ {'name': 'WARPGATE_POLICY', 'value': 'foo'}, ], }, runtime='linux' ), 'Must have some tickets' ) self.assertFalse( feature_mod.applies( manifest={ 'features': ['warpgate'], 'proid': 'foo', 'tickets': ['foo@realm'], 'environ': [], }, runtime='linux' ), 'Must have env variable WARPGATE_POLICY' )
def test_docker_feature(self): """test apply dockerd feature """ manifest = { 'environment': 'dev', 'services': [], 'system_services': [], 'features': ['docker'], 'proid': 'foo', 'environ': [], } tm_env = mock.Mock( cell='testcell', zkurl='zookeeper://foo@foo:123', apps_dir='apps', root='/var/tmp/treadmill', ) self.assertTrue(features.feature_exists('docker')) feature_mod = features.get_feature('docker')(tm_env) feature_mod.configure(manifest) self.assertEqual(len(manifest['services']), 2) self.assertEqual(manifest['services'][0]['name'], 'dockerd') self.assertTrue(manifest['services'][0]['root']) self.assertEqual( manifest['services'][0]['command'], ('exec tm' ' -H tcp://127.0.0.1:2375' ' --authorization-plugin=authz' ' --add-runtime docker-runc=tm --default-runtime=docker-runc' ' --exec-opt native.cgroupdriver=cgroupfs --bridge=none' ' --ip-forward=false --ip-masq=false --iptables=false' ' --cgroup-parent=docker --block-registry="*"' ' --default-ulimit core=0:0' ' --default-ulimit data=0:0' ' --default-ulimit fsize=0:0' ' --default-ulimit nproc=0:0' ' --default-ulimit nofile=0:0' ' --default-ulimit rss=0:0' ' --default-ulimit stack=0:0' ' --tlsverify' ' --tlscacert=/ca.pem' ' --tlscert=/host.pem' ' --tlskey=/host.key' ' --add-registry foo:5050' ' --add-registry bar:5050')) self.assertEqual(manifest['services'][1]['name'], 'docker-auth') self.assertTrue(manifest['services'][1]['root']) self.assertIn({ 'name': 'DOCKER_HOST', 'value': 'tcp://127.0.0.1:2375' }, manifest['environ'])
def test_warpgate_feature(self): """Test warpgate feature. """ manifest = { 'services': [], 'system_services': [], 'features': ['warpgate'], 'proid': 'foo', 'environ': [ {'name': 'WARPGATE_POLICY', 'value': 'foo'}, ], 'tickets': ['foo@realm'], } self.assertTrue(features.feature_exists('warpgate')) feature_mod = features.get_feature('warpgate')(self.tm_env) feature_mod.configure(manifest) self.assertEqual(len(manifest['services']), 1) self.assertEqual(manifest['services'][0]['name'], 'warpgate') self.assertTrue(manifest['services'][0]['root']) self.assertEqual( manifest['services'][0], { 'command': ( 'exec $TREADMILL/bin/treadmill sproc' ' --logging-conf daemon_container.json' ' warpgate' ' --policy-servers somehost:1234' ' --policy foo' ' --service-principal foo' ' --tun-dev eth0' ' --tun-addr ${TREADMILL_CONTAINER_IP}' ), 'config': None, 'downed': False, 'environ': [ { 'name': 'KRB5CCNAME', 'value': 'FILE:/var/spool/tickets/foo@realm' } ], 'name': 'warpgate', 'proid': 'root', 'restart': { 'interval': 60, 'limit': 5 }, 'root': True, 'trace': False } )
def add_manifest_features(manifest, runtime): """Configure optional container features.""" for feature in manifest.get('features', []): feature_mod = features.get_feature(feature)() if feature_mod is None: _LOGGER.error('Unable to load feature: %s', feature) raise Exception('Unsupported feature: ' + feature) if not feature_mod.applies(manifest, runtime): _LOGGER.error('Feature does not apply: %s', feature) raise Exception('Unsupported feature: ' + feature) try: feature_mod.configure(manifest) except Exception: _LOGGER.exception('Error configuring feature: %s', feature) raise Exception('Error configuring feature: ' + feature)
def test_insecure_docker_feature(self): """Test insecure registry logic """ manifest = { 'environment': 'dev', 'services': [], 'system_services': [], 'features': ['docker'], 'proid': 'foo', 'environ': [], } tm_env = mock.Mock( cell='testcell', zkurl='zookeeper://foo@foo:123', apps_dir='apps', root='/var/tmp/treadmill', ) feature_mod = features.get_feature('docker')(tm_env) feature_mod.configure(manifest) self.assertEqual( manifest['services'][0]['command'], ('exec tm' ' -H tcp://127.0.0.1:2375' ' --authorization-plugin=authz' ' --add-runtime docker-runc=tm --default-runtime=docker-runc' ' --exec-opt native.cgroupdriver=cgroupfs --bridge=none' ' --ip-forward=false --ip-masq=false --iptables=false' ' --cgroup-parent=docker --block-registry="*"' ' --default-ulimit core=0:0' ' --default-ulimit data=0:0' ' --default-ulimit fsize=0:0' ' --default-ulimit nproc=0:0' ' --default-ulimit nofile=0:0' ' --default-ulimit rss=0:0' ' --default-ulimit stack=0:0' ' --add-registry foo:5050' ' --insecure-registry foo:5050' ' --add-registry bar:5050' ' --insecure-registry bar:5050'))
def test_docker_feature(self): """test apply dockerd feature """ manifest = { 'services': [], 'system_services': [], 'features': ['docker'], 'proid': 'foo', 'environ': [], } tm_env = mock.Mock( cell='testcell', zkurl='zookeeper://foo@foo:123', apps_dir='apps', root='/var/tmp/treadmill', ) self.assertTrue(features.feature_exists('docker')) feature_mod = features.get_feature('docker')(tm_env) feature_mod.configure(manifest) self.assertEqual(len(manifest['services']), 2) self.assertEqual(manifest['services'][0]['name'], 'dockerd') self.assertTrue(manifest['services'][0]['root']) self.assertEqual( manifest['services'][0]['command'], ('exec tm' ' -H tcp://127.0.0.1:2375' ' --authorization-plugin=authz' ' --add-runtime docker-runc=tm --default-runtime=docker-runc' ' --exec-opt native.cgroupdriver=cgroupfs --bridge=none' ' --ip-forward=false --ip-masq=false --iptables=false' ' --cgroup-parent=docker --block-registry="*"' ' --insecure-registry foo:5050 --add-registry foo:5050' ' --insecure-registry bar:5050 --add-registry bar:5050')) self.assertEqual(manifest['services'][1]['name'], 'docker-auth') self.assertTrue(manifest['services'][1]['root'])
def test_docker_feature(self): """test apply dockerd feature """ manifest = { 'services': [], 'system_services': [], 'features': ['docker'], 'proid': 'foo', } tm_env = mock.Mock( cell='testcell', zkurl='zookeeper://foo@foo:123', apps_dir='apps', root='/var/tmp/treadmill', ) self.assertTrue(features.feature_exists('docker')) feature_mod = features.get_feature('docker')(tm_env) feature_mod.configure(manifest) self.assertEqual(len(manifest['services']), 1) self.assertEqual(manifest['services'][0]['name'], 'dockerd') self.assertTrue(manifest['services'][0]['root'])