From 5f09d9b60d11b6d96b394a8266e30b3edf0519b6 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Tue, 16 Aug 2022 09:58:02 -0400
Subject: Fix podman kube generate --help to show correct help message

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 test/system/710-kube.bats | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 test/system/710-kube.bats

(limited to 'test/system')

diff --git a/test/system/710-kube.bats b/test/system/710-kube.bats
new file mode 100644
index 000000000..2608ad34e
--- /dev/null
+++ b/test/system/710-kube.bats
@@ -0,0 +1,15 @@
+#!/usr/bin/env bats   -*- bats -*-
+#
+# Test podman kube generate
+#
+
+load helpers
+
+@test "podman kube generate - basic" {
+    run_podman kube generate --help
+    is "$output" ".*podman.* kube generate \[options\] {CONTAINER...|POD...|VOLUME...}"
+    run_podman generate kube --help
+    is "$output" ".*podman.* generate kube \[options\] {CONTAINER...|POD...|VOLUME...}"
+}
+
+# vim: filetype=sh
-- 
cgit v1.2.3-54-g00ecf


From 2a6daa1e313c18814192548627058a85dc97f158 Mon Sep 17 00:00:00 2001
From: Lokesh Mandvekar <lsm5@fedoraproject.org>
Date: Wed, 17 Aug 2022 09:11:06 -0400
Subject: Cirrus: add podman_machine_aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Run machine tests on every PR as label-driven machine test
triggering is currently hard to predict and debug.

Co-authored-by: Ed Santiago <santiago@redhat.com>
Co-authored-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
---
 .cirrus.yml                        | 35 +++++++++++++++++++++++++++--------
 contrib/cirrus/cirrus_yaml_test.py |  2 +-
 pkg/machine/e2e/basic_test.go      |  8 ++++++++
 test/system/200-pod.bats           |  2 +-
 4 files changed, 37 insertions(+), 10 deletions(-)

(limited to 'test/system')

diff --git a/.cirrus.yml b/.cirrus.yml
index f94ee2f3b..e3ddc4933 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -681,11 +681,6 @@ podman_machine_task:
     # Required_pr_labels does not apply to non-PRs.
     # Do not run on tags, branches, [CI:BUILD], or [CI:DOCS].
     only_if: *not_tag_branch_build_docs
-    # This task costs about $4 per attempt to execute.
-    # Only run it if a magic PR label is present.
-    # DO NOT ADD THIS TASK AS DEPENDENCY FOR `success_task`
-    # it will cause an infinate-block / never completing build.
-    required_pr_labels: test_podman_machine
     depends_on:
         - build
         - local_integration_test
@@ -708,6 +703,31 @@ podman_machine_task:
     always: *int_logs_artifacts
 
 
+podman_machine_aarch64_task:
+    name: *std_name_fmt
+    alias: podman_machine_aarch64
+    only_if: *not_tag_branch_build_docs
+    depends_on:
+        - build_aarch64
+        - validate_aarch64
+        - local_integration_test
+        - remote_integration_test
+        - container_integration_test
+        - rootless_integration_test
+    ec2_instance:
+        <<: *standard_build_ec2_aarch64
+    env:
+        TEST_FLAVOR: "machine"
+        EC2_INST_TYPE: c6g.metal
+        PRIV_NAME: "rootless"  # intended use-case
+        DISTRO_NV: "${FEDORA_AARCH64_NAME}"
+        VM_IMAGE_NAME: "${FEDORA_AARCH64_AMI}"
+    clone_script: *get_gosrc_aarch64
+    setup_script: *setup
+    main_script: *main
+    always: *int_logs_artifacts
+
+
 # Always run subsequent to integration tests.  While parallelism is lost
 # with runtime, debugging system-test failures can be more challenging
 # for some golang developers.  Otherwise the following tasks run across
@@ -1003,9 +1023,8 @@ success_task:
         - remote_integration_test
         - container_integration_test
         - rootless_integration_test
-        # Label triggered task. If made automatic, remove line below
-        # AND bypass in contrib/cirrus/cirrus_yaml_test.py for this name.
-        # - podman_machine
+        - podman_machine
+        - podman_machine_aarch64
         - local_system_test
         - local_system_test_aarch64
         - remote_system_test
diff --git a/contrib/cirrus/cirrus_yaml_test.py b/contrib/cirrus/cirrus_yaml_test.py
index 3968b8b1b..a7fff8d3f 100755
--- a/contrib/cirrus/cirrus_yaml_test.py
+++ b/contrib/cirrus/cirrus_yaml_test.py
@@ -26,7 +26,7 @@ class TestCaseBase(unittest.TestCase):
 class TestDependsOn(TestCaseBase):
 
     ALL_TASK_NAMES = None
-    SUCCESS_DEPS_EXCLUDE = set(['success', 'artifacts', 'podman_machine',
+    SUCCESS_DEPS_EXCLUDE = set(['success', 'artifacts',
         'test_image_build', 'release', 'release_test'])
 
     def setUp(self):
diff --git a/pkg/machine/e2e/basic_test.go b/pkg/machine/e2e/basic_test.go
index da0310485..fa1728770 100644
--- a/pkg/machine/e2e/basic_test.go
+++ b/pkg/machine/e2e/basic_test.go
@@ -1,6 +1,8 @@
 package e2e_test
 
 import (
+	"os"
+
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	. "github.com/onsi/gomega/gexec"
@@ -20,6 +22,12 @@ var _ = Describe("run basic podman commands", func() {
 	})
 
 	It("Basic ops", func() {
+		// golangci-lint has trouble with actually skipping tests marked Skip
+		// so skip it on cirrus envs and where CIRRUS_CI isn't set.
+		if os.Getenv("CIRRUS_CI") != "false" {
+			Skip("FIXME: #15347 - ssh know hosts broken - fails on PR runs and on x86_64")
+		}
+
 		name := randomString()
 		i := new(initMachine)
 		session, err := mb.setName(name).setCmd(i.withImagePath(mb.imagePath).withNow()).run()
diff --git a/test/system/200-pod.bats b/test/system/200-pod.bats
index b1b9ee5e1..b9063ad1b 100644
--- a/test/system/200-pod.bats
+++ b/test/system/200-pod.bats
@@ -478,7 +478,7 @@ spec:
 }
 
 @test "pod resource limits" {
-    # FIXME: #15074 - possible flake on aarch64
+    skip_if_aarch64 "FIXME: #15074 - flakes on aarch64 non-remote"
     skip_if_remote "resource limits only implemented on non-remote"
     skip_if_rootless "resource limits only work with root"
     skip_if_cgroupsv1 "resource limits only meaningful on cgroups V2"
-- 
cgit v1.2.3-54-g00ecf


From 09ef6fc66cac44dec94c29cd7a1a53f70831446d Mon Sep 17 00:00:00 2001
From: Ed Santiago <santiago@redhat.com>
Date: Wed, 17 Aug 2022 11:50:41 -0600
Subject: podman generate kube - add actual tests

This exposed a nasty bug in our system-test setup: Ubuntu (runc)
was writing a scratch containers.conf file, and setting CONTAINERS_CONF
to point to it. This was well-intentionedly introduced in #10199 as
part of our long sad history of not testing runc. What I did not
understand at that time is that CONTAINERS_CONF is **dangerous**:
it does not mean "I will read standard containers.conf and then
override", it means "I will **IGNORE** standard containers.conf
and use only the settings in this file"! So on Ubuntu we were
losing all the default settings: capabilities, sysctls, all.

