Resolving cascading boot error in alma9.8 that results from acl boot option

Reason:

  Running on linode instances, /etc/hosts file changes are worth
testing.

This reverts commit f51c228573.

.gitea/tofu/main.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    linode		= {
+      source 		= "linode/linode"
+      # version		= "..."
+    }
+  }
+}
+
+# Configure the Linode Provider
+provider "linode" {
+   token		= var.token
+}
+
+resource "linode_instance" "eqit_test_instance" {
+    image = "linode/almalinux9"
+    label = "act_worker"
+    region = "us-ord"
+    type = "g6-nanode-1"
+    authorized_keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeRI1w3uNny7KjK2UdlAnyoGdGgtOx4isSD52u5dr4QkkdLRMj42dLjgT0MK+QehlgaH2XzFPMDz+hZQ+66YeBSm+F4km/8F9XVyUzGl0scUA1p0pqeL3FiyM3Art4Bo71zuE3PvMjyI3pGMKQ3VDWVA0XdAjjSw4G+czJTxZLLBPGvzDT07WuWM4Evl6H21Gn7PB6CKNV0vuUZwGiCsjRbghml1L2kDtTXV1B6wQsniuhQigIVo6YXhMgge/2UCcmiyeEizdfaSstrQHEyxFMvlPUJyw4a3plAuPORDyZdAFF6OA7/wP5fVWoCu/CkbMIDjPifXGQOuhQU1qUVy7r m00t@miserver.lan","ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINi1TmECeYdnrw8OCiBVB+rm8SwBWcz98Se/q+3l3iM/ act_runner@miserver.lan"]
+    root_pass = "supersecrettestpassword"
+}
+
+variable "token" {}
+
+output "act_worker_ip_address" {
+  value = linode_instance.eqit_test_instance.ip_address
+}

.gitea/workflows/demo.yml

@@ -1,6 +1,9 @@
 name: Gitea Actions - molecule test work
 run-name: ${{ gitea.actor }} is running molecule test work
-on: [push]
+on:
+  push:
+    tags:
+      - 'molecule-test'
 
 jobs:
   Explore-molecule-Gitea-Action:

.gitea/workflows/linode.yml

@@ -0,0 +1,36 @@
+name: Gitea Actions - molecule test work
+run-name: ${{ gitea.actor }} is running molecule test work
+on:
+  push:
+    tags:
+      - 'linode-test'
+
+jobs:
+  Explore-terraform-molecule-Gitea-Action:
+    env:
+      ANSIBLE_ROLES_PATH: '/workspace/seasharp/ansible-role_podman-host'
+      TF_VAR_token: "${{ secrets.LINODE_API_TOKEN  }}"
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: 'podman-host'
+      - uses: opentofu/setup-opentofu@v1
+      - name: tofu apply
+        run: "tofu init && tofu apply -auto-approve"
+        working-directory: "${{ gitea.workspace }}/podman-host/.gitea/tofu"
+      - name: Set up Python
+        uses: actions/setup-python@v2
+      - name: molecule test
+        continue-on-error: true
+        run: |
+          export TARGET_IP_ADDRESS=$(tofu output -raw act_worker_ip_address)
+          export ACT_RUNNER_DEPLOY_KEY="${{ secrets.ACT_RUNNER_DEPLOY_KEY }}"
+          cd ${{ gitea.workspace}}/podman-host/extensions
+          molecule test -s linode
+        working-directory: "${{ gitea.workspace }}/podman-host/.gitea/tofu"
+      - name: tofu destroy
+        run: "sleep 180 && tofu destroy -auto-approve"
+        working-directory: "${{ gitea.workspace }}/podman-host/.gitea/tofu"
+

extensions/molecule/default/create.yml

@@ -91,9 +91,9 @@
   gather_facts: false
 
   tasks:
-    - name: Packages openssh-server, python3-policycoreutils
+    - name: Package procps-ng
       ansible.builtin.dnf:
-        name: ['openssh-server', 'python3-policycoreutils']
+        name: procps-ng
         state: present
 
     - name: systemd PID

extensions/molecule/default/molecule.yml

@@ -9,7 +9,7 @@ driver:
       ansible_connection: docker
 platforms:
   - name: instance
-    image: geerlingguy/docker-rockylinux9-ansible:latest
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest
     command: "/sbin/init"
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro

extensions/molecule/linode/converge.yml

@@ -0,0 +1,26 @@
+---
+- name: Fail if linode group is missing
+  hosts: localhost
+  tasks:
+    - name: Print some info
+      ansible.builtin.debug:
+        msg: "{{ groups }}"
+
+    - name: Assert group existence
+      ansible.builtin.assert:
+        that: "'linode' in groups"
+        fail_msg: |
+          linode group was not found inside inventory groups: {{ groups }}
+
+- name: Converge
+  hosts: linode
+  # We disable gather facts because it would fail due to our container not
+  # having python installed. This will not prevent use from running 'raw'
+  # commands. Most molecule users are expected to use containers that already
+  # have python installed in order to avoid notable delays installing it.
+  tasks:
+    - name: Apply podman-host Role
+      include_role:
+        name: podman-host
+#      ansible.builtin.assert:
+#        that: result.stdout | regex_search("^Linux")

