Strict patch

Author: ktsakalozos

.github/workflows/build-snap.yml

@@ -1,9 +1,7 @@
 name: Build and test MicroK8s snap
 
 on:
-  pull_request:
-    branches:
-      - master
+  - push
 
 jobs:
   build:
@@ -54,7 +52,7 @@ jobs:
         uses: ./.github/actions/test-prep
       - name: Running upgrade path test
         run: |
-          sudo -E UPGRADE_MICROK8S_FROM=latest/edge UPGRADE_MICROK8S_TO=$PWD/build/microk8s.snap pytest -s ./tests/test-upgrade-path.py
+          sudo -E STRICT=yes UPGRADE_MICROK8S_FROM=latest/edge/strict UPGRADE_MICROK8S_TO=$PWD/build/microk8s.snap pytest -s ./tests/test-upgrade-path.py
 
   test-addons-core:
     name: Test core addons
@@ -69,18 +67,20 @@ jobs:
         uses: actions/checkout@v4
       - name: Prepare test prerequisites
         uses: ./.github/actions/test-prep
-      - name: Running addons tests
+      - name: Running addons tests in strict mode
         env:
           UNDER_TIME_PRESSURE: ${{ !contains(github.event.pull_request.labels.*.name, 'run-all-tests') }}
         run: |
           set -x
-          sudo snap install build/microk8s.snap --classic --dangerous
+          sudo snap install build/microk8s.snap --dangerous
+          sudo /snap/microk8s/current/connect-all-interfaces.sh
+          sudo microk8s status --wait-ready --timeout 300
           ./tests/smoke-test.sh
           # The GitHub runner is using the 10.1.0.0/16 CIDR, which would conflict with
           # kube-ovn's default POD_CIDR. They have to be different.
+          export STRICT="yes"
           export POD_CIDR="10.200.0.0/16"
           export POD_GATEWAY="10.200.0.1"
-          export SKIP_PROMETHEUS="False"
           export UNDER_TIME_PRESSURE=${UNDER_TIME_PRESSURE@u}
           sudo -E bash -c "cd /var/snap/microk8s/common/addons/core/tests; pytest -s -ra test-addons.py"
 
@@ -100,8 +100,11 @@ jobs:
         run: |
           set -x
           sudo snap install build/microk8s.snap --classic --dangerous
+          sudo /snap/microk8s/current/connect-all-interfaces.sh
+          sudo microk8s status --wait-ready --timeout 300
           sudo microk8s enable community
           export UNDER_TIME_PRESSURE=${UNDER_TIME_PRESSURE@u}
+          export STRICT="yes"
           sudo -E bash -c "cd /var/snap/microk8s/common/addons/community/; pytest -s -ra ./tests/"
 
   test-addons-core-upgrade:
@@ -120,7 +123,8 @@ jobs:
         run: |
           set -x
           export UNDER_TIME_PRESSURE=${UNDER_TIME_PRESSURE@u}
-          sudo -E bash -c "UPGRADE_MICROK8S_FROM=latest/edge UPGRADE_MICROK8S_TO=$PWD/build/microk8s.snap pytest -s ./tests/test-upgrade.py"
+          export STRICT="yes"
+          sudo -E bash -c "UPGRADE_MICROK8S_FROM=latest/edge/strict UPGRADE_MICROK8S_TO=$PWD/build/microk8s.snap pytest -s ./tests/test-upgrade.py"
 
   test-cluster-agent:
     name: Cluster agent health check
@@ -136,6 +140,7 @@ jobs:
         run: |
           set -x
           sudo snap install build/microk8s.snap --classic --dangerous
+          sudo /snap/microk8s/current/connect-all-interfaces.sh
           sudo -E bash -c "pytest -s ./tests/test-cluster-agent.py"
 
   test-airgap:

docs/build.md

@@ -83,9 +83,16 @@ lxc file pull test-build/root/microk8s/microk8s_v1.9.6_amd64.snap .
 After copying it, you can install it with:
 
 ```shell
-snap install microk8s_*_amd64.snap --classic --dangerous
+snap install microk8s_*_amd64.snap --dangerous
 ```
 
+Finally, you need to connect the interfaces. To this end you can use the `connect-all-interfaces.sh`:
+
+```shell
+sudo /snap/microk8s/current/connect-all-interfaces.sh
+```
+
+
 ## Assembling the Calico CNI manifest
 
 The calico CNI manifest can be found under `upgrade-scripts/000-switch-to-calico/resources/calico.yaml`.

microk8s-resources/connect-all-interfaces.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -u
+
+if [ "$EUID" -ne 0 ]
+then echo "Please run this script as root."
+  exit 1
+fi
+
+for i in account-control \
+         docker-privileged \
+         kubernetes-support \
+         k8s-journald \
+         k8s-kubelet \
+         k8s-kubeproxy \
+         dot-kube \
+         network \
+         network-bind \
+         network-control \
+         network-observe \
+         firewall-control \
+         process-control \
+         kernel-module-observe \
+         mount-observe \
+         hardware-observe \
+         system-observe \
+         home \
+         opengl \
+         home-read-all \
+         login-session-observe \
+         log-observe \
+         dot-config-helm
+do
+  snap connect microk8s:$i
+done

snap/hooks/connect-plug-configuration

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eux
+
+cp "$SNAP/content-interface/launcher/configuration/"*.yaml "$SNAP_COMMON/etc/launcher/" || true
+cp "$SNAP/content-interface/launcher/sideload/"*.tar "$SNAP_COMMON/etc/sideload/" || true

snap/hooks/disconnect-plug-configuration

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+set -eux

snap/hooks/install

@@ -25,7 +25,8 @@ if ! is_strict && cat /proc/1/environ | grep "container=lxc" &> /dev/null
   fi
 fi
 
-cp -r --preserve=mode ${SNAP}/default-args ${SNAP_DATA}/args
+mkdir -p ${SNAP_DATA}/args
+cp -r --preserve=mode ${SNAP}/default-args/* ${SNAP_DATA}/args
 mv ${SNAP_DATA}/args/certs.d/localhost__32000 ${SNAP_DATA}/args/certs.d/localhost:32000
 
 SNAP_DATA_CURRENT=`echo "${SNAP_DATA}" | sed -e "s,${SNAP_REVISION},current,"`