Yes, this is documented in containers.conf(5) but it is such
a huge violation of POLA that I need to repeat it.

In #14972, as yet another attempt to fix our runc crisis, I
introduced a new runc-override mechanism: create a custom
/etc/containers/containers.conf when OCI_RUNTIME=runc.
Unlike the CONTAINERS_CONF envariable, the /etc file
actually means what you think it means: "read the default
file first, then override with the /etc file contents".
I.e., we get the desired defaults. But I didn't remember
this helpers.bash workaround, so our runc testing has
actually been flawed: we have not been testing with
the system containers.conf. This commit removes the
no-longer-needed and never-actually-wanted workaround,
and by virtue of testing the cap-drops in kube generate,
we add a regression test to make sure this never happens
again.

It's a little scary that we haven't been testing capabilities.

Also scary: this PR requires python, for converting yaml to json.
I think that should be safe: python3 'import yaml' and 'json'
works fine on a RHEL8.7 VM from 1minutetip.

Signed-off-by: Ed Santiago <santiago@redhat.com>
---
 test/system/710-kube.bats | 158 +++++++++++++++++++++++++++++++++++++++++++++-
 test/system/helpers.bash  |  14 ----
 2 files changed, 157 insertions(+), 15 deletions(-)

(limited to 'test/system')

diff --git a/test/system/710-kube.bats b/test/system/710-kube.bats
index 2608ad34e..58e42148a 100644
--- a/test/system/710-kube.bats
+++ b/test/system/710-kube.bats
@@ -5,11 +5,167 @@
 
 load helpers
 
-@test "podman kube generate - basic" {
+# standard capability drop list
+capabilities='{"drop":["CAP_MKNOD","CAP_NET_RAW","CAP_AUDIT_WRITE"]}'
+
+# Warning that is emitted once on containers, multiple times on pods
+kubernetes_63='Truncation Annotation: .* Kubernetes only allows 63 characters'
+
+# filter: convert yaml to json, because bash+yaml=madness
+function yaml2json() {
+    egrep -v "$kubernetes_63" | python3 -c 'import yaml
+import json
+import sys
+json.dump(yaml.safe_load(sys.stdin), sys.stdout)'
+}
+
+###############################################################################
+# BEGIN tests
+
+@test "podman kube generate - usage message" {
     run_podman kube generate --help
     is "$output" ".*podman.* kube generate \[options\] {CONTAINER...|POD...|VOLUME...}"
     run_podman generate kube --help
     is "$output" ".*podman.* generate kube \[options\] {CONTAINER...|POD...|VOLUME...}"
 }
 
+@test "podman kube generate - container" {
+    cname=c$(random_string 15)
+    run_podman container create --name $cname $IMAGE top
+    run_podman kube generate $cname
+
+    # Convert yaml to json, and dump to stdout (to help in case of errors)
+    json=$(yaml2json <<<"$output")
+    jq . <<<"$json"
+
+    # What we expect to see. This is by necessity an incomplete list.
+    # For instance, it does not include org.opencontainers.image.base.*
+    # because sometimes we get that, sometimes we don't. No clue why.
+    #
+    # And, unfortunately, if new fields are added to the YAML, we won't
+    # test those unless a developer remembers to add them here.
+    #
+    # Reasons for doing it this way, instead of straight-comparing yaml:
+    #   1) the arbitrariness of the org.opencontainers.image.base annotations
+    #   2) YAML order is nondeterministic, so on a pod with two containers
+    #      (as in the pod test below) we cannot rely on cname1/cname2.
+    expect="
+apiVersion | =  | v1
+kind       | =  | Pod
+
+metadata.annotations.\"io.kubernetes.cri-o.TTY/$cname\"           | =  | false
+metadata.annotations.\"io.podman.annotations.autoremove/$cname\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.init/$cname\"        | =  | FALSE
+metadata.annotations.\"io.podman.annotations.privileged/$cname\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.publish-all/$cname\" | =  | FALSE
+
+metadata.creationTimestamp | =~ | [0-9T:-]\\+Z
+metadata.labels.app        | =  | ${cname}-pod
+metadata.name              | =  | ${cname}-pod
+
+spec.containers[0].command       | =  | [\"top\"]
+spec.containers[0].image         | =  | $IMAGE
+spec.containers[0].name          | =  | $cname
+
+spec.containers[0].securityContext.capabilities  | =  | $capabilities
+
+status                           | =  | null
+"
+
+    # Parse and check all those
+    while read key op expect; do
+        actual=$(jq -r -c ".$key" <<<"$json")
+        assert "$actual" $op "$expect" ".$key"
+    done < <(parse_table "$expect")
+
+    if ! is_remote; then
+        count=$(egrep -c "$kubernetes_63" <<<"$output")
+        assert "$count" = 1 "1 instance of the Kubernetes-63-char warning"
+    fi
+
+    run_podman rm $cname
+}
+
+@test "podman kube generate - pod" {
+    local pname=p$(random_string 15)
+    local cname1=c1$(random_string 15)
+    local cname2=c2$(random_string 15)
+
+    run_podman pod create --name $pname --publish 9999:8888
+
+    # Needs at least one container. Error is slightly different between
+    # regular and remote podman:
+    #   regular: Error: pod ... only has...
+    #   remote:  Error: error generating YAML: pod ... only has...
+    run_podman 125 kube generate $pname
+    assert "$output" =~ "Error: .* only has an infra container"
+
+    run_podman container create --name $cname1 --pod $pname $IMAGE top
+    run_podman container create --name $cname2 --pod $pname $IMAGE bottom
+    run_podman kube generate $pname
+
+    json=$(yaml2json <<<"$output")
+    jq . <<<"$json"
+
+    # See container test above for description of this table
+    expect="
+apiVersion | =  | v1
+kind       | =  | Pod
+
+metadata.annotations.\"io.kubernetes.cri-o.ContainerType/$cname1\" | =  | container
+metadata.annotations.\"io.kubernetes.cri-o.ContainerType/$cname2\" | =  | container
+metadata.annotations.\"io.kubernetes.cri-o.SandboxID/$cname1\"     | =~ | [0-9a-f]\\{56\\}
+metadata.annotations.\"io.kubernetes.cri-o.SandboxID/$cname2\"     | =~ | [0-9a-f]\\{56\\}
+metadata.annotations.\"io.kubernetes.cri-o.TTY/$cname1\"           | =  | false
+metadata.annotations.\"io.kubernetes.cri-o.TTY/$cname2\"           | =  | false
+metadata.annotations.\"io.podman.annotations.autoremove/$cname1\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.autoremove/$cname2\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.init/$cname1\"        | =  | FALSE
+metadata.annotations.\"io.podman.annotations.init/$cname2\"        | =  | FALSE
+metadata.annotations.\"io.podman.annotations.privileged/$cname1\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.privileged/$cname2\"  | =  | FALSE
+metadata.annotations.\"io.podman.annotations.publish-all/$cname1\" | =  | FALSE
+metadata.annotations.\"io.podman.annotations.publish-all/$cname2\" | =  | FALSE
+
+metadata.creationTimestamp | =~ | [0-9T:-]\\+Z
+metadata.labels.app        | =  | ${pname}
+metadata.name              | =  | ${pname}
+
+spec.hostname                              | =  | $pname
+spec.restartPolicy                         | =  | Never
+
+spec.containers[0].command                 | =  | [\"top\"]
+spec.containers[0].image                   | =  | $IMAGE
+spec.containers[0].name                    | =  | $cname1
+spec.containers[0].ports[0].containerPort  | =  | 8888
+spec.containers[0].ports[0].hostPort       | =  | 9999
+spec.containers[0].resources               | =  | {}
+
+spec.containers[1].command                 | =  | [\"bottom\"]
+spec.containers[1].image                   | =  | $IMAGE
+spec.containers[1].name                    | =  | $cname2
+spec.containers[1].ports                   | =  | null
+spec.containers[1].resources               | =  | {}
+
+spec.containers[0].securityContext.capabilities  | =  | $capabilities
+
+status  | =  | {}
+"
+
+    while read key op expect; do
+        actual=$(jq -r -c ".$key" <<<"$json")
+        assert "$actual" $op "$expect" ".$key"
+    done < <(parse_table "$expect")
+
+    # Why 4? Maybe two for each container?
+    if ! is_remote; then
+        count=$(egrep -c "$kubernetes_63" <<<"$output")
+        assert "$count" = 4 "instances of the Kubernetes-63-char warning"
+    fi
+
+    run_podman rm $cname1 $cname2
+    run_podman pod rm $pname
+    run_podman rmi $(pause_image)
+}
+
 # vim: filetype=sh
diff --git a/test/system/helpers.bash b/test/system/helpers.bash
index 5ff3fae6d..f2eb3016c 100644
--- a/test/system/helpers.bash
+++ b/test/system/helpers.bash
@@ -36,20 +36,6 @@ fi
 # That way individual tests can override with their own setup/teardown,
 # while retaining the ability to include these if they so desire.
 
