CI: factorize tests into a single playbook

This allows to use kubespray_defaults (once) instead of redefining
defaults in the tests.
Test test files becomes imported tasks rather thand standalone
playbooks.

tests/scripts/testcases_run.sh

@@ -78,25 +78,12 @@ if [ "${RECOVER_CONTROL_PLANE_TEST}" != "false" ]; then
     run_playbook recover-control-plane -e etcd_retries=10 --limit "etcd:kube_control_plane"
 fi
 
-# Tests Cases
+# Run tests
-## Test Control Plane API
+ansible-playbook \
-run_playbook tests/testcases/010_check-apiserver.yml
+    -e @tests/common_vars.yml \
-run_playbook tests/testcases/015_check-nodes-ready.yml
+    -e @tests/${TESTCASE_FILE} \
-
+    -e local_release_dir=${PWD}/downloads \
-## Test that all nodes are Ready
+    tests/testcases/tests.yml
-
-if [[ ! ( "$TESTCASE" =~ "macvlan" ) ]]; then
-    run_playbook tests/testcases/020_check-pods-running.yml
-    run_playbook tests/testcases/030_check-network.yml
-    if [[ ! ( "$TESTCASE" =~ "hardening" ) ]]; then
-      # TODO: We need to remove this condition by finding alternative container
-      # image instead of netchecker which doesn't work at hardening environments.
-      run_playbook tests/testcases/040_check-network-adv.yml
-    fi
-fi
-
-## Kubernetes conformance tests
-run_playbook tests/testcases/100_check-k8s-conformance.yml
 
 # Test node removal procedure
 if [ "${REMOVE_NODE_CHECK}" = "true" ]; then

tests/testcases/010_check-apiserver.yml

@@ -1,21 +1,17 @@
 ---
-- name: Testcases for apiserver
+- name: Check the API servers are responding
-  hosts: kube_control_plane
+  uri:
+    url: "https://{{ (access_ip if (ipv4_stack | default(true)) else access_ip6) | default(ansible_default_ipv4.address if (ipv4_stack | default(true)) else ansible_default_ipv6.address) | ansible.utils.ipwrap }}:{{ kube_apiserver_port | default(6443) }}/version"
+    validate_certs: false
+    status_code: 200
+  register: apiserver_response
+  retries: 12
+  delay: 5
+  until: apiserver_response is success
 
-  tasks:
+- name: Check API servers version
-  - name: Check the API servers are responding
+  assert:
-    uri:
+    that:
-      url: "https://{{ (access_ip if (ipv4_stack | default(true)) else access_ip6) | default(ansible_default_ipv4.address if (ipv4_stack | default(true)) else ansible_default_ipv6.address) | ansible.utils.ipwrap }}:{{ kube_apiserver_port | default(6443) }}/version"
+    - apiserver_response.json.gitVersion == kube_version
-      validate_certs: false
+    fail_msg: "apiserver version different than expected {{ kube_version }}"
-      status_code: 200
+  when: kube_version is defined
-    register: apiserver_response
-    retries: 12
-    delay: 5
-    until: apiserver_response is success
-
-  - name: Check API servers version
-    assert:
-      that:
-      - apiserver_response.json.gitVersion == kube_version
-      fail_msg: "apiserver version different than expected {{ kube_version }}"
-    when: kube_version is defined

tests/testcases/015_check-nodes-ready.yml

@@ -1,22 +1,18 @@
 ---
-- name: Testcases checking nodes
+- import_role:  # noqa name[missing]
-  hosts: kube_control_plane[0]
+    name: cluster-dump
-  tasks:
 
-  - import_role:  # noqa name[missing]
+- name: Check kubectl output
-      name: cluster-dump
+  command: "{{ bin_dir }}/kubectl get nodes"
+  changed_when: false
+  register: get_nodes
 
