From 23bc882ee06ab7acca4984a7d162ac5fb1a87532 Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Mon, 6 Nov 2023 12:26:21 -0700
Subject: [PATCH] feat: support for ostree systems

Feature: Allow running and testing the role with ostree managed nodes.

Reason: We have users who want to use the role to manage ostree
systems.

Result: Users can use the role to manage ostree managed nodes.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
---
 .ansible-lint                         |   2 +
 .ostree/README.md                     |   3 +
 .ostree/get_ostree_data.sh            | 123 ++++++++++++++++++++++++++
 .ostree/packages-runtime-CentOS-7.txt |   7 ++
 .ostree/packages-runtime-CentOS-8.txt |   1 +
 .ostree/packages-runtime-Fedora.txt   |   1 +
 .ostree/packages-runtime-RedHat-7.txt |   8 ++
 .ostree/packages-runtime-RedHat-8.txt |   1 +
 .ostree/packages-runtime-RedHat-9.txt |   1 +
 .ostree/packages-runtime.txt          |   7 ++
 .ostree/packages-testing-CentOS-7.txt |   2 +
 .ostree/packages-testing-CentOS-8.txt |   3 +
 .ostree/packages-testing-Fedora.txt   |   3 +
 .ostree/packages-testing-RedHat-7.txt |   2 +
 .ostree/packages-testing-RedHat-8.txt |   3 +
 .ostree/packages-testing-RedHat-9.txt |   3 +
 .ostree/packages-testing.txt          |   0
 .ostree/roles-runtime.txt             |   3 +
 .ostree/roles-testing.txt             |   1 +
 .sanity-ansible-ignore-2.12.txt       |   1 +
 .sanity-ansible-ignore-2.13.txt       |   1 +
 .sanity-ansible-ignore-2.14.txt       |   1 +
 .sanity-ansible-ignore-2.15.txt       |   1 +
 .sanity-ansible-ignore-2.9.txt        |   1 +
 README-ostree.md                      |  66 ++++++++++++++
 README.md                             |   8 +-
 meta/collection-requirements.yml      |   2 +
 tasks/main.yml                        |   2 +
 tasks/set_vars.yml                    |  18 ++++
 tests/tasks/cleanup.yml               |   1 +
 tests/tasks/install_selinux_tools.yml |  36 ++++++--
 tests/tests_config.yml                |   4 +-
 32 files changed, 306 insertions(+), 10 deletions(-)
 create mode 100644 .ostree/README.md
 create mode 100755 .ostree/get_ostree_data.sh
 create mode 100644 .ostree/packages-runtime-CentOS-7.txt
 create mode 100644 .ostree/packages-runtime-CentOS-8.txt
 create mode 100644 .ostree/packages-runtime-Fedora.txt
 create mode 100644 .ostree/packages-runtime-RedHat-7.txt
 create mode 100644 .ostree/packages-runtime-RedHat-8.txt
 create mode 100644 .ostree/packages-runtime-RedHat-9.txt
 create mode 100644 .ostree/packages-runtime.txt
 create mode 100644 .ostree/packages-testing-CentOS-7.txt
 create mode 100644 .ostree/packages-testing-CentOS-8.txt
 create mode 100644 .ostree/packages-testing-Fedora.txt
 create mode 100644 .ostree/packages-testing-RedHat-7.txt
 create mode 100644 .ostree/packages-testing-RedHat-8.txt
 create mode 100644 .ostree/packages-testing-RedHat-9.txt
 create mode 100644 .ostree/packages-testing.txt
 create mode 100644 .ostree/roles-runtime.txt
 create mode 100644 .ostree/roles-testing.txt
 create mode 100644 .sanity-ansible-ignore-2.12.txt
 create mode 100644 .sanity-ansible-ignore-2.13.txt
 create mode 100644 .sanity-ansible-ignore-2.14.txt
 create mode 100644 .sanity-ansible-ignore-2.15.txt
 create mode 100644 .sanity-ansible-ignore-2.9.txt
 create mode 100644 README-ostree.md

