search

containers / udica

This repository contains a tool for generating SELinux security profiles for containers
GNU General Public License v3.0
479 stars 47 forks source link

Add initial support for Cirrus-CI testing #37

Closed cevich closed 5 years ago

cevich commented 5 years ago

Signed-off-by: Chris Evich cevich@redhat.com

cevich commented 5 years ago

@wrabcak it just occurred to me that running tests inside a container may not fly as we're dealing with SELinux stuffs here. Is there a way to make this work or do we need a VM?

If so, it's probably not a show-stopper, it will just take me some time to organize all the requirements to make that happen.

Let me know.

cevich commented 5 years ago

clarification: This is for integration testing. If you like, I can port the current Travis tests over into Cirrus-CI as well (it is quite a bit faster) but in a future PR.

wrabcak commented 5 years ago

@wrabcak it just occurred to me that running tests inside a container may not fly as we're dealing with SELinux stuffs here. Is there a way to make this work or do we need a VM?

Exactly, SELinux is not inside the container, so we need Fedora/RHEL VM for proper testing of udica.

If so, it's probably not a show-stopper, it will just take me some time to organize all the requirements to make that happen.

Let me know.

Thanks, Lukas.

cevich commented 5 years ago

I can swing Fedora pretty easily, but RHEL is a huge amount of work. It can be done, but it's quite painful. Okay, I'll go down the Fedora VM path first. Setup-wise it's quite involved, maybe half a day of fast typing if I'm lucky and don't forget some detail :smile:

wrabcak commented 5 years ago

@cevich , For now it's enough to have CI on Fedora VMs.

Thanks for your contribution. :) Lukas.

cevich commented 5 years ago

Small progress:

Next step: secure $$$ for ^^^

cevich commented 5 years ago

Got head-nod for $$$ to wire in Cirrus-CI + VMs to validate this.

Still need to make it official.

cevich commented 5 years ago

Still working on making things official.

cevich commented 5 years ago

Okay, we're supported in running CI in google cloud. Next step is for me to start wiring things together with Cirrus CI so it can manage the VMs. I've got a number of tasks ahead of this one, but will avoid starting an new ones. Should be able to make progress on this one starting early next week.

wrabcak commented 5 years ago

Hi @cevich ,

Thank you for your time and help, no pressure, this could wait. :)

Lukas

cevich commented 5 years ago

Haven't forgotten about this. Managed to add the two google service accounts today. Next is getting their permissions setup and access granted to Cirrus-CI.

cevich commented 5 years ago

yay! :clap: Test-failures can be dealt with, for now it's nice to see VMs up and running :smile:

cevich commented 5 years ago

@wrabcak @rhatdan PTAL this is ready to go.

Lukas - I added a script hack/get_ci_vm.sh similar to what we use in other projects, it will give you access to a VM for debugging, configured nearly exactly as in CI. However, since you're outside the US, it will be very slow (network-wise) unless I share some tricks. Write me an e-mail so I have your redhat.com address, can grant you GCE access + explain how to get fast networking to the VMs.

wrabcak commented 5 years ago

Amazing! Thanks for PR! Merging.

Yep, I'll send you e-mail.

Thanks, Lukas.