-  - name: Check kubectl output
+- name: Check that all nodes are running and ready
-    command: "{{ bin_dir }}/kubectl get nodes"
+  command: "{{ bin_dir }}/kubectl get nodes --no-headers -o yaml"
-    changed_when: false
+  changed_when: false
-    register: get_nodes
+  register: get_nodes_yaml
-
+  until:
-  - name: Check that all nodes are running and ready
+  # Check that all nodes are Status=Ready
-    command: "{{ bin_dir }}/kubectl get nodes --no-headers -o yaml"
+  - '(get_nodes_yaml.stdout | from_yaml)["items"] | map(attribute = "status.conditions") | map("items2dict", key_name="type", value_name="status") | map(attribute="Ready") | list | min'
-    changed_when: false
+  retries: 30
-    register: get_nodes_yaml
+  delay: 10
-    until:
-    # Check that all nodes are Status=Ready
-    - '(get_nodes_yaml.stdout | from_yaml)["items"] | map(attribute = "status.conditions") | map("items2dict", key_name="type", value_name="status") | map(attribute="Ready") | list | min'
-    retries: 30
-    delay: 10

tests/testcases/020_check-pods-running.yml

@@ -1,27 +1,23 @@
 ---
-- name: Testcases checking pods
+- import_role:  # noqa name[missing]
-  hosts: kube_control_plane[0]
+    name: cluster-dump
-  tasks:
 
-  - import_role:  # noqa name[missing]
+- name: Check kubectl output
-      name: cluster-dump
+  command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
+  changed_when: false
 
-  - name: Check kubectl output
+- name: Check that all pods are running and ready
-    command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
+  command: "{{ bin_dir }}/kubectl get pods --all-namespaces --no-headers -o yaml"
-    changed_when: false
+  changed_when: false
+  register: run_pods_log
+  until:
+  # Check that all pods are running
+  - '(run_pods_log.stdout | from_yaml)["items"] | map(attribute = "status.phase") | unique | list == ["Running"]'
+  # Check that all pods are ready
+  - '(run_pods_log.stdout | from_yaml)["items"] | map(attribute = "status.containerStatuses") | map("map", attribute = "ready") | map("min") | min'
+  retries: 30
+  delay: 10
 
-  - name: Check that all pods are running and ready
+- name: Check kubectl output
-    command: "{{ bin_dir }}/kubectl get pods --all-namespaces --no-headers -o yaml"
+  command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
-    changed_when: false
+  changed_when: false
-    register: run_pods_log
-    until:
-    # Check that all pods are running
-    - '(run_pods_log.stdout | from_yaml)["items"] | map(attribute = "status.phase") | unique | list == ["Running"]'
-    # Check that all pods are ready
-    - '(run_pods_log.stdout | from_yaml)["items"] | map(attribute = "status.containerStatuses") | map("map", attribute = "ready") | map("min") | min'
-    retries: 30
-    delay: 10
-
-  - name: Check kubectl output
-    command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
-    changed_when: false

tests/testcases/030_check-network.yml

@@ -1,128 +1,117 @@
 ---
-- name: Testcases for network
+- name: Check kubelet serving certificates approved with kubelet_csr_approver
-  hosts: kube_control_plane[0]
+  when:
+  - kubelet_rotate_server_certificates | default(false)
+  - kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false))
   vars:
-    test_image_repo: registry.k8s.io/e2e-test-images/agnhost
+    csrs: "{{ csr_json.stdout | from_json }}"
-    test_image_tag: "2.40"
+  block:
-    # TODO: source those from kubespray_defaults instead.
-    # Needs kubespray_defaults to be decoupled from no-proxy stuff
-    kube_pods_subnet: "{{ 'fd85:ee78:d8a6:8607::1:0000/112' if not (ipv4_stack | default(true)) else '10.233.64.0/18' }}"
 
