docker_cli_swarm_test.go 80 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139
  1. // +build !windows
  2. package main
  3. import (
  4. "bytes"
  5. "crypto/x509"
  6. "encoding/json"
  7. "encoding/pem"
  8. "fmt"
  9. "io/ioutil"
  10. "net/http"
  11. "net/http/httptest"
  12. "os"
  13. "path/filepath"
  14. "strings"
  15. "time"
  16. "github.com/cloudflare/cfssl/helpers"
  17. "github.com/docker/docker/api/types"
  18. "github.com/docker/docker/api/types/swarm"
  19. "github.com/docker/docker/integration-cli/checker"
  20. "github.com/docker/docker/integration-cli/cli"
  21. "github.com/docker/docker/integration-cli/daemon"
  22. "github.com/docker/libnetwork/driverapi"
  23. "github.com/docker/libnetwork/ipamapi"
  24. remoteipam "github.com/docker/libnetwork/ipams/remote/api"
  25. "github.com/go-check/check"
  26. "github.com/gotestyourself/gotestyourself/fs"
  27. "github.com/gotestyourself/gotestyourself/icmd"
  28. "github.com/vishvananda/netlink"
  29. "golang.org/x/net/context"
  30. )
  31. func (s *DockerSwarmSuite) TestSwarmUpdate(c *check.C) {
  32. d := s.AddDaemon(c, true, true)
  33. getSpec := func() swarm.Spec {
  34. sw := d.GetSwarm(c)
  35. return sw.Spec
  36. }
  37. out, err := d.Cmd("swarm", "update", "--cert-expiry", "30h", "--dispatcher-heartbeat", "11s")
  38. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  39. spec := getSpec()
  40. c.Assert(spec.CAConfig.NodeCertExpiry, checker.Equals, 30*time.Hour)
  41. c.Assert(spec.Dispatcher.HeartbeatPeriod, checker.Equals, 11*time.Second)
  42. // setting anything under 30m for cert-expiry is not allowed
  43. out, err = d.Cmd("swarm", "update", "--cert-expiry", "15m")
  44. c.Assert(err, checker.NotNil)
  45. c.Assert(out, checker.Contains, "minimum certificate expiry time")
  46. spec = getSpec()
  47. c.Assert(spec.CAConfig.NodeCertExpiry, checker.Equals, 30*time.Hour)
  48. // passing an external CA (this is without starting a root rotation) does not fail
  49. cli.Docker(cli.Args("swarm", "update", "--external-ca", "protocol=cfssl,url=https://something.org",
  50. "--external-ca", "protocol=cfssl,url=https://somethingelse.org,cacert=fixtures/https/ca.pem"),
  51. cli.Daemon(d.Daemon)).Assert(c, icmd.Success)
  52. expected, err := ioutil.ReadFile("fixtures/https/ca.pem")
  53. c.Assert(err, checker.IsNil)
  54. spec = getSpec()
  55. c.Assert(spec.CAConfig.ExternalCAs, checker.HasLen, 2)
  56. c.Assert(spec.CAConfig.ExternalCAs[0].CACert, checker.Equals, "")
  57. c.Assert(spec.CAConfig.ExternalCAs[1].CACert, checker.Equals, string(expected))
  58. // passing an invalid external CA fails
  59. tempFile := fs.NewFile(c, "testfile", fs.WithContent("fakecert"))
  60. defer tempFile.Remove()
  61. result := cli.Docker(cli.Args("swarm", "update",
  62. "--external-ca", fmt.Sprintf("protocol=cfssl,url=https://something.org,cacert=%s", tempFile.Path())),
  63. cli.Daemon(d.Daemon))
  64. result.Assert(c, icmd.Expected{
  65. ExitCode: 125,
  66. Err: "must be in PEM format",
  67. })
  68. }
  69. func (s *DockerSwarmSuite) TestSwarmInit(c *check.C) {
  70. d := s.AddDaemon(c, false, false)
  71. getSpec := func() swarm.Spec {
  72. sw := d.GetSwarm(c)
  73. return sw.Spec
  74. }
  75. // passing an invalid external CA fails
  76. tempFile := fs.NewFile(c, "testfile", fs.WithContent("fakecert"))
  77. defer tempFile.Remove()
  78. result := cli.Docker(cli.Args("swarm", "init", "--cert-expiry", "30h", "--dispatcher-heartbeat", "11s",
  79. "--external-ca", fmt.Sprintf("protocol=cfssl,url=https://somethingelse.org,cacert=%s", tempFile.Path())),
  80. cli.Daemon(d.Daemon))
  81. result.Assert(c, icmd.Expected{
  82. ExitCode: 125,
  83. Err: "must be in PEM format",
  84. })
  85. cli.Docker(cli.Args("swarm", "init", "--cert-expiry", "30h", "--dispatcher-heartbeat", "11s",
  86. "--external-ca", "protocol=cfssl,url=https://something.org",
  87. "--external-ca", "protocol=cfssl,url=https://somethingelse.org,cacert=fixtures/https/ca.pem"),
  88. cli.Daemon(d.Daemon)).Assert(c, icmd.Success)
  89. expected, err := ioutil.ReadFile("fixtures/https/ca.pem")
  90. c.Assert(err, checker.IsNil)
  91. spec := getSpec()
  92. c.Assert(spec.CAConfig.NodeCertExpiry, checker.Equals, 30*time.Hour)
  93. c.Assert(spec.Dispatcher.HeartbeatPeriod, checker.Equals, 11*time.Second)
  94. c.Assert(spec.CAConfig.ExternalCAs, checker.HasLen, 2)
  95. c.Assert(spec.CAConfig.ExternalCAs[0].CACert, checker.Equals, "")
  96. c.Assert(spec.CAConfig.ExternalCAs[1].CACert, checker.Equals, string(expected))
  97. c.Assert(d.Leave(true), checker.IsNil)
  98. cli.Docker(cli.Args("swarm", "init"), cli.Daemon(d.Daemon)).Assert(c, icmd.Success)
  99. spec = getSpec()
  100. c.Assert(spec.CAConfig.NodeCertExpiry, checker.Equals, 90*24*time.Hour)
  101. c.Assert(spec.Dispatcher.HeartbeatPeriod, checker.Equals, 5*time.Second)
  102. }
  103. func (s *DockerSwarmSuite) TestSwarmInitIPv6(c *check.C) {
  104. testRequires(c, IPv6)
  105. d1 := s.AddDaemon(c, false, false)
  106. cli.Docker(cli.Args("swarm", "init", "--listen-add", "::1"), cli.Daemon(d1.Daemon)).Assert(c, icmd.Success)
  107. d2 := s.AddDaemon(c, false, false)
  108. cli.Docker(cli.Args("swarm", "join", "::1"), cli.Daemon(d2.Daemon)).Assert(c, icmd.Success)
  109. out := cli.Docker(cli.Args("info"), cli.Daemon(d2.Daemon)).Assert(c, icmd.Success).Combined()
  110. c.Assert(out, checker.Contains, "Swarm: active")
  111. }
  112. func (s *DockerSwarmSuite) TestSwarmInitUnspecifiedAdvertiseAddr(c *check.C) {
  113. d := s.AddDaemon(c, false, false)
  114. out, err := d.Cmd("swarm", "init", "--advertise-addr", "0.0.0.0")
  115. c.Assert(err, checker.NotNil)
  116. c.Assert(out, checker.Contains, "advertise address must be a non-zero IP address")
  117. }
  118. func (s *DockerSwarmSuite) TestSwarmIncompatibleDaemon(c *check.C) {
  119. // init swarm mode and stop a daemon
  120. d := s.AddDaemon(c, true, true)
  121. info, err := d.SwarmInfo()
  122. c.Assert(err, checker.IsNil)
  123. c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateActive)
  124. d.Stop(c)
  125. // start a daemon with --cluster-store and --cluster-advertise
  126. err = d.StartWithError("--cluster-store=consul://consuladdr:consulport/some/path", "--cluster-advertise=1.1.1.1:2375")
  127. c.Assert(err, checker.NotNil)
  128. content, err := d.ReadLogFile()
  129. c.Assert(err, checker.IsNil)
  130. c.Assert(string(content), checker.Contains, "--cluster-store and --cluster-advertise daemon configurations are incompatible with swarm mode")
  131. // start a daemon with --live-restore
  132. err = d.StartWithError("--live-restore")
  133. c.Assert(err, checker.NotNil)
  134. content, err = d.ReadLogFile()
  135. c.Assert(err, checker.IsNil)
  136. c.Assert(string(content), checker.Contains, "--live-restore daemon configuration is incompatible with swarm mode")
  137. // restart for teardown
  138. d.Start(c)
  139. }
  140. func (s *DockerSwarmSuite) TestSwarmServiceTemplatingHostname(c *check.C) {
  141. d := s.AddDaemon(c, true, true)
  142. hostname, err := d.Cmd("node", "inspect", "--format", "{{.Description.Hostname}}", "self")
  143. c.Assert(err, checker.IsNil, check.Commentf(hostname))
  144. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "test", "--hostname", "{{.Service.Name}}-{{.Task.Slot}}-{{.Node.Hostname}}", "busybox", "top")
  145. c.Assert(err, checker.IsNil, check.Commentf(out))
  146. // make sure task has been deployed.
  147. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  148. containers := d.ActiveContainers()
  149. out, err = d.Cmd("inspect", "--type", "container", "--format", "{{.Config.Hostname}}", containers[0])
  150. c.Assert(err, checker.IsNil, check.Commentf(out))
  151. c.Assert(strings.Split(out, "\n")[0], checker.Equals, "test-1-"+strings.Split(hostname, "\n")[0], check.Commentf("hostname with templating invalid"))
  152. }
  153. // Test case for #24270
  154. func (s *DockerSwarmSuite) TestSwarmServiceListFilter(c *check.C) {
  155. d := s.AddDaemon(c, true, true)
  156. name1 := "redis-cluster-md5"
  157. name2 := "redis-cluster"
  158. name3 := "other-cluster"
  159. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name1, "busybox", "top")
  160. c.Assert(err, checker.IsNil)
  161. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  162. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name2, "busybox", "top")
  163. c.Assert(err, checker.IsNil)
  164. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  165. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name3, "busybox", "top")
  166. c.Assert(err, checker.IsNil)
  167. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  168. filter1 := "name=redis-cluster-md5"
  169. filter2 := "name=redis-cluster"
  170. // We search checker.Contains with `name+" "` to prevent prefix only.
  171. out, err = d.Cmd("service", "ls", "--filter", filter1)
  172. c.Assert(err, checker.IsNil)
  173. c.Assert(out, checker.Contains, name1+" ")
  174. c.Assert(out, checker.Not(checker.Contains), name2+" ")
  175. c.Assert(out, checker.Not(checker.Contains), name3+" ")
  176. out, err = d.Cmd("service", "ls", "--filter", filter2)
  177. c.Assert(err, checker.IsNil)
  178. c.Assert(out, checker.Contains, name1+" ")
  179. c.Assert(out, checker.Contains, name2+" ")
  180. c.Assert(out, checker.Not(checker.Contains), name3+" ")
  181. out, err = d.Cmd("service", "ls")
  182. c.Assert(err, checker.IsNil)
  183. c.Assert(out, checker.Contains, name1+" ")
  184. c.Assert(out, checker.Contains, name2+" ")
  185. c.Assert(out, checker.Contains, name3+" ")
  186. }
  187. func (s *DockerSwarmSuite) TestSwarmNodeListFilter(c *check.C) {
  188. d := s.AddDaemon(c, true, true)
  189. out, err := d.Cmd("node", "inspect", "--format", "{{ .Description.Hostname }}", "self")
  190. c.Assert(err, checker.IsNil)
  191. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  192. name := strings.TrimSpace(out)
  193. filter := "name=" + name[:4]
  194. out, err = d.Cmd("node", "ls", "--filter", filter)
  195. c.Assert(err, checker.IsNil)
  196. c.Assert(out, checker.Contains, name)
  197. out, err = d.Cmd("node", "ls", "--filter", "name=none")
  198. c.Assert(err, checker.IsNil)
  199. c.Assert(out, checker.Not(checker.Contains), name)
  200. }
  201. func (s *DockerSwarmSuite) TestSwarmNodeTaskListFilter(c *check.C) {
  202. d := s.AddDaemon(c, true, true)
  203. name := "redis-cluster-md5"
  204. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--replicas=3", "busybox", "top")
  205. c.Assert(err, checker.IsNil)
  206. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  207. // make sure task has been deployed.
