How to use molecule-podman in order to simulate multiple instance whitin a network?

[bioinfornatics]

Dear,

I would like to test my freeipa server and ipa client recipe deployment with molecule podman.
Thus to my understanding with podman as a rootless container runner we have to use a pod.

Could you show us an example which involve multiple instance with in network pod using podman please ?

With molecule-docker usually we define into molecule.yml something close to this:

docker_networks:
   - name: 'acmenet'
     ipam_config:
      - subnet: '10.30.50.0/24'
networks:
  - name: "acmenet"
    ipv4_address: '10.30.50.12'

Thanks for you help

Best regards

[bioinfornatics]

I found some interesting information from file molecule-podman/src/molecule_podman/driver.py

So currently I have this:

driver:
  name: podman
platforms:
  - name: ipa
    image: quay.io/freeipa/freeipa-server:rocky-8-4.9.6
    pre_build_image: true
    privileged: false
    network: msio_ipa
    subnet: 10.0.1.0/16
#    ip: 10.0.1.1
    hostname: ipa.msio.test
    command: ipa-server-install -U --realm=MSIO.TEST --domain=msio.test --ds-password=IsASecret --admin-password=IsASecret --hostname=ipa.msio.test

  - name: client1
    image: quay.io/rockylinux/rockylinux
    pre_build_image: true
    privileged: false
    network: msio_ipa
    subnet: 10.0.1.0/16
#    ip: 10.0.1.2
    hostname: client1.msio.test
    groups:
      - all
      - client

I do not know yet if that will works yet, as I am stuck on the road.
How can we assign a private ip within this network to each instance like this I could use ansible_host

ERROR LOG

     "stderr": "time=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error adding network: failed to set bridge addr: could not set bridge's mac: invalid argument\"\ntime=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error while adding pod to CNI network \\\"msio_ipa\\\": failed to set bridge addr: could not set bridge's mac: invalid argument\"\ntime=\"2022-04-21T09:14:58+02:00\" level=error msg=\"error loading cached network config: network \\\"msio_ipa\\\" not found in CNI cache\"\ntime=\"2022-04-21T09:14:58+02:00\" level=warning msg=\"falling back to loading from existing plugins on disk\"\ntime=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error tearing down partially created network namespace for container a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91: Error while removing pod from CNI network \\\"msio_ipa\\\": running [/usr/sbin/iptables -t nat -D POSTROUTING -s 10.88.2.6 -j CNI-4a84f7bdb879f961fc7ed1da -m comment --comment name: \\\"msio_ipa\\\" id: \\\"a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91\\\" --wait]: exit status 2: iptables v1.8.7 (nf_tables): Chain 'CNI-4a84f7bdb879f961fc7ed1da' does not exist\\nTry `iptables -h' or 'iptables --help' for more information.\\n\"\nError: error configuring network namespace for container a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91: failed to set bridge addr: could not set bridge's mac: invalid argument",
    "stderr_lines": [
        "time=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error adding network: failed to set bridge addr: could not set bridge's mac: invalid argument\"",
        "time=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error while adding pod to CNI network \\\"msio_ipa\\\": failed to set bridge addr: could not set bridge's mac: invalid argument\"",
        "time=\"2022-04-21T09:14:58+02:00\" level=error msg=\"error loading cached network config: network \\\"msio_ipa\\\" not found in CNI cache\"",
        "time=\"2022-04-21T09:14:58+02:00\" level=warning msg=\"falling back to loading from existing plugins on disk\"",
        "time=\"2022-04-21T09:14:58+02:00\" level=error msg=\"Error tearing down partially created network namespace for container a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91: Error while removing pod from CNI network \\\"msio_ipa\\\": running [/usr/sbin/iptables -t nat -D POSTROUTING -s 10.88.2.6 -j CNI-4a84f7bdb879f961fc7ed1da -m comment --comment name: \\\"msio_ipa\\\" id: \\\"a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91\\\" --wait]: exit status 2: iptables v1.8.7 (nf_tables): Chain 'CNI-4a84f7bdb879f961fc7ed1da' does not exist\\nTry `iptables -h' or 'iptables --help' for more information.\\n\"",
        "Error: error configuring network namespace for container a8b30732796f45248329f257526092db40e83571f95c76ef752c0d3433a98c91: failed to set bridge addr: could not set bridge's mac: invalid argument"
    ],

