[7.0.x] tele sync packages (#2211)

* lib/builder: correct depedency synchronization for manifests with
dependencies.

When building an (cluster) image, tele syncs the local cache with
packages/applications from a remote hub if any are missing.
The recent work on intermediate upgrades introduced a change that
stopped syncing direct application dependencies - instead it only
synced the dependencies of the runtime applications.
This went unnoticed since the development workflow does not exercise
this path.

I added the relevant tests to exercise both direct dependency
synchronization as well handling intermediate hops (which were not
tested before).

* Add a separate docker image for running tests with docker support.

* Verify dependencies for the application packages in each syncer implementation

* Add another test for the development workflow when packages are explicitly placed into cache

build.assets/Dockerfile.testbox

@@ -0,0 +1,23 @@
+FROM quay.io/gravitational/debian-venti:go1.12.9-stretch
+
+RUN set -ex && adduser jenkins --uid=995 --disabled-password --system
+RUN (set -ex && mkdir -p /gopath/src/github.com/gravitational/gravity && \
+     chown -R jenkins /gopath && \
+     mkdir -p /.cache && \
+     chmod 777 /.cache)
+
+RUN set -ex && apt-get update && \
+    apt-get -y install apt-transport-https ca-certificates curl gnupg software-properties-common && \
+    curl -fsSL https://download.docker.com/linux/debian/gpg | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 apt-key add - && \
+    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian buster stable" && \
+    apt-get update && \
+    apt-get -y install docker-ce-cli
+
+ENV LANGUAGE="en_US.UTF-8" \
+     LANG="en_US.UTF-8" \
+     LC_ALL="en_US.UTF-8" \
+     LC_CTYPE="en_US.UTF-8" \
+     GOPATH="/gopath" \
+     PATH="$PATH:/opt/go/bin:/gopath/bin"
+
+VOLUME ["/gopath/src/github.com/gravitational/gravity"]

build.assets/Makefile

@@ -13,7 +13,8 @@ LOCAL_BUILDDIR ?= /gopath/src/github.com/gravitational/gravity/build
 LOCAL_GRAVITY_BUILDDIR ?= /gopath/src/github.com/gravitational/gravity/build/$(GRAVITY_VERSION)
 
 DOCKER_ARGS ?= --pull
-BBOX = gravity-buildbox:latest
+BUILDBOX = gravity-buildbox:7.0.x
+TESTBOX ?= gravity-testbox:7.0.x
 
 GRAVITY_WEB_APP_DIR ?= $(abspath $(LOCALDIR)/../web)/
 
@@ -122,12 +123,14 @@ endif
 # Runs tests inside a build container
 #
 .PHONY: test
-test: buildbox test-etcd
+test: testbox test-etcd
 	docker run --net=host --rm=true $(NOROOT) \
 		-v $(TOP):$(SRCDIR) \
-		-e "GRAVITY_PKG_PATH=$(GRAVITY_PKG_PATH)" \
+		-v /var/run/docker.sock:/var/run/docker.sock \
+		--tmpfs /tmp:rw,nosuid,nodev,exec,relatime \
+		-e "GRAVITY_PKG_PATH=$(GRAVITY_PK,_PATH)" \
 		-e "TEST_PACKAGES=$(TEST_PACKAGES)" \
-		-t $(BBOX) \
+		-t $(TESTBOX) \
 		dumb-init make -C $(SRCDIR)/build.assets FLAGS='-cover -race' TEST_ETCD=true TEST_K8S=$(TEST_K8S) test-inside-container
 
 
@@ -196,7 +199,7 @@ grpc: $(GRPC_PROTO_OUTPUTS)
 $(GRPC_PROTO_OUTPUTS): buildbox $(GRPC_PROTOS)
 	docker run --rm=true -u $$(id -u) \
 		   -v $(TOP):$(SRCDIR) \
-		   $(BBOX) \
+		   $(BUILDBOX) \
 		   dumb-init make -C $(subst $(TOP),$(SRCDIR),$(@D))
 
 #
@@ -211,7 +214,7 @@ validate-deps: buildbox
 	docker run --rm=true \
 		   -v $(GITHUB_SSH_KEY):/root/.ssh/id_rsa \
 		   -v $(TMP):$(SRCDIR) \
-		   $(BBOX) \
+		   $(BUILDBOX) \
 		   dumb-init make -C $(SRCDIR) validate-deps
 
 #
@@ -231,7 +234,7 @@ build-in-container: buildbox
 		   -e "GRAVITY_BUILDTAGS=$(GRAVITY_BUILDTAGS)" \
 		   -e "TARGETS=$(TARGETS)" \
 		   $(GOCACHE_DOCKER_OPTIONS) \
-		   $(BBOX) \
+		   $(BUILDBOX) \
 		   dumb-init make -C $(SRCDIR)/build.assets -j $(TARGETS)
 
 #
@@ -472,7 +475,7 @@ build-tsh-in-container: clone-teleport
 		   -e "GRAVITY_VERSION=$(GRAVITY_VERSION)" \
 		   -e "GRAVITY_TAG=$(GRAVITY_TAG)" \
 		   -e "LOCAL_GRAVITY_BUILDDIR=$(LOCAL_GRAVITY_BUILDDIR)" \
-		   $(BBOX) \
+		   $(BUILDBOX) \
 		   dumb-init make -C $(SRCDIR)/build.assets build-tsh-inside-container
 