  208. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 3)
  209. filter := "name=redis-cluster"
  210. out, err = d.Cmd("node", "ps", "--filter", filter, "self")
  211. c.Assert(err, checker.IsNil)
  212. c.Assert(out, checker.Contains, name+".1")
  213. c.Assert(out, checker.Contains, name+".2")
  214. c.Assert(out, checker.Contains, name+".3")
  215. out, err = d.Cmd("node", "ps", "--filter", "name=none", "self")
  216. c.Assert(err, checker.IsNil)
  217. c.Assert(out, checker.Not(checker.Contains), name+".1")
  218. c.Assert(out, checker.Not(checker.Contains), name+".2")
  219. c.Assert(out, checker.Not(checker.Contains), name+".3")
  220. }
  221. // Test case for #25375
  222. func (s *DockerSwarmSuite) TestSwarmPublishAdd(c *check.C) {
  223. d := s.AddDaemon(c, true, true)
  224. name := "top"
  225. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--label", "x=y", "busybox", "top")
  226. c.Assert(err, checker.IsNil)
  227. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  228. out, err = d.Cmd("service", "update", "--detach", "--publish-add", "80:80", name)
  229. c.Assert(err, checker.IsNil)
  230. out, err = d.CmdRetryOutOfSequence("service", "update", "--detach", "--publish-add", "80:80", name)
  231. c.Assert(err, checker.IsNil)
  232. out, err = d.CmdRetryOutOfSequence("service", "update", "--detach", "--publish-add", "80:80", "--publish-add", "80:20", name)
  233. c.Assert(err, checker.NotNil)
  234. out, err = d.Cmd("service", "inspect", "--format", "{{ .Spec.EndpointSpec.Ports }}", name)
  235. c.Assert(err, checker.IsNil)
  236. c.Assert(strings.TrimSpace(out), checker.Equals, "[{ tcp 80 80 ingress}]")
  237. }
  238. func (s *DockerSwarmSuite) TestSwarmServiceWithGroup(c *check.C) {
  239. d := s.AddDaemon(c, true, true)
  240. name := "top"
  241. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--user", "root:root", "--group", "wheel", "--group", "audio", "--group", "staff", "--group", "777", "busybox", "top")
  242. c.Assert(err, checker.IsNil)
  243. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  244. // make sure task has been deployed.
  245. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  246. out, err = d.Cmd("ps", "-q")
  247. c.Assert(err, checker.IsNil)
  248. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  249. container := strings.TrimSpace(out)
  250. out, err = d.Cmd("exec", container, "id")
  251. c.Assert(err, checker.IsNil)
  252. c.Assert(strings.TrimSpace(out), checker.Equals, "uid=0(root) gid=0(root) groups=10(wheel),29(audio),50(staff),777")
  253. }
  254. func (s *DockerSwarmSuite) TestSwarmContainerAutoStart(c *check.C) {
  255. d := s.AddDaemon(c, true, true)
  256. out, err := d.Cmd("network", "create", "--attachable", "-d", "overlay", "foo")
  257. c.Assert(err, checker.IsNil)
  258. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  259. out, err = d.Cmd("run", "-id", "--restart=always", "--net=foo", "--name=test", "busybox", "top")
  260. c.Assert(err, checker.IsNil, check.Commentf(out))
  261. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  262. out, err = d.Cmd("ps", "-q")
  263. c.Assert(err, checker.IsNil, check.Commentf(out))
  264. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  265. d.Restart(c)
  266. out, err = d.Cmd("ps", "-q")
  267. c.Assert(err, checker.IsNil, check.Commentf(out))
  268. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  269. }
  270. func (s *DockerSwarmSuite) TestSwarmContainerEndpointOptions(c *check.C) {
  271. d := s.AddDaemon(c, true, true)
  272. out, err := d.Cmd("network", "create", "--attachable", "-d", "overlay", "foo")
  273. c.Assert(err, checker.IsNil, check.Commentf(out))
  274. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  275. _, err = d.Cmd("run", "-d", "--net=foo", "--name=first", "--net-alias=first-alias", "busybox", "top")
  276. c.Assert(err, checker.IsNil, check.Commentf(out))
  277. _, err = d.Cmd("run", "-d", "--net=foo", "--name=second", "busybox", "top")
  278. c.Assert(err, checker.IsNil, check.Commentf(out))
  279. _, err = d.Cmd("run", "-d", "--net=foo", "--net-alias=third-alias", "busybox", "top")
  280. c.Assert(err, checker.IsNil, check.Commentf(out))
  281. // ping first container and its alias, also ping third and anonymous container by its alias
  282. _, err = d.Cmd("exec", "second", "ping", "-c", "1", "first")
  283. c.Assert(err, check.IsNil, check.Commentf(out))
  284. _, err = d.Cmd("exec", "second", "ping", "-c", "1", "first-alias")
  285. c.Assert(err, check.IsNil, check.Commentf(out))
  286. _, err = d.Cmd("exec", "second", "ping", "-c", "1", "third-alias")
  287. c.Assert(err, check.IsNil, check.Commentf(out))
  288. }
  289. func (s *DockerSwarmSuite) TestSwarmContainerAttachByNetworkId(c *check.C) {
  290. d := s.AddDaemon(c, true, true)
  291. out, err := d.Cmd("network", "create", "--attachable", "-d", "overlay", "testnet")
  292. c.Assert(err, checker.IsNil)
  293. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  294. networkID := strings.TrimSpace(out)
  295. out, err = d.Cmd("run", "-d", "--net", networkID, "busybox", "top")
  296. c.Assert(err, checker.IsNil)
  297. cID := strings.TrimSpace(out)
  298. d.WaitRun(cID)
  299. _, err = d.Cmd("rm", "-f", cID)
  300. c.Assert(err, checker.IsNil)
  301. _, err = d.Cmd("network", "rm", "testnet")
  302. c.Assert(err, checker.IsNil)
  303. checkNetwork := func(*check.C) (interface{}, check.CommentInterface) {
  304. out, err := d.Cmd("network", "ls")
  305. c.Assert(err, checker.IsNil)
  306. return out, nil
  307. }
  308. waitAndAssert(c, 3*time.Second, checkNetwork, checker.Not(checker.Contains), "testnet")
  309. }
  310. func (s *DockerSwarmSuite) TestOverlayAttachable(c *check.C) {
  311. d := s.AddDaemon(c, true, true)
  312. out, err := d.Cmd("network", "create", "-d", "overlay", "--attachable", "ovnet")
  313. c.Assert(err, checker.IsNil, check.Commentf(out))
  314. // validate attachable
  315. out, err = d.Cmd("network", "inspect", "--format", "{{json .Attachable}}", "ovnet")
  316. c.Assert(err, checker.IsNil, check.Commentf(out))
  317. c.Assert(strings.TrimSpace(out), checker.Equals, "true")
  318. // validate containers can attache to this overlay network
  319. out, err = d.Cmd("run", "-d", "--network", "ovnet", "--name", "c1", "busybox", "top")
  320. c.Assert(err, checker.IsNil, check.Commentf(out))
  321. // redo validation, there was a bug that the value of attachable changes after
  322. // containers attach to the network
  323. out, err = d.Cmd("network", "inspect", "--format", "{{json .Attachable}}", "ovnet")
  324. c.Assert(err, checker.IsNil, check.Commentf(out))
  325. c.Assert(strings.TrimSpace(out), checker.Equals, "true")
  326. }
  327. func (s *DockerSwarmSuite) TestOverlayAttachableOnSwarmLeave(c *check.C) {
  328. d := s.AddDaemon(c, true, true)
  329. // Create an attachable swarm network
  330. nwName := "attovl"
  331. out, err := d.Cmd("network", "create", "-d", "overlay", "--attachable", nwName)
  332. c.Assert(err, checker.IsNil, check.Commentf(out))
  333. // Connect a container to the network
  334. out, err = d.Cmd("run", "-d", "--network", nwName, "--name", "c1", "busybox", "top")
  335. c.Assert(err, checker.IsNil, check.Commentf(out))
  336. // Leave the swarm
  337. err = d.Leave(true)
  338. c.Assert(err, checker.IsNil)
  339. // Check the container is disconnected
  340. out, err = d.Cmd("inspect", "c1", "--format", "{{.NetworkSettings.Networks."+nwName+"}}")
  341. c.Assert(err, checker.IsNil)
  342. c.Assert(strings.TrimSpace(out), checker.Equals, "<no value>")
  343. // Check the network is gone
  344. out, err = d.Cmd("network", "ls", "--format", "{{.Name}}")
  345. c.Assert(err, checker.IsNil)
  346. c.Assert(out, checker.Not(checker.Contains), nwName)
  347. }
  348. func (s *DockerSwarmSuite) TestOverlayAttachableReleaseResourcesOnFailure(c *check.C) {
  349. d := s.AddDaemon(c, true, true)
  350. // Create attachable network
  351. out, err := d.Cmd("network", "create", "-d", "overlay", "--attachable", "--subnet", "10.10.9.0/24", "ovnet")
  352. c.Assert(err, checker.IsNil, check.Commentf(out))
  353. // Attach a container with specific IP
  354. out, err = d.Cmd("run", "-d", "--network", "ovnet", "--name", "c1", "--ip", "10.10.9.33", "busybox", "top")
  355. c.Assert(err, checker.IsNil, check.Commentf(out))
  356. // Attempt to attach another container with same IP, must fail
  357. _, err = d.Cmd("run", "-d", "--network", "ovnet", "--name", "c2", "--ip", "10.10.9.33", "busybox", "top")
  358. c.Assert(err, checker.NotNil)
  359. // Remove first container
  360. out, err = d.Cmd("rm", "-f", "c1")
  361. c.Assert(err, checker.IsNil, check.Commentf(out))
  362. // Verify the network can be removed, no phantom network attachment task left over
  363. out, err = d.Cmd("network", "rm", "ovnet")
  364. c.Assert(err, checker.IsNil, check.Commentf(out))
  365. }
  366. func (s *DockerSwarmSuite) TestSwarmIngressNetwork(c *check.C) {
  367. d := s.AddDaemon(c, true, true)
  368. // Ingress network can be removed
  369. removeNetwork := func(name string) *icmd.Result {
  370. return cli.Docker(
  371. cli.Args("-H", d.Sock(), "network", "rm", name),
  372. cli.WithStdin(strings.NewReader("Y")))
  373. }
  374. result := removeNetwork("ingress")
  375. result.Assert(c, icmd.Success)
  376. // And recreated
  377. out, err := d.Cmd("network", "create", "-d", "overlay", "--ingress", "new-ingress")
  378. c.Assert(err, checker.IsNil, check.Commentf(out))
  379. // But only one is allowed
  380. out, err = d.Cmd("network", "create", "-d", "overlay", "--ingress", "another-ingress")
  381. c.Assert(err, checker.NotNil)
  382. c.Assert(strings.TrimSpace(out), checker.Contains, "is already present")
  383. // It cannot be removed if it is being used
  384. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "srv1", "-p", "9000:8000", "busybox", "top")
  385. c.Assert(err, checker.IsNil, check.Commentf(out))
  386. result = removeNetwork("new-ingress")
  387. result.Assert(c, icmd.Expected{
  388. ExitCode: 1,
  389. Err: "ingress network cannot be removed because service",
  390. })
  391. // But it can be removed once no more services depend on it
  392. out, err = d.Cmd("service", "update", "--detach", "--publish-rm", "9000:8000", "srv1")
  393. c.Assert(err, checker.IsNil, check.Commentf(out))
  394. result = removeNetwork("new-ingress")
  395. result.Assert(c, icmd.Success)
  396. // A service which needs the ingress network cannot be created if no ingress is present
  397. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "srv2", "-p", "500:500", "busybox", "top")
  398. c.Assert(err, checker.NotNil)
  399. c.Assert(strings.TrimSpace(out), checker.Contains, "no ingress network is present")
  400. // An existing service cannot be updated to use the ingress nw if the nw is not present
  401. out, err = d.Cmd("service", "update", "--detach", "--publish-add", "9000:8000", "srv1")
  402. c.Assert(err, checker.NotNil)
  403. c.Assert(strings.TrimSpace(out), checker.Contains, "no ingress network is present")
  404. // But services which do not need routing mesh can be created regardless
  405. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "srv3", "--endpoint-mode", "dnsrr", "busybox", "top")
  406. c.Assert(err, checker.IsNil, check.Commentf(out))
  407. }
  408. func (s *DockerSwarmSuite) TestSwarmCreateServiceWithNoIngressNetwork(c *check.C) {
  409. d := s.AddDaemon(c, true, true)
  410. // Remove ingress network
  411. result := cli.Docker(
  412. cli.Args("-H", d.Sock(), "network", "rm", "ingress"),
  413. cli.WithStdin(strings.NewReader("Y")))
  414. result.Assert(c, icmd.Success)
  415. // Create a overlay network and launch a service on it
  416. // Make sure nothing panics because ingress network is missing
  417. out, err := d.Cmd("network", "create", "-d", "overlay", "another-network")
  418. c.Assert(err, checker.IsNil, check.Commentf(out))
  419. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "srv4", "--network", "another-network", "busybox", "top")
  420. c.Assert(err, checker.IsNil, check.Commentf(out))
  421. }
  422. // Test case for #24108, also the case from:
  423. // https://github.com/docker/docker/pull/24620#issuecomment-233715656
  424. func (s *DockerSwarmSuite) TestSwarmTaskListFilter(c *check.C) {
  425. d := s.AddDaemon(c, true, true)
  426. name := "redis-cluster-md5"
  427. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--replicas=3", "busybox", "top")
  428. c.Assert(err, checker.IsNil)
  429. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  430. filter := "name=redis-cluster"
  431. checkNumTasks := func(*check.C) (interface{}, check.CommentInterface) {
