simp-beaker-helpers 3.0.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e51892c7f01f52c49e29840032a8e4b7d5f524a3c3160b3218d3839224bfaf6
-  data.tar.gz: abbce77cea4030bcc802eaa16359e5f53998fb1dda40cd8dbb5aa11e56fff768
+  metadata.gz: 1f747ed7e2c82094df9bdfee076de2354e8e40c51b5671d5003dd939a3c97dca
+  data.tar.gz: 11ce7874aa49de3e2f389efdb1abdfd3d96c356a40097ed371f09b810db49c6e
 SHA512:
-  metadata.gz: 3c0c3ef0740aef92c4dcb643b94ac228d5484a0ad524b7b419832f30e28caa63f4ba802bf48d721ae242af7a387cc291582e33e9ad23ef345f6bc88105161f67
-  data.tar.gz: 61829ea33bf1911ee6da64d46b29f270f907631c01b3e681b62ac4650716ccaeba4d3d8dababc07cfea1eb8400b1bd2ab72d8528940e296bf4e35f290f36ddac
+  metadata.gz: 87afefb2d6a5936c8b2e4f598549079de3a8e158b9f05a2e1d01005be47d4481b8b94af4dc8083a6dfb36a2a4e0eccc8e9df100ae84cd66461f65792a158619f
+  data.tar.gz: c5897a3b95fe0978543ba98476a77f77e01aaeba0cec1984b8d0ef7203f3b3fefdad2811d42ade13caa6a5391eb7515984c93a35791c302726f884cc50780baf

data/CHANGELOG.md

@@ -1,3 +1,22 @@
+### 3.1.1 / 2026-07-03
+* Fixed:
+  * `run_fake_pki_ca_on` now runs `ensure_beaker_ip_on` before collecting
+    the IP addresses embedded in certificate subjectAltNames, so certs match
+    the corrected (Beaker-recorded) addresses on SUTs where the static
+    private-network IP was never applied (e.g. EL10 under Vagrant). Without
+    this, IKE peer IDs no longer match the cert SANs after remediation and
+    strict validators (libreswan 5) reject authentication.
+
+### 3.1.0 / 2026-07-02
+* Added:
+  * `ensure_beaker_ip_on`: detect SUTs whose recorded `host[:ip]` was never
+    actually applied (e.g. EL10 under Vagrant, where the legacy ifcfg files
+    Vagrant writes for static private-network IPs are no longer supported and
+    the interface silently falls back to DHCP) and (re-)apply the expected
+    address via NetworkManager (reboot-safe), falling back to `ip addr add`.
+    Runs automatically alongside `activate_interfaces` in the global
+    `before(:all)` hook; disable with `BEAKER_no_fix_interfaces`.
+
 ### 3.0.0 / 2026-06-24
 * Changed (**Breaking**):
   * Dropped support for Puppet 7 / Ruby 2.7. CI now tests Puppet/OpenVox 8 only,

data/lib/simp/beaker_helpers/version.rb

@@ -4,5 +4,5 @@
 module Simp; end
 
 module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
-  VERSION = '3.0.0'
+  VERSION = '3.1.1'
 end

data/lib/simp/beaker_helpers.rb

@@ -976,6 +976,13 @@ module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
       # Ensure that all interfaces are active prior to collecting data
       activate_interfaces(host)
 
+      # Ensure the Beaker-recorded IP is actually applied before it is
+      # embedded in certificate subjectAltNames (on EL10 under Vagrant the
+      # static private-network IP is silently never applied and the
+      # interface falls back to DHCP; certs cut from the DHCP address no
+      # longer match the peer IDs once the address is corrected)
+      ensure_beaker_ip_on(host)
+
       networking_fact = pfact_on(host, 'networking')
       if networking_fact && networking_fact['interfaces']
         networking_fact['interfaces'].each_value do |data|
@@ -1138,6 +1145,64 @@ module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
     end
   end
 
