CI: cleanup and factorization of molecule tests

.gitlab-ci.yml

@@ -24,6 +24,7 @@ variables:
   ANSIBLE_REMOTE_USER: kubespray
   ANSIBLE_PRIVATE_KEY_FILE: /tmp/id_rsa
   ANSIBLE_INVENTORY: /tmp/inventory
+  ANSIBLE_STDOUT_CALLBACK: "debug"
   RESET_CHECK: "false"
   REMOVE_NODE_CHECK: "false"
   UPGRADE_TEST: "false"
@@ -48,8 +49,6 @@ before_script:
       - cluster-dump/
   needs:
     - pipeline-image
-  variables:
-    ANSIBLE_STDOUT_CALLBACK: "debug"
 
 .job-moderated:
   extends: .job

.gitlab-ci/lint.yml

@@ -6,6 +6,7 @@ pre-commit:
   image: 'ghcr.io/pre-commit-ci/runner-image@sha256:fe01a6ec51b298412990b88627c3973b1146c7304f930f469bafa29ba60bcde9'
   variables:
     PRE_COMMIT_HOME: ${CI_PROJECT_DIR}/.cache/pre-commit
+    ANSIBLE_STDOUT_CALLBACK: default
   script:
   - pre-commit run --all-files --show-diff-on-failure
   cache:

.gitlab-ci/molecule.yml

@@ -34,6 +34,8 @@ molecule:
       - container-engine/cri-dockerd
       - container-engine/containerd
       - container-engine/cri-o
+      - container-engine/gvisor
+      - container-engine/youki
       - adduser
       - bastion-ssh-config
       - bootstrap_os
@@ -51,5 +53,3 @@ molecule_full:
     - ROLE:
       # FIXME : tests below are perma-failing
       - container-engine/kata-containers
-      - container-engine/gvisor
-      - container-engine/youki

playbooks/boilerplate.yml

@@ -6,35 +6,12 @@
 # - to ensure we keep compatibility with old style group names
 # - to reduce inventory boilerplate (defining parent groups / empty groups)
 
-- name: Define groups for legacy less structured inventories
-  hosts: all
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Match needed groups by their old names or definition
-      vars:
-        group_mappings:
-          kube_control_plane:
-            - kube-master
-          kube_node:
-            - kube-node
-          calico_rr:
-            - calico-rr
-          no_floating:
-            - no-floating
-          k8s_cluster:
-            - kube_node
-            - kube_control_plane
-            - calico_rr
-      group_by:
-        key: "{{ (group_names | intersect(item.value) | length > 0) | ternary(item.key, '_all') }}"
-      loop: "{{ group_mappings | dict2items }}"
-
-- name: Check inventory settings
+- name: Inventory setup and validation
   hosts: all
   gather_facts: false
   tags: always
   roles:
+    - dynamic_groups
     - validate_inventory
 
 - name: Install bastion ssh config

roles/container-engine/containerd/molecule/default/molecule.yml

@@ -35,5 +35,6 @@ provisioner:
       timeout: 120
   playbooks:
     create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
+    prepare: ../../../molecule/prepare.yml
 verifier:
-  name: testinfra
+  name: ansible

roles/container-engine/containerd/molecule/default/verify.yml

@@ -0,0 +1,39 @@
+---
+- name: Test containerd CRI
+  import_playbook: ../../../molecule/test_cri.yml
+  vars:
+    container_manager: containerd
+    cri_socket: unix:///var/run/containerd/containerd.sock
+    cri_name: containerd
+
+- name: Test nerdctl
+  hosts: all
+  gather_facts: false
+  become: true
+  tasks:
+  - name: Get kubespray defaults
+    import_role:
+      name: ../../../../../kubespray_defaults
+  - name: Test nerdctl commands
+    command: "{{ bin_dir }}/nerdctl {{ item | join(' ') }}"
+    vars:
+      image: quay.io/kubespray/hello-world:latest
+    loop:
+    - - pull
+      - "{{ image }}"
+    - - save
+      - -o
+      - /tmp/hello-world.tar
+      - "{{ image }}"
+    - - load
+      - -i
+      - /tmp/hello-world.tar
+    - - -n
+      - k8s.io
+      - run
+      - "{{ image }}"
+    register: nerdctl
+  - name: Check log from running a container
+    assert:
+      that:
+      - ('Hello from Docker' in nerdctl.results[3].stdout)

roles/container-engine/cri-dockerd/molecule/default/molecule.yml

@@ -27,5 +27,6 @@ provisioner:
         become: true
   playbooks:
     create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
+    prepare: ../../../molecule/prepare.yml
 verifier:
-  name: testinfra
+  name: ansible

roles/container-engine/cri-dockerd/molecule/default/verify.yml

@@ -0,0 +1,15 @@
+---
+- name: Test cri-dockerd
+  import_playbook: ../../../molecule/test_cri.yml
+  vars:
+    container_manager: cri-dockerd
+    cri_socket: unix:///var/run/cri-dockerd.sock
+    cri_name: docker
+
+- name: Test running a container with docker
+  import_playbook: ../../../molecule/test_runtime.yml
+  vars:
+    container_runtime: docker
+  # cri-dockerd does not support multiple runtime handler before 0.4.0
+  # https://github.com/Mirantis/cri-dockerd/pull/350
+  # TODO: check this when we upgrade cri-dockerd

roles/container-engine/cri-o/molecule/default/molecule.yml

@@ -43,5 +43,6 @@ provisioner:
       timeout: 120
   playbooks:
     create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
+    prepare: ../../../molecule/prepare.yml
 verifier:
-  name: testinfra
+  name: ansible

roles/container-engine/cri-o/molecule/default/verify.yml

@@ -0,0 +1,11 @@
+---
+- name: Test CRI-O cri
+  import_playbook: ../../../molecule/test_cri.yml
+  vars:
+    container_manager: crio
+    cri_socket: unix:///var/run/crio/crio.sock
+    cri_name: cri-o
+- name: Test running a container with crun
+  import_playbook: ../../../molecule/test_runtime.yml
+  vars:
+    container_runtime: crun