diff --git a/.ansible-lint b/.ansible-lint
index fcec4a6..92f62e3 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -22,3 +22,5 @@ exclude_paths:
   - examples/roles/
 mock_roles:
   - linux-system-roles.cockpit
+mock_modules:
+  - ansible.utils.update_fact
diff --git a/.ostree/README.md b/.ostree/README.md
new file mode 100644
index 0000000..f5e6931
--- /dev/null
+++ b/.ostree/README.md
@@ -0,0 +1,3 @@
+*NOTE*: The `*.txt` files are used by `get_ostree_data.sh` to create the lists
+of packages, and to find other system roles used by this role.  DO NOT use them
+directly.
diff --git a/.ostree/get_ostree_data.sh b/.ostree/get_ostree_data.sh
new file mode 100755
index 0000000..7c32524
--- /dev/null
+++ b/.ostree/get_ostree_data.sh
@@ -0,0 +1,123 @@
+#!/bin/bash
+
+set -euo pipefail
+
+role_collection_dir="${ROLE_COLLECTION_DIR:-fedora/linux_system_roles}"
+ostree_dir="${OSTREE_DIR:-"$(dirname "$(realpath "$0")")"}"
+
+if [ -z "${4:-}" ] || [ "${1:-}" = help ] || [ "${1:-}" = -h ]; then
+    cat <<EOF
+Usage: $0 packages [runtime|testing] DISTRO-MAJOR[.MINOR] [json|yaml|raw|toml]
+The script will use the packages and roles files in $ostree_dir to
+construct the list of packages needed to build the ostree image.  The script
+will output the list of packages in the given format
+- json is a JSON list like ["pkg1","pkg2",....,"pkgN"]
+- yaml is the YAML list format
+- raw is the list of packages, one per line
+- toml is a list of [[packages]] elements as in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/composing_installing_and_managing_rhel_for_edge_images/index#creating-an-image-builder-blueprint-for-a-rhel-for-edge-image-using-the-command-line-interface_composing-a-rhel-for-edge-image-using-image-builder-command-line
+The DISTRO-MAJOR.MINOR is the same format used by Ansible for distribution e.g. CentOS-8, RedHat-8.9, etc.
+EOF
+    exit 1
+fi
+category="$1"
+pkgtype="$2"
+distro_ver="$3"
+format="$4"
+pkgtypes=("$pkgtype")
+if [ "$pkgtype" = testing ]; then
+    pkgtypes+=(runtime)
+fi
+
+get_rolepath() {
+    local ostree_dir role rolesdir roles_parent_dir
+    ostree_dir="$1"
+    role="$2"
+    roles_parent_dir="$(dirname "$(dirname "$ostree_dir")")"
+    rolesdir="$roles_parent_dir/$role/.ostree"
+    # assumes collection format
+    if [ -d "$rolesdir" ]; then
+        echo "$rolesdir"
+        return 0
+    fi
+    # assumes legacy role format like linux-system-roles.$role/
+    for rolesdir in "$roles_parent_dir"/*-system-roles."$role"/.ostree; do
+        if [ -d "$rolesdir" ]; then
+          echo "$rolesdir"
+          return 0
+        fi
+    done
+    # look elsewhere
+    if [ -n "${ANSIBLE_COLLECTIONS_PATHS:-}" ]; then
+        for pth in ${ANSIBLE_COLLECTIONS_PATHS//:/ }; do
+            rolesdir="$pth/ansible_collections/$role_collection_dir/roles/$role/.ostree"
+            if [ -d "$rolesdir" ]; then
+                echo "$rolesdir"
+                return 0
+            fi
+        done
+    fi
+    return 1
+}
+
+get_packages() {
+    local ostree_dir pkgtype pkgfile rolefile
+    ostree_dir="$1"
+    for pkgtype in "${pkgtypes[@]}"; do
+        for suff in "" "-$distro" "-${distro}-${major_ver}" "-${distro}-${ver}"; do
+            pkgfile="$ostree_dir/packages-${pkgtype}${suff}.txt"
+            if [ -f "$pkgfile" ]; then
+                cat "$pkgfile"
+            fi
+        done
+        rolefile="$ostree_dir/roles-${pkgtype}.txt"
+        if [ -f "$rolefile" ]; then
+            local roles role rolepath
+            roles="$(cat "$rolefile")"
+            for role in $roles; do
+                rolepath="$(get_rolepath "$ostree_dir" "$role")"
+                get_packages "$rolepath"
+            done
+        fi
+    done | sort -u
+}
+
+format_packages_json() {
+    local comma pkgs pkg
+    comma=""
+    pkgs="["
+    while read -r pkg; do
+        pkgs="${pkgs}${comma}\"${pkg}\""
+        comma=,
+    done
+    pkgs="${pkgs}]"
+    echo "$pkgs"
+}
+
+format_packages_raw() {
+    cat
+}
+
+format_packages_yaml() {
+    while read -r pkg; do
+        echo "- $pkg"