extensions/molecule/linode/create.yml

@@ -0,0 +1,113 @@
+---
+- name: Create
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  # no_log: "{{ molecule_no_log }}"
+  vars:
+    molecule_inventory:
+      all:
+        hosts: {}
+        linode: {}
+
+  tasks:
+    - name: ssh key setup
+      copy:
+        content: |
+          {{ lookup('env', 'ACT_RUNNER_DEPLOY_KEY') }}
+        dest: "~/.ssh/id_ed25519"
+
+    - name: ssh config setup
+      copy:
+        content: |
+          Host act_worker
+            Hostname {{ lookup('env', 'TARGET_IP_ADDRESS') }}
+            StrictHostKeyChecking accept-new
+            User root
+            IdentityFile ~/.ssh/id_ed25519
+        dest: "~/.ssh/config"
+
+    - name: Confirm we can reach
+      command:
+        cmd: |
+          ssh -vv -T act_worker
+      retries: 12
+      delay: 10
+      register: isping
+      until: isping.rc == 0
+
+    - debug:
+        msg: |
+          {{ isping }}
+
+    - name: Fail if instance is not running
+      when: isping.failed
+      fail:
+
+    - name: Add linode to molecule_inventory
+      vars:
+        inventory_partial_yaml: |
+          all:
+            children:
+              linode:
+                hosts:
+                  act_worker:
+                    ansible_connection: ssh
+                    service_users:
+                      - name: serviceuser1
+                        services:
+                          - service1
+                          - service2
+      ansible.builtin.set_fact:
+        molecule_inventory: >
+          {{ molecule_inventory | combine(inventory_partial_yaml | from_yaml, recursive=true) }}
+
+    - name: Dump molecule_inventory
+      ansible.builtin.copy:
+        content: |
+          {{ molecule_inventory | to_yaml }}
+        dest: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
+        mode: "0600"
+
+    - name: Force inventory refresh
+      ansible.builtin.meta: refresh_inventory
+
+    - name: Fail if linode group is missing
+      ansible.builtin.assert:
+        that: "'linode' in groups"
+        fail_msg: |
+          linode group was not found inside inventory groups: {{ groups }}
+      run_once: true # noqa: run-once[task]
+
+# we want to avoid errors like "Failed to create temporary directory"
+- name: Validate that inventory was refreshed
+  hosts: linode
+  gather_facts: false
+  tasks:
+    - name: Check uname
+      ansible.builtin.raw: uname -a
+      register: result
+      changed_when: false
+
+    - name: Display uname info
+      ansible.builtin.debug:
+        msg: "{{ result.stdout }}"
+
+- name: Verify linode properties
+  hosts: linode
+  gather_facts: false
+
+  tasks:
+    - name: Package procps-ng
+      ansible.builtin.dnf:
+        name: procps-ng
+        state: present
+
+    - name: systemd PID
+      command: ps -q 1
+      register: ps_result
+      changed_when: false
+
+    - name: Display PID 1 info
+      ansible.builtin.debug:
+        msg: "{{ ps_result.stdout }}"

extensions/molecule/linode/destroy.yml

@@ -0,0 +1,15 @@
+---
+- name: Destroy
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  # no_log: "{{ molecule_no_log }}"
+  tasks:
+- name: Remove dynamic molecule inventory
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Remove dynamic inventory file
+      ansible.builtin.file:
+        path: "{{ molecule_ephemeral_directory }}/inventory/molecule_inventory.yml"
+        state: absent    # Developer must implement.

extensions/molecule/linode/molecule.yml

@@ -0,0 +1,8 @@
+---
+driver:
+  name: default
+platforms:
+  - name: instance
+    # you might want to add your own variables here based on what provisioning
+    # you are doing like:
+    # image: quay.io/centos/centos:stream8

extensions/molecule/linode/requirements.yml

@@ -0,0 +1,2 @@
+collections:
+  - community.general

tasks/main.yml

@@ -1,8 +1,17 @@
 - import_tasks: include-vars.yml
 
 - name: Install podman, podman networking plugins, and python support packages
+  vars:
+    dnf_packages:
+      - 'openssh-server'
+      - 'podman'
+      - 'podman-plugins'
+      - 'systemd-container'
+      - 'containernetworking-plugins'
+      - 'python3-pip'
+      - 'python3-policycoreutils'
   dnf:
-    name: ['podman', 'containernetworking-plugins', 'podman-plugins', 'python3-pip', 'systemd-container']
+    name: "{{ dnf_packages }}"
     state: present
 
 - name: Install podman-compose pip Package
@@ -21,6 +30,7 @@
    - "{{ service_users }}"
 
 - name: Create service folders
+  become: yes
   become_user: "{{ item.0.name }}"
   file:
     path: "/home/{{ item.0.name }}/{{ item.1 }}"
@@ -101,8 +111,7 @@
     owner: root
     group: root
     mode: 0644
-  tags:
-    - 'molecule-notest'
+  when: '"molecule" not in group_names'
 
 - lineinfile:
     path: /etc/hosts
@@ -111,8 +120,7 @@
     owner: root
     group: root
     mode: 0644
-  tags:
-    - 'molecule-notest'
+  when: '"molecule" not in group_names'
 # - name: Copy cni networking driver config into place
 #   blockinfile:
 #     name: "/etc/cni/net.d/podman.conflist"