install.sh: initial support for sle-micro (#4331)

Support invoking install.sh on SLE Micro with or without SELinux
enabled. Same deal for SLES.

Additionally, easy-to-invoke assertions, via Vagrant, that the local
install.sh works correctly:
- tests/install/centos-7 (stand-in for rhel 7)
- tests/install/centos-8 (stand-in for rhel 8)
- tests/install/opensuse-leap (stand-in for sles)
- tests/install/opensuse-microos (stand-in for sle-micro)
- tests/install/ubuntu-focal

Addresses #3188
Addresses #3917

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

.github/workflows/cgroup2.yaml

@@ -3,9 +3,13 @@ on:
   push:
     paths-ignore: 
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   pull_request:
     paths-ignore:
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   workflow_dispatch: {}
 jobs:
   build:

.github/workflows/install.yaml

@@ -0,0 +1,95 @@
+name: Installer
+on:
+  push:
+    paths:
+      - "install.sh"
+      - "tests/install"
+  pull_request:
+    paths:
+      - "install.sh"
+      - "tests/install"
+  workflow_dispatch: {}
+jobs:
+  install-centos-7:
+    name: "CentOS 7"
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    timeout-minutes: 40
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
+      - name: "VagrantPlugin::K3S"
+        working-directory: tests/install/centos-7
+        run: vagrant plugin install vagrant-k3s
+      - name: "Vagrant::⬆"
+        working-directory: tests/install/centos-7
+        run: vagrant up
+  install-centos-8:
+    name: "CentOS 8"
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    timeout-minutes: 40
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
+      - name: "VagrantPlugin::K3S"
+        working-directory: tests/install/centos-8
+        run: vagrant plugin install vagrant-k3s
+      - name: "Vagrant::⬆"
+        working-directory: tests/install/centos-8
+        run: vagrant up
+  install-opensuse-leap:
+    name: "openSUSE Leap"
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    timeout-minutes: 40
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
+      - name: "VagrantPlugin::K3S"
+        working-directory: tests/install/opensuse-leap
+        run: vagrant plugin install vagrant-k3s
+      - name: "Vagrant::⬆"
+        working-directory: tests/install/opensuse-leap
+        run: vagrant up
+#  install-opensuse-microos:
+#    name: "openSUSE MicroOS"
+#    # nested virtualization is only available on macOS hosts
+#    runs-on: macos-10.15
+#    timeout-minutes: 40
+#    steps:
+#      - name: "Checkout"
+#        uses: actions/checkout@v2
+#        with:
+#          fetch-depth: 1
+#      - name: "VagrantPlugin::Reload"
+#        working-directory: tests/install/opensuse-microos
+#        run: vagrant plugin install vagrant-reload
+#      - name: "VagrantPlugin::K3S"
+#        working-directory: tests/install/opensuse-microos
+#        run: vagrant plugin install vagrant-k3s
+#      - name: "Vagrant::⬆"
+#        working-directory: tests/install/opensuse-microos
+#        run: vagrant up
+  install-ubuntu-focal:
+    name: "Ubuntu Focal"
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    timeout-minutes: 40
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 1
+      - name: "VagrantPlugin::K3S"
+        working-directory: tests/install/ubuntu-focal
+        run: vagrant plugin install vagrant-k3s
+      - name: "Vagrant::⬆"
+        working-directory: tests/install/ubuntu-focal
+        run: vagrant up

.github/workflows/integration.yaml

@@ -1,11 +1,15 @@
 name: Integration Test Coverage
 on: 
   push:
-    paths-ignore: 
+    paths-ignore:
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   pull_request:
     paths-ignore:
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   workflow_dispatch: {}
 jobs:
   build:

.github/workflows/unitcoverage.yaml

@@ -1,11 +1,15 @@
 name: Unit Test Coverage
-on: 
+on:
   push:
-    paths-ignore: 
+    paths-ignore:
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   pull_request:
     paths-ignore:
       - "**.md"
+      - "install.sh"
+      - "tests/install"
   workflow_dispatch: {}
 jobs:
   test:

install.sh

@@ -116,7 +116,7 @@ verify_system() {
         HAS_OPENRC=true
         return
     fi
-    if [ -d /run/systemd ]; then
+    if [ -x /bin/systemctl ] || type systemctl > /dev/null 2>&1; then
         HAS_SYSTEMD=true
         return
     fi
@@ -460,32 +460,41 @@ setup_selinux() {
     fi
 
