This is an automated email from the ASF dual-hosted git repository.
apupier pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 654e3a3a7674 Revert "CAMEL-25436: camel-test-infra-spiffe - fix IT
failures on rootless co…"
654e3a3a7674 is described below
commit 654e3a3a7674fbf1573284bf1f7eec73a72df84c
Author: Aurélien Pupier <[email protected]>
AuthorDate: Fri Oct 9 10:05:25 2026 +0200
Revert "CAMEL-25436: camel-test-infra-spiffe - fix IT failures on rootless
co…"
This reverts commit 5dfd8834c2e37848e69c99dd410019e04d61bb8f.
---
.../services/SpiffeLocalContainerInfraService.java | 65 +---------------------
1 file changed, 3 insertions(+), 62 deletions(-)
diff --git
a/test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java
b/test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java
index 74c148c9a7de..20aaecb545af 100644
---
a/test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java
+++
b/test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java
@@ -21,7 +21,6 @@ import java.nio.file.Files;
import java.nio.file.Path;
import java.time.Duration;
-import com.github.dockerjava.api.model.Info;
import com.sun.security.auth.module.UnixSystem;
import org.apache.camel.spi.annotations.InfraService;
import org.apache.camel.test.infra.common.LocalPropertyResolver;
@@ -29,7 +28,6 @@ import
org.apache.camel.test.infra.common.services.ContainerService;
import org.apache.camel.test.infra.spiffe.common.SpiffeProperties;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import org.testcontainers.DockerClientFactory;
import org.testcontainers.containers.BindMode;
import org.testcontainers.containers.Container;
import org.testcontainers.containers.GenericContainer;
@@ -50,8 +48,8 @@ import org.testcontainers.utility.MountableFile;
* <p>
* This assumes a Linux Docker host: the host PID namespace, the Unix-socket
bind mount and the {@code unix:uid}
* selector all rely on the test JVM and the containers sharing one Linux
kernel. It is not expected to work on Docker
- * Desktop (macOS/Windows, where the daemon runs in a separate VM). Under
rootless Podman the uid is remapped (the host
- * uid appears as uid 0 inside the container), and this class handles that
transparently.
+ * Desktop (macOS/Windows, where the daemon runs in a separate VM) or on
rootless Podman (uid remapping) - which is also
+ * why the component gates these integration tests off non-amd64 CI. It
targets a Linux CI/development Docker.
*/
@InfraService(service = SpiffeInfraService.class,
description = "SPIFFE/SPIRE server and agent exposing the
Workload API",
@@ -67,7 +65,6 @@ public class SpiffeLocalContainerInfraService implements
SpiffeInfraService, Con
private static final String SERVER_ALIAS = "spire-server";
private static final int SERVER_PORT = 8081;
private static final String SERVER_BIN = "/opt/spire/bin/spire-server";
- private static final String AGENT_BIN = "/opt/spire/bin/spire-agent";
private static final String SERVER_CONF =
"/opt/spire/conf/server/server.conf";
private static final String AGENT_CONF =
"/opt/spire/conf/agent/agent.conf";
private static final String SOCKET_CONTAINER_DIR =
"/tmp/spire-agent/public";
@@ -141,7 +138,6 @@ public class SpiffeLocalContainerInfraService implements
SpiffeInfraService, Con
LOG.info("Starting the SPIRE agent container");
agent.start();
waitForSocket();
- waitForAgentHealthy();
socketPath = "unix://" + hostSocketDir.resolve(SOCKET_FILE);
registerProperties();
@@ -196,44 +192,11 @@ public class SpiffeLocalContainerInfraService implements
SpiffeInfraService, Con
}
private void createWorkloadEntry() {
- long uid = resolveWorkloadUid();
- LOG.info("Registering workload entry for unix:uid:{}", uid);
+ long uid = new UnixSystem().getUid();
exec(server, SERVER_BIN, "entry", "create", "-parentID",
AGENT_SPIFFE_ID, "-spiffeID", WORKLOAD_SPIFFE_ID,
"-selector", "unix:uid:" + uid);
}
- /**
- * Returns the UID of this JVM process as it will appear to the SPIRE unix
workload attestor.
- * <p>
- * Under rootless Podman and Docker the container's user namespace maps
the host owner uid to container uid 0, so
- * the agent sees the test process as uid 0 when reading {@code
/proc/<pid>/status} through the host PID namespace.
- * On a standard (root-owned) Docker daemon no such remapping occurs and
the real host uid is used.
- * <p>
- * Rootless mode is detected via the Docker info API: Podman returns
{@code "Rootless": true} in the JSON response
- * (captured in {@code rawValues} since the docker-java model does not
have a typed field for it).
- */
- private long resolveWorkloadUid() {
- Info info = DockerClientFactory.instance().client().infoCmd().exec();
- if (isPodmanRootless(info) || isDockerRootless(info)) {
- // Under rootless Podman and Docker the host uid of the container
owner (us) is remapped to uid 0 inside every
- // container, so the agent's unix workload attestor sees the test
process as uid 0.
- LOG.debug("Rootless container runtime detected; using uid 0 for
workload entry selector");
- return 0L;
- }
- long uid = new UnixSystem().getUid();
- LOG.debug("Standard container runtime; using host uid {} for workload
entry selector", uid);
- return uid;
- }
-
- private boolean isPodmanRootless(Info info) {
- Object podmanRootless = info.getRawValues().get("Rootless");
- return Boolean.TRUE.equals(podmanRootless);
- }
-
- private boolean isDockerRootless(Info info) {
- return info.getSecurityOptions() != null &&
info.getSecurityOptions().stream().anyMatch(o -> o.contains("rootless"));
- }
-
private void waitForSocket() {
Path socket = hostSocketDir.resolve(SOCKET_FILE);
long deadline = System.currentTimeMillis() +
Duration.ofSeconds(60).toMillis();
@@ -246,28 +209,6 @@ public class SpiffeLocalContainerInfraService implements
SpiffeInfraService, Con
throw new RuntimeException("The SPIRE agent did not create the
Workload API socket at " + socket);
}
- private void waitForAgentHealthy() {
- long deadline = System.currentTimeMillis() +
Duration.ofSeconds(60).toMillis();
- RuntimeException last = null;
- while (System.currentTimeMillis() < deadline) {
- try {
- Container.ExecResult result = agent.execInContainer(AGENT_BIN,
"healthcheck",
- "-socketPath", SOCKET_CONTAINER_DIR + "/" +
SOCKET_FILE);
- if (result.getExitCode() == 0) {
- return;
- }
- last = new RuntimeException("agent healthcheck exit " +
result.getExitCode() + ": " + result.getStderr());
- } catch (IOException e) {
- last = new RuntimeException(e);
- } catch (InterruptedException e) {
- Thread.currentThread().interrupt();
- throw new RuntimeException(e);
- }
- sleep(500);
- }
- throw new RuntimeException("SPIRE agent did not become healthy in
time", last);
- }
-
private Container.ExecResult exec(GenericContainer<?> container, String...
command) {
try {
Container.ExecResult result = container.execInContainer(command);