-  tasks:
+  - name: Get certificate signing requests
-
+    command: "{{ bin_dir }}/kubectl get csr -o jsonpath-as-json={.items[*]}"
-  - name: Check kubelet serving certificates approved with kubelet_csr_approver
+    register: csr_json
-    when:
-    - kubelet_rotate_server_certificates | default(false)
-    - kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false))
-    vars:
-      csrs: "{{ csr_json.stdout | from_json }}"
-    block:
-
-    - name: Get certificate signing requests
-      command: "{{ bin_dir }}/kubectl get csr -o jsonpath-as-json={.items[*]}"
-      register: csr_json
-      changed_when: false
-
-    - name: Check there are csrs
-      assert:
-        that: csrs | length > 0
-        fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found
-
-    - name: Check there are Denied/Pending csrs
-      assert:
-        that:
-        - csrs | rejectattr('status') | length == 0 # Pending == no status
-        - csrs | map(attribute='status.conditions') | flatten | selectattr('type', 'equalto', 'Denied') | length == 0 # Denied
-
-        fail_msg: kubelet_csr_approver is enabled but CSRs are not approved
-
-  - name: Approve kubelet serving certificates
-    when:
-    - kubelet_rotate_server_certificates | default(false)
-    - not (kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false)))
-    block:
-
-    - name: Get certificate signing requests
-      command: "{{ bin_dir }}/kubectl get csr -o name"
-      register: get_csr
-      changed_when: false
-
-    - name: Check there are csrs
-      assert:
-        that: get_csr.stdout_lines | length > 0
-        fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found
-
-    - name: Approve certificates
-      command: "{{ bin_dir }}/kubectl certificate approve {{ get_csr.stdout_lines | join(' ') }}"
-      register: certificate_approve
-      when: get_csr.stdout_lines | length > 0
-      changed_when: certificate_approve.stdout
-
-  - name: Create test namespace
-    command: "{{ bin_dir }}/kubectl create namespace test"
     changed_when: false
 
