zuul: drop devstack-gate reference

Devstack jobs no longer depend on the devstack-gate project, which has
been retired

Change-Id: Id4721d419b22b6d6498d192e3f313629ad33ef69
(cherry picked from commit 3e2a0ffe4f)
(cherry picked from commit 70f7bba359)
(cherry picked from commit db4b92fce4)
(cherry picked from commit c1b19c850a)
(cherry picked from commit ac44a0e105)
(cherry picked from commit 5a6502673a)

.gitignore

@@ -0,0 +1 @@
+.tox

.gitreview

@@ -2,3 +2,4 @@
 host=review.opendev.org
 port=29418
 project=openstack/devstack-plugin-container.git
+defaultbranch=unmaintained/victoria

.zuul.yaml

@@ -7,7 +7,6 @@
     timeout: 4200
     required-projects:
       - openstack/devstack
-      - openstack/devstack-gate
       - openstack/devstack-plugin-container
     vars:
       devstack_localrc:
@@ -18,14 +17,13 @@
 - job:
     name: devstack-plugin-container-k8s
     parent: devstack-minimal
-    nodeset: openstack-two-node-bionic
+    nodeset: openstack-two-node-focal
     pre-run: playbooks/devstack-plugin-container-k8s/pre.yaml
     run: playbooks/devstack-plugin-container-k8s/run.yaml
     post-run: playbooks/devstack-plugin-container-k8s/post.yaml
     timeout: 7200
     required-projects:
       - openstack/devstack
-      - openstack/devstack-gate
       - openstack/devstack-plugin-container
     vars:
       devstack_services:
@@ -53,9 +51,11 @@
 - project:
     check:
       jobs:
+        - openstack-tox-bashate
         - devstack-plugin-container-dsvm
         - devstack-plugin-container-k8s:
             voting: false
     gate:
       jobs:
+        - openstack-tox-bashate
         - devstack-plugin-container-dsvm

CONTRIBUTING.rst

@@ -0,0 +1,19 @@
+The source repository for this project can be found at:
+
+   https://opendev.org/openstack/devstack-plugin-container
+
+Pull requests submitted through GitHub are not monitored.
+
+To start contributing to OpenStack, follow the steps in the contribution guide
+to set up and use Gerrit:
+
+   https://docs.openstack.org/contributors/code-and-documentation/quick-start.html
+
+Bugs should be filed on Launchpad:
+
+   https://bugs.launchpad.net/devstack
+
+For more specific information about contributing to this repository, see the
+Devstack contributor guide:
+
+   https://docs.openstack.org/devstack/latest/contributor/contributing.html

