feat: run integration tests on more platforms

.github/workflows/integration-tests.yml

@@ -27,6 +27,10 @@ jobs:
  vm:
  - fedora-coreos
  - fcarm
+ - rhel
+ - rhel-arm64
+ - rhcos
+ - rhcos-arm64
 
  steps:
  - uses: actions/checkout@v4
@@ -80,11 +84,29 @@ jobs:
  quay:
  username: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
  password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+ excluded_vms:
+ # RHEL 8 doesn't handle file creation properly,
+ # need more investigation
+ - rhel-8
+ - rhcos-412-86-202402272018-0-gcp-x86-64
+ - rhcos-414-92-202407091253-0-gcp-x86-64
+ # BPF trampolines are only implemented starting with RHEL 10
+ - rhel-9-arm64
+ - rhcos-9-8-20260520-0-gcp-aarch64
+ - rhcos-9-6-20260512-0-gcp-aarch64
+ - rhcos-418-94-202602022246-0-gcp-aarch64
+ - rhcos-416-94-202510081640-0-gcp-aarch64
  EOF
 
  - name: Create Test VMs
+ env:
+ ANSIBLE_CONFIG: "${{ github.workspace }}/collector/ansible/ansible.cfg"
  run: |
- make -C "./collector/ansible" create-ci-vms
+ ansible-playbook \
+ -i "${GITHUB_WORKSPACE}/collector/ansible/ci" \
+ -e @vars.yml \
+ --tags setup,provision \
+ "${GITHUB_WORKSPACE}/collector/ansible/integration-tests.yml"
 
  - name: Run the tests
  env:
@@ -103,17 +125,17 @@ jobs:
  - name: Unarchive logs
  if: always()
  run: |
- cd "${GITHUB_WORKSPACE}/fact/tests"
-if [[ -f "logs.tar.gz" ]]; then
- tar xzf "logs.tar.gz"
- rm -f "logs.tar.gz"
-fi
+ cd "/tmp/fact/tests"
+for file in logs/*.tar.gz; do
+ tar xzf "$file"
+ rm -f "$file"
+done
 
  - name: Test summary
  uses: test-summary/action@v2
  if: always()
  with:
- paths: ${{ github.workspace }}/fact/tests/results.xml
+ paths: /tmp/fact/tests/*-results.xml
 
  - name: Store artifacts
  if: always()
@@ -125,6 +147,6 @@ jobs:
  with:
  name: ${{ matrix.vm }}-test-logs
  path: |
-${{ github.workspace }}/fact/tests/logs
-${{ github.workspace }}/fact/tests/results.xml
+/tmp/fact/tests/logs
+/tmp/fact/tests/*-results.xml
  if-no-files-found: ignore

CHANGELOG.md

@@ -6,6 +6,7 @@ possible include a PR number for easier tracking.
 
 ## Next
 
+* feat: run integration tests on more platforms (#760)
 * ROX-34502: reload mTLS certificates on each gRPC connection attempt (#788)
 * chore: add formatting and linting to integration test code (#783, #784)
 * feat: add code coverage with cargo-llvm-cov and Codecov upload (#745)

ansible/ansible.cfg

@@ -1,3 +1,7 @@
 [defaults]
 stdout_callback=debug
 stderr_callback=debug
+
+[ssh_connection]
+ssh_args = -o StrictHostKeyChecking=no -C -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30 -o ServerAliveCountMax=10
+retries = 5

ansible/group_vars/all.yml

@@ -1,2 +1,3 @@
 ---
 runtime_command: docker
+runtime_host: 'unix:///var/run/docker.sock'

ansible/group_vars/container_engine_podman.yml

@@ -1,2 +1,3 @@
 ---
 runtime_command: podman
+runtime_host: 'unix:///run/podman/podman.sock'

ansible/run-tests.yml

@@ -5,57 +5,90 @@
  FACT_IMAGE_NAME: "{{ fact.image | default(None) }}"
 
  tasks:
- - name: Install dependencies
- become: true
- community.general.rpm_ostree_pkg:
- apply_live: true
- name:
- - make
- - python3-packaging
- - python3-requests
- state: present
-
- - name: Login to quay.io
- community.docker.docker_login:
- registry_url: quay.io
- username: "{{ quay.username }}"
- password: "{{ quay.password }}"
-
  - name: Clone the repo
  ansible.builtin.git:
  repo: https://github.com/stackrox/fact
- dest: ./fact
+ dest: /tmp/fact
  version: "{{ fact.version }}"
  update: false
 