-  - name: Run 2 agnhost pods in test ns
+  - name: Check there are csrs
-    command:
+    assert:
-      cmd: "{{ bin_dir }}/kubectl apply --namespace test -f -"
+      that: csrs | length > 0
-      stdin: |
+      fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found
-        apiVersion: apps/v1
+
-        kind: Deployment
+  - name: Check there are Denied/Pending csrs
-        metadata:
+    assert:
-          name: agnhost
+      that:
-        spec:
+      - csrs | rejectattr('status') | length == 0 # Pending == no status
-          replicas: 2
+      - csrs | map(attribute='status.conditions') | flatten | selectattr('type', 'equalto', 'Denied') | length == 0 # Denied
-          selector:
+
-            matchLabels:
+      fail_msg: kubelet_csr_approver is enabled but CSRs are not approved
+
+- name: Approve kubelet serving certificates
+  when:
+  - kubelet_rotate_server_certificates | default(false)
+  - not (kubelet_csr_approver_enabled | default(kubelet_rotate_server_certificates | default(false)))
+  block:
+
+  - name: Get certificate signing requests
+    command: "{{ bin_dir }}/kubectl get csr -o name"
+    register: get_csr
+    changed_when: false
+
+  - name: Check there are csrs
+    assert:
+      that: get_csr.stdout_lines | length > 0
+      fail_msg: kubelet_rotate_server_certificates is {{ kubelet_rotate_server_certificates }} but no csr's found
+
+  - name: Approve certificates
+    command: "{{ bin_dir }}/kubectl certificate approve {{ get_csr.stdout_lines | join(' ') }}"
+    register: certificate_approve
+    when: get_csr.stdout_lines | length > 0
+    changed_when: certificate_approve.stdout
+
+- name: Create test namespace
+  command: "{{ bin_dir }}/kubectl create namespace test"
+  changed_when: false
+
+- name: Run 2 agnhost pods in test ns
+  command:
+    cmd: "{{ bin_dir }}/kubectl apply --namespace test -f -"
+    stdin: |
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: agnhost
+      spec:
+        replicas: 2
+        selector:
+          matchLabels:
+            app: agnhost
+        template:
+          metadata:
+            labels:
               app: agnhost
-          template:
+          spec:
-            metadata:
+            containers:
-              labels:
+            - name: agnhost
-                app: agnhost
+              image: {{ test_image_repo }}:{{ test_image_tag }}
-            spec:
+              command: ['/agnhost', 'netexec', '--http-port=8080']
-              containers:
+              securityContext:
-              - name: agnhost
+                allowPrivilegeEscalation: false
-                image: {{ test_image_repo }}:{{ test_image_tag }}
+                capabilities:
-                command: ['/agnhost', 'netexec', '--http-port=8080']
+                  drop: ['ALL']
-                securityContext:
+                runAsUser: 1000
-                  allowPrivilegeEscalation: false
+                runAsNonRoot: true
-                  capabilities:
+                seccompProfile:
-                    drop: ['ALL']
+                  type: RuntimeDefault
-                  runAsUser: 1000
+  changed_when: false
-                  runAsNonRoot: true
+
-                  seccompProfile:
+- name: Check that all pods are running and ready
-                    type: RuntimeDefault
+  vars:
+    pods: "{{ (pods_json.stdout | from_json)['items'] }}"
+  block:
+  - name: Check Deployment is ready
+    command: "{{ bin_dir }}/kubectl rollout status deploy --namespace test agnhost --timeout=180s"
+    changed_when: false
+  - name: Get pod names
+    command: "{{ bin_dir }}/kubectl get pods -n test -o json"
+    changed_when: false
+    register: pods_json
+
+  - name: Check pods IP are in correct network
+    assert:
+      that: pods
+            | selectattr('status.phase', '==', 'Running')
+            | selectattr('status.podIP', 'ansible.utils.in_network', kube_pods_subnet)
+            | length == 2
+
+  - name: Curl between pods is working
+    command: "{{ bin_dir }}/kubectl -n test exec {{ item[0].metadata.name }} -- curl {{ item[1].status.podIP | ansible.utils.ipwrap}}:8080"
+    with_nested:
+    - "{{ pods }}"
+    - "{{ pods }}"
+  rescue:
+  - name: List pods cluster-wide
+    command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
     changed_when: false
 
-  - name: Check that all pods are running and ready
+  - import_role:  # noqa name[missing]
-    vars:
+      name: cluster-dump
-      pods: "{{ (pods_json.stdout | from_json)['items'] }}"
+  - fail: # noqa name[missing]
-    block:
-    - name: Check Deployment is ready
-      command: "{{ bin_dir }}/kubectl rollout status deploy --namespace test agnhost --timeout=180s"
-      changed_when: false
-    - name: Get pod names
-      command: "{{ bin_dir }}/kubectl get pods -n test -o json"
-      changed_when: false
-      register: pods_json
-
-    - name: Check pods IP are in correct network
-      assert:
-        that: pods
-              | selectattr('status.phase', '==', 'Running')
-              | selectattr('status.podIP', 'ansible.utils.in_network', kube_pods_subnet)
-              | length == 2
-
-    - name: Curl between pods is working
-      command: "{{ bin_dir }}/kubectl -n test exec {{ item[0].metadata.name }} -- curl {{ item[1].status.podIP | ansible.utils.ipwrap}}:8080"
-      with_nested:
-      - "{{ pods }}"
-      - "{{ pods }}"
-    rescue:
-    - name: List pods cluster-wide
-      command: "{{ bin_dir }}/kubectl get pods --all-namespaces -owide"
-      changed_when: false
-
-    - import_role:  # noqa name[missing]
-        name: cluster-dump
-    - fail: # noqa name[missing]