 #
@@ -582,7 +585,7 @@ build-fio-sub: clone-fio
 	docker run --rm=true -u $$(id -u) \
 	    -v $(TOP):$(SRCDIR) \
 	    -v $(FIO_BUILDDIR):/fio \
-	    $(BBOX) \
+	    $(BUILDBOX) \
 	    dumb-init make -C $(SRCDIR)/build.assets build-fio-in-buildbox
 
 .PHONY: build-fio-in-buildbox
@@ -657,7 +660,7 @@ push-storage-app: $(STORAGE_APP_OUT)
 #
 .PHONY: enter
 enter:
-	docker run -ti --rm=true $(BBOX) /bin/bash
+	docker run -ti --rm=true $(BUILDBOX) /bin/bash
 
 .PHONY: selinux
 selinux: $(SELINUX_ASSETS)
@@ -696,4 +699,10 @@ buildbox:
 		--build-arg GRPC_GATEWAY_TAG=$(GRPC_GATEWAY_TAG) \
 		--build-arg GODEP_TAG=$(GODEP_TAG) \
 		--build-arg VERSION_TAG=$(VERSION_TAG) \
-		$(DOCKER_ARGS) --tag $(BBOX) .
+		$(DOCKER_ARGS) --tag $(BUILDBOX) .
+#
+# testbox container: container used for tests
+#
+.PHONY: testbox
+testbox:
+	docker build $(DOCKER_ARGS) --tag $(TESTBOX) -f Dockerfile.testbox .

lib/app/service/test/builder.go

@@ -198,6 +198,7 @@ func CreateApplicationFromBinaryData(apps app.Applications, locator loc.Locator,
 	app, err := apps.CreateApp(locator, &data, labels)
 	c.Assert(err, IsNil)
 	c.Assert(app, NotNil)
+	c.Logf("Created app %v.", app.Package)
 	return app
 }
 

lib/builder/builder.go

@@ -26,6 +26,7 @@ import (
 	"runtime"
 	"time"
 
+	"github.com/gravitational/gravity/lib/app"
 	libapp "github.com/gravitational/gravity/lib/app"
 	"github.com/gravitational/gravity/lib/app/service"
 	blobfs "github.com/gravitational/gravity/lib/blob/fs"
@@ -245,40 +246,10 @@ func (b *Builder) SelectRuntime() (*semver.Version, error) {
 
 // SyncPackageCache ensures that all system dependencies are present in
 // the local cache directory for the specified list of runtime versions
-func (b *Builder) SyncPackageCache(ctx context.Context, runtimeVersion semver.Version, intermediateVersions ...semver.Version) error {
-	apps, err := b.Env.AppServiceLocal(localenv.AppConfig{})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	for _, runtimeVersion := range append([]semver.Version{runtimeVersion}, intermediateVersions...) {
-		b.NextStep("Syncing packages for %v", runtimeVersion)
-		if err := b.syncPackageCache(ctx, runtimeVersion, apps); err != nil {
-			return trace.Wrap(err, "failed to sync packages for runtime version %v", runtimeVersion)
-		}
-	}
-	return nil
-}
-
-func (b *Builder) syncPackageCache(ctx context.Context, runtimeVersion semver.Version, apps libapp.Applications) error {
-	// see if all required packages/apps are already present in the local cache
-	runtimeApp, err := apps.GetApp(RuntimeApp(runtimeVersion))
-	if err != nil && !trace.IsNotFound(err) {
-		return trace.Wrap(err)
-	}
-	if runtimeApp != nil {
-		err = libapp.VerifyDependencies(*runtimeApp, apps, b.Env.Packages)
-		if err != nil && !trace.IsNotFound(err) {
-			return trace.Wrap(err)
-		}
-		if err == nil {
-			b.Info("Local package cache is up-to-date.")
-			b.NextStep("Local package cache is up-to-date")
-			return nil
-		}
-	}
+func (b *Builder) SyncPackageCache(ctx context.Context, runtimeVersion semver.Version, intermediateRuntimes ...semver.Version) error {
 	b.Infof("Synchronizing package cache with %v.", b.Repository)
 	b.NextStep("Downloading dependencies from %v", b.Repository)
-	return b.Syncer.Sync(ctx, b, runtimeVersion)
+	return b.Syncer.Sync(ctx, b, b.app(runtimeVersion), intermediateRuntimes)
 }
 
 // Vendor vendors the application images in the provided directory and
@@ -493,8 +464,17 @@ func (b *Builder) collectUpgradeDependencies() (result *libapp.Dependencies, err
 	return result, nil
 }
 
-// RuntimeApp returns the locator of the runtime application with the specified version
-func RuntimeApp(version semver.Version) loc.Locator {
+// app returns the application value with the specified runtime version
+// set as the base
+func (b Builder) app(runtimeVersion semver.Version) app.Application {
+	return app.Application{
+		Package:  b.Manifest.Locator(),
+		Manifest: b.Manifest.WithBase(runtimeApp(runtimeVersion)),
+	}
+}
+
+// runtimeApp returns the locator of the runtime application with the specified version
+func runtimeApp(version semver.Version) loc.Locator {
 	return loc.Runtime.WithVersion(version)
 }