-# Some CI systems set this to runc, overriding the default crun.
-if [[ -n $OCI_RUNTIME ]]; then
-    if [[ -z $CONTAINERS_CONF ]]; then
-        # FIXME: BATS provides no mechanism for end-of-run cleanup[1]; how
-        # can we avoid leaving this file behind when we finish?
-        #   [1] https://github.com/bats-core/bats-core/issues/39
-        export CONTAINERS_CONF=$(mktemp --tmpdir=${BATS_TMPDIR:-/tmp} podman-bats-XXXXXXX.containers.conf)
-        cat >$CONTAINERS_CONF <<EOF
-[engine]
-runtime="$OCI_RUNTIME"
-EOF
-    fi
-fi
-
 # Setup helper: establish a test environment with exactly the images needed
 function basic_setup() {
     # Clean up all containers
-- 
cgit v1.2.3-54-g00ecf


From 64339d47c105373557248d45fddf7ab2db435180 Mon Sep 17 00:00:00 2001
From: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
Date: Tue, 23 Aug 2022 11:54:31 +0900
Subject: Warning messages are printed and ignored if we use an unsupported
 option

When an unsupported limit on cgroups V1 rootless systems
is requested, podman prints an warning message and
ignores the option/flag.

```
  Target options/flags:
    --cpu-period, --cpu-quota, --cpu-rt-period, --cpu-rt-runtime,
    --cpus, --cpu-shares, --cpuset-cpus, --cpuset-mems, --memory,
    --memory-reservation, --memory-swap, --memory-swappiness,
    --blkio-weight, --device-read-bps, --device-write-bps,
    --device-read-iops, --device-write-iops, --blkio-weight-device
```

Related to https://github.com/containers/podman/discussions/10152

Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
---
 docs/source/markdown/options/blkio-weight.md        |  2 ++
 docs/source/markdown/options/cpu-period.md          |  2 ++
 docs/source/markdown/options/cpu-quota.md           |  2 ++
 docs/source/markdown/options/cpu-rt-period.md       |  2 +-
 docs/source/markdown/options/cpu-rt-runtime.md      |  2 +-
 docs/source/markdown/options/cpu-shares.md          |  2 ++
 docs/source/markdown/options/cpuset-cpus.md         |  2 ++
 docs/source/markdown/options/cpuset-mems.md         |  2 ++
 docs/source/markdown/options/memory-swappiness.md   |  2 +-
 docs/source/markdown/podman-container-clone.1.md.in | 12 ++++++++++++
 docs/source/markdown/podman-create.1.md.in          | 16 ++++++++++++++++
 docs/source/markdown/podman-run.1.md.in             | 16 ++++++++++++++++
 pkg/specgen/generate/validate.go                    |  6 ++++++
 test/e2e/container_clone_test.go                    |  1 +
 test/e2e/create_test.go                             |  2 ++
 test/e2e/generate_kube_test.go                      |  2 ++
 test/e2e/generate_spec_test.go                      |  2 ++
 test/system/030-run.bats                            |  7 ++++++-
 18 files changed, 78 insertions(+), 4 deletions(-)

(limited to 'test/system')

diff --git a/docs/source/markdown/options/blkio-weight.md b/docs/source/markdown/options/blkio-weight.md
index eb8e94144..04a1071c0 100644
--- a/docs/source/markdown/options/blkio-weight.md
+++ b/docs/source/markdown/options/blkio-weight.md
@@ -1,3 +1,5 @@
 #### **--blkio-weight**=*weight*
 
 Block IO relative weight. The _weight_ is a value between **10** and **1000**.
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/cpu-period.md b/docs/source/markdown/options/cpu-period.md
index efbe6c2ab..5c5eb56e7 100644
--- a/docs/source/markdown/options/cpu-period.md
+++ b/docs/source/markdown/options/cpu-period.md
@@ -8,3 +8,5 @@ microseconds.
 On some systems, changing the resource limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/cpu-quota.md b/docs/source/markdown/options/cpu-quota.md
index 753797bad..81d5db3d2 100644
--- a/docs/source/markdown/options/cpu-quota.md
+++ b/docs/source/markdown/options/cpu-quota.md
@@ -10,3 +10,5 @@ ends (controllable via **--cpu-period**).
 On some systems, changing the resource limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/cpu-rt-period.md b/docs/source/markdown/options/cpu-rt-period.md
index 9014beb33..36e88632e 100644
--- a/docs/source/markdown/options/cpu-rt-period.md
+++ b/docs/source/markdown/options/cpu-rt-period.md
@@ -4,4 +4,4 @@ Limit the CPU real-time period in microseconds.
 