  432. out, err := d.Cmd("service", "ps", "--filter", filter, name)
  433. c.Assert(err, checker.IsNil)
  434. return len(strings.Split(out, "\n")) - 2, nil // includes header and nl in last line
  435. }
  436. // wait until all tasks have been created
  437. waitAndAssert(c, defaultReconciliationTimeout, checkNumTasks, checker.Equals, 3)
  438. out, err = d.Cmd("service", "ps", "--filter", filter, name)
  439. c.Assert(err, checker.IsNil)
  440. c.Assert(out, checker.Contains, name+".1")
  441. c.Assert(out, checker.Contains, name+".2")
  442. c.Assert(out, checker.Contains, name+".3")
  443. out, err = d.Cmd("service", "ps", "--filter", "name="+name+".1", name)
  444. c.Assert(err, checker.IsNil)
  445. c.Assert(out, checker.Contains, name+".1")
  446. c.Assert(out, checker.Not(checker.Contains), name+".2")
  447. c.Assert(out, checker.Not(checker.Contains), name+".3")
  448. out, err = d.Cmd("service", "ps", "--filter", "name=none", name)
  449. c.Assert(err, checker.IsNil)
  450. c.Assert(out, checker.Not(checker.Contains), name+".1")
  451. c.Assert(out, checker.Not(checker.Contains), name+".2")
  452. c.Assert(out, checker.Not(checker.Contains), name+".3")
  453. name = "redis-cluster-sha1"
  454. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--mode=global", "busybox", "top")
  455. c.Assert(err, checker.IsNil)
  456. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  457. waitAndAssert(c, defaultReconciliationTimeout, checkNumTasks, checker.Equals, 1)
  458. filter = "name=redis-cluster"
  459. out, err = d.Cmd("service", "ps", "--filter", filter, name)
  460. c.Assert(err, checker.IsNil)
  461. c.Assert(out, checker.Contains, name)
  462. out, err = d.Cmd("service", "ps", "--filter", "name="+name, name)
  463. c.Assert(err, checker.IsNil)
  464. c.Assert(out, checker.Contains, name)
  465. out, err = d.Cmd("service", "ps", "--filter", "name=none", name)
  466. c.Assert(err, checker.IsNil)
  467. c.Assert(out, checker.Not(checker.Contains), name)
  468. }
  469. func (s *DockerSwarmSuite) TestPsListContainersFilterIsTask(c *check.C) {
  470. d := s.AddDaemon(c, true, true)
  471. // Create a bare container
  472. out, err := d.Cmd("run", "-d", "--name=bare-container", "busybox", "top")
  473. c.Assert(err, checker.IsNil)
  474. bareID := strings.TrimSpace(out)[:12]
  475. // Create a service
  476. name := "busybox-top"
  477. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "busybox", "top")
  478. c.Assert(err, checker.IsNil)
  479. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  480. // make sure task has been deployed.
  481. waitAndAssert(c, defaultReconciliationTimeout, d.CheckServiceRunningTasks(name), checker.Equals, 1)
  482. // Filter non-tasks
  483. out, err = d.Cmd("ps", "-a", "-q", "--filter=is-task=false")
  484. c.Assert(err, checker.IsNil)
  485. psOut := strings.TrimSpace(out)
  486. c.Assert(psOut, checker.Equals, bareID, check.Commentf("Expected id %s, got %s for is-task label, output %q", bareID, psOut, out))
  487. // Filter tasks
  488. out, err = d.Cmd("ps", "-a", "-q", "--filter=is-task=true")
  489. c.Assert(err, checker.IsNil)
  490. lines := strings.Split(strings.Trim(out, "\n "), "\n")
  491. c.Assert(lines, checker.HasLen, 1)
  492. c.Assert(lines[0], checker.Not(checker.Equals), bareID, check.Commentf("Expected not %s, but got it for is-task label, output %q", bareID, out))
  493. }
  494. const globalNetworkPlugin = "global-network-plugin"
  495. const globalIPAMPlugin = "global-ipam-plugin"
  496. func setupRemoteGlobalNetworkPlugin(c *check.C, mux *http.ServeMux, url, netDrv, ipamDrv string) {
  497. mux.HandleFunc("/Plugin.Activate", func(w http.ResponseWriter, r *http.Request) {
  498. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  499. fmt.Fprintf(w, `{"Implements": ["%s", "%s"]}`, driverapi.NetworkPluginEndpointType, ipamapi.PluginEndpointType)
  500. })
  501. // Network driver implementation
  502. mux.HandleFunc(fmt.Sprintf("/%s.GetCapabilities", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  503. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  504. fmt.Fprintf(w, `{"Scope":"global"}`)
  505. })
  506. mux.HandleFunc(fmt.Sprintf("/%s.AllocateNetwork", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  507. err := json.NewDecoder(r.Body).Decode(&remoteDriverNetworkRequest)
  508. if err != nil {
  509. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  510. return
  511. }
  512. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  513. fmt.Fprintf(w, "null")
  514. })
  515. mux.HandleFunc(fmt.Sprintf("/%s.FreeNetwork", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  516. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  517. fmt.Fprintf(w, "null")
  518. })
  519. mux.HandleFunc(fmt.Sprintf("/%s.CreateNetwork", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  520. err := json.NewDecoder(r.Body).Decode(&remoteDriverNetworkRequest)
  521. if err != nil {
  522. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  523. return
  524. }
  525. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  526. fmt.Fprintf(w, "null")
  527. })
  528. mux.HandleFunc(fmt.Sprintf("/%s.DeleteNetwork", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  529. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  530. fmt.Fprintf(w, "null")
  531. })
  532. mux.HandleFunc(fmt.Sprintf("/%s.CreateEndpoint", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  533. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  534. fmt.Fprintf(w, `{"Interface":{"MacAddress":"a0:b1:c2:d3:e4:f5"}}`)
  535. })
  536. mux.HandleFunc(fmt.Sprintf("/%s.Join", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  537. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  538. veth := &netlink.Veth{
  539. LinkAttrs: netlink.LinkAttrs{Name: "randomIfName", TxQLen: 0}, PeerName: "cnt0"}
  540. if err := netlink.LinkAdd(veth); err != nil {
  541. fmt.Fprintf(w, `{"Error":"failed to add veth pair: `+err.Error()+`"}`)
  542. } else {
  543. fmt.Fprintf(w, `{"InterfaceName":{ "SrcName":"cnt0", "DstPrefix":"veth"}}`)
  544. }
  545. })
  546. mux.HandleFunc(fmt.Sprintf("/%s.Leave", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  547. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  548. fmt.Fprintf(w, "null")
  549. })
  550. mux.HandleFunc(fmt.Sprintf("/%s.DeleteEndpoint", driverapi.NetworkPluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  551. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  552. if link, err := netlink.LinkByName("cnt0"); err == nil {
  553. netlink.LinkDel(link)
  554. }
  555. fmt.Fprintf(w, "null")
  556. })
  557. // IPAM Driver implementation
  558. var (
  559. poolRequest remoteipam.RequestPoolRequest
  560. poolReleaseReq remoteipam.ReleasePoolRequest
  561. addressRequest remoteipam.RequestAddressRequest
  562. addressReleaseReq remoteipam.ReleaseAddressRequest
  563. lAS = "localAS"
  564. gAS = "globalAS"
  565. pool = "172.28.0.0/16"
  566. poolID = lAS + "/" + pool
  567. gw = "172.28.255.254/16"
  568. )
  569. mux.HandleFunc(fmt.Sprintf("/%s.GetDefaultAddressSpaces", ipamapi.PluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  570. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  571. fmt.Fprintf(w, `{"LocalDefaultAddressSpace":"`+lAS+`", "GlobalDefaultAddressSpace": "`+gAS+`"}`)
  572. })
  573. mux.HandleFunc(fmt.Sprintf("/%s.RequestPool", ipamapi.PluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  574. err := json.NewDecoder(r.Body).Decode(&poolRequest)
  575. if err != nil {
  576. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  577. return
  578. }
  579. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  580. if poolRequest.AddressSpace != lAS && poolRequest.AddressSpace != gAS {
  581. fmt.Fprintf(w, `{"Error":"Unknown address space in pool request: `+poolRequest.AddressSpace+`"}`)
  582. } else if poolRequest.Pool != "" && poolRequest.Pool != pool {
  583. fmt.Fprintf(w, `{"Error":"Cannot handle explicit pool requests yet"}`)
  584. } else {
  585. fmt.Fprintf(w, `{"PoolID":"`+poolID+`", "Pool":"`+pool+`"}`)
  586. }
  587. })
  588. mux.HandleFunc(fmt.Sprintf("/%s.RequestAddress", ipamapi.PluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  589. err := json.NewDecoder(r.Body).Decode(&addressRequest)
  590. if err != nil {
  591. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  592. return
  593. }
  594. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  595. // make sure libnetwork is now querying on the expected pool id
  596. if addressRequest.PoolID != poolID {
  597. fmt.Fprintf(w, `{"Error":"unknown pool id"}`)
  598. } else if addressRequest.Address != "" {
  599. fmt.Fprintf(w, `{"Error":"Cannot handle explicit address requests yet"}`)
  600. } else {
  601. fmt.Fprintf(w, `{"Address":"`+gw+`"}`)
  602. }
  603. })
  604. mux.HandleFunc(fmt.Sprintf("/%s.ReleaseAddress", ipamapi.PluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  605. err := json.NewDecoder(r.Body).Decode(&addressReleaseReq)
  606. if err != nil {
  607. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  608. return
  609. }
  610. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  611. // make sure libnetwork is now asking to release the expected address from the expected poolid
  612. if addressRequest.PoolID != poolID {
  613. fmt.Fprintf(w, `{"Error":"unknown pool id"}`)
  614. } else if addressReleaseReq.Address != gw {
  615. fmt.Fprintf(w, `{"Error":"unknown address"}`)
  616. } else {
  617. fmt.Fprintf(w, "null")
  618. }
  619. })
  620. mux.HandleFunc(fmt.Sprintf("/%s.ReleasePool", ipamapi.PluginEndpointType), func(w http.ResponseWriter, r *http.Request) {
  621. err := json.NewDecoder(r.Body).Decode(&poolReleaseReq)
  622. if err != nil {
  623. http.Error(w, "Unable to decode JSON payload: "+err.Error(), http.StatusBadRequest)
  624. return
  625. }
  626. w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
  627. // make sure libnetwork is now asking to release the expected poolid
  628. if addressRequest.PoolID != poolID {
  629. fmt.Fprintf(w, `{"Error":"unknown pool id"}`)
  630. } else {
  631. fmt.Fprintf(w, "null")
  632. }
  633. })
  634. err := os.MkdirAll("/etc/docker/plugins", 0755)
  635. c.Assert(err, checker.IsNil)
  636. fileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", netDrv)
  637. err = ioutil.WriteFile(fileName, []byte(url), 0644)
  638. c.Assert(err, checker.IsNil)
  639. ipamFileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", ipamDrv)
  640. err = ioutil.WriteFile(ipamFileName, []byte(url), 0644)
  641. c.Assert(err, checker.IsNil)
  642. }
  643. func (s *DockerSwarmSuite) TestSwarmNetworkPlugin(c *check.C) {
  644. mux := http.NewServeMux()
  645. s.server = httptest.NewServer(mux)
  646. c.Assert(s.server, check.NotNil, check.Commentf("Failed to start an HTTP Server"))
  647. setupRemoteGlobalNetworkPlugin(c, mux, s.server.URL, globalNetworkPlugin, globalIPAMPlugin)
  648. defer func() {
  649. s.server.Close()
  650. err := os.RemoveAll("/etc/docker/plugins")
  651. c.Assert(err, checker.IsNil)
  652. }()
  653. d := s.AddDaemon(c, true, true)
  654. out, err := d.Cmd("network", "create", "-d", globalNetworkPlugin, "foo")
  655. c.Assert(err, checker.NotNil)
  656. c.Assert(out, checker.Contains, "not supported in swarm mode")
  657. }
  658. // Test case for #24712
  659. func (s *DockerSwarmSuite) TestSwarmServiceEnvFile(c *check.C) {
  660. d := s.AddDaemon(c, true, true)
  661. path := filepath.Join(d.Folder, "env.txt")
  662. err := ioutil.WriteFile(path, []byte("VAR1=A\nVAR2=A\n"), 0644)
  663. c.Assert(err, checker.IsNil)
  664. name := "worker"
  665. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--env-file", path, "--env", "VAR1=B", "--env", "VAR1=C", "--env", "VAR2=", "--env", "VAR2", "--name", name, "busybox", "top")
  666. c.Assert(err, checker.IsNil)
  667. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  668. // The complete env is [VAR1=A VAR2=A VAR1=B VAR1=C VAR2= VAR2] and duplicates will be removed => [VAR1=C VAR2]
  669. out, err = d.Cmd("inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.Env }}", name)
  670. c.Assert(err, checker.IsNil)
  671. c.Assert(out, checker.Contains, "[VAR1=C VAR2]")
  672. }
  673. func (s *DockerSwarmSuite) TestSwarmServiceTTY(c *check.C) {
  674. d := s.AddDaemon(c, true, true)
  675. name := "top"
  676. ttyCheck := "if [ -t 0 ]; then echo TTY > /status && top; else echo none > /status && top; fi"
  677. // Without --tty
  678. expectedOutput := "none"
  679. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "busybox", "sh", "-c", ttyCheck)
  680. c.Assert(err, checker.IsNil)
  681. // Make sure task has been deployed.
