Skip to content

Commit 273dbde

Browse files
traviertravier
committed
overlay.d & tests: Add alternatives migration and test
- Add an overlay with the migration logic for alternatives - Add a test for the migration script This should make sure that the system is setup properly and that the migration script will do the right thing on older systems. See: coreos/fedora-coreos-tracker#1818 See: coreos/fedora-coreos-tracker#677 See: https://docs.fedoraproject.org/en-US/fedora-coreos/alternatives/
1 parent 076a734 commit 273dbde

File tree

6 files changed

+122
-0
lines changed

6 files changed

+122
-0
lines changed

‎manifests/fedora-coreos-base.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ ostree-layers:
2222
- overlay/25azure-udev-rules
2323
- overlay/30lvmdevices
2424
- overlay/40grub
25+
- overlay/50alternatives
2526

2627
# Be minimal
2728
recommends: false

‎overlay.d/50alternatives/statoverride‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Config file for overriding permission bits on overlay files/dirs
2+
# Format: =<file mode in decimal> <absolute path to a file or directory>

‎overlay.d/50alternatives/usr/libexec/coreos-alternatives-migration‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
# set -x
5+
6+
main() {
7+
# Should never happen as systemd checks this, but just in case
8+
if [[ ! -d "/var/lib/alternatives" ]]; then
9+
echo "Skipped /var/lib/alternatives as it is not a directory"
10+
exit 0
11+
fi
12+
13+
# We can safely directly try to remove the directory as rmdir will fail on
14+
# a non-empty directory
15+
rmdir "/var/lib/alternatives" || echo "Warning: /var/lib/alternatives is not empty"
16+
17+
# Do the migration, explicitely using the new configuration directory to
18+
# ignore /var/lib/alternatives if it still exists
19+
alternatives --admindir /etc/alternatives-admindir --set iptables /usr/sbin/iptables-nft
20+
return $?
21+
}
22+
23+
main "${@}"

‎overlay.d/50alternatives/usr/systemd/system/coreos-alternatives-migration.service‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[Unit]
2+
Description=Migrate systems to fixed alternatives configuration
3+
ConditionPathExists=/var/lib/alternatives
4+
ConditionPathIsDirectory=/var/lib/alternatives
5+
6+
[Service]
7+
ExecStart=/usr/libexec/coreos-alternatives-migration
8+
Type=oneshot
9+
RemainAfterExit=yes
10+
11+
[Install]
12+
WantedBy=basic.target

‎overlay.d/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,8 @@ information.
9393

9494
Add in static grub configs that will be leveraged by bootupd when
9595
managing bootloaders. See https://github.com/coreos/bootupd/pull/543
96+
97+
50alternatives
98+
--------------
99+
100+
Temporary overlay for the alternatives migration scripts.

‎tests/kola/files/alternatives‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/bash
2+
## kola:
3+
## description: Verify that the alternatives config is properly migrated and test the migration
4+
5+
# See
6+
# - https://github.com/coreos/fedora-coreos-tracker/issues/1818
7+
8+
set -xeuo pipefail
9+
10+
# shellcheck disable=SC1091
11+
. "$KOLA_EXT_DATA/commonlib.sh"
12+
13+
if test -e "/var/lib/alternatives"; then
14+
ls -al "/var/lib/alternatives"
15+
fatal "Error: Found '/var/lib/alternatives' which should not exists"
16+
fi
17+
if ! test -d "/etc/alternatives"; then
18+
fatal "Error: '/etc/alternatives' is missing"
19+
fi
20+
if ! test -d "/etc/alternatives-admindir"; then
21+
fatal "Error: '/etc/alternatives-admindir' is missing"
22+
fi
23+
24+
# To test the migration we will re-create the setup from an older FCOS node
25+
26+
# First, reset iptables to the legacy backend
27+
alternatives --set iptables /usr/sbin/iptables-legacy
28+
if [[ $(alternatives --display iptables | grep -c "link currently points to /usr/sbin/iptables-legacy") != "1" ]]; then
29+
fatal "Could not set iptables to legacy backend for testing"
30+
fi
31+
if [[ $(iptables --version | grep -c "legacy") != "1" ]]; then
32+
fatal "Could not set iptables to legacy backend for testing"
33+
fi
34+
35+
# Then re-create the broken alternatives folder in /var
36+
install -dm0755 /var/lib/alternatives
37+
38+
# Do the migration
39+
/usr/libexec/coreos-alternatives-migration
40+
41+
if [[ $(alternatives --admindir /etc/alternatives-admindir --display iptables | grep -c "link currently points to /usr/sbin/iptables-nft") != "1" ]]; then
42+
fatal "Error: migration did not set iptables to nft backend"
43+
fi
44+
if [[ $(iptables --version | grep -c "nf_tables") != "1" ]]; then
45+
fatal "Error: iptables not reset to nftables backend"
46+
fi
47+
if [[ -d "/var/lib/alternatives" ]]; then
48+
fatal "Error: /var/lib/alternatives should not exists anymore"
49+
fi
50+
51+
# Second case, if an admin set some config up for alternatives
52+
53+
# First, reset iptables to the legacy backend
54+
alternatives --set iptables /usr/sbin/iptables-legacy
55+
if [[ $(alternatives --display iptables | grep -c "link currently points to /usr/sbin/iptables-legacy") != "1" ]]; then
56+
fatal "Could not set iptables to legacy backend for testing"
57+
fi
58+
if [[ $(iptables --version | grep -c "legacy") != "1" ]]; then
59+
fatal "Could not set iptables to legacy backend for testing"
60+
fi
61+
62+
# Then re-create the broken alternatives folder in /var
63+
install -dm0755 /var/lib/alternatives
64+
65+
# And add some fake config
66+
touch /var/lib/alternatives/foo
67+
68+
# Do the migration
69+
/usr/libexec/coreos-alternatives-migration
70+
71+
if [[ $(alternatives --admindir /etc/alternatives-admindir --display iptables | grep -c "link currently points to /usr/sbin/iptables-nft") != "1" ]]; then
72+
fatal "Error: migration did not set iptables to nft backend"
73+
fi
74+
if [[ $(iptables --version | grep -c "nf_tables") != "1" ]]; then
75+
fatal "Error: iptables not reset to nftables backend"
76+
fi
77+
if [[ ! -d "/var/lib/alternatives" ]]; then
78+
fatal "Error: /var/lib/alternatives should still exists"
79+
fi

0 commit comments

Comments
 (0)