tests/testcases/040_check-network-adv.yml

@@ -1,160 +1,149 @@
 ---
-- name: Testcases for calico
+- name: Test tunl0 routes
-  hosts: kube_node
+  command: "/sbin/ip route"
-  tasks:
+  register: routes
-    - name: Test tunl0 routes
+  failed_when: routes.stdout_lines
-      command: "/sbin/ip route"
+    | select('contains', '/' ~ calico_pool_blocksize|d(26))
-      register: routes
+    | select('contains', 'tunl0') | length == 0
-      failed_when: routes.stdout_lines
+  when:
-        | select('contains', '/' ~ calico_pool_blocksize|d(26))
+    - ('kube_node' in group_names)
-        | select('contains', 'tunl0') | length == 0
+    - (calico_ipip_mode is defined and calico_ipip_mode != 'Never')
-      when:
+    - kube_network_plugin | default('calico') == 'calico'
-        - (calico_ipip_mode is defined and calico_ipip_mode != 'Never')
-        - kube_network_plugin | default('calico') == 'calico'
 
+- import_role:  # noqa name[missing]
+    name: cluster-dump
 
-- name: Advanced testcases for network
+- name: Wait for netchecker server
-  hosts: k8s_cluster
+  command: "{{ bin_dir }}/kubectl get pods --field-selector=status.phase==Running -o jsonpath-as-json={.items[*].metadata.name} --namespace {{ netcheck_namespace }}"
-  vars:
+  register: pods_json
-    agent_report_interval: 10
+  until:
-    netcheck_namespace: default
+    - pods_json.stdout | from_json | select('match', 'netchecker-server.*') | length == 1
-    netchecker_port: 31081
+    - (pods_json.stdout | from_json | select('match', 'netchecker-agent.*') | length)
+      >= (groups['k8s_cluster'] | intersect(ansible_play_hosts) | length * 2)
+  retries: 3
+  delay: 10
+  when: inventory_hostname == groups['kube_control_plane'][0]
 
-  tasks:
+- name: Get netchecker pods
-    - import_role:  # noqa name[missing]
+  command: "{{ bin_dir }}/kubectl -n {{ netcheck_namespace }} describe pod -l app={{ item }}"
-        name: cluster-dump
+  run_once: true
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  with_items:
+    - netchecker-agent
+    - netchecker-agent-hostnet
+  when: not pods_json is success
 
-    - name: Wait for netchecker server
+- name: Perform netchecker tests
-      command: "{{ bin_dir }}/kubectl get pods --field-selector=status.phase==Running -o jsonpath-as-json={.items[*].metadata.name} --namespace {{ netcheck_namespace }}"
+  run_once: true
-      register: pods_json
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  block:
+    - name: Get netchecker agents
+      uri:
+        url: "http://{{ (ansible_default_ipv6.address if not (ipv4_stack | default(true)) else ansible_default_ipv4.address) | ansible.utils.ipwrap }}:{{ netchecker_port }}/api/v1/agents/"
+        return_content: true
+        headers:
+          Accept: application/json
+      register: agents
+      retries: 18
+      delay: "{{ agent_report_interval }}"
       until:
-        - pods_json.stdout | from_json | select('match', 'netchecker-server.*') | length == 1
+        - agents is success
-        - (pods_json.stdout | from_json | select('match', 'netchecker-agent.*') | length)
+        - (agents.content | from_json | length) == (groups['k8s_cluster'] | length * 2)
-          >= (groups['k8s_cluster'] | intersect(ansible_play_hosts) | length * 2)
+
+    - name: Check netchecker status
+      uri:
+        url: "http://{{ (ansible_default_ipv6.address if not (ipv4_stack | default(true)) else ansible_default_ipv4.address) | ansible.utils.ipwrap }}:{{ netchecker_port }}/api/v1/connectivity_check"
+        return_content: true
+        headers:
+          Accept: application/json
+      register: connectivity_check
       retries: 3
-      delay: 10
+      delay: "{{ agent_report_interval }}"
-      when: inventory_hostname == groups['kube_control_plane'][0]
+      until:
+        - connectivity_check is success
+        - connectivity_check.content | from_json
 