  682. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  683. // We need to get the container id.
  684. out, err = d.Cmd("ps", "-q", "--no-trunc")
  685. c.Assert(err, checker.IsNil)
  686. id := strings.TrimSpace(out)
  687. out, err = d.Cmd("exec", id, "cat", "/status")
  688. c.Assert(err, checker.IsNil)
  689. c.Assert(out, checker.Contains, expectedOutput, check.Commentf("Expected '%s', but got %q", expectedOutput, out))
  690. // Remove service
  691. out, err = d.Cmd("service", "rm", name)
  692. c.Assert(err, checker.IsNil)
  693. // Make sure container has been destroyed.
  694. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 0)
  695. // With --tty
  696. expectedOutput = "TTY"
  697. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--tty", "busybox", "sh", "-c", ttyCheck)
  698. c.Assert(err, checker.IsNil)
  699. // Make sure task has been deployed.
  700. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  701. // We need to get the container id.
  702. out, err = d.Cmd("ps", "-q", "--no-trunc")
  703. c.Assert(err, checker.IsNil)
  704. id = strings.TrimSpace(out)
  705. out, err = d.Cmd("exec", id, "cat", "/status")
  706. c.Assert(err, checker.IsNil)
  707. c.Assert(out, checker.Contains, expectedOutput, check.Commentf("Expected '%s', but got %q", expectedOutput, out))
  708. }
  709. func (s *DockerSwarmSuite) TestSwarmServiceTTYUpdate(c *check.C) {
  710. d := s.AddDaemon(c, true, true)
  711. // Create a service
  712. name := "top"
  713. _, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "busybox", "top")
  714. c.Assert(err, checker.IsNil)
  715. // Make sure task has been deployed.
  716. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  717. out, err := d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.TTY }}", name)
  718. c.Assert(err, checker.IsNil)
  719. c.Assert(strings.TrimSpace(out), checker.Equals, "false")
  720. _, err = d.Cmd("service", "update", "--detach", "--tty", name)
  721. c.Assert(err, checker.IsNil)
  722. out, err = d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.TTY }}", name)
  723. c.Assert(err, checker.IsNil)
  724. c.Assert(strings.TrimSpace(out), checker.Equals, "true")
  725. }
  726. func (s *DockerSwarmSuite) TestSwarmServiceNetworkUpdate(c *check.C) {
  727. d := s.AddDaemon(c, true, true)
  728. result := icmd.RunCmd(d.Command("network", "create", "-d", "overlay", "foo"))
  729. result.Assert(c, icmd.Success)
  730. fooNetwork := strings.TrimSpace(string(result.Combined()))
  731. result = icmd.RunCmd(d.Command("network", "create", "-d", "overlay", "bar"))
  732. result.Assert(c, icmd.Success)
  733. barNetwork := strings.TrimSpace(string(result.Combined()))
  734. result = icmd.RunCmd(d.Command("network", "create", "-d", "overlay", "baz"))
  735. result.Assert(c, icmd.Success)
  736. bazNetwork := strings.TrimSpace(string(result.Combined()))
  737. // Create a service
  738. name := "top"
  739. result = icmd.RunCmd(d.Command("service", "create", "--detach", "--no-resolve-image", "--network", "foo", "--network", "bar", "--name", name, "busybox", "top"))
  740. result.Assert(c, icmd.Success)
  741. // Make sure task has been deployed.
  742. waitAndAssert(c, defaultReconciliationTimeout, d.CheckRunningTaskNetworks, checker.DeepEquals,
  743. map[string]int{fooNetwork: 1, barNetwork: 1})
  744. // Remove a network
  745. result = icmd.RunCmd(d.Command("service", "update", "--detach", "--network-rm", "foo", name))
  746. result.Assert(c, icmd.Success)
  747. waitAndAssert(c, defaultReconciliationTimeout, d.CheckRunningTaskNetworks, checker.DeepEquals,
  748. map[string]int{barNetwork: 1})
  749. // Add a network
  750. result = icmd.RunCmd(d.Command("service", "update", "--detach", "--network-add", "baz", name))
  751. result.Assert(c, icmd.Success)
  752. waitAndAssert(c, defaultReconciliationTimeout, d.CheckRunningTaskNetworks, checker.DeepEquals,
  753. map[string]int{barNetwork: 1, bazNetwork: 1})
  754. }
  755. func (s *DockerSwarmSuite) TestDNSConfig(c *check.C) {
  756. d := s.AddDaemon(c, true, true)
  757. // Create a service
  758. name := "top"
  759. _, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--dns=1.2.3.4", "--dns-search=example.com", "--dns-option=timeout:3", "busybox", "top")
  760. c.Assert(err, checker.IsNil)
  761. // Make sure task has been deployed.
  762. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  763. // We need to get the container id.
  764. out, err := d.Cmd("ps", "-a", "-q", "--no-trunc")
  765. c.Assert(err, checker.IsNil)
  766. id := strings.TrimSpace(out)
  767. // Compare against expected output.
  768. expectedOutput1 := "nameserver 1.2.3.4"
  769. expectedOutput2 := "search example.com"
  770. expectedOutput3 := "options timeout:3"
  771. out, err = d.Cmd("exec", id, "cat", "/etc/resolv.conf")
  772. c.Assert(err, checker.IsNil)
  773. c.Assert(out, checker.Contains, expectedOutput1, check.Commentf("Expected '%s', but got %q", expectedOutput1, out))
  774. c.Assert(out, checker.Contains, expectedOutput2, check.Commentf("Expected '%s', but got %q", expectedOutput2, out))
  775. c.Assert(out, checker.Contains, expectedOutput3, check.Commentf("Expected '%s', but got %q", expectedOutput3, out))
  776. }
  777. func (s *DockerSwarmSuite) TestDNSConfigUpdate(c *check.C) {
  778. d := s.AddDaemon(c, true, true)
  779. // Create a service
  780. name := "top"
  781. _, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "busybox", "top")
  782. c.Assert(err, checker.IsNil)
  783. // Make sure task has been deployed.
