Changes rock bases to bare

The whereabouts image is supposed to install the binaries on the host
it's running on. For this, it runs a bash script, which is why we still
need a few stage packages. Note that the helm chart uses pgrep in a
readiness / liveness probe.

We can no longer use ensure_image_contains_paths to check if files exist
in the rock images, since they are now bare-based. Instead, we can use
ensure_image_contains_paths_bare, which checks the image layers instead.
Because of this, we need sufficient permissions to check the
/var/lib/docker folder.

0.5.4/rockcraft.yaml

@@ -7,7 +7,7 @@ description: |
 license: Apache-2.0
 version: 0.5.4
 
-base: [email protected]
+base: bare
 build-base: [email protected]
 
 platforms:
@@ -33,6 +33,12 @@ parts:
     source-type: git
     source-tag: v${CRAFT_PROJECT_VERSION}
     source-depth: 1
+    stage-packages:
+      - bash
+      - coreutils
+      - sed
+      # Needed for pgrep, which is used as a liveness / readiness probe.
+      - procps
     build-snaps:
       - go/1.16/stable
     build-environment:

0.6.1/rockcraft.yaml

@@ -7,7 +7,7 @@ description: |
 license: Apache-2.0
 version: 0.6.1
 
-base: [email protected]
+base: bare
 build-base: [email protected]
 
 platforms:
@@ -33,6 +33,12 @@ parts:
     source-type: git
     source-tag: v${CRAFT_PROJECT_VERSION}
     source-depth: 1
+    stage-packages:
+      - bash
+      - coreutils
+      - sed
+      # Needed for pgrep, which is used as a liveness / readiness probe.
+      - procps
     build-snaps:
       - go/1.19/stable
     build-environment:

0.6.3/rockcraft.yaml

@@ -7,7 +7,7 @@ description: |
 license: Apache-2.0
 version: 0.6.3
 
-base: [email protected]
+base: bare
 build-base: [email protected]
 
 platforms:
@@ -33,6 +33,12 @@ parts:
     source-type: git
     source-tag: v${CRAFT_PROJECT_VERSION}
     source-depth: 1
+    stage-packages:
+      - bash
+      - coreutils
+      - sed
+      # Needed for pgrep, which is used as a liveness / readiness probe.
+      - procps
     build-snaps:
       - go/1.20/stable
     build-environment:

tests/sanity/test_whereabouts.py

@@ -20,7 +20,7 @@ def _test_whereabouts_rock(image_version, expected_files):
     image = rock.image
 
     # check rock filesystem
-    docker_util.ensure_image_contains_paths(image, expected_files)
+    docker_util.ensure_image_contains_paths_bare(image, expected_files)
 
     # check binary name and version.
     version = docker_util.get_image_version(image)
@@ -33,7 +33,7 @@ def _test_whereabouts_rock(image_version, expected_files):
     assert "KUBERNETES_SERVICE_HOST" in process.stderr
 
     # check script. It expects serviceaccount token to exist.
-    process = docker_util.run_in_docker(image, ["/install-cni.sh"], False)
+    process = docker_util.run_in_docker(image, ["bash", "-x", "/install-cni.sh"], False)
     assert (
         "cat: /var/run/secrets/kubernetes.io/serviceaccount/token: No such file or directory"
         in process.stderr

tests/tox.ini

@@ -35,8 +35,10 @@ commands =
 description = Run integration tests
 deps =
     -r {tox_root}/requirements-test.txt
+allowlist_externals =
+    sudo
 commands =
-    pytest -v \
+    sudo -E {envpython} -m pytest -v \
         --maxfail 1 \
         --tb native \
         --log-cli-level DEBUG \