chore(test): migrate remaining container-based unit tests

Finishes the migration started by the keycloak-version pilot
(84dbef4). The four remaining hand-rolled podman test runners
are replaced as follows:

- keycloak-memory-usage, keycloak-stats: use the same
  testcontainers-python pattern as keycloak-version. All 9 Keycloak
  majors (18-26) pulled as upstream images, plugin runs from host
  against the exposed port, assertions check message shape and a
  valid monitoring state rather than hardcoded timings.
- deb-updates: add `--test` argument with a single-fixture layout
  (the `apt-get update` cache refresh is skipped in test mode, only
  the `apt list --upgradable` output is injected). Unit tests are
  fixture-based and cover ok-no-updates, warn-one-pending,
  ok-with-high-threshold, warn-three-pending. No longer depends on
  the debian/ubuntu test containers' upstream mirror state.
- needs-restarting: add `--test` + a hidden `--test-os-family`
  override so a single host can exercise both the RedHat and Debian
  branches through fixtures. Six test cases cover ok/warn for each
  OS family plus an unsupported-OS case. Runs in ~0.3s instead of
  several minutes of cross-distro podman builds.

The `containerfiles/` directories stay in place for all four plugins
so that a future maintainer can migrate them to testcontainers-python
if real-OS coverage is desired.

Follow-up: while writing fixtures for needs-restarting I noticed the
kernel-version mismatch detection (`NEEDRESTART-KCUR` vs `KEXP`) is
broken because `kcur`/`kexp` are reset inside the parse loop, so the
"Running Kernel X != Installed Kernel Y" line is never printed. Left
as-is here to keep the scope limited to the test migration; worth a
follow-up bugfix.

Author: markuslf

check-plugins/deb-updates/deb-updates

@@ -24,7 +24,7 @@ from lib.globals import STATE_OK, STATE_UNKNOWN
 
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026041201'
+__version__ = '2026041202'
 
 DESCRIPTION = """Checks for available APT package updates on Debian, Ubuntu, and compatible systems.
 Reports the number of pending updates and upgrades, and alerts when updates are
@@ -75,6 +75,13 @@ def parse_args():
         default=DEFAULT_QUERY,
     )
 
+    parser.add_argument(
+        '--test',
+        help=lib.args.help('--test'),
+        dest='TEST',
+        type=lib.args.csv,
+    )
+
     parser.add_argument(
         '--timeout',
         help=lib.args.help('--timeout') + ' Default: %(default)s (seconds)',
@@ -112,22 +119,30 @@ def main():
     perfdata = ''
 
     # fetch data
-    # try to update the package cache first
-    stdout, stderr, retc = lib.base.coe(
-        lib.shell.shell_exec('sudo apt-get update --quiet 2', timeout=args.TIMEOUT),
-    )
-    if retc or stderr:
-        # Not printing stderr as it is quite verbose
-        msg += '`apt-get update` returned with an error. '
-        lib.base.cu(msg)
+    if args.TEST is None:
+        # try to update the package cache first
+        stdout, stderr, retc = lib.base.coe(
+            lib.shell.shell_exec('sudo apt-get update --quiet 2', timeout=args.TIMEOUT),
+        )
+        if retc or stderr:
+            # Not printing stderr as it is quite verbose
+            msg += '`apt-get update` returned with an error. '
+            lib.base.cu(msg)
 
-    stdout, _, retc = lib.base.coe(
-        lib.shell.shell_exec('apt list --upgradable', timeout=args.TIMEOUT),
-    )
-    if retc:
-        # Not printing stderr as it is quite verbose
-        msg += '`apt list --upgradable` returned with an error. '
-        lib.base.cu(msg)
+        stdout, _, retc = lib.base.coe(
+            lib.shell.shell_exec('apt list --upgradable', timeout=args.TIMEOUT),
+        )
+        if retc:
+            # Not printing stderr as it is quite verbose
+            msg += '`apt list --upgradable` returned with an error. '
+            lib.base.cu(msg)
+    else:
+        # skip the apt-get update refresh in test mode and read the
+        # `apt list --upgradable` output from a fixture file
+        stdout, _, retc = lib.lftest.test(args.TEST)
+        if retc:
+            msg += '`apt list --upgradable` returned with an error. '
+            lib.base.cu(msg)
 
     # strip first line "Listing... Done." (if any)
     first, _, rest = stdout.partition('\n')

check-plugins/deb-updates/unit-test/run

@@ -8,274 +8,60 @@
 
 # https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CONTRIBUTING.md
 
-import os
-import subprocess
-import time
+import sys
+sys.path.append('..')
+
 import unittest
 