+  # Ensure that the IP address that Beaker has recorded for each SUT is
+  # actually present on the system and (re-)apply it if it is not.
+  #
+  # Some OS/hypervisor combinations silently fail to configure the static IP
+  # for secondary (private) networks. In particular, Vagrant configures
+  # static IPs on RedHat-family guests by writing legacy ifcfg files, which
+  # EL10 no longer supports at all. The interface falls back to NetworkManager
+  # DHCP and receives an arbitrary address, so everything that targets the
+  # recorded `host[:ip]` (cross-SUT traffic, direct Net::SSH logins, etc.)
+  # fails with 'No route to host'.
+  #
+  # This detects the mismatch and applies the expected address to the
+  # interface that is attached to the same network, using NetworkManager so
+  # that the address survives reboots, and falling back to a runtime-only
+  # `ip addr add` when NetworkManager is not in use.
+  def ensure_beaker_ip_on(hosts)
+    return if ENV['BEAKER_no_fix_interfaces']
+
+    block_on(hosts, run_in_parallel: @run_in_parallel) do |host|
+      expected_ip = host[:ip]
+      next unless expected_ip
+      next if host[:platform].include?('windows')
+
+      # All currently assigned IPv4 addresses ('<iface> <address>/<prefix>')
+      addrs = on(host, %(ip -o -4 addr show), accept_all_exit_codes: true).stdout.lines.map { |line|
+        next unless line =~ %r{^\d+:\s+(\S+)\s+inet\s+(\S+)/(\d+)}
+        { iface: Regexp.last_match(1), ip: Regexp.last_match(2), prefix: Regexp.last_match(3) }
+      }.compact
+
+      next if addrs.any? { |a| a[:ip] == expected_ip }
+
+      require 'ipaddr'
+      target = addrs.find do |a|
+        IPAddr.new("#{a[:ip]}/#{a[:prefix]}").include?(expected_ip)
+      rescue IPAddr::Error
+        false
+      end
+
+      unless target
+        puts "  -- WARNING: #{host} does not have expected IP #{expected_ip} and no interface on that network could be found"
+        next
+      end
+
+      puts "  -- FIXING: #{host} expected IP #{expected_ip} but '#{target[:iface]}' has #{target[:ip]}"
+
+      nm_connection = on(host, %(nmcli -g GENERAL.CONNECTION device show #{target[:iface]}), accept_all_exit_codes: true).stdout.strip
+      if nm_connection.empty?
+        # Not NetworkManager-managed => runtime-only fallback
+        on(host, %(ip addr add #{expected_ip}/#{target[:prefix]} dev #{target[:iface]}), accept_all_exit_codes: true)
+      else
+        # Match Vagrant's static network behavior: fixed address, no gateway,
+        # and never a default route on the private interface
+        on(host, %(nmcli connection modify "#{nm_connection}" ipv4.method manual ipv4.addresses "#{expected_ip}/#{target[:prefix]}" ipv4.gateway "" ipv4.never-default yes))
+        on(host, %(nmcli connection up "#{nm_connection}"))
+      end
+    end
+  end
+
   ## Inline Hiera Helpers ##
   ## These will be integrated into core Beaker at some point ##
 
@@ -1152,6 +1217,10 @@ module Simp::BeakerHelpers # rubocop:disable Style/OneClassPerFile
 
       # We can't guarantee that the upstream vendor isn't disabling interfaces
       activate_interfaces(hosts)
+
+      # Some OS/hypervisor combinations (e.g. EL10 under Vagrant) fail to
+      # apply the static IP that Beaker expects for private networks
+      ensure_beaker_ip_on(hosts)
     end
 
     c.after(:all) do

data/spec/lib/simp/beaker_helpers_spec.rb

@@ -4,6 +4,7 @@ require 'simp/beaker_helpers'
 # redefine methods used in RSpec.configure withing Simp::BeakerHelpers
 def hosts; end
 def activate_interfaces(hosts); end
+def ensure_beaker_ip_on(hosts); end
 def clear_temp_hieradata; end
 
 class MyTestClass

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simp-beaker-helpers
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Chris Tessmer
 - Trevor Vaughan
 bindir: bin
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: beaker