     [ -r /etc/os-release ] && . /etc/os-release
-    if [ "${ID_LIKE:-}" = suse ]; then
+    if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
-        policy_hint="k3s with SELinux is currently not supported on SUSE/openSUSE systems.
+        rpm_target=sle
-    Please disable SELinux before installing k3s.
+        rpm_site_infix=microos
-"
+        package_installer=zypper
+    elif [ "${VERSION_ID%%.*}" = "7" ]; then
+        rpm_target=el7
+        rpm_site_infix=centos/7
+        package_installer=yum
     else
-        maj_ver=$(echo "$VERSION_ID" | sed -E -e "s/^([0-9]+)\.?[0-9]*$/\1/")
+        rpm_target=el8
-        if [ "${maj_ver:-7}" != 7 ]; then
+        rpm_site_infix=centos/8
-            maj_ver=8
+        package_installer=yum
-        fi
+    fi
-        policy_hint="please install:
+
-    yum install -y container-selinux selinux-policy-base
+    if [ "${package_installer}" = "yum" ] && [ -x /usr/bin/dnf ]; then
-    yum install -y https://${rpm_site}/k3s/${rpm_channel}/common/centos/${maj_ver}/noarch/k3s-selinux-0.3-0.el${maj_ver}.noarch.rpm
+        package_installer=dnf
+    fi
+
+    policy_hint="please install:
+    ${package_installer} install -y container-selinux
+    ${package_installer} install -y https://${rpm_site}/k3s/${rpm_channel}/common/${rpm_site_infix}/noarch/k3s-selinux-0.4-1.${rpm_target}.noarch.rpm
 "
+
+    if [ "$INSTALL_K3S_SKIP_SELINUX_RPM" = true ] || can_skip_download || [ ! -d /usr/share/selinux ]; then
+        info "Skipping installation of SELinux RPM"
+    else
+        install_selinux_rpm ${rpm_site} ${rpm_channel} ${rpm_target} ${rpm_site_infix}
     fi
 
     policy_error=fatal
+    # install_selinux_rpm will set INSTALL_K3S_SELINUX_WARN=true on microos
     if [ "$INSTALL_K3S_SELINUX_WARN" = true ] || [ "${ID_LIKE:-}" = coreos ]; then
         policy_error=warn
     fi
 
-    if [ "$INSTALL_K3S_SKIP_SELINUX_RPM" = true ] || can_skip_download; then
-        info "Skipping installation of SELinux RPM"
-    else
-        install_selinux_rpm ${rpm_site} ${rpm_channel}
-    fi
-
     if ! $SUDO chcon -u system_u -r object_r -t container_runtime_exec_t ${BIN_DIR}/k3s >/dev/null 2>&1; then
         if $SUDO grep '^\s*SELINUX=enforcing' /etc/selinux/config >/dev/null 2>&1; then
             $policy_error "Failed to apply container_runtime_exec_t to ${BIN_DIR}/k3s, ${policy_hint}"
@@ -497,36 +506,46 @@ setup_selinux() {
     fi
 }
 