-CHECK_PLUGIN = 'deb-updates'
-REMOTE_DIR = (
-    '/tmp'  # work dir in container (where to find the CHECK_PLUGIN in the container)
-)
-LOCAL_DIR = '..'  # local work dir (where to find the CHECK_PLUGIN locally)
-TIMEOUT = 0
+from lib.globals import STATE_OK, STATE_WARN
+import lib.lftest
+
+
+# deb-updates makes two shell calls, but only `apt list --upgradable`
+# drives the analysis. In test mode the `apt-get update` cache refresh
+# is skipped and the single fixture file is used as the upgradable
+# list. The `containerfiles/` directory next door still holds the
+# legacy podman setup for cross-distro smoke coverage and can be
+# migrated to testcontainers-python later.
 TESTS = [
     {
-        'containerfile': 'containerfiles/debian-v11',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
-    },
-    {
-        'containerfile': 'containerfiles/debian-v12',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
+        'id': 'ok-no-updates',
+        'test': 'stdout/no-updates,,0',
+        'params': '',
+        'assert-retc': STATE_OK,
+        'assert-in': ['No updates available'],
     },
     {
-        'containerfile': 'containerfiles/debian-v13',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
+        'id': 'warn-one-pending-upgrade',
+        'test': 'stdout/one-pending-upgrade,,0',
+        'params': '',
+        'assert-retc': STATE_WARN,
+        'assert-in': ['1 update available', 'vim-tiny'],
     },
     {
-        'containerfile': 'containerfiles/ubuntu-v2004',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
+        'id': 'ok-one-pending-upgrade-with-high-warn',
+        'test': 'stdout/one-pending-upgrade,,0',
+        'params': '--warning 5',
+        'assert-retc': STATE_OK,
     },
     {
-        'containerfile': 'containerfiles/ubuntu-v2204',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
-    },
-    {
-        'containerfile': 'containerfiles/ubuntu-v2404',
-        'podman-run-params': '',
-        'tests': [
-            {
-                'run-where': 'container',
-                'plugin-params': '',
-                'assert-regex': r'\d+ updates available',
-                'assert-retc': 1,
-            },
-        ],
+        'id': 'warn-three-pending-upgrades',
+        'test': 'stdout/security-upgrades,,0',
+        'params': '',
+        'assert-retc': STATE_WARN,
+        'assert-in': ['3 updates available'],
     },
 ]
 
 
 class TestCheck(unittest.TestCase):
-    def test(self):
-        """
-        Test all Dockerfiles in the 'unit-test/containerfiles' directory.
-        Builds, runs, and tests each container and validates the output, using podman.
-        """
-        for testcase in TESTS:
-            if not os.path.isfile(testcase['containerfile']):
-                self.fail(f'Containerfile {testcase["containerfile"]} not found.')
-
-            print(f'\n=== Testing {os.path.basename(testcase["containerfile"])} ===')
-            image_name = (
-                f'lfmp-{os.path.basename(testcase["containerfile"]).replace("-v", ":")}'
-            )
-            container_name = f'lfmp-{os.path.basename(testcase["containerfile"])}'
 
-            try:
-                # Build the container image
-                podman_cmd = [
-                    'podman',
-                    'build',
-                    '--file',
-                    testcase['containerfile'],
-                    '--tag',
-                    image_name,
-                ]
-                print(f'Build the container image: {" ".join(podman_cmd)}')
-                subprocess.run(
-                    podman_cmd,
-                    check=True,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.PIPE,
-                )
+    check = '../deb-updates'
 
