FreeIPA replication testing
Hey folks!
So, a while back we talked about how we should probably be testing
FreeIPA server replication as part of the automated Server validation
testing.
I started working on that last week, and it's deployed on staging.
Unfortunately, in this last week or so we've had several bugs in
FreeIPA deployment in Rawhide, and also bugs in Rawhide itself, that
have rather interfered with testing.
You can see some 'real' runs of the tests from the 20180710.n.0 compose
on staging, which is the compose I used to test the tests:
https://openqa.stg.fedoraproject.org/tests/overview?version=Rawhide&g...
The relevant tests are server_freeipa_replication_master ,
server_freeipa_replication_replica , and
server_freeipa_replication_client .
First thing to note: this is a separate set of tests from the existing
one. Logistically, given how openQA implements signalling between
tests, it turned out to be really difficult to wedge replication
testing into that already-quite-complex interconnected server-plus-
multiple-client set of tests, and it would've been quite a pain to
maintain and debug. So I decided not to do that, but just create a
separate test group. This is a bit less resource efficient, but rather
easier to monitor and maintain.
So, the way the tests work is basically this:
1. The 'master' test deploys its SUT as the initial FreeIPA server,
using a command like this:
ipa-server-install -U --realm=DOMAIN.LOCAL --domain=domain.local --ds-password=monkeys123
--admin-password=monkeys123 --setup-dns --reverse-zone=2.0.10.in-addr.arpa
--allow-zone-overlap --forwarder=10.5.126.21 --forwarder=10.5.126.22
2. The 'replica' test then deploys its SUT as a replica of the initial
server, with DNS and CA support, using a command like this:
ipa-replica-install --setup-dns --setup-ca --allow-zone-overlap -U --principal admin
--admin-password monkeys123 --forwarder=10.5.126.21 --forwarder=10.5.126.22
3. The 'client' test configures the SUT to use the replica as its DNS
server and enrols it as a member of the domain *using the replica
server*, not the master server, with a command like this:
realm join --user=admin ipa003.domain.local
where 'ipa003.domain.local' is the hostname of the replica, not the
master. It then runs through a standard set of client tests, the same
ones used in the existing FreeIPA test set - see
https://openqa.stg.fedoraproject.org/tests/330695/modules/freeipa_client/...
.
So, I wanted to ask folks, and especially ab and other FreeIPA folks,
if this looks like a valid test approach? Is it doing the deployments
the right way? Is it testing everything that needs to be tested? Any
other suggestions, etc? Thanks a lot!
I'm hopeful that the next Rawhide compose will be in decent shape and
have FreeIPA actually working well enough for the tests to run properly
again...once we have them working reliably and FreeIPA folks sign off
on their validity, I can merge them to master so they will also run in
production.
You can see the actual commit with all the changes on the feature
branch here:
https://pagure.io/fedora-qa/os-autoinst-distri-fedora/commits/ipa-replica
if interested.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net