- - name: Install python packages
- ansible.builtin.pip:
- requirements: ./fact/tests/requirements.txt
- chdir: "{{ ansible_env.HOME }}"
- virtualenv: ./fact/.venv
- virtualenv_command: python3 -m venv
+ - name: Log into quay.io
+ become: true
+ shell:
+ cmd: "{{ runtime_command }} login -u {{ quay.username }} --password-stdin quay.io"
+ stdin: "{{ quay.password }}"
+
+ - name: Copy podman auth
+ become: true
+ shell:
+ cmd: |
+ mkdir -p ~/.docker/
+ if [[ -f "${XDG_RUNTIME_DIR:-}/containers/auth.json" ]]; then
+ AUTH_FILE="${XDG_RUNTIME_DIR:-}/containers/auth.json"
+ elif [[ -f "/run/containers/0/auth.json" ]]; then
+ AUTH_FILE="/run/containers/0/auth.json"
+ else
+ echo &>2 "No valid auth.json file found"
+ exit 1
+ fi
+ cp "${AUTH_FILE}" ~/.docker/config.json
+ creates: ~/.docker/config.json
+ when: runtime_command == "podman"
 
  - block:
+ # There are some ansible modules that we could use to modularize
+ # this next task, however they required some Python modules to be
+ # installed on the managed VM that may not be available (like
+ # python3-packaging), so we stick to a shell as ugly as it is.
  - name: Run tests
+ become: true
+ environment:
+ DOCKER_HOST: "{{ runtime_host }}"
  ansible.builtin.shell:
  cmd: |
- cd "${HOME}/fact"
- source ".venv/bin/activate"
- make integration-tests
+ set -euo pipefail
+ cd "/tmp/fact/tests"
+
+ # Setup the virtual environment
+ python3 -m venv .venv
+ source .venv/bin/activate
+ pip install -r requirements.txt
+
+ # Generate gRPC files
+ python3 -m grpc_tools.protoc \
+ -I../third_party/stackrox/proto \
+ --python_out=. \
+ --pyi_out=. \
+ --grpc_python_out=. \
+ ../third_party/stackrox/proto/internalapi/sensor/collector.proto \
+ ../third_party/stackrox/proto/internalapi/sensor/sfa.proto \
+ ../third_party/stackrox/proto/internalapi/sensor/sfa_iservice.proto
+
+ # Run the tests
+ pytest --image="${FACT_IMAGE_NAME}" --junit-xml=results.xml
+
  always:
+ - name: Make logs directories
+ ansible.builtin.file:
+ state: directory
+ path: /tmp/fact/tests/logs
+ recurse: true
+ delegate_to: localhost
+
  - name: Retrieve results
  ansible.builtin.fetch:
- src: "{{ ansible_env.HOME }}/fact/tests/results.xml"
- dest: ../tests/
+ src: /tmp/fact/tests/results.xml
+ dest: "/tmp/fact/tests/{{ vm_config }}-results.xml"
  flat: true
 
  - name: Compress log files
  community.general.archive:
- path: "{{ ansible_env.HOME }}/fact/tests/logs"
- dest: "{{ ansible_env.HOME }}/fact/tests/logs.tar.gz"
+ path: /tmp/fact/tests/logs
+ dest: "/tmp/fact/tests/{{ vm_config }}.tar.gz"
 