devstack/lib/cni/plugins

@@ -0,0 +1,94 @@
+#!/bin/bash
+#
+# lib/cni/plugins
+# Common CNI plugins functions
+
+# Dependencies:
+# ``functions`` file
+# ``STACK_USER`` has to be defined
+
+# Save trace setting
+_XTRACE_CONTAINER_CNI_PLUGINS=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+CNI_PLUGINS_BIN_DIR=/opt/cni/bin
+# install all plugins by default
+CNI_PLUGINS_INSTALL_PLUGINS=${CNI_PLUGINS_INSTALL_PLUGINS:-flannel,ptp,host-local,portmap,tuning,vlan,host-device,sample,dhcp,ipvlan,macvlan,loopback,bridge}
+CNI_PLUGINS_CONF_SOURCE_DIR=${CNI_PLUGINS_CONF_SOURCE_DIR:-$DEST/devstack-plugin-container/etc/cni/net.d}
+CNI_PLUGINS_CONF_DIR=${CNI_PLUGINS_CONF_DIR:-/etc/cni/net.d}
+
+CNI_PLUGINS_VERSION=${CNI_PLUGINS_VERSION:-v0.7.1}
+CNI_PLUGINS_SHA256_AMD64=${CNI_PLUGINS_SHA256_AMD64:-"6ecc5c7dbb8e4296b0d0d017e5440618e19605b9aa3b146a2c29af492f299dc7"}
+CNI_PLUGINS_SHA256_ARM64=${CNI_PLUGINS_SHA256_ARM64:-"258080b94bfc54bd54fd0ea7494efc31806aa4b2836ba3f2d189e0fc16fab0ef"}
+CNI_PLUGINS_SHA256_PPC64=${CNI_PLUGINS_SHA256_PPC64:-"a515c45a52e752249bb0e9feac1654c5d38974df6a36148778f6eeab9826f706"}
+CNI_PLUGINS_SHA256_S390X=${CNI_PLUGINS_SHA256_S390X:-"24e31be69a012395f1026cd37d125f5f81001cfc36434d8f7a17b36bc5f1e6ad"}
+# Make sure CNI plugins downloads the correct architecture
+if is_arch "x86_64"; then
+    CNI_PLUGINS_ARCH="amd64"
+    CNI_PLUGINS_SHA256=${CNI_PLUGINS_SHA256:-$CNI_PLUGINS_SHA256_AMD64}
+elif is_arch "aarch64"; then
+    CNI_PLUGINS_ARCH="arm64"
+    CNI_PLUGINS_SHA256=${CNI_PLUGINS_SHA256:-$CNI_PLUGINS_SHA256_ARM64}
+elif is_arch "ppc64le"; then
+    CNI_PLUGINS_ARCH="ppc64le"
+    CNI_PLUGINS_SHA256=${CNI_PLUGINS_SHA256:-$CNI_PLUGINS_SHA256_PPC64}
+elif is_arch "s390x"; then
+    CNI_PLUGINS_ARCH="s390x"
+    CNI_PLUGINS_SHA256=${CNI_PLUGINS_SHA256:-$CNI_PLUGINS_SHA256_S390X}
+else
+    exit_distro_not_supported "invalid hardware type"
+fi
+CNI_PLUGINS_DOWNLOAD_URL=${CNI_PLUGINS_DOWNLOAD_URL:-https://github.com/containernetworking/plugins/releases/download}
+CNI_PLUGINS_DOWNLOAD_FILE=cni-plugins-$CNI_PLUGINS_ARCH-$CNI_PLUGINS_VERSION.tgz
+CNI_PLUGINS_DOWNLOAD_LOCATION=$CNI_PLUGINS_DOWNLOAD_URL/$CNI_PLUGINS_VERSION/$CNI_PLUGINS_DOWNLOAD_FILE
+
+
+# Installs standard cni plugins.
+function install_cni_plugins {
+    echo "Installing CNI standard plugins"
+
+    # Download and cache the cni plugins tgz for subsequent use
+    local plugins_file
+    cni_plugins_file="$(get_extra_file $CNI_PLUGINS_DOWNLOAD_LOCATION)"
+    if [ ! -d "$FILES/cniplugins" ]; then
+        echo "${CNI_PLUGINS_SHA256} $cni_plugins_file" > $FILES/cniplugins.sha256sum
+        # remove the damaged file when checksum fails
+        sha256sum -c $FILES/cniplugins.sha256sum || (sudo rm -f $cni_plugins_file; exit 1)
+
+        mkdir $FILES/cniplugins
+        tar xzvf $cni_plugins_file -C $FILES/cniplugins
+    fi
+    for plugin in ${CNI_PLUGINS_INSTALL_PLUGINS//,/ }; do
+        if [ $(ls $FILES/cniplugins/$plugin 2> /dev/null) ]; then
+            echo "Install plugin: $plugin"
+            sudo install -o "$STACK_USER" -m 0555 -D "$FILES/cniplugins/$plugin" \
+                "$CNI_PLUGINS_BIN_DIR/$plugin"
+        else
+            echo "Skip installing plugin: $plugin"
+        fi
+    done
+}
+
+# Configure cni plugins.
+function configure_cni_plugins {
+    echo "Configuring CNI plugins"
+
+    for plugin in ${CNI_PLUGINS_INSTALL_PLUGINS//,/ }; do
+        local source_config_file
+        source_config_file=$(ls ${CNI_PLUGINS_CONF_SOURCE_DIR}/*${plugin}.conf 2> /dev/null || true)
+        if [ $source_config_file ]; then
+            echo "Found config file for plugin: $plugin"
+            sudo install -o "$STACK_USER" -m 0664 -t "$CNI_PLUGINS_CONF_DIR" -D \
+                "${source_config_file}"
+        else
+            echo "Config file not found for plugin: $plugin"
+        fi
+    done
+}
+
+
+# Restore xtrace
+$_XTRACE_CONTAINER_CNI_PLUGINS

