Fix LXC virtualization facts

[silverwind]

SUMMARY

LXD guests were wrongly detected when running as non-root (making the check for /proc/1/environ fail) and when systemd was absent (making the check for /run/systemd/container fail).

Fixed this by adding a check for the LXD host <-> guest communication socket /dev/lxd/sock which is almost guaranteed to exist, thought it can theoretically be disabled by configuration.

Ref: https://github.com/lxc/lxd/issues/5923#issuecomment-509705074
Ref: https://lxd.readthedocs.io/en/latest/dev-lxd/

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

facts

ADDITIONAL INFORMATION

Before

"ansible_virtualization_role": "host",
"ansible_virtualization_type": "kvm",

After

"ansible_virtualization_role": "lxc",
"ansible_virtualization_type": "guest",

[silverwind]

There's an option to add another check for existance of /var/lib/lxd/devlxd for the host role, but I think generally, hosts do run systemd so they'd be covered via the /run/systemd/container check, so I opted to not do it. If we want to cover ancient LXD systems without systemd, I guess it should be added, thought.

[silverwind]

Decided to add the host role check as well. Testing against a Ubuntu 18.04 LXD node running various LXC guests showed it as

"ansible_virtualization_role": "host",
"ansible_virtualization_type": "kvm",

which is just wrong. Checking on the system, I see /run/systemd/container is absent so that check won't work there as I had initially assumed. After the fix, it now correctly shows the host role:

"ansible_virtualization_role": "host",
"ansible_virtualization_type": "lxc",

[samdoran]

Please create unit tests and a changelog fragment. See this fragment as an example.

There are tests in test/units/module_utils/facts/test_ansible_collector.py but it may be easier to create newer pytest-style tests for testing this specific case.

[silverwind]

Any pointers for writing tests which mock a remote file system and then assert the facts for those file systems? Do such tests exist yet?

[samdoran]

@silverwind I do not believe we have any tests that do this currently. Go ahead and add the changelog fragment and I'll see if I can come up with some tests.

[silverwind]

Will do. Maybe a rudimentary mock like this could suffice for some basic testing:

{
  "/proc/1/cgroup":  "file content",
  "/dev/lxd/sock": "", # no content
  "/var/lib/lxd/devlxd": "" # no content
}

Thought generally, I think the whole concept of ansible_virtualization_role/type is flawed because a system can host multiple virtualization techs, e.g. LXD, Docker and KVM can all co-exist on the same machine, but we can only return one.

The thing with LXD is that if someone has it installed, it's rather likely that it's their virtualization of choice, so that's why I added the check near the top of the file.

[silverwind]

Did a small change to the host detection. Because LXD docs were apparently wrong, I did only check for the directory containing the socket, not the socket file itself. Filed https://github.com/lxc/lxd/pull/5941 to fix their docs.

[silverwind]

Force-pushed with changelog fragment and a new commit message.

[samdoran]

Will do. Maybe a rudimentary mock like this could suffice for some basic testing:

That's what I was thinking as well. Just patch things to behave like files exist.

Thought[sic.] generally, I think the whole concept of ansible_virtualization_role/type is flawed because a system can host multiple virtualization techs, e.g. LXD, Docker and KVM can all co-exist on the same machine, but we can only return one.

Also true. We were discussing this today and it would make more sense for this to be a list since there can be a combination of virtualization going on. This has compatibility implications, but your point is valid.

[silverwind]

This has compatibility implications

Yes, of course. One way I see it done could be:

• Indroduce a new list-based fact virtualization_roles in the format ["lxc-host", "docker-host"], can be empty too. The first item in the list must correspond to what the module currently returns.
• Deprecate virtualization_role and virtualization_type and set them to use the first item from the new fact.
• A few versions later, remove the old facts variables.

[bcoca]

That has mostly been my plan for a while, but we was waiting for a facility to 'deprecate specific variables' which we have not been able to add yet. Until that happens, we could just go with the alternate keys and document that these are 'more precise' than the old ones.

[s-hertel]

This fix is still applicable. Adding lxc to the new virtualization_tech_guest and virtualization_tech_host facts lists is good since systems may have multiple. LGTM besides a concern about backwards compatibility for the legacy singular facts.

[s-hertel]

To keep backwards compatibility for the virtualization_type and virtualization_role facts, this would need to occur at the end of the function. First found wins, so this would take precedence over any of the facts found later. Same for the /var/lib/lxd/devlxd/sock section.

[silverwind]

@s-hertel maybe you want to take this over and file a new PR? I'm not really using ansible any more, so my motivation to further work on it is pretty much nil.

[webknjaz]

The branch is too old, the CI can't check it out, needs rebase.

[silverwind]

I don't really need this anymore so I have lost interest.

Anyone still interested, feel free to raise a new PR based on this one.