introduce podman sanity checks (#417)

* roles: podman_pull_run_remove

This introduces a new role named `podman_pull_run_remove` which is a
implementation of `docker_pull_run_remove` using `podman`.

The role has been enhanced to test basic running of containers and
also testing network access from the container.  (These enhancements
should likely be applied to `docker_pull_run_remove`, too).

* i-s-t:  add basic podman tests

Let's start testing `podman` on the hosts that support it.

* roles: fix centos container image location

* roles: use alternate set of images for CentOS

CentOS AH is missing the Red Hat CA cert, so it is unable to pull
images from the registry (see:  CentOS/sig-atomic-buildscripts#329).
To workaround this, we'll have to build the list of images to pull
differently for CentOS vs. the rest.

roles/podman_pull_run_remove/meta/main.yml

@@ -0,0 +1,3 @@
+---
+# vim: set ft=ansible:
+allow_duplicates: true

roles/podman_pull_run_remove/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+# vim: set ft=ansible:
+#
+# This is a copy of the `docker_pull_run_remove` role which has been adapted
+# to use `podman`.  There are some minor changes that expand on the original
+# role to make this more comprehensive.
+#
+# `popular_images` is defined in roles/podman_pull_run_remove/vars/main.yml
+# It is a dict using image names as a key and the value is a command that
+# can be run.
+#
+
+# Check to see if the host has podman, but don't fail if it is not installed
+- name: Check if podman is installed
+  command: rpm -q podman
+  register: podman
+  ignore_errors: true
+
+- when: "'CentOS' not in ansible_distribution"
+  set_fact:
+    pull_images: "{{ popular_images | combine(rhel_images) }}"
+
+- when: "'CentOS' in ansible_distribution"
+  set_fact:
+    pull_images: "{{ popular_images }}"
+
+- when: podman.rc == 0
+  block:
+    - name: Disable the docker daemon
+      service:
+        name: docker
+        state: stopped
+
+    - name: Pull the popular container images
+      command: "podman pull {{ item.key }}"
+      with_dict: "{{ pull_images }}"
+      register: podman_pull
+      retries: 5
+      delay: 60
+      until: podman_pull is success
+
+    - name: Run the popular container images
+      command: "podman run --rm {{ item.key }} echo 'hello'"
+      with_dict: "{{ pull_images }}"
+
+    # Test for https://bugzilla.redhat.com/show_bug.cgi?id=1585735
+    - name: Run the popular container images with cpu-shares flag
+      command: "podman run --cpu-shares 2 --rm {{ item.key }} echo 'hello'"
+      with_dict: "{{ pull_images }}"
+
+    # Test for https://bugzilla.redhat.com/show_bug.cgi?id=1592932
+    #          https://bugzilla.redhat.com/show_bug.cgi?id=1593419
+    - name: Run the popular container images testing for network access
+      command: "podman run --rm {{ item.key }} {{ item.value }}"
+      with_dict: "{{ pull_images }}"
+
+    - name: Remove the popular container images
+      command: "podman rmi {{ item.key }}"
+      with_dict: "{{ pull_images }}"
+
+    - name: Re-enable docker
+      service:
+        name: docker
+        state: started

roles/podman_pull_run_remove/vars/main.yml

@@ -0,0 +1,12 @@
+---
+# vim: set ft=ansible:
+#
+popular_images:
+  docker.io/alpine: 'ping -c 3 1.1.1.1'
+  docker.io/busybox: 'ping -c 3 1.1.1.1'
+  docker.io/ubuntu: 'bash -c "apt-get update && apt-get -y install iputils-ping && ping -c 3 1.1.1.1"'
+  registry.fedoraproject.org/fedora: 'bash -c "dnf -y install iputils && ping -c 3 1.1.1.1"'
+  registry.centos.org/centos/centos: 'ping -c 3 1.1.1.1'
+
+rhel_images:
+  registry.access.redhat.com/rhel: 'curl --fail -o /dev/null -I https://1.1.1.1'

tests/improved-sanity-test/main.yml

@@ -204,6 +204,13 @@
         - docker_pull_run_remove
         - rhcos
 
+    # TEST
+    # Verify that basic `podman` operations are successful.
+    - role: podman_pull_run_remove
+      tags:
+        - podman_pull_run_remove
+        - rhcos
+
     # TEST
     # Validate 'atomic pull', 'atomic scan' works correctly.
     # Remove images after test of each command.
@@ -616,6 +623,11 @@
         - docker_pull_run_remove
         - rhcos
 
+    - role: podman_pull_run_remove
+      tags:
+        - podman_pull_run_remove
+        - rhcos
+
     # Check layered package is still installed
     - role: rpm_ostree_install_verify
       roiv_package_name: "{{ g_pkg }}"