  784. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  785. _, err = d.Cmd("service", "update", "--detach", "--dns-add=1.2.3.4", "--dns-search-add=example.com", "--dns-option-add=timeout:3", name)
  786. c.Assert(err, checker.IsNil)
  787. out, err := d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.DNSConfig }}", name)
  788. c.Assert(err, checker.IsNil)
  789. c.Assert(strings.TrimSpace(out), checker.Equals, "{[1.2.3.4] [example.com] [timeout:3]}")
  790. }
  791. func getNodeStatus(c *check.C, d *daemon.Swarm) swarm.LocalNodeState {
  792. info, err := d.SwarmInfo()
  793. c.Assert(err, checker.IsNil)
  794. return info.LocalNodeState
  795. }
  796. func checkKeyIsEncrypted(d *daemon.Swarm) func(*check.C) (interface{}, check.CommentInterface) {
  797. return func(c *check.C) (interface{}, check.CommentInterface) {
  798. keyBytes, err := ioutil.ReadFile(filepath.Join(d.Folder, "root", "swarm", "certificates", "swarm-node.key"))
  799. if err != nil {
  800. return fmt.Errorf("error reading key: %v", err), nil
  801. }
  802. keyBlock, _ := pem.Decode(keyBytes)
  803. if keyBlock == nil {
  804. return fmt.Errorf("invalid PEM-encoded private key"), nil
  805. }
  806. return x509.IsEncryptedPEMBlock(keyBlock), nil
  807. }
  808. }
  809. func checkSwarmLockedToUnlocked(c *check.C, d *daemon.Swarm, unlockKey string) {
  810. // Wait for the PEM file to become unencrypted
  811. waitAndAssert(c, defaultReconciliationTimeout, checkKeyIsEncrypted(d), checker.Equals, false)
  812. d.Restart(c)
  813. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  814. }
  815. func checkSwarmUnlockedToLocked(c *check.C, d *daemon.Swarm) {
  816. // Wait for the PEM file to become encrypted
  817. waitAndAssert(c, defaultReconciliationTimeout, checkKeyIsEncrypted(d), checker.Equals, true)
  818. d.Restart(c)
  819. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
  820. }
  821. func (s *DockerSwarmSuite) TestUnlockEngineAndUnlockedSwarm(c *check.C) {
  822. d := s.AddDaemon(c, false, false)
  823. // unlocking a normal engine should return an error - it does not even ask for the key
  824. cmd := d.Command("swarm", "unlock")
  825. result := icmd.RunCmd(cmd)
  826. result.Assert(c, icmd.Expected{
  827. ExitCode: 1,
  828. })
  829. c.Assert(result.Combined(), checker.Contains, "Error: This node is not part of a swarm")
  830. c.Assert(result.Combined(), checker.Not(checker.Contains), "Please enter unlock key")
  831. _, err := d.Cmd("swarm", "init")
  832. c.Assert(err, checker.IsNil)
  833. // unlocking an unlocked swarm should return an error - it does not even ask for the key
  834. cmd = d.Command("swarm", "unlock")
  835. result = icmd.RunCmd(cmd)
  836. result.Assert(c, icmd.Expected{
  837. ExitCode: 1,
  838. })
  839. c.Assert(result.Combined(), checker.Contains, "Error: swarm is not locked")
  840. c.Assert(result.Combined(), checker.Not(checker.Contains), "Please enter unlock key")
  841. }
  842. func (s *DockerSwarmSuite) TestSwarmInitLocked(c *check.C) {
  843. d := s.AddDaemon(c, false, false)
  844. outs, err := d.Cmd("swarm", "init", "--autolock")
  845. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  846. c.Assert(outs, checker.Contains, "docker swarm unlock")
  847. var unlockKey string
  848. for _, line := range strings.Split(outs, "\n") {
  849. if strings.Contains(line, "SWMKEY") {
  850. unlockKey = strings.TrimSpace(line)
  851. break
  852. }
  853. }
  854. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  855. outs, err = d.Cmd("swarm", "unlock-key", "-q")
  856. c.Assert(outs, checker.Equals, unlockKey+"\n")
  857. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  858. // It starts off locked
  859. d.Restart(c)
  860. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
  861. cmd := d.Command("swarm", "unlock")
  862. cmd.Stdin = bytes.NewBufferString("wrong-secret-key")
  863. icmd.RunCmd(cmd).Assert(c, icmd.Expected{
  864. ExitCode: 1,
  865. Err: "invalid key",
  866. })
  867. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
  868. cmd = d.Command("swarm", "unlock")
  869. cmd.Stdin = bytes.NewBufferString(unlockKey)
  870. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  871. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  872. outs, err = d.Cmd("node", "ls")
  873. c.Assert(err, checker.IsNil)
  874. c.Assert(outs, checker.Not(checker.Contains), "Swarm is encrypted and needs to be unlocked")
  875. outs, err = d.Cmd("swarm", "update", "--autolock=false")
  876. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  877. checkSwarmLockedToUnlocked(c, d, unlockKey)
  878. outs, err = d.Cmd("node", "ls")
  879. c.Assert(err, checker.IsNil)
  880. c.Assert(outs, checker.Not(checker.Contains), "Swarm is encrypted and needs to be unlocked")
  881. }
  882. func (s *DockerSwarmSuite) TestSwarmLeaveLocked(c *check.C) {
  883. d := s.AddDaemon(c, false, false)
  884. outs, err := d.Cmd("swarm", "init", "--autolock")
  885. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  886. // It starts off locked
  887. d.Restart(c, "--swarm-default-advertise-addr=lo")
  888. info, err := d.SwarmInfo()
  889. c.Assert(err, checker.IsNil)
  890. c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateLocked)
  891. outs, _ = d.Cmd("node", "ls")
  892. c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")
  893. // `docker swarm leave` a locked swarm without --force will return an error
  894. outs, _ = d.Cmd("swarm", "leave")
  895. c.Assert(outs, checker.Contains, "Swarm is encrypted and locked.")
  896. // It is OK for user to leave a locked swarm with --force
  897. outs, err = d.Cmd("swarm", "leave", "--force")
  898. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  899. info, err = d.SwarmInfo()
  900. c.Assert(err, checker.IsNil)
  901. c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateInactive)
  902. outs, err = d.Cmd("swarm", "init")
  903. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  904. info, err = d.SwarmInfo()
  905. c.Assert(err, checker.IsNil)
  906. c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateActive)
  907. }
  908. func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
  909. d1 := s.AddDaemon(c, true, true)
  910. d2 := s.AddDaemon(c, true, true)
  911. d3 := s.AddDaemon(c, true, true)
  912. // they start off unlocked
  913. d2.Restart(c)
  914. c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
  915. // stop this one so it does not get autolock info
  916. d2.Stop(c)
  917. // enable autolock
  918. outs, err := d1.Cmd("swarm", "update", "--autolock")
  919. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  920. c.Assert(outs, checker.Contains, "docker swarm unlock")
  921. var unlockKey string
  922. for _, line := range strings.Split(outs, "\n") {
  923. if strings.Contains(line, "SWMKEY") {
  924. unlockKey = strings.TrimSpace(line)
  925. break
  926. }
  927. }
  928. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  929. outs, err = d1.Cmd("swarm", "unlock-key", "-q")
  930. c.Assert(outs, checker.Equals, unlockKey+"\n")
  931. // The ones that got the cluster update should be set to locked
  932. for _, d := range []*daemon.Swarm{d1, d3} {
  933. checkSwarmUnlockedToLocked(c, d)
  934. cmd := d.Command("swarm", "unlock")
  935. cmd.Stdin = bytes.NewBufferString(unlockKey)
  936. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  937. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  938. }
  939. // d2 never got the cluster update, so it is still set to unlocked
  940. d2.Start(c)
  941. c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
  942. // d2 is now set to lock
  943. checkSwarmUnlockedToLocked(c, d2)
  944. // leave it locked, and set the cluster to no longer autolock
  945. outs, err = d1.Cmd("swarm", "update", "--autolock=false")
  946. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  947. // the ones that got the update are now set to unlocked
  948. for _, d := range []*daemon.Swarm{d1, d3} {
  949. checkSwarmLockedToUnlocked(c, d, unlockKey)
  950. }
  951. // d2 still locked
  952. c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateLocked)
  953. // unlock it
  954. cmd := d2.Command("swarm", "unlock")
  955. cmd.Stdin = bytes.NewBufferString(unlockKey)
  956. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  957. c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
  958. // once it's caught up, d2 is set to not be locked
  959. checkSwarmLockedToUnlocked(c, d2, unlockKey)
  960. // managers who join now are never set to locked in the first place
  961. d4 := s.AddDaemon(c, true, true)
  962. d4.Restart(c)
  963. c.Assert(getNodeStatus(c, d4), checker.Equals, swarm.LocalNodeStateActive)
  964. }
  965. func (s *DockerSwarmSuite) TestSwarmJoinPromoteLocked(c *check.C) {
  966. d1 := s.AddDaemon(c, true, true)
  967. // enable autolock
  968. outs, err := d1.Cmd("swarm", "update", "--autolock")
  969. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  970. c.Assert(outs, checker.Contains, "docker swarm unlock")
  971. var unlockKey string
  972. for _, line := range strings.Split(outs, "\n") {
  973. if strings.Contains(line, "SWMKEY") {
  974. unlockKey = strings.TrimSpace(line)
  975. break
  976. }
  977. }
  978. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  979. outs, err = d1.Cmd("swarm", "unlock-key", "-q")
  980. c.Assert(outs, checker.Equals, unlockKey+"\n")
  981. // joined workers start off unlocked
  982. d2 := s.AddDaemon(c, true, false)
  983. d2.Restart(c)
  984. c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
  985. // promote worker
  986. outs, err = d1.Cmd("node", "promote", d2.Info.NodeID)
  987. c.Assert(err, checker.IsNil)
  988. c.Assert(outs, checker.Contains, "promoted to a manager in the swarm")
  989. // join new manager node
  990. d3 := s.AddDaemon(c, true, true)
  991. // both new nodes are locked
  992. for _, d := range []*daemon.Swarm{d2, d3} {
  993. checkSwarmUnlockedToLocked(c, d)
  994. cmd := d.Command("swarm", "unlock")
  995. cmd.Stdin = bytes.NewBufferString(unlockKey)
  996. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  997. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  998. }
  999. // demote manager back to worker - workers are not locked
  1000. outs, err = d1.Cmd("node", "demote", d3.Info.NodeID)
  1001. c.Assert(err, checker.IsNil)
  1002. c.Assert(outs, checker.Contains, "demoted in the swarm")
  1003. // Wait for it to actually be demoted, for the key and cert to be replaced.
  1004. // Then restart and assert that the node is not locked. If we don't wait for the cert
  1005. // to be replaced, then the node still has the manager TLS key which is still locked
  1006. // (because we never want a manager TLS key to be on disk unencrypted if the cluster
  1007. // is set to autolock)
  1008. waitAndAssert(c, defaultReconciliationTimeout, d3.CheckControlAvailable, checker.False)
  1009. waitAndAssert(c, defaultReconciliationTimeout, func(c *check.C) (interface{}, check.CommentInterface) {
  1010. certBytes, err := ioutil.ReadFile(filepath.Join(d3.Folder, "root", "swarm", "certificates", "swarm-node.crt"))
  1011. if err != nil {
  1012. return "", check.Commentf("error: %v", err)
  1013. }
  1014. certs, err := helpers.ParseCertificatesPEM(certBytes)
  1015. if err == nil && len(certs) > 0 && len(certs[0].Subject.OrganizationalUnit) > 0 {
  1016. return certs[0].Subject.OrganizationalUnit[0], nil
  1017. }
  1018. return "", check.Commentf("could not get organizational unit from certificate")
  1019. }, checker.Equals, "swarm-worker")
  1020. // by now, it should *never* be locked on restart
  1021. d3.Restart(c)
  1022. c.Assert(getNodeStatus(c, d3), checker.Equals, swarm.LocalNodeStateActive)
  1023. }
  1024. func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {
  1025. d := s.AddDaemon(c, true, true)
  1026. outs, err := d.Cmd("swarm", "update", "--autolock")
  1027. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1028. c.Assert(outs, checker.Contains, "docker swarm unlock")
  1029. var unlockKey string
  1030. for _, line := range strings.Split(outs, "\n") {
  1031. if strings.Contains(line, "SWMKEY") {
  1032. unlockKey = strings.TrimSpace(line)
  1033. break
  1034. }
  1035. }
  1036. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  1037. outs, err = d.Cmd("swarm", "unlock-key", "-q")
  1038. c.Assert(outs, checker.Equals, unlockKey+"\n")
  1039. // Rotate multiple times
  1040. for i := 0; i != 3; i++ {
  1041. outs, err = d.Cmd("swarm", "unlock-key", "-q", "--rotate")
  1042. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1043. // Strip \n
  1044. newUnlockKey := outs[:len(outs)-1]
  1045. c.Assert(newUnlockKey, checker.Not(checker.Equals), "")
  1046. c.Assert(newUnlockKey, checker.Not(checker.Equals), unlockKey)
  1047. d.Restart(c)
  1048. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
  1049. outs, _ = d.Cmd("node", "ls")
  1050. c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")
  1051. cmd := d.Command("swarm", "unlock")
  1052. cmd.Stdin = bytes.NewBufferString(unlockKey)
  1053. result := icmd.RunCmd(cmd)
  1054. if result.Error == nil {
  1055. // On occasion, the daemon may not have finished
  1056. // rotating the KEK before restarting. The test is
  1057. // intentionally written to explore this behavior.
  1058. // When this happens, unlocking with the old key will
  1059. // succeed. If we wait for the rotation to happen and
  1060. // restart again, the new key should be required this
  1061. // time.
  1062. time.Sleep(3 * time.Second)
  1063. d.Restart(c)
  1064. cmd = d.Command("swarm", "unlock")
  1065. cmd.Stdin = bytes.NewBufferString(unlockKey)
  1066. result = icmd.RunCmd(cmd)
  1067. }
  1068. result.Assert(c, icmd.Expected{
  1069. ExitCode: 1,
  1070. Err: "invalid key",
  1071. })
  1072. outs, _ = d.Cmd("node", "ls")
  1073. c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")
  1074. cmd = d.Command("swarm", "unlock")
  1075. cmd.Stdin = bytes.NewBufferString(newUnlockKey)
  1076. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  1077. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  1078. outs, err = d.Cmd("node", "ls")
  1079. c.Assert(err, checker.IsNil)
  1080. c.Assert(outs, checker.Not(checker.Contains), "Swarm is encrypted and needs to be unlocked")
  1081. unlockKey = newUnlockKey
  1082. }
  1083. }
  1084. // This differs from `TestSwarmRotateUnlockKey` because that one rotates a single node, which is the leader.