-# --- if on an el7/el8 system, install k3s-selinux
 install_selinux_rpm() {
-    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ]; then
+    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ] || [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
-        maj_ver=$(echo "$VERSION_ID" | sed -E -e "s/^([0-9]+)\.?[0-9]*$/\1/")
+        repodir=/etc/yum.repos.d
-        set +o noglob
+        if [ -d /etc/zypp/repos.d ]; then
-        $SUDO rm -f /etc/yum.repos.d/rancher-k3s-common*.repo
+            repodir=/etc/zypp/repos.d
-        set -o noglob
-        if [ -r /etc/redhat-release ]; then
-            case ${maj_ver} in
-                7)
-                    $SUDO yum -y install yum-utils
-                    $SUDO yum-config-manager --enable rhel-7-server-extras-rpms
-                    ;;
-                8)
-                    :
-                    ;;
-                *)
-                    return
-                    ;;
-            esac
         fi
-        $SUDO tee /etc/yum.repos.d/rancher-k3s-common.repo >/dev/null << EOF
+        set +o noglob
+        $SUDO rm -f ${repodir}/rancher-k3s-common*.repo
+        set -o noglob
+        if [ -r /etc/redhat-release ] && [ "${3}" = "el7" ]; then
+            $SUDO yum install -y yum-utils
+            $SUDO yum-config-manager --enable rhel-7-server-extras-rpms
+        fi
+        $SUDO tee ${repodir}/rancher-k3s-common.repo >/dev/null << EOF
 [rancher-k3s-common-${2}]
 name=Rancher K3s Common (${2})
-baseurl=https://${1}/k3s/${2}/common/centos/${maj_ver}/noarch
+baseurl=https://${1}/k3s/${2}/common/${4}/noarch
 enabled=1
 gpgcheck=1
+repo_gpgcheck=0
 gpgkey=https://${1}/public.key
 EOF
-        $SUDO yum -y install "k3s-selinux"
+        case ${3} in
+        el8)
+            rpm_installer="dnf"
+            ;;
+        sle)
+            rpm_installer="zypper --gpg-auto-import-keys"
+            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /sbin/transactional-update ]; then
+                rpm_installer="transactional-update --no-selfupdate -d run ${rpm_installer}"
+                : "${INSTALL_K3S_SKIP_START:=true}"
+                : "${INSTALL_K3S_SELINUX_WARN:=true}"
+            fi
+            ;;
+        *)
+            rpm_installer="yum"
+            ;;
+        esac
+        # shellcheck disable=SC2086
+        $SUDO ${rpm_installer} install -y "k3s-selinux"
     fi
     return
 }

tests/install/centos-7/Vagrantfile

@@ -0,0 +1,99 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'
+
+Vagrant.configure("2") do |config|
+  config.vagrant.plugins = {
+    'vagrant-k3s' => {:version => '~> 0.1.2'},
+  }
+
+  config.vm.define 'install-centos-7', primary: true do |test|
+    test.vm.box = 'centos/7'
+    test.vm.hostname = 'install'
+    test.vm.provision 'selinux-status', type: 'shell', run: 'once', inline: 'sestatus'
+    test.vm.provision 'k3s-upload', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
+    test.vm.provision 'k3s-install', type: 'k3s', run: 'once' do |k3s|
+      k3s.installer_url = 'file:///home/vagrant/install.sh'
+      k3s.args = %w[server]
+      k3s.env = %w[INSTALL_K3S_NAME=server]
+      k3s.config = {
+        :selinux => true,
+        :token => 'vagrant',
+      }
+      k3s.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
+    end
+    test.vm.provision "k3s-wait-for-node", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        echo 'Waiting for node to be ready ...'
+        time timeout 120 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-coredns", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/coredns 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-local-storage", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/local-path-provisioner 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-metrics-server", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/metrics-server 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-traefik", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/traefik 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-status", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-status-selinux", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        ps auxZ | grep container_ | grep -v grep
+      SHELL
+    end
+  end
+
+  %w[hyperv libvirt virtualbox vmware_desktop].each do |p|
+    config.vm.provider p do |v|
+      v.cpus = ENV['TEST_VM_CPUS'] || 2
+      v.memory = ENV['TEST_VM_MEMORY'] || 2048
+    end
+  end
+  config.vm.provider :virtualbox do |v,o|
+    v.gui = false
+    v.check_guest_additions = false
+  end
+
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+end