devstack/lib/crio

@@ -26,10 +26,10 @@ CRIO_ENGINE_SOCKET_FILE=${CRIO_ENGINE_SOCKET_FILE:-/var/run/crio/crio.sock}
 
 function check_crio {
     if is_ubuntu; then
-       dpkg -l | grep crio-o > /dev/null 2>&1
+        dpkg -l | grep crio-o > /dev/null 2>&1
     else
-       false
-       # TODO: CentOS/Fedora support.
+        false
+        # TODO: CentOS/Fedora support.
     fi
 }
 
@@ -40,7 +40,8 @@ function install_crio {
 
     local lsb_dist=${os_VENDOR,,}
     local dist_version=${os_CODENAME}
-    local arch=$(dpkg --print-architecture)
+    local arch
+    arch=$(dpkg --print-architecture)
     if is_ubuntu; then
         apt_get install apt-transport-https ca-certificates software-properties-common
         sudo add-apt-repository -y ppa:projectatomic/ppa

devstack/lib/docker

@@ -29,18 +29,23 @@ DOCKER_CGROUP_DRIVER=${DOCKER_CGROUP_DRIVER:-}
 # TODO(hongbin): deprecate and remove clear container
 ENABLE_CLEAR_CONTAINER=$(trueorfalse False ENABLE_CLEAR_CONTAINER)
 ENABLE_KATA_CONTAINERS=$(trueorfalse False ENABLE_KATA_CONTAINERS)
+ENABLE_CONTAINERD_CRI=$(trueorfalse False ENABLE_CONTAINERD_CRI)
 ENABLE_LIVE_RESTORE=$(trueorfalse False ENABLE_LIVE_RESTORE)
 ENABLE_IPV6=$(trueorfalse False ENABLE_IPV6)
 KATA_BRANCH=${KATA_BRANCH:-master}
+KATA_RUNTIME=${KATA_RUNTIME:-kata-runtime}
+
+CONTAINERD_CONF_DIR=/etc/containerd
+CONTAINERD_CONF=$CONTAINERD_CONF_DIR/config.toml
 
 # Functions
 # ---------
 
 function check_docker {
     if is_ubuntu; then
-       dpkg -s docker-engine > /dev/null 2>&1 || dpkg -s docker-ce > /dev/null 2>&1
+        dpkg -s docker-engine > /dev/null 2>&1 || dpkg -s docker-ce > /dev/null 2>&1
     else
-       rpm -q docker-engine > /dev/null 2>&1 || rpm -q docker > /dev/null 2>&1 || rpm -q docker-ce > /dev/null 2>&1
+        rpm -q docker-engine > /dev/null 2>&1 || rpm -q docker > /dev/null 2>&1 || rpm -q docker-ce > /dev/null 2>&1
     fi
 }
 