  1085. // This one keeps the leader up, and asserts that other manager nodes in the cluster also have their unlock
  1086. // key rotated.
  1087. func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {
  1088. d1 := s.AddDaemon(c, true, true) // leader - don't restart this one, we don't want leader election delays
  1089. d2 := s.AddDaemon(c, true, true)
  1090. d3 := s.AddDaemon(c, true, true)
  1091. outs, err := d1.Cmd("swarm", "update", "--autolock")
  1092. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1093. c.Assert(outs, checker.Contains, "docker swarm unlock")
  1094. var unlockKey string
  1095. for _, line := range strings.Split(outs, "\n") {
  1096. if strings.Contains(line, "SWMKEY") {
  1097. unlockKey = strings.TrimSpace(line)
  1098. break
  1099. }
  1100. }
  1101. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  1102. outs, err = d1.Cmd("swarm", "unlock-key", "-q")
  1103. c.Assert(outs, checker.Equals, unlockKey+"\n")
  1104. // Rotate multiple times
  1105. for i := 0; i != 3; i++ {
  1106. outs, err = d1.Cmd("swarm", "unlock-key", "-q", "--rotate")
  1107. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1108. // Strip \n
  1109. newUnlockKey := outs[:len(outs)-1]
  1110. c.Assert(newUnlockKey, checker.Not(checker.Equals), "")
  1111. c.Assert(newUnlockKey, checker.Not(checker.Equals), unlockKey)
  1112. d2.Restart(c)
  1113. d3.Restart(c)
  1114. for _, d := range []*daemon.Swarm{d2, d3} {
  1115. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
  1116. outs, _ := d.Cmd("node", "ls")
  1117. c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")
  1118. cmd := d.Command("swarm", "unlock")
  1119. cmd.Stdin = bytes.NewBufferString(unlockKey)
  1120. result := icmd.RunCmd(cmd)
  1121. if result.Error == nil {
  1122. // On occasion, the daemon may not have finished
  1123. // rotating the KEK before restarting. The test is
  1124. // intentionally written to explore this behavior.
  1125. // When this happens, unlocking with the old key will
  1126. // succeed. If we wait for the rotation to happen and
  1127. // restart again, the new key should be required this
  1128. // time.
  1129. time.Sleep(3 * time.Second)
  1130. d.Restart(c)
  1131. cmd = d.Command("swarm", "unlock")
  1132. cmd.Stdin = bytes.NewBufferString(unlockKey)
  1133. result = icmd.RunCmd(cmd)
  1134. }
  1135. result.Assert(c, icmd.Expected{
  1136. ExitCode: 1,
  1137. Err: "invalid key",
  1138. })
  1139. outs, _ = d.Cmd("node", "ls")
  1140. c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")
  1141. cmd = d.Command("swarm", "unlock")
  1142. cmd.Stdin = bytes.NewBufferString(newUnlockKey)
  1143. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  1144. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  1145. outs, err = d.Cmd("node", "ls")
  1146. c.Assert(err, checker.IsNil)
  1147. c.Assert(outs, checker.Not(checker.Contains), "Swarm is encrypted and needs to be unlocked")
  1148. }
  1149. unlockKey = newUnlockKey
  1150. }
  1151. }
  1152. func (s *DockerSwarmSuite) TestSwarmAlternateLockUnlock(c *check.C) {
  1153. d := s.AddDaemon(c, true, true)
  1154. var unlockKey string
  1155. for i := 0; i < 2; i++ {
  1156. // set to lock
  1157. outs, err := d.Cmd("swarm", "update", "--autolock")
  1158. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1159. c.Assert(outs, checker.Contains, "docker swarm unlock")
  1160. for _, line := range strings.Split(outs, "\n") {
  1161. if strings.Contains(line, "SWMKEY") {
  1162. unlockKey = strings.TrimSpace(line)
  1163. break
  1164. }
  1165. }
  1166. c.Assert(unlockKey, checker.Not(checker.Equals), "")
  1167. checkSwarmUnlockedToLocked(c, d)
  1168. cmd := d.Command("swarm", "unlock")
  1169. cmd.Stdin = bytes.NewBufferString(unlockKey)
  1170. icmd.RunCmd(cmd).Assert(c, icmd.Success)
  1171. c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
  1172. outs, err = d.Cmd("swarm", "update", "--autolock=false")
  1173. c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
  1174. checkSwarmLockedToUnlocked(c, d, unlockKey)
  1175. }
  1176. }
  1177. func (s *DockerSwarmSuite) TestExtraHosts(c *check.C) {
  1178. d := s.AddDaemon(c, true, true)
  1179. // Create a service
  1180. name := "top"
  1181. _, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", name, "--host=example.com:1.2.3.4", "busybox", "top")
  1182. c.Assert(err, checker.IsNil)
  1183. // Make sure task has been deployed.
  1184. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  1185. // We need to get the container id.
  1186. out, err := d.Cmd("ps", "-a", "-q", "--no-trunc")
  1187. c.Assert(err, checker.IsNil)
  1188. id := strings.TrimSpace(out)
  1189. // Compare against expected output.
  1190. expectedOutput := "1.2.3.4\texample.com"
  1191. out, err = d.Cmd("exec", id, "cat", "/etc/hosts")
  1192. c.Assert(err, checker.IsNil)
  1193. c.Assert(out, checker.Contains, expectedOutput, check.Commentf("Expected '%s', but got %q", expectedOutput, out))
  1194. }
  1195. func (s *DockerSwarmSuite) TestSwarmManagerAddress(c *check.C) {
  1196. d1 := s.AddDaemon(c, true, true)
  1197. d2 := s.AddDaemon(c, true, false)
  1198. d3 := s.AddDaemon(c, true, false)
  1199. // Manager Addresses will always show Node 1's address
  1200. expectedOutput := fmt.Sprintf("Manager Addresses:\n 127.0.0.1:%d\n", d1.Port)
  1201. out, err := d1.Cmd("info")
  1202. c.Assert(err, checker.IsNil)
  1203. c.Assert(out, checker.Contains, expectedOutput)
  1204. out, err = d2.Cmd("info")
  1205. c.Assert(err, checker.IsNil)
  1206. c.Assert(out, checker.Contains, expectedOutput)
  1207. out, err = d3.Cmd("info")
  1208. c.Assert(err, checker.IsNil)
  1209. c.Assert(out, checker.Contains, expectedOutput)
  1210. }
  1211. func (s *DockerSwarmSuite) TestSwarmNetworkIPAMOptions(c *check.C) {
  1212. d := s.AddDaemon(c, true, true)
  1213. out, err := d.Cmd("network", "create", "-d", "overlay", "--ipam-opt", "foo=bar", "foo")
  1214. c.Assert(err, checker.IsNil, check.Commentf(out))
  1215. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1216. out, err = d.Cmd("network", "inspect", "--format", "{{.IPAM.Options}}", "foo")
  1217. c.Assert(err, checker.IsNil, check.Commentf(out))
  1218. c.Assert(strings.TrimSpace(out), checker.Contains, "foo:bar")
  1219. c.Assert(strings.TrimSpace(out), checker.Contains, "com.docker.network.ipam.serial:true")
  1220. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--network=foo", "--name", "top", "busybox", "top")
  1221. c.Assert(err, checker.IsNil, check.Commentf(out))
  1222. // make sure task has been deployed.
  1223. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  1224. out, err = d.Cmd("network", "inspect", "--format", "{{.IPAM.Options}}", "foo")
  1225. c.Assert(err, checker.IsNil, check.Commentf(out))
  1226. c.Assert(strings.TrimSpace(out), checker.Contains, "foo:bar")
  1227. c.Assert(strings.TrimSpace(out), checker.Contains, "com.docker.network.ipam.serial:true")
  1228. }
  1229. func (s *DockerTrustedSwarmSuite) TestTrustedServiceCreate(c *check.C) {
  1230. d := s.swarmSuite.AddDaemon(c, true, true)
  1231. // Attempt creating a service from an image that is known to notary.
  1232. repoName := s.trustSuite.setupTrustedImage(c, "trusted-pull")
  1233. name := "trusted"
  1234. cli.Docker(cli.Args("-D", "service", "create", "--detach", "--no-resolve-image", "--name", name, repoName, "top"), trustedCmd, cli.Daemon(d.Daemon)).Assert(c, icmd.Expected{
  1235. Err: "resolved image tag to",
  1236. })
  1237. out, err := d.Cmd("service", "inspect", "--pretty", name)
  1238. c.Assert(err, checker.IsNil, check.Commentf(out))
  1239. c.Assert(out, checker.Contains, repoName+"@", check.Commentf(out))
  1240. // Try trusted service create on an untrusted tag.
  1241. repoName = fmt.Sprintf("%v/untrustedservicecreate/createtest:latest", privateRegistryURL)
  1242. // tag the image and upload it to the private registry
  1243. cli.DockerCmd(c, "tag", "busybox", repoName)
  1244. cli.DockerCmd(c, "push", repoName)
  1245. cli.DockerCmd(c, "rmi", repoName)
  1246. name = "untrusted"
  1247. cli.Docker(cli.Args("service", "create", "--detach", "--no-resolve-image", "--name", name, repoName, "top"), trustedCmd, cli.Daemon(d.Daemon)).Assert(c, icmd.Expected{
  1248. ExitCode: 1,
  1249. Err: "Error: remote trust data does not exist",
  1250. })
  1251. out, err = d.Cmd("service", "inspect", "--pretty", name)
  1252. c.Assert(err, checker.NotNil, check.Commentf(out))
  1253. }
  1254. func (s *DockerTrustedSwarmSuite) TestTrustedServiceUpdate(c *check.C) {
  1255. d := s.swarmSuite.AddDaemon(c, true, true)
  1256. // Attempt creating a service from an image that is known to notary.
  1257. repoName := s.trustSuite.setupTrustedImage(c, "trusted-pull")
  1258. name := "myservice"
  1259. // Create a service without content trust
  1260. cli.Docker(cli.Args("service", "create", "--detach", "--no-resolve-image", "--name", name, repoName, "top"), cli.Daemon(d.Daemon)).Assert(c, icmd.Success)
  1261. result := cli.Docker(cli.Args("service", "inspect", "--pretty", name), cli.Daemon(d.Daemon))
  1262. c.Assert(result.Error, checker.IsNil, check.Commentf(result.Combined()))
  1263. // Daemon won't insert the digest because this is disabled by
  1264. // DOCKER_SERVICE_PREFER_OFFLINE_IMAGE.
  1265. c.Assert(result.Combined(), check.Not(checker.Contains), repoName+"@", check.Commentf(result.Combined()))
  1266. cli.Docker(cli.Args("-D", "service", "update", "--detach", "--no-resolve-image", "--image", repoName, name), trustedCmd, cli.Daemon(d.Daemon)).Assert(c, icmd.Expected{
  1267. Err: "resolved image tag to",
  1268. })
  1269. cli.Docker(cli.Args("service", "inspect", "--pretty", name), cli.Daemon(d.Daemon)).Assert(c, icmd.Expected{
  1270. Out: repoName + "@",
  1271. })
  1272. // Try trusted service update on an untrusted tag.
  1273. repoName = fmt.Sprintf("%v/untrustedservicecreate/createtest:latest", privateRegistryURL)
  1274. // tag the image and upload it to the private registry
  1275. cli.DockerCmd(c, "tag", "busybox", repoName)
  1276. cli.DockerCmd(c, "push", repoName)
  1277. cli.DockerCmd(c, "rmi", repoName)
  1278. cli.Docker(cli.Args("service", "update", "--detach", "--no-resolve-image", "--image", repoName, name), trustedCmd, cli.Daemon(d.Daemon)).Assert(c, icmd.Expected{
  1279. ExitCode: 1,
  1280. Err: "Error: remote trust data does not exist",
  1281. })
  1282. }
  1283. // Test case for issue #27866, which did not allow NW name that is the prefix of a swarm NW ID.
