Similar to the standard build workflow, with the following exceptions:
- Sets internal variable 'ver' to ${GITHUB_REF#refs/tags/v}, for filenames
and directories, ensuring the leading 'v' in the tag is dropped
- Sets INFIX_RELEASE variable, for post-image.sh, to '$ver' so it creates
the .img files with the same name as the tarball and directory. (RELEASE
clashes with OpenSSL's release handling, breaking builds completely.)
- Sets release directory + tarball to infix-$variant-$ver, where variant
is one of "classic" or "" (for NETCONF).
- *Skips the tests*, for now. We release from main, which should already
be tested. Future releases may run a release test suite here
- Each build step (matrix) uploads its artifacts, when all build steps
have completed we start the release job (depends on build), which then
downloads all the various artifacts before creating the GitHub release
- The release notes are derived from the file ChangeLog.md. Please note,
extraction of the first release notes will fail since there is no prior
release marker in the file
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch affects the various artiact file names in release tarballs.
The files /etc/os-release and /etc/version in the image use the actual
GIT commit (git describe), as per post-build.sh
Guiding principle: artifacts without release suffix are development or
"nightly" builds. Artifacts *with* release suffix are released ones.
This drops the $GITVER from .img files for consistency with the other
artifacts, e.g. .gns3a and .pkg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical data shows response times of over 10s for even simple config
changes on heavily loaded systems (non-accelerated VMs with lots of
stress on the host). So we choose a really large number, hoping that
we won't be back here for a while.
When/If dagger generations are abandoned we should not bail out if a
recovery generation finds an existing 'order' in the previous gen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Same as with creating veth pairs, we must not try to delete both ends
since the kernel does that for us. Ensure we check skip in the current
generation and not in the next.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should copy factory running, instead of using the factory-reset RPC
but for now we use startup since 'factory' is not yet supported as a
copy-from target.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 116, in put_config
except self.ncc.RpcError:
^^^^^^^^^^^^^^^^^
AttributeError: 'Manager' object has no attribute 'RpcError'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This one was a little bit tricky with the special yang union. To figure
out the integer value of enums one has to check the schema and deref the
correct subvalue within.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While running tests in GitHub action, the following[1] often happens.
From the timestamp it seems unlikely to be casused by timeout, which
from what I can tell is 120 sec in the library and 30 sec on our socket.
This never happens when running locally, so I've added a simple
try-catch to retry the operation, because some[2] jobs actually pass.
2023-06-18 09:18:17 # Traceback (most recent call last):
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/case/infix_interfaces/dual_bridge.py", line 18, in <module>
2023-06-18 09:18:17 # target.put_config_dict("ietf-interfaces", {
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 117, in put_config_dict
2023-06-18 09:18:17 # return self.put_config(lyd.print_mem("xml", with_siblings=True, pretty=False))
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 112, in put_config
2023-06-18 09:18:17 # self.ncc.edit_config(xml, default_operation='merge')
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 277, in edit_config
2023-06-18 09:18:17 # self._send_rpc(rpc_xml)
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 223, in _send_rpc
2023-06-18 09:18:17 # r = f.result(timeout=timeout)
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 456, in result
2023-06-18 09:18:17 # return self.__get_result()
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
2023-06-18 09:18:17 # raise self._exception
2023-06-18 09:18:17 # netconf_client.error.RpcError: EV ORIGIN: "rpc" ID 5 processing timed out.
2023-06-18 09:18:17 #
[1]: https://github.com/kernelkit/infix/actions/runs/5302735753/jobs/9597878647
[2]. https://github.com/kernelkit/infix/actions/runs/5302735946/jobs/9597878838
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A basic test should be just that, very basic test of a feature. So we
split out the more advanced ones, building up to the dual-bridge.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unsure if this is right, but existing nework test does not send loopback
or other interfaces in the networking configuration, so maybe merge?
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for uploading resulting image(s) from a job even though the
tests may have failed. This way we can inspect the image and see what
went wrong, or if it was a glitch in the matrix^W^Wazure.
Retain a symlink to images/ for test step.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The admin account is the superuser in Infix. The root account will soon
only be for running system daemons.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport upstream sysrepo support for initializing internal modules,
like ietf-netconf-acm, with factory-default data.
A local KernelKit patch on top is required for run-time loading from
/etc/sysrepo/factory-default.json instead of the upsream compile-time
support.
Renamed existing patches to maintain the proper patch order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The ietf-ip yang model has a global IPv4 and IPv6 'enabled' setting that
must be honored. E.g., when setting eth0 as a bridge port and disabling
IPv4 address on eth0, we must flush all addresses, including autoconf.
When detaching interface from the bridge and toggling the 'enabled' node
back on, we only get a "replaced" flag for that node, so we must restore
all addresses from the configure data. The same goes for 'autoconf'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When toggling settings like 'interfaces/interface/ipv6/enabled', which
guards both link-local and all static addresses, the operation is not
"create" or "delete", but "replace". Callback must take any "replace"
on an 'enabled' node into account since none of the other nodes will
be available in the diff.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for Linux veth pairs and is also a bit of a
cleanup of our native yang models, more on that below. The interesting
things are the use of submodule(s) for veth, and the addition of the
deviation for the deprecated /if:interfaces-state.
Unfortunately the `fprintf(ip, "link add dev %s down", ifname);` had to
be delagated from netdag_gen_afspec_add() because of this change. This
because we only know very late that the peer-end of the pair should be
skipped. Having a lingering `ip link add dev foo down` causes iproute2
to fail hard.
A note about Yang models. According to RFC they must follow the naming
standard; 'org-name' and use prefixes 'org-shortname'. So we've decided
to standardize on 'infix-modulename' and 'infix-mn', where 'modulename'
is the standard model we extend, and 'mn' is the prefix used by that
standard model. For example
- infix-interfaces extend ietf-interfaces and use infix-if
- infix-if-veth is a submodule extending infix with veth pairs
Upcoming bridge and lag models follow the same pattern. The use of
submodules require a patch to sysrepo, included earlier, and allows
us to have the same 'infix-if:', or 'infix-interfaecs:' prefix to
all ietf-interfaces extensions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When setting up veth pairs we only need to set up one end of the pair,
so the confd callback code need a way to remember to skip setting up
the peer interface.
The code added here is generic enough to handle other such transactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the coming support for veth pairs, bridge, and link aggregates, we
need to infer peer interfaces (veth), and similar more deeply nested
data nodes to aid the user. Thereforce we can no longer rely on the
xpath in the callbacks to always be "interfaces/interface[name='ifnm']".
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This changeset includes a patch to the upstream sysrepo that is a slight
refactor of the internal function sr_install_modules_prepare_mod() that
is used by sr_install_module2(). Meaning, the srx_require_module() can
now be simplified greatly and we now also support the include statement
with submodules in yang models.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Initial yang model cleanup:
- Use infix-foo@rev.yang for augments and deviations of each std-foo model
- Drop kernelkit-infix-deviations, moved to infix-system model
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running in the cloud, without KVM emulation, together with many
other tenants, it can take a very long time to boot the instances.
Therefore, add a meta test that will wait for all devices in the
physical topology to come up before exiting. This means that the
actual test cases that follow can assume that devices will answer
NETCONF requests.
Create topology objects that are tailored to represent topologies on
the expected format. This let's us make convenient accessors for
things like the controller node, infix devices, getting the ports used
to reach a certain device from another one, etc.