  - name: Fetch log files
  ansible.builtin.fetch:
- src: "{{ ansible_env.HOME }}/fact/tests/logs.tar.gz"
- dest: ../tests/logs.tar.gz
+ src: "/tmp/fact/tests/{{ vm_config }}.tar.gz"
+ dest: /tmp/fact/tests/logs/
+ validate_checksum: false
  flat: true

tests/event.py

@@ -1,8 +1,18 @@
+from __future__ import annotations
+
 import os
 import string
 from enum import Enum
 from re import Pattern
-from typing import Any, override
+from typing import Any
+
+try:
+ from typing import override # type: ignore[reportAssignmentType]
+except ImportError:
+
+ def override(func): # type: ignore[reportMissingParameterType]
+ return func
+
 
 import utils
 from internalapi.sensor.collector_pb2 import ProcessSignal

tests/test_config_hotreload.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+from concurrent.futures import TimeoutError as FuturesTimeoutError
 from time import sleep
 
 import docker.models.containers
@@ -219,7 +220,7 @@ def test_no_paths_then_add(
 
  e = Event(process=p, event_type=EventType.OPEN, file=fut, host_path=fut)
 
- with pytest.raises(TimeoutError):
+ with pytest.raises((TimeoutError, FuturesTimeoutError)):
  server.wait_events([e])
 
  # Add paths back
@@ -264,7 +265,7 @@ def test_paths_then_remove(
  f.write('This should be ignored')
  sleep(1)
 
- with pytest.raises(TimeoutError):
+ with pytest.raises((TimeoutError, FuturesTimeoutError)):
  server.wait_events([e])
 
 

tests/test_path_rename.py

@@ -451,28 +451,39 @@ def test_cross_mountpoints(
  container_id=test_container.id[:12],
  )
 
- server.wait_events(
- [
- Event(
- process=touch,
- event_type=EventType.OPEN,
- file=mounted_file,
- host_path=host_path,
- ),
- Event(
- process=first_rename,
- event_type=EventType.CREATION,
- file=ovfs_file,
- host_path='',
- ),
+ events = [
+ Event(
+ process=touch,
+ event_type=EventType.OPEN,
+ file=mounted_file,
+ host_path=host_path,
+ ),
+ Event(
+ process=first_rename,
+ event_type=EventType.CREATION,
+ file=ovfs_file,
+ host_path='',
+ ),
+ ]
+
+ # If the id for the current process and the process in the container (root)
+ # match, the ownership events are skipped
+ curr_id = (os.getuid(), os.getgid())
+ root_id = (0, 0)
+ if curr_id != root_id:
+ events.append(
  Event(
  process=first_rename,
  event_type=EventType.OWNERSHIP,
  file=ovfs_file,
  host_path='',
  owner_uid=owner_uid,
  owner_gid=owner_gid,
- ),
+ )
+ )
+
+ events.extend(
+ [
  Event(
  process=first_rename,
  event_type=EventType.PERMISSION,
@@ -492,14 +503,23 @@ def test_cross_mountpoints(
  file=mounted_file,
  host_path=host_path,
  ),
+ ]
+ )
+
+ if curr_id != root_id:
+ events.append(
  Event(
  process=second_rename,
  event_type=EventType.OWNERSHIP,
  file=mounted_file,
  host_path=host_path,
  owner_uid=owner_uid,
  owner_gid=owner_gid,
- ),
+ )
+ )
+
+ events.extend(
+ [
  Event(
  process=second_rename,
  event_type=EventType.PERMISSION,
@@ -513,5 +533,7 @@ def test_cross_mountpoints(
  file=ovfs_file,
  host_path='',
  ),
- ],
+ ]
  )
+
+ server.wait_events(events)

tests/test_path_rmdir.py

@@ -2,6 +2,7 @@
 
 import os
 import shutil
+import sys
 
 import pytest
 
@@ -154,6 +155,10 @@ def test_rmdir_empty(
  )
 
 
+@pytest.mark.skipif(
+ sys.version_info < (3, 10),
+ reason='shutil.rmtree behavior changes between interpreter versions',
+)
 def test_rmdir_recursive(
  monitored_dir: str,
  server: FileActivityService,