-    - name: Get netchecker pods
+  rescue:
-      command: "{{ bin_dir }}/kubectl -n {{ netcheck_namespace }} describe pod -l app={{ item }}"
+    - name: Get kube-proxy logs
-      run_once: true
+      command: "{{ bin_dir }}/kubectl -n kube-system logs -l k8s-app=kube-proxy"
-      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+
+    - name: Get logs from other apps
+      command: "{{ bin_dir }}/kubectl -n kube-system logs -l k8s-app={{ item }} --all-containers"
       with_items:
-        - netchecker-agent
+        - kube-router
-        - netchecker-agent-hostnet
+        - flannel
-      when: not pods_json is success
+        - canal-node
+        - calico-node
+        - cilium
 
-    - name: Perform netchecker tests
+    - name: Netchecker tests failed
-      run_once: true
+      fail:
-      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+        msg: "netchecker tests failed"
-      block:
-        - name: Get netchecker agents
-          uri:
-            url: "http://{{ (ansible_default_ipv6.address if not (ipv4_stack | default(true)) else ansible_default_ipv4.address) | ansible.utils.ipwrap }}:{{ netchecker_port }}/api/v1/agents/"
-            return_content: true
-            headers:
-              Accept: application/json
-          register: agents
-          retries: 18
-          delay: "{{ agent_report_interval }}"
-          until:
-            - agents is success
-            - (agents.content | from_json | length) == (groups['k8s_cluster'] | length * 2)
 
-        - name: Check netchecker status
+- name: Check connectivity with all netchecker agents
-          uri:
+  vars:
-            url: "http://{{ (ansible_default_ipv6.address if not (ipv4_stack | default(true)) else ansible_default_ipv4.address) | ansible.utils.ipwrap }}:{{ netchecker_port }}/api/v1/connectivity_check"
+    connectivity_check_result: "{{ connectivity_check.content | from_json }}"
-            return_content: true
+    agents_check_result: "{{ agents.content | from_json }}"
-            headers:
+  assert:
-              Accept: application/json
+    that:
-          register: connectivity_check
+      - agents_check_result is defined
-          retries: 3
+      - connectivity_check_result is defined
-          delay: "{{ agent_report_interval }}"
+      - agents_check_result.keys() | length > 0
-          until:
+      - not connectivity_check_result.Absent
-            - connectivity_check is success
+      - not connectivity_check_result.Outdated
-            - connectivity_check.content | from_json
+    msg: "Connectivity check to netchecker agents failed"
+  delegate_to: "{{ groups['kube_control_plane'][0] }}"
+  run_once: true
 
-      rescue:
+- name: Create macvlan network conf
-        - name: Get kube-proxy logs
+  command:
-          command: "{{ bin_dir }}/kubectl -n kube-system logs -l k8s-app=kube-proxy"
+    cmd: "{{ bin_dir }}/kubectl create -f -"
+    stdin: |
+      apiVersion: "k8s.cni.cncf.io/v1"
+      kind: NetworkAttachmentDefinition
+      metadata:
+        name: macvlan-conf
+      spec:
+        config: '{
+          "cniVersion": "0.4.0",
+          "type": "macvlan",
+          "master": "eth0",
+          "mode": "bridge",
+          "ipam": {
+            "type": "host-local",
+            "subnet": "192.168.1.0/24",
+            "rangeStart": "192.168.1.200",
+            "rangeEnd": "192.168.1.216",
+            "routes": [
+              { "dst": "0.0.0.0/0" }
+            ],
+          "gateway": "192.168.1.1"
+        }
+      }'
+      ---
+      apiVersion: v1
+      kind: Pod
+      metadata:
+        name: samplepod
+        annotations:
+          k8s.v1.cni.cncf.io/networks: macvlan-conf
+      spec:
+        containers:
+        - name: samplepod
+          command: ["/bin/bash", "-c", "sleep 2000000000000"]
+          image: dougbtv/centos-network
+  delegate_to: groups['kube_control_plane'][0]
+  run_once: true
+  when:
+    - kube_network_plugin_multus | default(false) | bool
 