-                podman_cmd = (
-                    [
-                        'podman',
-                        'run',
-                        '--name',
-                        container_name,
-                        '--replace',
-                        '--detach',  # run in detached mode
-                    ]
-                    + testcase['podman-run-params'].split()
-                    + image_name.split()
-                )
-                print(f'Run the container: {" ".join(podman_cmd)}')
-                subprocess.run(
-                    podman_cmd,
-                    check=True,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.PIPE,
-                )
-
-                print('Give the container a few seconds to start up')
-                time.sleep(3)
-
-                podman_cmd = [
-                    'podman',
-                    'cp',
-                    '../lib',
-                    f'{container_name}:{REMOTE_DIR}/',
-                ]
-                print(f'Copy local files into container: {" ".join(podman_cmd)}')
-                subprocess.run(
-                    podman_cmd,
-                    check=True,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.PIPE,
-                )
-                podman_cmd = [
-                    'podman',
-                    'cp',
-                    f'../{CHECK_PLUGIN}',
-                    f'{container_name}:{REMOTE_DIR}/{CHECK_PLUGIN}',
-                ]
-                print(f'Copy local files into container: {" ".join(podman_cmd)}')
-                subprocess.run(
-                    podman_cmd,
-                    check=True,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.PIPE,
-                )
-
-                # Check if /tmp/venv exists in the container
-                podman_cmd = [
-                    'podman',
-                    'exec',
-                    container_name,
-                    'sh',
-                    '-c',
-                    "test -d /tmp/venv && echo 'venv exists'",
-                ]
-                print(
-                    f'Check if /tmp/venv exists in the container: {" ".join(podman_cmd)}'
-                )
-                venv_exists = (
-                    subprocess.run(
-                        podman_cmd,
-                        check=False,
-                        stdout=subprocess.PIPE,
-                        stderr=subprocess.PIPE,
-                        text=True,
-                    ).stdout.strip()
-                    == 'venv exists'
-                )
-                print(f'Check if /tmp/venv exists in the container: {venv_exists}')
-
-                print('Give server daemons a few seconds to start up')
-                time.sleep(TIMEOUT)
-
-                print('Run the test cases...')
-                for test in testcase['tests']:
-                    if test['run-where'] == 'container':
-                        cmdline = (
-                            f'python3 {CHECK_PLUGIN} {test["plugin-params"]}'.strip()
-                        )
-                        if venv_exists:
-                            podman_cmd = [
-                                'podman',
-                                'exec',
-                                '--workdir',
-                                REMOTE_DIR,
-                                container_name,
-                                'sh',
-                                '-c',
-                                f'. /tmp/venv/bin/activate && {cmdline}',
-                            ]
-                            print(
-                                f'Run test in container in venv: `{" ".join(podman_cmd)}`'
-                            )
-                        else:
-                            podman_cmd = [
-                                'podman',
-                                'exec',
-                                '--workdir',
-                                REMOTE_DIR,
-                                container_name,
-                            ] + cmdline.split()
-                            print(f'Run test in container: `{" ".join(podman_cmd)}`')
-                        result = subprocess.run(
-                            podman_cmd,
-                            check=False,  # We'll handle checking the output ourselves
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE,
-                            text=True,
-                        )
-                    else:
-                        local_cmd = [
-                            'python3',
-                            os.path.join(LOCAL_DIR, CHECK_PLUGIN),
-                        ] + test['plugin-params'].strip().split()
-                        print(f'Run test locally: `{" ".join(local_cmd)}`')
-                        result = subprocess.run(
-                            local_cmd,
-                            check=False,  # We'll handle checking the output ourselves
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE,
-                            text=True,
-                        )
-
-                    # Check the output
-                    output = result.stdout + '\n' + result.stderr
-                    print(f'Script output:\n{output.strip()}')
-
-                    # the unit test result
-                    self.assertRegex(
-                        result.stdout + result.stderr, test['assert-regex']
-                    )
-                    self.assertEqual(result.returncode, test['assert-retc'])
-
-            finally:
-                # Stop and remove the container no matter what
-                podman_cmd = ['podman', 'rm', '--force', container_name]
-                print(f'Stop and remove container: {" ".join(podman_cmd)}')
-                subprocess.run(
-                    podman_cmd,
-                    check=False,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.PIPE,
-                )
+    def test(self):
+        for t in TESTS:
+            with self.subTest(id=t['id']):
+                lib.lftest.run(self, self.check, t)
 
 
 if __name__ == '__main__':

check-plugins/deb-updates/unit-test/stdout/no-updates

@@ -0,0 +1 @@
+Listing... Done.

check-plugins/deb-updates/unit-test/stdout/one-pending-upgrade

@@ -0,0 +1,2 @@
+Listing... Done.
+vim-tiny/noble-updates,noble-security 2:9.1.0016-1ubuntu7.9 amd64 [upgradable from: 2:9.1.0016-1ubuntu7.8]

check-plugins/deb-updates/unit-test/stdout/security-upgrades

@@ -0,0 +1,4 @@
+Listing... Done.
+libssl3/noble-updates,noble-security 3.0.13-0ubuntu3.5 amd64 [upgradable from: 3.0.13-0ubuntu3.4]
+openssl/noble-updates,noble-security 3.0.13-0ubuntu3.5 amd64 [upgradable from: 3.0.13-0ubuntu3.4]
+vim-tiny/noble-updates 2:9.1.0016-1ubuntu7.9 amd64 [upgradable from: 2:9.1.0016-1ubuntu7.8]