 Limit the container's Real Time CPU usage. This option tells the kernel to restrict the container's Real Time CPU usage to the period specified.
 
-This option is not supported on cgroups V2 systems.
+This option is only supported on cgroups V1 rootful systems.
diff --git a/docs/source/markdown/options/cpu-rt-runtime.md b/docs/source/markdown/options/cpu-rt-runtime.md
index 05b1d3b96..64f0ec38b 100644
--- a/docs/source/markdown/options/cpu-rt-runtime.md
+++ b/docs/source/markdown/options/cpu-rt-runtime.md
@@ -7,4 +7,4 @@ Period of 1,000,000us and Runtime of 950,000us means that this container could c
 
 The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup.
 
-This option is not supported on cgroups V2 systems.
+This option is only supported on cgroups V1 rootful systems.
diff --git a/docs/source/markdown/options/cpu-shares.md b/docs/source/markdown/options/cpu-shares.md
index c2115c1bf..c0e2c3035 100644
--- a/docs/source/markdown/options/cpu-shares.md
+++ b/docs/source/markdown/options/cpu-shares.md
@@ -37,3 +37,5 @@ this can result in the following division of CPU shares:
 On some systems, changing the resource limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/cpuset-cpus.md b/docs/source/markdown/options/cpuset-cpus.md
index a67766897..8a2a82e9f 100644
--- a/docs/source/markdown/options/cpuset-cpus.md
+++ b/docs/source/markdown/options/cpuset-cpus.md
@@ -7,3 +7,5 @@ CPUs in which to allow execution. Can be specified as a comma-separated list
 On some systems, changing the resource limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/cpuset-mems.md b/docs/source/markdown/options/cpuset-mems.md
index 1eeab7b13..b86d0ef6b 100644
--- a/docs/source/markdown/options/cpuset-mems.md
+++ b/docs/source/markdown/options/cpuset-mems.md
@@ -10,3 +10,5 @@ two memory nodes.
 On some systems, changing the resource limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
+
+This option is not supported on cgroups V1 rootless systems.
diff --git a/docs/source/markdown/options/memory-swappiness.md b/docs/source/markdown/options/memory-swappiness.md
index 65f0ef310..1e6a51188 100644
--- a/docs/source/markdown/options/memory-swappiness.md
+++ b/docs/source/markdown/options/memory-swappiness.md
@@ -2,4 +2,4 @@
 
 Tune a container's memory swappiness behavior. Accepts an integer between *0* and *100*.
 
-This flag is not supported on cgroups V2 systems.
+This flag is only supported on cgroups V1 rootful systems.
diff --git a/docs/source/markdown/podman-container-clone.1.md.in b/docs/source/markdown/podman-container-clone.1.md.in
index cf760d7a2..26f414b62 100644
--- a/docs/source/markdown/podman-container-clone.1.md.in
+++ b/docs/source/markdown/podman-container-clone.1.md.in
@@ -40,6 +40,8 @@ Set a number of CPUs for the container that overrides the original containers CP
 This is shorthand
 for **--cpu-period** and **--cpu-quota**, so only **--cpus** or either both the **--cpu-period** and **--cpu-quota** options can be set.
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option cpuset-cpus
 
 If none are specified, the original container's CPUset is used.
@@ -54,10 +56,14 @@ If none are specified, the original container's CPU memory nodes are used.
 
 Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-write-bps**=*path*
 
 Limit write rate (bytes per second) to a device (e.g. --device-write-bps=/dev/sda:1mb)
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--force**, **-f**
 
 Force removal of the original container that we are cloning. Can only be used in conjunction with **--destroy**.
@@ -74,6 +80,8 @@ system's page size (the value would be very large, that's millions of trillions)
 
 If no memory limits are specified, the original container's will be used.
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-reservation**=*limit*
 
 Memory soft limit (format: `<number>[<unit>]`, where unit = b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes))
@@ -84,6 +92,8 @@ reservation. So you should always set the value below **--memory**, otherwise th
 hard limit will take precedence. By default, memory reservation will be the same
 as memory limit from the container being cloned.
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-swap**=*limit*
 
 A limit value equal to memory plus swap. Must be used with the  **-m**
@@ -95,6 +105,8 @@ The format of `LIMIT` is `<number>[<unit>]`. Unit can be `b` (bytes),
 `k` (kibibytes), `m` (mebibytes), or `g` (gibibytes). If you don't specify a
 unit, `b` is used. Set LIMIT to `-1` to enable unlimited swap.
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option memory-swappiness
 
 #### **--name**
diff --git a/docs/source/markdown/podman-create.1.md.in b/docs/source/markdown/podman-create.1.md.in
index 7ec4fc66f..74348ac7d 100644
--- a/docs/source/markdown/podman-create.1.md.in
+++ b/docs/source/markdown/podman-create.1.md.in
@@ -131,6 +131,8 @@ On some systems, changing the CPU limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-cpu-limits-fails-with-a-permissions-error
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option cpuset-cpus
 
 @@option cpuset-mems
@@ -165,18 +167,26 @@ Add a rule to the cgroup allowed devices list. The rule is expected to be in the
 
 Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb)
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-read-iops**=*path*
 
 Limit read rate (IO per second) from a device (e.g. --device-read-iops=/dev/sda:1000)
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-write-bps**=*path*
 
 Limit write rate (bytes per second) to a device (e.g. --device-write-bps=/dev/sda:1mb)
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-write-iops**=*path*
 
 Limit write rate (IO per second) to a device (e.g. --device-write-iops=/dev/sda:1000)
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--disable-content-trust**
 
 This is a Docker specific option to disable image verification to a Docker
@@ -366,6 +376,8 @@ RAM. If a limit of 0 is specified (not using **-m**), the container's memory is
 not limited. The actual limit may be rounded up to a multiple of the operating
 system's page size (the value would be very large, that's millions of trillions).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-reservation**=*limit*
 
