From 460c70ac6c609af7bad2f1ef7b0b5958c0365fe3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?=
 <jsalmeron@vmware.com>
Date: Fri, 29 Sep 2023 11:22:32 +0200
Subject: [PATCH] [bitnami/mlflow] chore: :construction_worker: Add VIB
 integration (#50293)

* [bitnami/mlflow] chore: :construction_worker: Add VIB integration

This PR adds basic goss tests to the MLflow container. Runs:

- Common tests
- Version test
- User tests
- MLflow tracking server test

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* test: :white_check_mark: Improve signal handling and permissions

In the `mlflow-serve` test, the timeout command must be changed to use
SIGINT as `mlflow server` does not behave correctly when using SIGTERM.

In the directory tests, the permissions of the `/opt/bitnami/python`
folder are more restricted

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
---
 .vib/mlflow/goss/goss.yaml   | 14 ++++++++
 .vib/mlflow/goss/mlflow.yaml | 15 ++++++++
 .vib/mlflow/goss/vars.yaml   | 14 ++++++++
 .vib/mlflow/vib-verify.json  | 66 ++++++++++++++++++++++++++++++++++++
 4 files changed, 109 insertions(+)
 create mode 100644 .vib/mlflow/goss/goss.yaml
 create mode 100644 .vib/mlflow/goss/mlflow.yaml
 create mode 100644 .vib/mlflow/goss/vars.yaml
 create mode 100644 .vib/mlflow/vib-verify.json

diff --git a/.vib/mlflow/goss/goss.yaml b/.vib/mlflow/goss/goss.yaml
new file mode 100644
index 000000000000..f838ffa6e599
--- /dev/null
+++ b/.vib/mlflow/goss/goss.yaml
@@ -0,0 +1,14 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
+gossfile:
+  # Goss tests exclusive to the current container
+  ../../mlflow/goss/mlflow.yaml: {}
+  # Load scripts from .vib/common/goss/templates
+  ../../common/goss/templates/check-app-version.yaml: {}
+  ../../common/goss/templates/check-binaries.yaml: {}
+  ../../common/goss/templates/check-broken-symlinks.yaml: {}
+  ../../common/goss/templates/check-ca-certs.yaml: {}
+  ../../common/goss/templates/check-directories.yaml: {}
+  ../../common/goss/templates/check-linked-libraries.yaml: {}
+  ../../common/goss/templates/check-spdx.yaml: {}
diff --git a/.vib/mlflow/goss/mlflow.yaml b/.vib/mlflow/goss/mlflow.yaml
new file mode 100644
index 000000000000..b73b2635ea50
--- /dev/null
+++ b/.vib/mlflow/goss/mlflow.yaml
@@ -0,0 +1,15 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
+user:
+  mlflow:
+    exists: true
+    uid: 1001
+    gid: 0
+command:
+  mlflow-serve:
+    exec: cd /app && timeout --signal 2 --preserve-status 5 mlflow server
+    timeout: 10000
+    exit-status: 1
+    stderr:
+      - "Listening at"
diff --git a/.vib/mlflow/goss/vars.yaml b/.vib/mlflow/goss/vars.yaml
new file mode 100644
index 000000000000..193f0c3d0b9a
--- /dev/null
+++ b/.vib/mlflow/goss/vars.yaml
@@ -0,0 +1,14 @@
+binaries:
+  - python
+  - mlflow
+root_dir: /opt/bitnami
+directories:
+  - mode: "0755"
+    paths:
+      - /opt/bitnami/python
+  - mode: "0775"
+    paths:
+      - /app
+version:
+  bin_name: python
+  flag: "-c 'import mlflow; print(mlflow.__version__)'"
diff --git a/.vib/mlflow/vib-verify.json b/.vib/mlflow/vib-verify.json
new file mode 100644
index 000000000000..4be0b79bfb41
--- /dev/null
+++ b/.vib/mlflow/vib-verify.json
@@ -0,0 +1,66 @@
+{
+  "context": {
+    "resources": {
+      "url": "{SHA_ARCHIVE}",
+      "path": "{VIB_ENV_PATH}"
+    },
+    "runtime_parameters": "Y29tbWFuZDogWyJ0YWlsIiwgIi1mIiwgIi9kZXYvbnVsbCJd"
+  },
+  "phases": {
+    "package": {
+      "actions": [
+        {
+          "action_id": "container-image-package",
+          "params": {
+            "application": {
+              "details": {
+                "name": "{VIB_ENV_CONTAINER}",
+                "tag": "{VIB_ENV_TAG}"
+              }
+            },
+            "architectures": ["linux/amd64", "linux/arm64"]
+          }
+        },
+        {
+          "action_id": "container-image-lint",
+          "params": {
+            "threshold": "error"
+          }
+        }
+      ]
+    },
+    "verify": {
+      "actions": [
+        {
+          "action_id": "goss",
+          "params": {
+            "resources": {
+              "path": "/.vib"
+            },
+            "tests_file": "mlflow/goss/goss.yaml",
+            "vars_file": "mlflow/goss/vars.yaml",
+            "remote": {
+              "pod": {
+                "workload": "deploy-mlflow"
+              }
+            }
+          }
+        },
+        {
+          "action_id": "trivy",
+          "params": {
+            "threshold": "CRITICAL",
+            "vuln_type": ["OS"]
+          }
+        },
+        {
+          "action_id": "grype",
+          "params": {
+            "threshold": "CRITICAL",
+            "package_type": ["OS"]
+          }
+        }
+      ]
+    }
+  }
+}