@@ -51,7 +56,8 @@ function install_docker {
 
     local lsb_dist=${os_VENDOR,,}
     local dist_version=${os_CODENAME}
-    local arch=$(dpkg --print-architecture)
+    local arch
+    arch=$(dpkg --print-architecture)
     if is_ubuntu; then
         if [[ ${dist_version} == 'trusty' ]]; then
             if uname -r | grep -q -- '-generic' && dpkg -l 'linux-image-*-generic' | grep -qE '^ii|^hi' 2>/dev/null; then
@@ -107,9 +113,27 @@ function install_docker {
             (>&2 echo "WARNING: Clear Container needs the CPU extensions svm or vmx which is not enabled. Skipping Clear Container installation.")
         fi
     fi
+
+    if [[ "$ENABLE_CONTAINERD_CRI" == "True" ]]; then
+        source $DEST/devstack-plugin-container/devstack/lib/cni/plugins
+        install_cni_plugins
+
+        source $DEST/devstack-plugin-container/devstack/lib/tools/crictl
+        install_crictl
+    fi
 }
 
 function configure_docker {
+    if [[ ${ENABLE_CONTAINERD_CRI} == "True" ]]; then
+        source $DEST/devstack-plugin-container/devstack/lib/cni/plugins
+        configure_cni_plugins
+
+        configure_containerd
+
+        source $DEST/devstack-plugin-container/devstack/lib/tools/crictl
+        configure_crictl
+    fi
+
     # After an ./unstack it will be stopped. So it is ok if it returns exit-code == 1
     sudo systemctl stop docker.service || true
 
@@ -121,11 +145,11 @@ function configure_docker {
     if [[ "$ENABLE_KATA_CONTAINERS" == "True" ]]; then
         if sudo grep -E 'svm|vmx' /proc/cpuinfo &> /dev/null; then
             runtime_opts+="\"runtimes\": {
-                \"kata-runtime\": {
+                \"$KATA_RUNTIME\": {
                     \"path\": \"/usr/bin/kata-runtime\"
                 }
             },
-            \"default-runtime\": \"kata-runtime\","
+            \"default-runtime\": \"$KATA_RUNTIME\","
         fi
     # TODO(hongbin): deprecate and remove clear container
     elif [[ "$ENABLE_CLEAR_CONTAINER" == "True" ]]; then
@@ -196,12 +220,39 @@ EOF
     sudo systemctl --no-block restart docker.service
 }
 
+function configure_containerd {
+    sudo mkdir -p $CONTAINERD_CONF_DIR
+    sudo chown -R $STACK_USER $CONTAINERD_CONF_DIR
+
+    stack_user_gid=$(getent group $STACK_USER | cut -d: -f3)
+    cat <<EOF | sudo tee $CONTAINERD_CONF >/dev/null
+[grpc]
+  gid = $stack_user_gid
+
+[debug]
+  level = "debug"
+
+EOF
+    if [[ "$ENABLE_KATA_CONTAINERS" == "True" ]]; then
+        cat <<EOF | sudo tee -a $CONTAINERD_CONF >/dev/null
+[plugins]
+  [plugins.cri]
+    [plugins.cri.containerd]
+      [plugins.cri.containerd.runtimes.${KATA_RUNTIME}]
+         runtime_type = "io.containerd.kata.v2"
+EOF
+    fi
+
+    sudo systemctl --no-block restart containerd.service
+}
+
 function stop_docker {
     sudo systemctl stop docker.service || true
 }
 
 function cleanup_docker {
     uninstall_package docker-ce
+    rm -f $CONTAINERD_CONF
 }
 
 # TODO(hongbin): deprecate and remove clear container

devstack/lib/k8s

@@ -27,7 +27,7 @@ K8S_NODE_IP=${K8S_NODE_IP:-$HOST_IP}
 K8S_API_SERVER_PORT=${K8S_API_SERVER_PORT:-6443}
 K8S_POD_NETWORK_CIDR=${K8S_POD_NETWORK_CIDR:-10.244.0.0/16}
 K8S_SERVICE_NETWORK_CIDR=${K8S_SERVICE_NETWORK_CIDR:-10.96.0.0/12}
-K8S_VERSION=${K8S_VERSION:-1.14.1-00}
+K8S_VERSION=${K8S_VERSION:-1.19.0-00}
 K8S_NETWORK_ADDON=${K8S_NETWORK_ADDON:-flannel}
 