 Memory soft limit (format: `<number>[<unit>]`, where unit = b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes))
@@ -376,6 +388,8 @@ reservation. So you should always set the value below **--memory**, otherwise th
 hard limit will take precedence. By default, memory reservation will be the same
 as memory limit.
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-swap**=*limit*
 
 A limit value equal to memory plus swap. Must be used with the  **-m**
@@ -387,6 +401,8 @@ The format of `LIMIT` is `<number>[<unit>]`. Unit can be `b` (bytes),
 `k` (kibibytes), `m` (mebibytes), or `g` (gibibytes). If you don't specify a
 unit, `b` is used. Set LIMIT to `-1` to enable unlimited swap.
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option memory-swappiness
 
 @@option mount
diff --git a/docs/source/markdown/podman-run.1.md.in b/docs/source/markdown/podman-run.1.md.in
index d10520e35..e943ec005 100644
--- a/docs/source/markdown/podman-run.1.md.in
+++ b/docs/source/markdown/podman-run.1.md.in
@@ -146,6 +146,8 @@ On some systems, changing the CPU limits may not be allowed for non-root
 users. For more details, see
 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-cpu-limits-fails-with-a-permissions-error
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option cpuset-cpus
 
 @@option cpuset-mems
@@ -196,18 +198,26 @@ Add a rule to the cgroup allowed devices list
 
 Limit read rate (in bytes per second) from a device (e.g. **--device-read-bps=/dev/sda:1mb**).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-read-iops**=*path:rate*
 
 Limit read rate (in IO operations per second) from a device (e.g. **--device-read-iops=/dev/sda:1000**).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-write-bps**=*path:rate*
 
 Limit write rate (in bytes per second) to a device (e.g. **--device-write-bps=/dev/sda:1mb**).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--device-write-iops**=*path:rate*
 
 Limit write rate (in IO operations per second) to a device (e.g. **--device-write-iops=/dev/sda:1000**).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--disable-content-trust**
 
 This is a Docker specific option to disable image verification to a Docker
@@ -377,6 +387,8 @@ RAM. If a limit of 0 is specified (not using **-m**), the container's memory is
 not limited. The actual limit may be rounded up to a multiple of the operating
 system's page size (the value would be very large, that's millions of trillions).
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-reservation**=*number[unit]*
 
 Memory soft limit. A _unit_ can be **b** (bytes), **k** (kibibytes), **m** (mebibytes), or **g** (gibibytes).
@@ -387,6 +399,8 @@ reservation. So you should always set the value below **--memory**, otherwise th
 hard limit will take precedence. By default, memory reservation will be the same
 as memory limit.
 
+This option is not supported on cgroups V1 rootless systems.
+
 #### **--memory-swap**=*number[unit]*
 
 A limit value equal to memory plus swap.
@@ -399,6 +413,8 @@ the value of **--memory**.
 
 Set _number_ to **-1** to enable unlimited swap.
 
+This option is not supported on cgroups V1 rootless systems.
+
 @@option memory-swappiness
 
 @@option mount
diff --git a/pkg/specgen/generate/validate.go b/pkg/specgen/generate/validate.go
index 9c933d747..3c5d5fb96 100644
--- a/pkg/specgen/generate/validate.go
+++ b/pkg/specgen/generate/validate.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/containers/common/pkg/cgroups"
 	"github.com/containers/common/pkg/sysinfo"
+	"github.com/containers/podman/v4/pkg/rootless"
 	"github.com/containers/podman/v4/pkg/specgen"
 	"github.com/containers/podman/v4/utils"
 )
@@ -19,6 +20,11 @@ func verifyContainerResourcesCgroupV1(s *specgen.SpecGenerator) ([]string, error
 
 	sysInfo := sysinfo.New(true)
 
+	if s.ResourceLimits != nil && rootless.IsRootless() {
+		s.ResourceLimits = nil
+		warnings = append(warnings, "Resource limits are not supported and ignored on cgroups V1 rootless systems")
+	}
+
 	if s.ResourceLimits == nil {
 		return warnings, nil
 	}
diff --git a/test/e2e/container_clone_test.go b/test/e2e/container_clone_test.go
index 94ccd6ffe..d7641e42a 100644
--- a/test/e2e/container_clone_test.go
+++ b/test/e2e/container_clone_test.go
@@ -87,6 +87,7 @@ var _ = Describe("Podman container clone", func() {
 	})
 
 	It("podman container clone resource limits override", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		create := podmanTest.Podman([]string{"create", "--cpus=5", ALPINE})
 		create.WaitWithDefaultTimeout()
 		Expect(create).To(Exit(0))
diff --git a/test/e2e/create_test.go b/test/e2e/create_test.go
index 9679aad24..b35d0f3c5 100644
--- a/test/e2e/create_test.go
+++ b/test/e2e/create_test.go
@@ -438,6 +438,7 @@ var _ = Describe("Podman create", func() {
 	})
 
 	It("podman create with -m 1000000 sets swap to 2000000", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		numMem := 1000000
 		ctrName := "testCtr"
 		session := podmanTest.Podman([]string{"create", "-t", "-m", fmt.Sprintf("%db", numMem), "--name", ctrName, ALPINE, "/bin/sh"})
@@ -452,6 +453,7 @@ var _ = Describe("Podman create", func() {
 	})
 
 	It("podman create --cpus 5 sets nanocpus", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		numCpus := 5
 		nanoCPUs := numCpus * 1000000000
 		ctrName := "testCtr"
diff --git a/test/e2e/generate_kube_test.go b/test/e2e/generate_kube_test.go
index 142f32d19..e7ceaf2d2 100644
--- a/test/e2e/generate_kube_test.go
+++ b/test/e2e/generate_kube_test.go
@@ -490,6 +490,7 @@ var _ = Describe("Podman generate kube", func() {
 	})
 
 	It("podman generate kube on pod with memory limit", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		podName := "testMemoryLimit"
 		podSession := podmanTest.Podman([]string{"pod", "create", "--name", podName})
 		podSession.WaitWithDefaultTimeout()
@@ -515,6 +516,7 @@ var _ = Describe("Podman generate kube", func() {
 	})
 
 	It("podman generate kube on pod with cpu limit", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		podName := "testCpuLimit"
 		podSession := podmanTest.Podman([]string{"pod", "create", "--name", podName})
 		podSession.WaitWithDefaultTimeout()
diff --git a/test/e2e/generate_spec_test.go b/test/e2e/generate_spec_test.go
index 57cd9546b..9188b5222 100644
--- a/test/e2e/generate_spec_test.go
+++ b/test/e2e/generate_spec_test.go
@@ -41,6 +41,7 @@ var _ = Describe("Podman generate spec", func() {
 	})
 