+    done
+}
+
+format_packages_toml() {
+    while read -r pkg; do
+        echo "[[packages]]"
+        echo "name = \"$pkg\""
+        echo "version = \"*\""
+    done
+}
+
+distro="${distro_ver%%-*}"
+ver="${distro_ver##*-}"
+if [[ "$ver" =~ ^([0-9]*) ]]; then
+    major_ver="${BASH_REMATCH[1]}"
+else
+    echo ERROR: cannot parse major version number from version "$ver"
+    exit 1
+fi
+
+"get_$category" "$ostree_dir" | "format_${category}_$format"
diff --git a/.ostree/packages-runtime-CentOS-7.txt b/.ostree/packages-runtime-CentOS-7.txt
new file mode 100644
index 0000000..92833e6
--- /dev/null
+++ b/.ostree/packages-runtime-CentOS-7.txt
@@ -0,0 +1,7 @@
+cockpit-composer
+cockpit-dashboard
+cockpit-doc
+cockpit-docker
+cockpit-machines
+cockpit-pcp
+cockpit-shell
diff --git a/.ostree/packages-runtime-CentOS-8.txt b/.ostree/packages-runtime-CentOS-8.txt
new file mode 100644
index 0000000..692bd4f
--- /dev/null
+++ b/.ostree/packages-runtime-CentOS-8.txt
@@ -0,0 +1 @@
+cockpit-*
diff --git a/.ostree/packages-runtime-Fedora.txt b/.ostree/packages-runtime-Fedora.txt
new file mode 100644
index 0000000..692bd4f
--- /dev/null
+++ b/.ostree/packages-runtime-Fedora.txt
@@ -0,0 +1 @@
+cockpit-*
diff --git a/.ostree/packages-runtime-RedHat-7.txt b/.ostree/packages-runtime-RedHat-7.txt
new file mode 100644
index 0000000..dc1c3a7
--- /dev/null
+++ b/.ostree/packages-runtime-RedHat-7.txt
@@ -0,0 +1,8 @@
+cockpit-composer
+cockpit-dashboard
+cockpit-doc
+cockpit-docker
+cockpit-leapp
+cockpit-machines
+cockpit-pcp
+cockpit-shell
diff --git a/.ostree/packages-runtime-RedHat-8.txt b/.ostree/packages-runtime-RedHat-8.txt
new file mode 100644
index 0000000..692bd4f
--- /dev/null
+++ b/.ostree/packages-runtime-RedHat-8.txt
@@ -0,0 +1 @@
+cockpit-*
diff --git a/.ostree/packages-runtime-RedHat-9.txt b/.ostree/packages-runtime-RedHat-9.txt
new file mode 100644
index 0000000..692bd4f
--- /dev/null
+++ b/.ostree/packages-runtime-RedHat-9.txt
@@ -0,0 +1 @@
+cockpit-*
diff --git a/.ostree/packages-runtime.txt b/.ostree/packages-runtime.txt
new file mode 100644
index 0000000..19209ff
--- /dev/null
+++ b/.ostree/packages-runtime.txt
@@ -0,0 +1,7 @@
+cockpit
+cockpit-networkmanager
+cockpit-packagekit
+cockpit-selinux
+cockpit-storaged
+cockpit-system
+cockpit-ws
diff --git a/.ostree/packages-testing-CentOS-7.txt b/.ostree/packages-testing-CentOS-7.txt
new file mode 100644
index 0000000..4c8454c
--- /dev/null
+++ b/.ostree/packages-testing-CentOS-7.txt
@@ -0,0 +1,2 @@
+libselinux-python
+policycoreutils-python
diff --git a/.ostree/packages-testing-CentOS-8.txt b/.ostree/packages-testing-CentOS-8.txt
new file mode 100644
index 0000000..5aa9f7c
--- /dev/null
+++ b/.ostree/packages-testing-CentOS-8.txt
@@ -0,0 +1,3 @@
+libselinux-python3
+policycoreutils-python3
+policycoreutils-python-utils
diff --git a/.ostree/packages-testing-Fedora.txt b/.ostree/packages-testing-Fedora.txt
new file mode 100644
index 0000000..5aa9f7c
--- /dev/null
+++ b/.ostree/packages-testing-Fedora.txt
@@ -0,0 +1,3 @@
+libselinux-python3
+policycoreutils-python3
+policycoreutils-python-utils
diff --git a/.ostree/packages-testing-RedHat-7.txt b/.ostree/packages-testing-RedHat-7.txt
new file mode 100644
index 0000000..4c8454c
--- /dev/null
+++ b/.ostree/packages-testing-RedHat-7.txt
@@ -0,0 +1,2 @@
+libselinux-python
+policycoreutils-python
diff --git a/.ostree/packages-testing-RedHat-8.txt b/.ostree/packages-testing-RedHat-8.txt
new file mode 100644
index 0000000..5aa9f7c
--- /dev/null
+++ b/.ostree/packages-testing-RedHat-8.txt
@@ -0,0 +1,3 @@
+libselinux-python3
+policycoreutils-python3
+policycoreutils-python-utils
diff --git a/.ostree/packages-testing-RedHat-9.txt b/.ostree/packages-testing-RedHat-9.txt
new file mode 100644
index 0000000..5aa9f7c
--- /dev/null
+++ b/.ostree/packages-testing-RedHat-9.txt
@@ -0,0 +1,3 @@
+libselinux-python3
+policycoreutils-python3
+policycoreutils-python-utils
diff --git a/.ostree/packages-testing.txt b/.ostree/packages-testing.txt
new file mode 100644
index 0000000..e69de29