  1284. // e.g. if the ingress ID starts with "n1", it was impossible to create a NW named "n1".
  1285. func (s *DockerSwarmSuite) TestSwarmNetworkCreateIssue27866(c *check.C) {
  1286. d := s.AddDaemon(c, true, true)
  1287. out, err := d.Cmd("network", "inspect", "-f", "{{.Id}}", "ingress")
  1288. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1289. ingressID := strings.TrimSpace(out)
  1290. c.Assert(ingressID, checker.Not(checker.Equals), "")
  1291. // create a network of which name is the prefix of the ID of an overlay network
  1292. // (ingressID in this case)
  1293. newNetName := ingressID[0:2]
  1294. out, err = d.Cmd("network", "create", "--driver", "overlay", newNetName)
  1295. // In #27866, it was failing because of "network with name %s already exists"
  1296. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1297. out, err = d.Cmd("network", "rm", newNetName)
  1298. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1299. }
  1300. // Test case for https://github.com/docker/docker/pull/27938#issuecomment-265768303
  1301. // This test creates two networks with the same name sequentially, with various drivers.
  1302. // Since the operations in this test are done sequentially, the 2nd call should fail with
  1303. // "network with name FOO already exists".
  1304. // Note that it is to ok have multiple networks with the same name if the operations are done
  1305. // in parallel. (#18864)
  1306. func (s *DockerSwarmSuite) TestSwarmNetworkCreateDup(c *check.C) {
  1307. d := s.AddDaemon(c, true, true)
  1308. drivers := []string{"bridge", "overlay"}
  1309. for i, driver1 := range drivers {
  1310. nwName := fmt.Sprintf("network-test-%d", i)
  1311. for _, driver2 := range drivers {
  1312. c.Logf("Creating a network named %q with %q, then %q",
  1313. nwName, driver1, driver2)
  1314. out, err := d.Cmd("network", "create", "--driver", driver1, nwName)
  1315. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1316. out, err = d.Cmd("network", "create", "--driver", driver2, nwName)
  1317. c.Assert(out, checker.Contains,
  1318. fmt.Sprintf("network with name %s already exists", nwName))
  1319. c.Assert(err, checker.NotNil)
  1320. c.Logf("As expected, the attempt to network %q with %q failed: %s",
  1321. nwName, driver2, out)
  1322. out, err = d.Cmd("network", "rm", nwName)
  1323. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1324. }
  1325. }
  1326. }
  1327. func (s *DockerSwarmSuite) TestSwarmPublishDuplicatePorts(c *check.C) {
  1328. d := s.AddDaemon(c, true, true)
  1329. out, err := d.Cmd("service", "create", "--no-resolve-image", "--detach=true", "--publish", "5005:80", "--publish", "5006:80", "--publish", "80", "--publish", "80", "busybox", "top")
  1330. c.Assert(err, check.IsNil, check.Commentf(out))
  1331. id := strings.TrimSpace(out)
  1332. // make sure task has been deployed.
  1333. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  1334. // Total len = 4, with 2 dynamic ports and 2 non-dynamic ports
  1335. // Dynamic ports are likely to be 30000 and 30001 but doesn't matter
  1336. out, err = d.Cmd("service", "inspect", "--format", "{{.Endpoint.Ports}} len={{len .Endpoint.Ports}}", id)
  1337. c.Assert(err, check.IsNil, check.Commentf(out))
  1338. c.Assert(out, checker.Contains, "len=4")
  1339. c.Assert(out, checker.Contains, "{ tcp 80 5005 ingress}")
  1340. c.Assert(out, checker.Contains, "{ tcp 80 5006 ingress}")
  1341. }
  1342. func (s *DockerSwarmSuite) TestSwarmJoinWithDrain(c *check.C) {
  1343. d := s.AddDaemon(c, true, true)
  1344. out, err := d.Cmd("node", "ls")
  1345. c.Assert(err, checker.IsNil)
  1346. c.Assert(out, checker.Not(checker.Contains), "Drain")
  1347. out, err = d.Cmd("swarm", "join-token", "-q", "manager")
  1348. c.Assert(err, checker.IsNil)
  1349. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1350. token := strings.TrimSpace(out)
  1351. d1 := s.AddDaemon(c, false, false)
  1352. out, err = d1.Cmd("swarm", "join", "--availability=drain", "--token", token, d.ListenAddr)
  1353. c.Assert(err, checker.IsNil)
  1354. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1355. out, err = d.Cmd("node", "ls")
  1356. c.Assert(err, checker.IsNil)
  1357. c.Assert(out, checker.Contains, "Drain")
  1358. out, err = d1.Cmd("node", "ls")
  1359. c.Assert(err, checker.IsNil)
  1360. c.Assert(out, checker.Contains, "Drain")
  1361. }
  1362. func (s *DockerSwarmSuite) TestSwarmInitWithDrain(c *check.C) {
  1363. d := s.AddDaemon(c, false, false)
  1364. out, err := d.Cmd("swarm", "init", "--availability", "drain")
  1365. c.Assert(err, checker.IsNil, check.Commentf("out: %v", out))
  1366. out, err = d.Cmd("node", "ls")
  1367. c.Assert(err, checker.IsNil)
  1368. c.Assert(out, checker.Contains, "Drain")
  1369. }
  1370. func (s *DockerSwarmSuite) TestSwarmReadonlyRootfs(c *check.C) {
  1371. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  1372. d := s.AddDaemon(c, true, true)
  1373. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "top", "--read-only", "busybox", "top")
  1374. c.Assert(err, checker.IsNil, check.Commentf(out))
  1375. // make sure task has been deployed.
  1376. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  1377. out, err = d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.ReadOnly }}", "top")
  1378. c.Assert(err, checker.IsNil, check.Commentf(out))
  1379. c.Assert(strings.TrimSpace(out), checker.Equals, "true")
  1380. containers := d.ActiveContainers()
  1381. out, err = d.Cmd("inspect", "--type", "container", "--format", "{{.HostConfig.ReadonlyRootfs}}", containers[0])
  1382. c.Assert(err, checker.IsNil, check.Commentf(out))
  1383. c.Assert(strings.TrimSpace(out), checker.Equals, "true")
  1384. }
  1385. func (s *DockerSwarmSuite) TestNetworkInspectWithDuplicateNames(c *check.C) {
  1386. d := s.AddDaemon(c, true, true)
  1387. name := "foo"
  1388. options := types.NetworkCreate{
  1389. CheckDuplicate: false,
  1390. Driver: "bridge",
  1391. }
  1392. cli, err := d.NewClient()
  1393. c.Assert(err, checker.IsNil)
  1394. defer cli.Close()
  1395. n1, err := cli.NetworkCreate(context.Background(), name, options)
  1396. c.Assert(err, checker.IsNil)
  1397. // Full ID always works
  1398. out, err := d.Cmd("network", "inspect", "--format", "{{.ID}}", n1.ID)
  1399. c.Assert(err, checker.IsNil, check.Commentf(out))
  1400. c.Assert(strings.TrimSpace(out), checker.Equals, n1.ID)
  1401. // Name works if it is unique
  1402. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", name)
  1403. c.Assert(err, checker.IsNil, check.Commentf(out))
  1404. c.Assert(strings.TrimSpace(out), checker.Equals, n1.ID)
  1405. n2, err := cli.NetworkCreate(context.Background(), name, options)
  1406. c.Assert(err, checker.IsNil)
  1407. // Full ID always works
  1408. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", n1.ID)
  1409. c.Assert(err, checker.IsNil, check.Commentf(out))
  1410. c.Assert(strings.TrimSpace(out), checker.Equals, n1.ID)
  1411. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", n2.ID)
  1412. c.Assert(err, checker.IsNil, check.Commentf(out))
  1413. c.Assert(strings.TrimSpace(out), checker.Equals, n2.ID)
  1414. // Name with duplicates
  1415. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", name)
  1416. c.Assert(err, checker.NotNil, check.Commentf(out))
  1417. c.Assert(out, checker.Contains, "2 matches found based on name")
  1418. out, err = d.Cmd("network", "rm", n2.ID)
  1419. c.Assert(err, checker.IsNil, check.Commentf(out))
  1420. // Dupliates with name but with different driver
  1421. options.Driver = "overlay"
  1422. n2, err = cli.NetworkCreate(context.Background(), name, options)
  1423. c.Assert(err, checker.IsNil)
  1424. // Full ID always works
  1425. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", n1.ID)
  1426. c.Assert(err, checker.IsNil, check.Commentf(out))
  1427. c.Assert(strings.TrimSpace(out), checker.Equals, n1.ID)
  1428. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", n2.ID)
  1429. c.Assert(err, checker.IsNil, check.Commentf(out))
  1430. c.Assert(strings.TrimSpace(out), checker.Equals, n2.ID)
  1431. // Name with duplicates
  1432. out, err = d.Cmd("network", "inspect", "--format", "{{.ID}}", name)
  1433. c.Assert(err, checker.NotNil, check.Commentf(out))
  1434. c.Assert(out, checker.Contains, "2 matches found based on name")
  1435. }
  1436. func (s *DockerSwarmSuite) TestSwarmStopSignal(c *check.C) {
  1437. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  1438. d := s.AddDaemon(c, true, true)
  1439. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "top", "--stop-signal=SIGHUP", "busybox", "top")
  1440. c.Assert(err, checker.IsNil, check.Commentf(out))
  1441. // make sure task has been deployed.
  1442. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 1)
  1443. out, err = d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.StopSignal }}", "top")
  1444. c.Assert(err, checker.IsNil, check.Commentf(out))
  1445. c.Assert(strings.TrimSpace(out), checker.Equals, "SIGHUP")
  1446. containers := d.ActiveContainers()
  1447. out, err = d.Cmd("inspect", "--type", "container", "--format", "{{.Config.StopSignal}}", containers[0])
  1448. c.Assert(err, checker.IsNil, check.Commentf(out))
  1449. c.Assert(strings.TrimSpace(out), checker.Equals, "SIGHUP")
  1450. out, err = d.Cmd("service", "update", "--detach", "--stop-signal=SIGUSR1", "top")
  1451. c.Assert(err, checker.IsNil, check.Commentf(out))
  1452. out, err = d.Cmd("service", "inspect", "--format", "{{ .Spec.TaskTemplate.ContainerSpec.StopSignal }}", "top")
  1453. c.Assert(err, checker.IsNil, check.Commentf(out))
  1454. c.Assert(strings.TrimSpace(out), checker.Equals, "SIGUSR1")
  1455. }
  1456. func (s *DockerSwarmSuite) TestSwarmServiceLsFilterMode(c *check.C) {
  1457. d := s.AddDaemon(c, true, true)
  1458. out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "top1", "busybox", "top")
  1459. c.Assert(err, checker.IsNil, check.Commentf(out))
  1460. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1461. out, err = d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", "top2", "--mode=global", "busybox", "top")
  1462. c.Assert(err, checker.IsNil, check.Commentf(out))
  1463. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1464. // make sure task has been deployed.