 	It("podman generate spec basic usage", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		session := podmanTest.Podman([]string{"create", "--cpus", "5", "--name", "specgen", ALPINE})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
@@ -51,6 +52,7 @@ var _ = Describe("Podman generate spec", func() {
 	})
 
 	It("podman generate spec file", func() {
+		SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
 		session := podmanTest.Podman([]string{"create", "--cpus", "5", "--name", "specgen", ALPINE})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 908c169ee..a3bfe5780 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -56,7 +56,12 @@ echo $rand        |   0 | $rand
 
 @test "podman run --memory=0 runtime option" {
     run_podman run --memory=0 --rm $IMAGE echo hello
-    is "$output" "hello" "failed to run when --memory is set to 0"
+    if is_rootless && ! is_cgroupsv2; then
+        is "${lines[0]}" "Resource limits are not supported and ignored on cgroups V1 rootless systems" "--memory is not supported"
+        is "${lines[1]}" "hello" "--memory is ignored"
+    else
+        is "$output" "hello" "failed to run when --memory is set to 0"
+    fi
 }
 
 # 'run --preserve-fds' passes a number of additional file descriptors into the container
-- 
cgit v1.2.3-54-g00ecf


From 5f719b533ec6468911a284f2d901d65c098f4539 Mon Sep 17 00:00:00 2001
From: Niall Crowe <nicrowe@redhat.com>
Date: Tue, 16 Aug 2022 15:38:59 +0100
Subject: podman kube play/down --read from URL

`podman kube play` can create pods and containers from YAML
read from a URL poiniting to a YAML file.
For example: `podman kube play https://example.com/demo.yml`.
`podman kube down` can also teardown pods and containers created
from that YAML file by also reading YAML from a URL, provided the
YAML file the URL points to has not been changed or altered since
it was used to create pods and containers

Closes #14955
Signed-off-by: Niall Crowe <nicrowe@redhat.com>
---
 cmd/podman/kube/down.go                       |  3 ++-
 cmd/podman/kube/play.go                       | 26 +++++++++++++++++++++++---
 docs/source/markdown/podman-kube-down.1.md    | 27 ++++++++++++++++++++++++---
 docs/source/markdown/podman-kube-play.1.md.in | 20 ++++++++++++++++++--
 test/system/700-play.bats                     | 25 +++++++++++++++++++++++++
 5 files changed, 92 insertions(+), 9 deletions(-)

(limited to 'test/system')

diff --git a/cmd/podman/kube/down.go b/cmd/podman/kube/down.go
index a670d911c..792c80499 100644
--- a/cmd/podman/kube/down.go
+++ b/cmd/podman/kube/down.go
@@ -19,7 +19,8 @@ var (
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: common.AutocompleteDefaultOneArg,
 		Example: `podman kube down nginx.yml
-   cat nginx.yml | podman kube down -`,
+   cat nginx.yml | podman kube down -
+   podman kube down https://example.com/nginx.yml`,
 	}
 )
 
diff --git a/cmd/podman/kube/play.go b/cmd/podman/kube/play.go
index d7719e28e..c846ec32c 100644
--- a/cmd/podman/kube/play.go
+++ b/cmd/podman/kube/play.go
@@ -5,7 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
+	"net/http"
 	"os"
 	"strings"
 
@@ -13,6 +15,7 @@ import (
 	"github.com/containers/common/pkg/completion"
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v4/cmd/podman/common"
+	"github.com/containers/podman/v4/cmd/podman/parse"
 	"github.com/containers/podman/v4/cmd/podman/registry"
 	"github.com/containers/podman/v4/cmd/podman/utils"
 	"github.com/containers/podman/v4/libpod/define"
@@ -52,7 +55,8 @@ var (
 		ValidArgsFunction: common.AutocompleteDefaultOneArg,
 		Example: `podman kube play nginx.yml
   cat nginx.yml | podman kube play -
-  podman kube play --creds user:password --seccomp-profile-root /custom/path apache.yml`,
+  podman kube play --creds user:password --seccomp-profile-root /custom/path apache.yml
+  podman kube play https://example.com/nginx.yml`,
 	}
 )
 
@@ -67,7 +71,8 @@ var (
 		ValidArgsFunction: common.AutocompleteDefaultOneArg,
 		Example: `podman play kube nginx.yml
   cat nginx.yml | podman play kube -
-  podman play kube --creds user:password --seccomp-profile-root /custom/path apache.yml`,
+  podman play kube --creds user:password --seccomp-profile-root /custom/path apache.yml
+  podman play kube https://example.com/nginx.yml`,
 	}
 )
 
@@ -167,7 +172,7 @@ func playFlags(cmd *cobra.Command) {
 		_ = cmd.RegisterFlagCompletionFunc(contextDirFlagName, completion.AutocompleteDefault)
 
 		// NOTE: The service-container flag is marked as hidden as it
-		// is purely designed for running kube-play in systemd units.
+		// is purely designed for running kube-play or play-kube in systemd units.
 		// It is not something users should need to know or care about.
 		//
 		// Having a flag rather than an env variable is cleaner.
@@ -255,6 +260,7 @@ func play(cmd *cobra.Command, args []string) error {
 			return err
 		}
 	}
+
 	return kubeplay(reader)
 }
 
@@ -263,6 +269,7 @@ func playKube(cmd *cobra.Command, args []string) error {
 }
 
 func readerFromArg(fileName string) (*bytes.Reader, error) {
+	errURL := parse.ValidURL(fileName)
 	if fileName == "-" { // Read from stdin
 		data, err := io.ReadAll(os.Stdin)
 		if err != nil {
@@ -270,6 +277,19 @@ func readerFromArg(fileName string) (*bytes.Reader, error) {
 		}
 		return bytes.NewReader(data), nil
 	}
+	if errURL == nil {
+		response, err := http.Get(fileName)
+		if err != nil {
+			return nil, err
+		}
+		defer response.Body.Close()
+
+		data, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+		return bytes.NewReader(data), nil
+	}
 	f, err := os.Open(fileName)
 	if err != nil {
 		return nil, err
diff --git a/docs/source/markdown/podman-kube-down.1.md b/docs/source/markdown/podman-kube-down.1.md
index 92abd4ba3..c345abbd1 100644
--- a/docs/source/markdown/podman-kube-down.1.md
+++ b/docs/source/markdown/podman-kube-down.1.md
@@ -4,10 +4,14 @@
 podman-kube-down - Remove containers and pods based on Kubernetes YAML
 
 ## SYNOPSIS
-**podman kube down** *file.yml|-*
+**podman kube down** *file.yml|-|https://website.io/file.yml*
 
 ## DESCRIPTION
-**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML file. Any volumes that were created by the previous `podman kube play` command remain intact. If the YAML file is specified as `-`, `podman kube down` reads the YAML from stdin.
+**podman kube down** reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML
+file. Any volumes that were created by the previous `podman kube play` command remain intact. If the YAML file is specified as `-`, `podman kube down` reads the
+YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube down` will then teardown the pods and
+containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, `podman kube down` will not work with a URL if the YAML file the URL
+points to has been changed or altered since the creation of the pods and containers using `podman kube play`.
 