diff --git a/.ostree/roles-runtime.txt b/.ostree/roles-runtime.txt
new file mode 100644
index 0000000..3bfffc9
--- /dev/null
+++ b/.ostree/roles-runtime.txt
@@ -0,0 +1,3 @@
+certificate
+firewall
+selinux
diff --git a/.ostree/roles-testing.txt b/.ostree/roles-testing.txt
new file mode 100644
index 0000000..1046ee4
--- /dev/null
+++ b/.ostree/roles-testing.txt
@@ -0,0 +1 @@
+certificate
diff --git a/.sanity-ansible-ignore-2.12.txt b/.sanity-ansible-ignore-2.12.txt
new file mode 100644
index 0000000..67a4c86
--- /dev/null
+++ b/.sanity-ansible-ignore-2.12.txt
@@ -0,0 +1 @@
+roles/cockpit/.ostree/get_ostree_data.sh shebang!skip
diff --git a/.sanity-ansible-ignore-2.13.txt b/.sanity-ansible-ignore-2.13.txt
new file mode 100644
index 0000000..67a4c86
--- /dev/null
+++ b/.sanity-ansible-ignore-2.13.txt
@@ -0,0 +1 @@
+roles/cockpit/.ostree/get_ostree_data.sh shebang!skip
diff --git a/.sanity-ansible-ignore-2.14.txt b/.sanity-ansible-ignore-2.14.txt
new file mode 100644
index 0000000..67a4c86
--- /dev/null
+++ b/.sanity-ansible-ignore-2.14.txt
@@ -0,0 +1 @@
+roles/cockpit/.ostree/get_ostree_data.sh shebang!skip
diff --git a/.sanity-ansible-ignore-2.15.txt b/.sanity-ansible-ignore-2.15.txt
new file mode 100644
index 0000000..67a4c86
--- /dev/null
+++ b/.sanity-ansible-ignore-2.15.txt
@@ -0,0 +1 @@
+roles/cockpit/.ostree/get_ostree_data.sh shebang!skip
diff --git a/.sanity-ansible-ignore-2.9.txt b/.sanity-ansible-ignore-2.9.txt
new file mode 100644
index 0000000..67a4c86
--- /dev/null
+++ b/.sanity-ansible-ignore-2.9.txt
@@ -0,0 +1 @@
+roles/cockpit/.ostree/get_ostree_data.sh shebang!skip
diff --git a/README-ostree.md b/README-ostree.md
new file mode 100644
index 0000000..a9f0185
--- /dev/null
+++ b/README-ostree.md
@@ -0,0 +1,66 @@
+# rpm-ostree
+
+The role supports running on [rpm-ostree](https://coreos.github.io/rpm-ostree/)
+systems. The primary issue is that the `/usr` filesystem is read-only, and the
+role cannot install packages. Instead, it will just verify that the necessary
+packages and any other `/usr` files are pre-installed. The role will change the
+package manager to one that is compatible with `rpm-ostree` systems.
+
+## Building
+
+To build an ostree image for a particular operating system distribution and
+version, use the script `.ostree/get_ostree_data.sh` to get the list of
+packages. If the role uses other system roles, then the script will include the
+packages for the other roles in the list it outputs.  The list of packages will
+be sorted in alphanumeric order.
+
+Usage:
+
+```bash
+.ostree/get_ostree_data.sh packages runtime DISTRO-VERSION FORMAT
+```
+
+`DISTRO-VERSION` is in the format that Ansible uses for `ansible_distribution`
+and `ansible_distribution_version` - for example, `Fedora-38`, `CentOS-8`,
+`RedHat-9.4`
+
+`FORMAT` is one of `toml`, `json`, `yaml`, `raw`
+
+* `toml` - each package in a TOML `[[packages]]` element
+
+```toml
+[[packages]]
+name = "package-a"
+version = "*"
+[[packages]]
+name = "package-b"
+version = "*"
+...
+```
+
+* `yaml` - a YAML list of packages
+
+```yaml
+- package-a
+- package-b
+...
+```
+
+* `json` - a JSON list of packages
+
+```json
+["package-a","package-b",...]
+```
+
+* `raw` - a plain text list of packages, one per line
+
+```bash
+package-a
+package-b
+...
+```
+
+What format you choose depends on which image builder you are using.  For
+example, if you are using something based on
+[osbuild-composer](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/composing_installing_and_managing_rhel_for_edge_images/index#creating-an-image-builder-blueprint-for-a-rhel-for-edge-image-using-the-command-line-interface_composing-a-rhel-for-edge-image-using-image-builder-command-line),
+you will probably want to use the `toml` output format.
diff --git a/README.md b/README.md
index d1fdb4e..0d996c7 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,9 @@ The role requires the `firewall` role and the `selinux` role from the
 If `cockpit` is a role from the `fedora.linux_system_roles` collection
 or from the Fedora RPM package, the requirement is already satisfied.
 