-        - name: Get logs from other apps
+- name: Check secondary macvlan interface
-          command: "{{ bin_dir }}/kubectl -n kube-system logs -l k8s-app={{ item }} --all-containers"
+  command: "{{ bin_dir }}/kubectl exec samplepod -- ip addr show dev net1"
-          with_items:
+  register: output
-            - kube-router
+  until: output.rc == 0
-            - flannel
+  retries: 90
-            - canal-node
+  changed_when: false
-            - calico-node
+  delegate_to: groups['kube_control_plane'][0]
-            - cilium
+  run_once: true
-
+  when:
-        - name: Netchecker tests failed
+    - kube_network_plugin_multus | default(false) | bool
-          fail:
-            msg: "netchecker tests failed"
-
-    - name: Check connectivity with all netchecker agents
-      vars:
-        connectivity_check_result: "{{ connectivity_check.content | from_json }}"
-        agents_check_result: "{{ agents.content | from_json }}"
-      assert:
-        that:
-          - agents_check_result is defined
-          - connectivity_check_result is defined
-          - agents_check_result.keys() | length > 0
-          - not connectivity_check_result.Absent
-          - not connectivity_check_result.Outdated
-        msg: "Connectivity check to netchecker agents failed"
-      delegate_to: "{{ groups['kube_control_plane'][0] }}"
-      run_once: true
-
-    - name: Create macvlan network conf
-      command:
-        cmd: "{{ bin_dir }}/kubectl create -f -"
-        stdin: |
-          apiVersion: "k8s.cni.cncf.io/v1"
-          kind: NetworkAttachmentDefinition
-          metadata:
-            name: macvlan-conf
-          spec:
-            config: '{
-              "cniVersion": "0.4.0",
-              "type": "macvlan",
-              "master": "eth0",
-              "mode": "bridge",
-              "ipam": {
-                "type": "host-local",
-                "subnet": "192.168.1.0/24",
-                "rangeStart": "192.168.1.200",
-                "rangeEnd": "192.168.1.216",
-                "routes": [
-                  { "dst": "0.0.0.0/0" }
-                ],
-              "gateway": "192.168.1.1"
-            }
-          }'
-          ---
-          apiVersion: v1
-          kind: Pod
-          metadata:
-            name: samplepod
-            annotations:
-              k8s.v1.cni.cncf.io/networks: macvlan-conf
-          spec:
-            containers:
-            - name: samplepod
-              command: ["/bin/bash", "-c", "sleep 2000000000000"]
-              image: dougbtv/centos-network
-      delegate_to: groups['kube_control_plane'][0]
-      run_once: true
-      when:
-        - kube_network_plugin_multus | default(false) | bool
-
-    - name: Check secondary macvlan interface
-      command: "{{ bin_dir }}/kubectl exec samplepod -- ip addr show dev net1"
-      register: output
-      until: output.rc == 0
-      retries: 90
-      changed_when: false
-      delegate_to: groups['kube_control_plane'][0]
-      run_once: true
-      when:
-        - kube_network_plugin_multus | default(false) | bool

tests/testcases/100_check-k8s-conformance.yml

@@ -1,38 +1,22 @@
 ---
-- name: Testcases for kubernetes conformance
+- name: Download sonobuoy
-  hosts: kube_control_plane[0]
+  get_url:
-  vars:
+    url: "https://github.com/heptio/sonobuoy/releases/download/v{{ sonobuoy_version }}/sonobuoy_{{ sonobuoy_version }}_linux_{{ sonobuoy_arch }}.tar.gz"
-    sonobuoy_version: 0.56.11
+    dest: /tmp/sonobuoy.tar.gz
-    sonobuoy_arch: amd64
+    mode: "0644"
-    sonobuoy_parallel: 30
-    sonobuoy_path: /usr/local/bin/sonobuoy
-    sonobuoy_mode: Quick
 