tests/install/centos-8/Vagrantfile

@@ -0,0 +1,99 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'
+
+Vagrant.configure("2") do |config|
+  config.vagrant.plugins = {
+    'vagrant-k3s' => {:version => '~> 0.1.2'},
+  }
+
+  config.vm.define 'install-centos-8', primary: true do |test|
+    test.vm.box = 'centos/stream8'
+    test.vm.hostname = 'install'
+    test.vm.provision 'selinux-status', type: 'shell', run: 'once', inline: 'sestatus'
+    test.vm.provision 'k3s-upload', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
+    test.vm.provision 'k3s-install', type: 'k3s', run: 'once' do |k3s|
+      k3s.installer_url = 'file:///home/vagrant/install.sh'
+      k3s.args = %w[server]
+      k3s.env = %w[INSTALL_K3S_NAME=server]
+      k3s.config = {
+        :selinux => true,
+        :token => 'vagrant',
+      }
+      k3s.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
+    end
+    test.vm.provision "k3s-wait-for-node", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        echo 'Waiting for node to be ready ...'
+        time timeout 120 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-coredns", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/coredns 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-local-storage", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/local-path-provisioner 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-metrics-server", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/metrics-server 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-traefik", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/traefik 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-status", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-status-selinux", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        ps auxZ | grep container_ | grep -v grep
+      SHELL
+    end
+  end
+
+  %w[hyperv libvirt virtualbox vmware_desktop].each do |p|
+    config.vm.provider p do |v|
+      v.cpus = ENV['TEST_VM_CPUS'] || 2
+      v.memory = ENV['TEST_VM_MEMORY'] || 2048
+    end
+  end
+  config.vm.provider :virtualbox do |v,o|
+    v.gui = false
+    v.check_guest_additions = false
+  end
+
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+end

tests/install/opensuse-leap/Vagrantfile

@@ -0,0 +1,91 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'
+
+Vagrant.configure("2") do |config|
+  config.vagrant.plugins = {
+    'vagrant-k3s' => {:version => '~> 0.1.2'},
+  }
+
+  config.vm.define 'install-opensuse-leap', primary: true do |test|
+    test.vm.box = 'opensuse/Leap-15.3.x86_64'
+    test.vm.hostname = 'install'
+    test.vm.provision 'k3s-upload', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
+    # /sbin/apparmor_parser is needed by the 1.21 kubelet if the value of /sys/module/apparmor/parameters/enabled is Y
+    test.vm.provision 'k3s-prepare', type: 'shell', run: 'once', inline: 'zypper install -y apparmor-parser'
+    test.vm.provision 'k3s-install', type: 'k3s', run: 'once' do |k3s|
+      k3s.installer_url = 'file:///home/vagrant/install.sh'
+      k3s.args = %w[server]
+      k3s.env = %w[INSTALL_K3S_NAME=server INSTALL_K3S_SKIP_SELINUX_RPM=true]
+      k3s.config = {
+        :token => 'vagrant',
+      }
+      k3s.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
+    end
+    test.vm.provision "k3s-wait-for-node", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        echo 'Waiting for node to be ready ...'
+        time timeout 120 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-coredns", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/coredns 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-local-storage", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/local-path-provisioner 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-metrics-server", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/metrics-server 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-traefik", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/traefik 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-status", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+  end
+
+  %w[hyperv libvirt virtualbox vmware_desktop].each do |p|
+    config.vm.provider p do |v|
+      v.cpus = ENV['TEST_VM_CPUS'] || 2
+      v.memory = ENV['TEST_VM_MEMORY'] || 2048
+    end
+  end
+  config.vm.provider :virtualbox do |v,o|
+    v.gui = false
+    v.check_guest_additions = false
+  end
+
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+end