 ## EXAMPLES
 
@@ -30,14 +34,31 @@ spec:
 Remove the pod and containers as described in the `demo.yml` file
 ```
 $ podman kube down demo.yml
+Pods stopped:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+Pods removed:
 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
 ```
 
-Remove the pod and containers as described in the`demo.yml` file YAML sent to stdin
+Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin
 ```
 $ cat demo.yml | podman kube play -
+Pods stopped:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+Pods removed:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+```
+
+Remove the pods and containers as described in the `demo.yml` file YAML read from a URL
+```
+$ podman kube down https://podman.io/demo.yml
+Pods stopped:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+Pods removed:
 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
 ```
+`podman kube down` will not work with a URL if the YAML file the URL points to has been changed
+or altered since it was used to create the pods and containers.
 
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-play(1)](podman-kube-play.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**
diff --git a/docs/source/markdown/podman-kube-play.1.md.in b/docs/source/markdown/podman-kube-play.1.md.in
index 1b9544fb6..f0b404057 100644
--- a/docs/source/markdown/podman-kube-play.1.md.in
+++ b/docs/source/markdown/podman-kube-play.1.md.in
@@ -4,13 +4,14 @@
 podman-kube-play - Create containers, pods and volumes based on Kubernetes YAML
 
 ## SYNOPSIS
-**podman kube play** [*options*] *file.yml|-*
+**podman kube play** [*options*] *file.yml|-|https://website.io/file.yml*
 
 ## DESCRIPTION
 **podman kube play** will read in a structured file of Kubernetes YAML.  It will then recreate the containers, pods or volumes described in the YAML.  Containers within a pod are then started and the ID of the new Pod or the name of the new Volume is output. If the yaml file is specified as "-" then `podman kube play` will read the YAML file from stdin.
 Using the `--down` command line option, it is also capable of tearing down the pods created by a previous run of `podman kube play`.
 Using the `--replace` command line option, it will tear down the pods(if any) created by a previous run of `podman kube play` and recreate the pods with the Kubernetes YAML file.
 Ideally the input file would be one created by Podman (see podman-kube-generate(1)).  This would guarantee a smooth import and expected results.
+The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube play` will read the YAML from the URL and create pods and containers from it.
 