 # Functions
@@ -58,8 +58,9 @@ function install_kubeadm {
 }
 
 function kubeadm_init {
-    local kubeadm_config_file=$(mktemp)
-    cat <<EOF | sudo tee $kubeadm_config_file >/dev/null
+    local kubeadm_config_file
+    kubeadm_config_file=$(mktemp)
+    cat <<EOF | tee $kubeadm_config_file >/dev/null
 apiVersion: kubeadm.k8s.io/v1beta1
 kind: ClusterConfiguration
 etcd:
@@ -91,13 +92,14 @@ EOF
     safe_chown $STACK_USER:$STACK_USER $kube_config_file
 
     if [[ "$K8S_NETWORK_ADDON" == "flannel" ]]; then
-        kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/a70459be0084506e4ec919aa1c114638878db11b/Documentation/kube-flannel.yml
+        kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/4ff77dc7c35851913587f7daccf25d754e77aa65/Documentation/kube-flannel.yml
     fi
 }
 
 function kubeadm_join {
-    local kubeadm_config_file=$(mktemp)
-    cat <<EOF | sudo tee $kubeadm_config_file >/dev/null
+    local kubeadm_config_file
+    kubeadm_config_file=$(mktemp)
+    cat <<EOF | tee $kubeadm_config_file >/dev/null
 apiVersion: kubeadm.k8s.io/v1beta1
 kind: JoinConfiguration
 discovery:

devstack/lib/tools/crictl

@@ -0,0 +1,76 @@
+#!/bin/bash
+#
+# lib/tools/crictl
+# CRI command line tools functions
+
+# Dependencies:
+# ``functions`` file
+# ``STACK_USER`` has to be defined
+
+# Save trace setting
+_XTRACE_CONTAINER_TOOLS_CRICTL=$(set +o | grep xtrace)
+set +o xtrace
+
+# Defaults
+# --------
+
+CRICTL_BIN_DIR=/usr/local/bin
+
+CRICTL_VERSION=${CRICTL_VERSION:-v1.17.0}
+CRICTL_SHA256_AMD64=${CRICTL_SHA256_AMD64:-"7b72073797f638f099ed19550d52e9b9067672523fc51b746e65d7aa0bafa414"}
+CRICTL_SHA256_ARM64=${CRICTL_SHA256_ARM64:-"d89afd89c2852509fafeaff6534d456272360fcee732a8d0cb89476377387e12"}
+CRICTL_SHA256_PPC64=${CRICTL_SHA256_PPC64:-"a61c52b9ac5bffe94ae4c09763083c60f3eccd30eb351017b310f32d1cafb855"}
+CRICTL_SHA256_S390X=${CRICTL_SHA256_S390X:-"0db445f0b74ecb51708b710480a462b728174155c5f2709a39d1cc2dc975e350"}
+# Make sure downloads the correct architecture
+if is_arch "x86_64"; then
+    CRICTL_ARCH="amd64"
+    CRICTL_SHA256=${CRICTL_SHA256:-$CRICTL_SHA256_AMD64}
+elif is_arch "aarch64"; then
+    CRICTL_ARCH="arm64"
+    CRICTL_SHA256=${CRICTL_SHA256:-$CRICTL_SHA256_ARM64}
+elif is_arch "ppc64le"; then
+    CRICTL_ARCH="ppc64le"
+    CRICTL_SHA256=${CRICTL_SHA256:-$CRICTL_SHA256_PPC64}
+elif is_arch "s390x"; then
+    CRICTL_ARCH="s390x"
+    CRICTL_SHA256=${CRICTL_SHA256:-$CRICTL_SHA256_S390X}
+else
+    exit_distro_not_supported "invalid hardware type"
+fi
+CRICTL_DOWNLOAD_URL=${CRICTL_DOWNLOAD_URL:-https://github.com/kubernetes-sigs/cri-tools/releases/download}
+CRICTL_DOWNLOAD_FILE=crictl-$CRICTL_VERSION-linux-$CRICTL_ARCH.tar.gz
+CRICTL_DOWNLOAD_LOCATION=$CRICTL_DOWNLOAD_URL/$CRICTL_VERSION/$CRICTL_DOWNLOAD_FILE
+
+
+# Installs crictl tools.
+function install_crictl {
+    echo "Installing CRI command-line tools"
+
+    # Download and cache the crictl tar for subsequent use
+    local crictl_file
+    crictl_file="$(get_extra_file $CRICTL_DOWNLOAD_LOCATION)"
+    if [ ! -f "$FILES/crictl" ]; then
+        echo "${CRICTL_SHA256} $crictl_file" > $FILES/crictl.sha256sum
+        # remove the damaged file when checksum fails
+        sha256sum -c $FILES/crictl.sha256sum || (sudo rm -f $crictl_file; exit 1)
+
+        tar xzvf $crictl_file -C $FILES
+        sudo install -o "$STACK_USER" -m 0555 -D "$FILES/crictl" \
+            "$CRICTL_BIN_DIR/crictl"
+    fi
+}
+
+# Configure crictl tools.
+function configure_crictl {
+    local crictl_config_file=/etc/crictl.yaml
+    cat <<EOF | sudo tee $crictl_config_file >/dev/null
+runtime-endpoint: unix:///run/containerd/containerd.sock
+image-endpoint: unix:///run/containerd/containerd.sock
+timeout: 10
+debug: true
+EOF
+}
+
+
+# Restore xtrace
+$_XTRACE_CONTAINER_TOOLS_CRICTL