-  tasks:
+- name: Extract sonobuoy
-  - name: Run sonobuoy
+  unarchive:
-    when:
+    src: /tmp/sonobuoy.tar.gz
-    - sonobuoy_enabled is defined
+    dest: /usr/local/bin/
-    - sonobuoy_enabled
+    copy: false
-    block:
-    - name: Download sonobuoy
-      get_url:
-        url: "https://github.com/heptio/sonobuoy/releases/download/v{{ sonobuoy_version }}/sonobuoy_{{ sonobuoy_version }}_linux_{{ sonobuoy_arch }}.tar.gz"
-        dest: /tmp/sonobuoy.tar.gz
-        mode: "0644"
 
-    - name: Extract sonobuoy
+- name: Run sonobuoy
-      unarchive:
+  command: "{{ sonobuoy_path }} run --mode {{ sonobuoy_mode }} --e2e-parallel {{ sonobuoy_parallel }} --wait"
-        src: /tmp/sonobuoy.tar.gz
-        dest: /usr/local/bin/
-        copy: false
 
-    - name: Run sonobuoy
+- name: Run sonobuoy retrieve
-      command: "{{ sonobuoy_path }} run --mode {{ sonobuoy_mode }} --e2e-parallel {{ sonobuoy_parallel }} --wait"
+  command: "{{ sonobuoy_path }} retrieve"
-      when: sonobuoy_enabled | default(false)
+  register: sonobuoy_retrieve
 
-    - name: Run sonobuoy retrieve
+- name: Run inspect results
-      command: "{{ sonobuoy_path }} retrieve"
+  command: "{{ sonobuoy_path }} results {{ sonobuoy_retrieve.stdout }} --plugin e2e --mode report"
-      register: sonobuoy_retrieve
-
-    - name: Run inspect results
-      command: "{{ sonobuoy_path }} results {{ sonobuoy_retrieve.stdout }} --plugin e2e --mode report"

tests/testcases/tests.yml

@@ -0,0 +1,54 @@
+---
+- name: Define dynamic groups
+  import_playbook: ../../playbooks/boilerplate.yml
+
+- name: Kubespray CI tests
+  hosts: k8s_cluster
+  gather_facts: false
+  vars:
+    testcase: "{{ lookup('env', 'TESTCASE') }}"
+  tasks:
+    - name: Import Kubespray variables
+      import_role:
+        name: ../../roles/kubespray_defaults
+    - name: Testcases for apiserver
+      import_tasks: 010_check-apiserver.yml
+      when:
+        - ('kube_control_plane') in group_names
+    - name: Test using API
+      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+      run_once: true
+      block:
+        - name: Testcases checking nodes
+          import_tasks: 015_check-nodes-ready.yml
+        - name: Testcases checking pods
+          import_tasks: 020_check-pods-running.yml
+          when: ('macvlan' not in testcase)
+        - name: Testcases for network
+          import_tasks: 030_check-network.yml
+          when: ('macvlan' not in testcase)
+          vars:
+            test_image_repo: registry.k8s.io/e2e-test-images/agnhost
+            test_image_tag: "2.40"
+    - name: Testcases for calico / advanced network
+      import_tasks: 040_check-network-adv.yml
+      when:
+        - ('macvlan' not in testcase)
+        - ('hardening' not in testcase)
+      vars:
+        agent_report_interval: 10
+        netcheck_namespace: default
+        netchecker_port: 31081
+    - name: Testcases for kubernetes conformance
+      import_tasks: 100_check-k8s-conformance.yml
+      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+      run_once: true
+      when:
+        - sonobuoy_enabled is defined
+        - sonobuoy_enabled
+      vars:
+        sonobuoy_version: 0.56.11
+        sonobuoy_arch: amd64
+        sonobuoy_parallel: 30
+        sonobuoy_path: /usr/local/bin/sonobuoy
+        sonobuoy_mode: Quick