[apatard]

Replying here instead of irc as it's easier for cut&paste. I've tested on top of PR119:

• molecule.yml

---
driver:
  name: podman
platforms:
  - name: instance-1
    image: docker.io/pycontribs/centos:8
    pre_build_image: true
    privileged: false
    network: testnet
    subnet: 10.0.1.0/16
    ip: 10.0.1.1
    extra_opts:
     - "--network-alias=test1.example.com"
  - name: instance-2
    image: docker.io/pycontribs/centos:8
    pre_build_image: true
    privileged: false
    network: testnet
    subnet: 10.0.1.0/16
    ip: 10.0.1.2
    extra_opts:
     - "--network-alias=test2.example.com"

• verify.yml

---
- name: Check instance-1
  hosts: instance-1
  gather_facts: false
  become: true
  tasks:
    - name: ping instance-2
      ansible.builtin.command:
        cmd: ping -c3 instance-2
        warn: false
      changed_when: false
    - name: ping instance-2 ip
      ansible.builtin.command:
        cmd: ping -c3 10.0.1.2
        warn: false
      changed_when: false
    - name: ping instance-2 hostname
      ansible.builtin.command:
        cmd: ping -c3 test2.example.com
        warn: false
      changed_when: false

- name: Change instance-2
  hosts: instance-2
  gather_facts: false
  become: true
  tasks:
    - name: ping instance-1
      ansible.builtin.command:
        cmd: ping -c3 instance-1
        warn: false
      changed_when: false
    - name: ping instance-1 ip
      ansible.builtin.command:
        cmd: ping -c3 10.0.1.1
        warn: false
      changed_when: false
    - name: ping instance-1 hostname
      ansible.builtin.command:
        cmd: ping -c3 test1.example.com
        warn: false
      changed_when: false

Also with:

• molecule.yml

---
driver:
  name: podman
platforms:
  - name: test1.example.com
    image: docker.io/pycontribs/centos:8
    pre_build_image: true
    privileged: false
    network: testnet
    subnet: 10.0.1.0/16
    ip: 10.0.1.1
  - name: test2.example.com
    image: docker.io/pycontribs/centos:8
    pre_build_image: true
    privileged: false
    network: testnet
    subnet: 10.0.1.0/16
    ip: 10.0.1.2

• verify.yml

---
- name: Check test1.example.com
  hosts: test1.example.com
  gather_facts: false
  become: true
  tasks:
    - name: ping instance-2 ip
      ansible.builtin.command:
        cmd: ping -c3 10.0.1.2
        warn: false
      changed_when: false
    - name: ping test2.example.com hostname
      ansible.builtin.command:
        cmd: ping -c3 test2.example.com
        warn: false
      changed_when: false

- name: Change test2.example.com
  hosts: test2.example.com
  gather_facts: false
  become: true
  tasks:
    - name: ping test1.example.com ip
      ansible.builtin.command:
        cmd: ping -c3 10.0.1.1
        warn: false
      changed_when: false
    - name: ping test1.example.com hostname
      ansible.builtin.command:
        cmd: ping -c3 test1.example.com
        warn: false
      changed_when: false

In both cases the molecule test is working. I'm wondering how to reproduce your problem (except the problem being missing documentation).

[apatard]

oh, I forgot to add: molecule-podman does not seem to remove the newly created network by the test...

[bioinfornatics]

Thanks a lot @apatard . Your are right by your way we can simulate a virtual network.
Now i understand my issue, it come when you do:

1. firstly declared the network with the use of network keyword
2. you launch molecule test
3. update the network by declaring a subnetand/or an ip
4. launch again molecule test

That will not works as molecule podman will not update the network, it only check if the networks exist
So any network update need to manually remove it by the use of
podman network rm <network>

[apatard]

oh, right. So, you issue is more that molecule-podman is not destroying the network after testing. A possible solution would be copy&adapt what's done in molecule-docker but containers.podman.podman_network doesn't seem to support labels. I'm not even sure which version of podman have this option to "podman network" commands

[bioinfornatics]

yes exactly