devstack/settings

@@ -8,6 +8,7 @@ ENABLE_KATA_CONTAINERS=${ENABLE_KATA_CONTAINERS:-false}
 ENABLE_LIVE_RESTORE=${ENABLE_LIVE_RESTORE:-false}
 ENABLE_IPV6=${ENABLE_IPV6:-false}
 K8S_NETWORK_ADDON=${K8S_NETWORK_ADDON:-flannel}
+ENABLE_CONTAINERD_CRI=${ENABLE_CONTAINERD_CRI:-false}
 
 # Enable container services
 enable_service container

etc/cni/net.d/10-bridge.conf

@@ -0,0 +1,15 @@
+{
+    "cniVersion": "0.2.0",
+    "name": "mynet",
+    "type": "bridge",
+    "bridge": "cni0",
+    "isGateway": true,
+    "ipMasq": true,
+    "ipam": {
+        "type": "host-local",
+        "subnet": "10.22.0.0/16",
+        "routes": [
+            { "dst": "0.0.0.0/0" }
+        ]
+    }
+}

etc/cni/net.d/99-loopback.conf

@@ -0,0 +1,5 @@
+{
+    "cniVersion": "0.2.0",
+    "name": "lo",
+    "type": "loopback"
+}

tox.ini

@@ -0,0 +1,35 @@
+[tox]
+minversion = 1.6
+skipsdist = True
+envlist = bashate
+
+[testenv]
+usedevelop = False
+install_command = pip install {opts} {packages}
+
+[testenv:bashate]
+basepython = python3
+# if you want to test out some changes you have made to bashate
+# against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
+# modified bashate tree
+deps =
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
+whitelist_externals = bash
+commands = bash -c "find {toxinidir}             \
+         -not \( -type d -name .?\* -prune \)    \
+         -not \( -type d -name doc -prune \)     \
+         -not \( -type f -name localrc -prune \) \
+         -type f                                 \
+         -not -name \*~                          \
+         -not -name \*.md                        \
+         -not -name stack-screenrc               \
+         -not -name \*.orig                      \
+         -not -name \*.rej                       \
+         \(                                      \
+          -name \*.sh -or                        \
+          -name \*rc -or                         \
+          -name functions\* -or                  \
+          -wholename \*/inc/\* -or               \
+          -wholename \*/lib/\*                   \
+         \)                                      \
+         -print0 | xargs -0 bashate -v -iE006 -eE005,E042"