-Otherwise, please run the following command line to install the collection.
+If you want to manage `rpm-ostree` systems with this role, you will need to
+install additional collections.  Please run the following command line to
+install the collection.
 
 ```bash
 ansible-galaxy collection install -vv -r meta/collection-requirements.yml
@@ -271,6 +273,10 @@ tasks:
         state: enabled
 ```
 
+## rpm-ostree
+
+See README-ostree.md
+
 ## License
 
 GPLv3
diff --git a/meta/collection-requirements.yml b/meta/collection-requirements.yml
index d2b6e5b..e22fbe0 100644
--- a/meta/collection-requirements.yml
+++ b/meta/collection-requirements.yml
@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: MIT
 ---
 collections:
+  - ansible.posix
+  - ansible.utils
   - fedora.linux_system_roles
diff --git a/tasks/main.yml b/tasks/main.yml
index 7463830..605555b 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -6,6 +6,7 @@
   when:
     - ansible_distribution == 'RedHat'
     - ansible_distribution_major_version == '7'
+    - ansible_facts.pkg_mgr | d() != "ansible.posix.rhel_rpm_ostree"
   block:
     - name: List active RHEL repositories
       command:
@@ -26,6 +27,7 @@
   with_first_found:
     - "setup-{{ ansible_pkg_mgr }}.yml"
     - "setup-default.yml"
+  when: ansible_facts.pkg_mgr | d() != "ansible.posix.rhel_rpm_ostree"
 