 Currently, the supported Kubernetes kinds are:
 - Pod
@@ -300,8 +301,23 @@ Create a pod connected to two networks (called net1 and net2) with a static ip
 $ podman kube play demo.yml --network net1:ip=10.89.1.5 --network net2:ip=10.89.10.10
 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
 ```
-
 Please take into account that networks must be created first using podman-network-create(1).
 
+Create and teardown from a URL pointing to a YAML file
+```
+$ podman kube play https://podman.io/demo.yml
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+
+$ podman kube play --down https://podman.io/demo.yml
+Pods stopped:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+Pods removed:
+52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6
+```
+`podman kube play --down` will not work with a URL if the YAML file the URL points to
+has been changed or altered.
+
+
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**
diff --git a/test/system/700-play.bats b/test/system/700-play.bats
index e1955cfd1..bad9544ff 100644
--- a/test/system/700-play.bats
+++ b/test/system/700-play.bats
@@ -361,3 +361,28 @@ status: {}
     run_podman pod rm -a
     run_podman rm -a
 }
+
+@test "podman kube play - URL" {
+    TESTDIR=$PODMAN_TMPDIR/testdir
+    mkdir -p $TESTDIR
+    echo "$testYaml" | sed "s|TESTDIR|${TESTDIR}|g" > $PODMAN_TMPDIR/test.yaml
+
+    HOST_PORT=$(random_free_port)
+    SERVER=http://127.0.0.1:$HOST_PORT
+
+    run_podman run -d --name myyaml -p "$HOST_PORT:80" \
+    -v $PODMAN_TMPDIR/test.yaml:/var/www/testpod.yaml:Z \
+    -w /var/www \
+    $IMAGE /bin/busybox-extras httpd -f -p 80
+
+    run_podman kube play $SERVER/testpod.yaml
+    run_podman inspect test_pod-test --format "{{.State.Running}}"
+    is "$output" "true"
+    run_podman kube down $SERVER/testpod.yaml
+    run_podman 125 inspect test_pod-test
+    is "$output" ".*Error: inspecting object: no such object: \"test_pod-test\""
+
+    run_podman pod rm -a -f
+    run_podman rm -a -f
+    run_podman rm -f -t0 myyaml
+}
-- 
cgit v1.2.3-54-g00ecf


From 8b1e88bf80b3cd650be04fd397f7b85d355788dd Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Tue, 23 Aug 2022 16:12:06 -0400
Subject: Fix documentation of use of tcp connections

Fixes: https://github.com/containers/podman/issues/15430

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 docs/source/markdown/podman-system-service.1.md     | 2 +-
 test/apiv2/python/rest_api/fixtures/api_testcase.py | 2 +-
 test/apiv2/python/rest_api/v1_test_rest_v1_0_0.py   | 2 +-
 test/system/272-system-connection.bats              | 4 ++--
 test/system/900-ssh.bats                            | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'test/system')

diff --git a/docs/source/markdown/podman-system-service.1.md b/docs/source/markdown/podman-system-service.1.md
index 99fde8ce4..3e7a00362 100644
--- a/docs/source/markdown/podman-system-service.1.md
+++ b/docs/source/markdown/podman-system-service.1.md
@@ -8,7 +8,7 @@ podman\-system\-service - Run an API service
 
 ## DESCRIPTION
 The **podman system service** command creates a listening service that will answer API calls for Podman.  You may
-optionally provide an endpoint for the API in URI form.  For example, *unix:///tmp/foobar.sock* or *tcp:localhost:8080*.
+optionally provide an endpoint for the API in URI form.  For example, *unix:///tmp/foobar.sock* or *tcp://localhost:8080*.
 If no endpoint is provided, defaults will be used.  The default endpoint for a rootful
 service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for
 example *unix:///run/user/1000/podman/podman.sock*)
diff --git a/test/apiv2/python/rest_api/fixtures/api_testcase.py b/test/apiv2/python/rest_api/fixtures/api_testcase.py
index f47136555..edb34b31e 100644
--- a/test/apiv2/python/rest_api/fixtures/api_testcase.py
+++ b/test/apiv2/python/rest_api/fixtures/api_testcase.py
@@ -20,7 +20,7 @@ class APITestCase(unittest.TestCase):
 
         APITestCase.podman = Podman()
         APITestCase.service = APITestCase.podman.open(
-            "system", "service", "tcp:localhost:8080", "--time=0"
+            "system", "service", "tcp://localhost:8080", "--time=0"
         )
         # give the service some time to be ready...
         time.sleep(2)
diff --git a/test/apiv2/python/rest_api/v1_test_rest_v1_0_0.py b/test/apiv2/python/rest_api/v1_test_rest_v1_0_0.py
index 905c29683..2274f25bf 100644
--- a/test/apiv2/python/rest_api/v1_test_rest_v1_0_0.py
+++ b/test/apiv2/python/rest_api/v1_test_rest_v1_0_0.py
@@ -63,7 +63,7 @@ class TestApi(unittest.TestCase):
                 podman(),
                 "system",
                 "service",
-                "tcp:localhost:8080",
+                "tcp://localhost:8080",
                 "--log-level=debug",
                 "--time=0",
             ],
diff --git a/test/system/272-system-connection.bats b/test/system/272-system-connection.bats
index e9e9a01ea..e937a7273 100644
--- a/test/system/272-system-connection.bats
+++ b/test/system/272-system-connection.bats
@@ -95,12 +95,12 @@ $c2[ ]\+tcp://localhost:54321[ ]\+true" \
     # we need for the server.
     ${PODMAN%%-remote*} --root ${PODMAN_TMPDIR}/root \
                         --runroot ${PODMAN_TMPDIR}/runroot \
-                        system service -t 99 tcp:localhost:$_SERVICE_PORT &
+                        system service -t 99 tcp://localhost:$_SERVICE_PORT &
     _SERVICE_PID=$!
     wait_for_port localhost $_SERVICE_PORT
 
     _run_podman_remote info --format '{{.Host.RemoteSocket.Path}}'
-    is "$output" "tcp:localhost:$_SERVICE_PORT" \
+    is "$output" "tcp://localhost:$_SERVICE_PORT" \
        "podman info works, and talks to the correct server"
 
     _run_podman_remote info --format '{{.Store.GraphRoot}}'
diff --git a/test/system/900-ssh.bats b/test/system/900-ssh.bats
index 0757f5838..4f1682d48 100644
--- a/test/system/900-ssh.bats
+++ b/test/system/900-ssh.bats
@@ -46,7 +46,7 @@ function _run_podman_remote() {
 
     ${PODMAN%%-remote*} --root ${PODMAN_TMPDIR}/root \
                         --runroot ${PODMAN_TMPDIR}/runroot \
-                        system service -t 99 tcp:localhost:$_SERVICE_PORT &
+                        system service -t 99 tcp://localhost:$_SERVICE_PORT &
     _SERVICE_PID=$!
     wait_for_port localhost $_SERVICE_PORT
 
-- 
cgit v1.2.3-54-g00ecf


From a933269ba5587d48c6dafa2ad1c6b44ecf048e48 Mon Sep 17 00:00:00 2001
From: Ed Santiago <santiago@redhat.com>
Date: Wed, 24 Aug 2022 14:48:13 -0600
Subject: System test cleanup

Misspellings, broken code, missing tests

Signed-off-by: Ed Santiago <santiago@redhat.com>
---
 test/system/200-pod.bats | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

(limited to 'test/system')

diff --git a/test/system/200-pod.bats b/test/system/200-pod.bats
index b9063ad1b..e3a9ec4c3 100644
--- a/test/system/200-pod.bats
+++ b/test/system/200-pod.bats
@@ -61,7 +61,7 @@ function teardown() {
 
 
 @test "podman pod create - custom infra image" {
-    skip_if_remote "CONTAINERS_CONF only effects server side"
+    skip_if_remote "CONTAINERS_CONF only affects server side"
     image="i.do/not/exist:image"
     tmpdir=$PODMAN_TMPDIR/pod-test
     mkdir -p $tmpdir
@@ -478,7 +478,6 @@ spec:
 }
 
 @test "pod resource limits" {
-    skip_if_aarch64 "FIXME: #15074 - flakes on aarch64 non-remote"
     skip_if_remote "resource limits only implemented on non-remote"
     skip_if_rootless "resource limits only work with root"
     skip_if_cgroupsv1 "resource limits only meaningful on cgroups V2"
@@ -493,30 +492,24 @@ spec:
     lomajmin=$(losetup -l --noheadings --output MAJ:MIN $LOOPDEVICE | tr -d ' ')
     run grep -w bfq /sys/block/$(basename ${LOOPDEVICE})/queue/scheduler
     if [ $status -ne 0 ]; then
+        losetup -d $LOOPDEVICE
+        LOOPDEVICE=
         skip "BFQ scheduler is not supported on the system"
-        if [ -f ${lofile} ]; then
-            run_podman '?' rm -t 0 --all --force --ignore
-
-            while read path dev; do
-                if [[ "$path" == "$lofile" ]]; then
-                    losetup -d $dev
-                fi
-            done < <(losetup -l --noheadings --output BACK-FILE,NAME)
-            rm ${lofile}
-        fi
     fi
     echo bfq > /sys/block/$(basename ${LOOPDEVICE})/queue/scheduler
 
+    # FIXME: #15464: blkio-weight-device not working
     expected_limits="
 cpu.max         | 500000 100000
 memory.max      | 5242880
 memory.swap.max | 1068498944
+io.bfq.weight   | default 50
 io.max          | $lomajmin rbps=1048576 wbps=1048576 riops=max wiops=max
 "
 
     for cgm in systemd cgroupfs; do
         local name=resources-$cgm
-        run_podman --cgroup-manager=$cgm pod create --name=$name --cpus=5 --memory=5m --memory-swap=1g --cpu-shares=1000 --cpuset-cpus=0 --cpuset-mems=0 --device-read-bps=${LOOPDEVICE}:1mb --device-write-bps=${LOOPDEVICE}:1mb --blkio-weight-device=${LOOPDEVICE}:123 --blkio-weight=50
+        run_podman --cgroup-manager=$cgm pod create --name=$name --cpus=5 --memory=5m --memory-swap=1g --cpu-shares=1000 --cpuset-cpus=0 --cpuset-mems=0 --device-read-bps=${LOOPDEVICE}:1mb --device-write-bps=${LOOPDEVICE}:1mb --blkio-weight=50
         run_podman --cgroup-manager=$cgm pod start $name
         run_podman pod inspect --format '{{.CgroupPath}}' $name
         local cgroup_path="$output"
-- 
cgit v1.2.3-54-g00ecf