  1465. waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, 2)
  1466. out, err = d.Cmd("service", "ls")
  1467. c.Assert(err, checker.IsNil, check.Commentf(out))
  1468. c.Assert(out, checker.Contains, "top1")
  1469. c.Assert(out, checker.Contains, "top2")
  1470. c.Assert(out, checker.Not(checker.Contains), "localnet")
  1471. out, err = d.Cmd("service", "ls", "--filter", "mode=global")
  1472. c.Assert(out, checker.Not(checker.Contains), "top1")
  1473. c.Assert(out, checker.Contains, "top2")
  1474. c.Assert(err, checker.IsNil, check.Commentf(out))
  1475. out, err = d.Cmd("service", "ls", "--filter", "mode=replicated")
  1476. c.Assert(err, checker.IsNil, check.Commentf(out))
  1477. c.Assert(out, checker.Contains, "top1")
  1478. c.Assert(out, checker.Not(checker.Contains), "top2")
  1479. }
  1480. func (s *DockerSwarmSuite) TestSwarmInitUnspecifiedDataPathAddr(c *check.C) {
  1481. d := s.AddDaemon(c, false, false)
  1482. out, err := d.Cmd("swarm", "init", "--data-path-addr", "0.0.0.0")
  1483. c.Assert(err, checker.NotNil)
  1484. c.Assert(out, checker.Contains, "data path address must be a non-zero IP")
  1485. out, err = d.Cmd("swarm", "init", "--data-path-addr", "0.0.0.0:2000")
  1486. c.Assert(err, checker.NotNil)
  1487. c.Assert(out, checker.Contains, "data path address must be a non-zero IP")
  1488. }
  1489. func (s *DockerSwarmSuite) TestSwarmJoinLeave(c *check.C) {
  1490. d := s.AddDaemon(c, true, true)
  1491. out, err := d.Cmd("swarm", "join-token", "-q", "worker")
  1492. c.Assert(err, checker.IsNil)
  1493. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1494. token := strings.TrimSpace(out)
  1495. // Verify that back to back join/leave does not cause panics
  1496. d1 := s.AddDaemon(c, false, false)
  1497. for i := 0; i < 10; i++ {
  1498. out, err = d1.Cmd("swarm", "join", "--token", token, d.ListenAddr)
  1499. c.Assert(err, checker.IsNil)
  1500. c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
  1501. _, err = d1.Cmd("swarm", "leave")
  1502. c.Assert(err, checker.IsNil)
  1503. }
  1504. }
  1505. const defaultRetryCount = 10
  1506. func waitForEvent(c *check.C, d *daemon.Swarm, since string, filter string, event string, retry int) string {
  1507. if retry < 1 {
  1508. c.Fatalf("retry count %d is invalid. It should be no less than 1", retry)
  1509. return ""
  1510. }
  1511. var out string
  1512. for i := 0; i < retry; i++ {
  1513. until := daemonUnixTime(c)
  1514. var err error
  1515. if len(filter) > 0 {
  1516. out, err = d.Cmd("events", "--since", since, "--until", until, filter)
  1517. } else {
  1518. out, err = d.Cmd("events", "--since", since, "--until", until)
  1519. }
  1520. c.Assert(err, checker.IsNil, check.Commentf(out))
  1521. if strings.Contains(out, event) {
  1522. return strings.TrimSpace(out)
  1523. }
  1524. // no need to sleep after last retry
  1525. if i < retry-1 {
  1526. time.Sleep(200 * time.Millisecond)
  1527. }
  1528. }
  1529. c.Fatalf("docker events output '%s' doesn't contain event '%s'", out, event)
  1530. return ""
  1531. }
  1532. func (s *DockerSwarmSuite) TestSwarmClusterEventsSource(c *check.C) {
  1533. d1 := s.AddDaemon(c, true, true)
  1534. d2 := s.AddDaemon(c, true, true)
  1535. d3 := s.AddDaemon(c, true, false)
  1536. // create a network
  1537. out, err := d1.Cmd("network", "create", "--attachable", "-d", "overlay", "foo")
  1538. c.Assert(err, checker.IsNil, check.Commentf(out))
  1539. networkID := strings.TrimSpace(out)
  1540. c.Assert(networkID, checker.Not(checker.Equals), "")
  1541. // d1, d2 are managers that can get swarm events
  1542. waitForEvent(c, d1, "0", "-f scope=swarm", "network create "+networkID, defaultRetryCount)
  1543. waitForEvent(c, d2, "0", "-f scope=swarm", "network create "+networkID, defaultRetryCount)
  1544. // d3 is a worker, not able to get cluster events
  1545. out = waitForEvent(c, d3, "0", "-f scope=swarm", "", 1)
  1546. c.Assert(out, checker.Not(checker.Contains), "network create ")
  1547. }
  1548. func (s *DockerSwarmSuite) TestSwarmClusterEventsScope(c *check.C) {
  1549. d := s.AddDaemon(c, true, true)
  1550. // create a service
  1551. out, err := d.Cmd("service", "create", "--no-resolve-image", "--name", "test", "--detach=false", "busybox", "top")
  1552. c.Assert(err, checker.IsNil, check.Commentf(out))
  1553. serviceID := strings.Split(out, "\n")[0]
  1554. // scope swarm filters cluster events
  1555. out = waitForEvent(c, d, "0", "-f scope=swarm", "service create "+serviceID, defaultRetryCount)
  1556. c.Assert(out, checker.Not(checker.Contains), "container create ")
  1557. // all events are returned if scope is not specified
  1558. waitForEvent(c, d, "0", "", "service create "+serviceID, 1)
  1559. waitForEvent(c, d, "0", "", "container create ", defaultRetryCount)
  1560. // scope local only shows non-cluster events
  1561. out = waitForEvent(c, d, "0", "-f scope=local", "container create ", 1)
  1562. c.Assert(out, checker.Not(checker.Contains), "service create ")
  1563. }
  1564. func (s *DockerSwarmSuite) TestSwarmClusterEventsType(c *check.C) {
  1565. d := s.AddDaemon(c, true, true)
  1566. // create a service
  1567. out, err := d.Cmd("service", "create", "--no-resolve-image", "--name", "test", "--detach=false", "busybox", "top")
  1568. c.Assert(err, checker.IsNil, check.Commentf(out))
  1569. serviceID := strings.Split(out, "\n")[0]
  1570. // create a network
  1571. out, err = d.Cmd("network", "create", "--attachable", "-d", "overlay", "foo")
  1572. c.Assert(err, checker.IsNil, check.Commentf(out))
  1573. networkID := strings.TrimSpace(out)
  1574. c.Assert(networkID, checker.Not(checker.Equals), "")
  1575. // filter by service
  1576. out = waitForEvent(c, d, "0", "-f type=service", "service create "+serviceID, defaultRetryCount)
  1577. c.Assert(out, checker.Not(checker.Contains), "network create")
  1578. // filter by network
  1579. out = waitForEvent(c, d, "0", "-f type=network", "network create "+networkID, defaultRetryCount)
  1580. c.Assert(out, checker.Not(checker.Contains), "service create")
  1581. }
  1582. func (s *DockerSwarmSuite) TestSwarmClusterEventsService(c *check.C) {
  1583. d := s.AddDaemon(c, true, true)
  1584. // create a service
  1585. out, err := d.Cmd("service", "create", "--no-resolve-image", "--name", "test", "--detach=false", "busybox", "top")
  1586. c.Assert(err, checker.IsNil, check.Commentf(out))
  1587. serviceID := strings.Split(out, "\n")[0]
  1588. // validate service create event
  1589. waitForEvent(c, d, "0", "-f scope=swarm", "service create "+serviceID, defaultRetryCount)
  1590. t1 := daemonUnixTime(c)
  1591. out, err = d.Cmd("service", "update", "--force", "--detach=false", "test")
  1592. c.Assert(err, checker.IsNil, check.Commentf(out))
  1593. // wait for service update start
  1594. out = waitForEvent(c, d, t1, "-f scope=swarm", "service update "+serviceID, defaultRetryCount)
  1595. c.Assert(out, checker.Contains, "updatestate.new=updating")
  1596. // allow service update complete. This is a service with 1 instance
  1597. time.Sleep(400 * time.Millisecond)
  1598. out = waitForEvent(c, d, t1, "-f scope=swarm", "service update "+serviceID, defaultRetryCount)
  1599. c.Assert(out, checker.Contains, "updatestate.new=completed, updatestate.old=updating")
  1600. // scale service
  1601. t2 := daemonUnixTime(c)
  1602. out, err = d.Cmd("service", "scale", "test=3")
  1603. c.Assert(err, checker.IsNil, check.Commentf(out))
  1604. out = waitForEvent(c, d, t2, "-f scope=swarm", "service update "+serviceID, defaultRetryCount)
  1605. c.Assert(out, checker.Contains, "replicas.new=3, replicas.old=1")
  1606. // remove service
  1607. t3 := daemonUnixTime(c)
  1608. out, err = d.Cmd("service", "rm", "test")
  1609. c.Assert(err, checker.IsNil, check.Commentf(out))
  1610. waitForEvent(c, d, t3, "-f scope=swarm", "service remove "+serviceID, defaultRetryCount)
  1611. }
  1612. func (s *DockerSwarmSuite) TestSwarmClusterEventsNode(c *check.C) {
  1613. d1 := s.AddDaemon(c, true, true)
  1614. s.AddDaemon(c, true, true)
  1615. d3 := s.AddDaemon(c, true, true)
  1616. d3ID := d3.NodeID
  1617. waitForEvent(c, d1, "0", "-f scope=swarm", "node create "+d3ID, defaultRetryCount)
  1618. t1 := daemonUnixTime(c)
  1619. out, err := d1.Cmd("node", "update", "--availability=pause", d3ID)
  1620. c.Assert(err, checker.IsNil, check.Commentf(out))
  1621. // filter by type
  1622. out = waitForEvent(c, d1, t1, "-f type=node", "node update "+d3ID, defaultRetryCount)
  1623. c.Assert(out, checker.Contains, "availability.new=pause, availability.old=active")
  1624. t2 := daemonUnixTime(c)
  1625. out, err = d1.Cmd("node", "demote", d3ID)
  1626. c.Assert(err, checker.IsNil, check.Commentf(out))
  1627. waitForEvent(c, d1, t2, "-f type=node", "node update "+d3ID, defaultRetryCount)
  1628. t3 := daemonUnixTime(c)
  1629. out, err = d1.Cmd("node", "rm", "-f", d3ID)
  1630. c.Assert(err, checker.IsNil, check.Commentf(out))
  1631. // filter by scope
  1632. waitForEvent(c, d1, t3, "-f scope=swarm", "node remove "+d3ID, defaultRetryCount)
  1633. }
  1634. func (s *DockerSwarmSuite) TestSwarmClusterEventsNetwork(c *check.C) {
  1635. d := s.AddDaemon(c, true, true)
  1636. // create a network
  1637. out, err := d.Cmd("network", "create", "--attachable", "-d", "overlay", "foo")
  1638. c.Assert(err, checker.IsNil, check.Commentf(out))
  1639. networkID := strings.TrimSpace(out)
  1640. waitForEvent(c, d, "0", "-f scope=swarm", "network create "+networkID, defaultRetryCount)
  1641. // remove network
  1642. t1 := daemonUnixTime(c)
  1643. out, err = d.Cmd("network", "rm", "foo")
  1644. c.Assert(err, checker.IsNil, check.Commentf(out))
  1645. // filtered by network
  1646. waitForEvent(c, d, t1, "-f type=network", "network remove "+networkID, defaultRetryCount)
  1647. }
  1648. func (s *DockerSwarmSuite) TestSwarmClusterEventsSecret(c *check.C) {
  1649. d := s.AddDaemon(c, true, true)
  1650. testName := "test_secret"
  1651. id := d.CreateSecret(c, swarm.SecretSpec{
  1652. Annotations: swarm.Annotations{
  1653. Name: testName,
  1654. },
  1655. Data: []byte("TESTINGDATA"),
  1656. })
  1657. c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("secrets: %s", id))
  1658. waitForEvent(c, d, "0", "-f scope=swarm", "secret create "+id, defaultRetryCount)
  1659. t1 := daemonUnixTime(c)
  1660. d.DeleteSecret(c, id)
  1661. // filtered by secret
  1662. waitForEvent(c, d, t1, "-f type=secret", "secret remove "+id, defaultRetryCount)
  1663. }
  1664. func (s *DockerSwarmSuite) TestSwarmClusterEventsConfig(c *check.C) {
  1665. d := s.AddDaemon(c, true, true)
  1666. testName := "test_config"
  1667. id := d.CreateConfig(c, swarm.ConfigSpec{
  1668. Annotations: swarm.Annotations{
  1669. Name: testName,
  1670. },
  1671. Data: []byte("TESTINGDATA"),
  1672. })
  1673. c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("configs: %s", id))
  1674. waitForEvent(c, d, "0", "-f scope=swarm", "config create "+id, defaultRetryCount)
  1675. t1 := daemonUnixTime(c)
  1676. d.DeleteConfig(c, id)
  1677. // filtered by config
  1678. waitForEvent(c, d, t1, "-f type=config", "config remove "+id, defaultRetryCount)
  1679. }