tests/install/opensuse-microos/Vagrantfile

@@ -0,0 +1,112 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'
+
+Vagrant.configure("2") do |config|
+  config.vagrant.plugins = {
+    'vagrant-k3s' => {:version => '~> 0.1.2'},
+    'vagrant-reload' => {},
+  }
+
+  config.vm.define 'install-microos', primary: true do |test|
+    test.vm.box = 'opensuse/MicroOS.x86_64'
+    test.vm.hostname = 'install'
+    # microos does not ship selinux-enabled but such is just an update + reboot away
+    test.vm.provision 'selinux-setup', type: 'shell', run: 'once' do |sh|
+        sh.inline = <<~EOF
+            transactional-update -n \
+                setup-selinux \
+                pkg install -y apparmor-parser
+        EOF
+    end
+    # reboot to have the snapshot from the previous step as the rootfs
+    test.vm.provision 'selinux-reload', type: 'reload', run: 'once'
+    test.vm.provision 'selinux-status', type: 'shell', run: 'once', inline: 'sestatus'
+    test.vm.provision 'k3s-upload', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
+    test.vm.provision 'k3s-install', type: 'k3s', run: 'once' do |k3s|
+      k3s.installer_url = 'file:///home/vagrant/install.sh'
+      k3s.args = %w[server]
+      k3s.env = %w[INSTALL_K3S_NAME=server]
+      k3s.config = {
+        :selinux => true,
+        :token => 'vagrant',
+      }
+      k3s.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
+    end
+    # install.sh will move the snapshot forward when installing k3s-selinux policy, so, we reboot to pick that up
+    test.vm.provision 'k3s-reload', type: 'reload', run: 'once'
+    test.vm.provision "k3s-wait-for-node", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        echo 'Waiting for node to be ready ...'
+        time timeout 120 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostnamectl --static) 2>/dev/null); do sleep 5; done'
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-coredns", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/coredns 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-local-storage", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/local-path-provisioner 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-metrics-server", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/metrics-server 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-traefik", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/traefik 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-status", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-status-selinux", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        ps auxZ | grep container_ | grep -v grep
+      SHELL
+    end
+  end
+
+  %w[hyperv libvirt virtualbox vmware_desktop].each do |p|
+    config.vm.provider p do |v|
+      v.cpus = ENV['TEST_VM_CPUS'] || 2
+      v.memory = ENV['TEST_VM_MEMORY'] || 2048
+    end
+  end
+  config.vm.provider :virtualbox do |v,o|
+    v.gui = false
+    v.check_guest_additions = false
+  end
+
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+end

tests/install/ubuntu-focal/Vagrantfile

@@ -0,0 +1,91 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+ENV['TEST_INSTALL_SH'] ||= '../../../install.sh'
+
+Vagrant.configure("2") do |config|
+  config.vagrant.plugins = {
+    'vagrant-k3s' => {:version => '~> 0.1.2'},
+  }
+
+  config.vm.define 'install-ubuntu-focal', primary: true do |test|
+    test.vm.box = 'generic/ubuntu2004'
+    test.vm.hostname = 'install'
+    test.vm.provision 'k3s-upload', type: 'file', run: 'always', source: ENV['TEST_INSTALL_SH'], destination: 'install.sh'
+    # sh is a symlink to dash, so, we need to sidestep this: https://github.com/dweomer/vagrant-k3s/blob/v0.1.2/lib/vagrant-k3s/provisioner.rb#L71
+    test.vm.provision 'k3s-prepare', type: 'shell', run: 'once', inline: 'ln -nsf bash /usr/bin/sh'
+    test.vm.provision 'k3s-install', type: 'k3s', run: 'once' do |k3s|
+      k3s.installer_url = 'file:///home/vagrant/install.sh'
+      k3s.args = %w[server]
+      k3s.env = %w[INSTALL_K3S_NAME=server INSTALL_K3S_SKIP_SELINUX_RPM=true]
+      k3s.config = {
+        :token => 'vagrant',
+      }
+      k3s.config_mode = '0644' # side-step https://github.com/k3s-io/k3s/issues/4321
+    end
+    test.vm.provision "k3s-wait-for-node", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        echo 'Waiting for node to be ready ...'
+        time timeout 120 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done'
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-coredns", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/coredns 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-local-storage", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/local-path-provisioner 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-metrics-server", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/metrics-server 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-wait-for-traefik", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eu -o pipefail
+        time timeout 180 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/traefik 2>/dev/null); do sleep 5; done'
+      SHELL
+    end
+    test.vm.provision "k3s-status", type: "shell", run: "once" do |sh|
+      sh.env = { :PATH => "/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin" }
+      sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        kubectl get node,all -A -o wide
+      SHELL
+    end
+  end
+
+  %w[hyperv libvirt virtualbox vmware_desktop].each do |p|
+    config.vm.provider p do |v|
+      v.cpus = ENV['TEST_VM_CPUS'] || 2
+      v.memory = ENV['TEST_VM_MEMORY'] || 2048
+    end
+  end
+  config.vm.provider :virtualbox do |v,o|
+    v.gui = false
+    v.check_guest_additions = false
+  end
+
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+end