 - name: Configure firewall
   include_tasks: firewall.yml
diff --git a/tasks/set_vars.yml b/tasks/set_vars.yml
index 620ba42..aea144e 100644
--- a/tasks/set_vars.yml
+++ b/tasks/set_vars.yml
@@ -5,6 +5,24 @@
   when: __cockpit_required_facts |
     difference(ansible_facts.keys() | list) | length > 0
 
+- name: Ensure correct package manager for ostree systems
+  vars:
+    ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree
+    ostree_booted_file: /run/ostree-booted
+  when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr
+  block:
+    - name: Check if system is ostree
+      stat:
+        path: "{{ ostree_booted_file }}"
+      register: __ostree_booted_stat
+
+    - name: Set package manager to use for ostree
+      ansible.utils.update_fact:
+        updates:
+          - path: ansible_facts.pkg_mgr
+            value: "{{ ostree_pkg_mgr }}"
+      when: __ostree_booted_stat.stat.exists
+
 - name: Set version specific variables
   include_vars: "{{ item }}"
   with_first_found:
diff --git a/tests/tasks/cleanup.yml b/tests/tasks/cleanup.yml
index 887af4b..10adbf6 100644
--- a/tests/tasks/cleanup.yml
+++ b/tests/tasks/cleanup.yml
@@ -7,6 +7,7 @@
       - cockpit-ws
       - cockpit-doc
     state: absent
+  when: ansible_facts.pkg_mgr | d() != "ansible.posix.rhel_rpm_ostree"
   tags:
     - always
     - tests::cleanup
diff --git a/tests/tasks/install_selinux_tools.yml b/tests/tasks/install_selinux_tools.yml
index cbd4da5..ad1f7f2 100644
--- a/tests/tasks/install_selinux_tools.yml
+++ b/tests/tasks/install_selinux_tools.yml
@@ -1,22 +1,42 @@
 # SPDX-License-Identifier: MIT
 ---
+- name: Ensure correct package manager for ostree systems
+  vars:
+    ostree_pkg_mgr: ansible.posix.rhel_rpm_ostree
+    ostree_booted_file: /run/ostree-booted
+  when: ansible_facts.pkg_mgr | d("") != ostree_pkg_mgr
+  block:
+    - name: Check if system is ostree
+      stat:
+        path: "{{ ostree_booted_file }}"
+      register: __ostree_booted_stat
+
+    - name: Set package manager to use for ostree
+      ansible.utils.update_fact:
+        updates:
+          - path: ansible_facts.pkg_mgr
+            value: "{{ ostree_pkg_mgr }}"
+      when: __ostree_booted_stat.stat.exists
+
 - name: Install SELinux python2 tools
   package:
     name:
       - libselinux-python
       - policycoreutils-python
     state: present
-  when: ( ansible_python_version is version('3', '<') and
-          ansible_distribution in ["Fedora", "CentOS", "RedHat", "Rocky"] )
+  when:
+    - ansible_python_version is version('3', '<')
+    - ansible_distribution in ["Fedora", "CentOS", "RedHat", "Rocky"]
 
 - name: Install SELinux python3 tools
   package:
     name:
-      - libselinux-python3
-      - policycoreutils-python3
+      - python3-libselinux
+      - python3-policycoreutils
     state: present
-  when: ( ansible_python_version is version('3', '>=') and
-          ansible_distribution in ["Fedora", "CentOS", "RedHat", "Rocky"] )
+  when:
+    - ansible_python_version is version('3', '>=')
+    - ansible_distribution in ["Fedora", "CentOS", "RedHat", "Rocky"]
 
 - name: Install SELinux tool semanage
   package:
@@ -24,5 +44,5 @@
       - policycoreutils-python-utils
     state: present
   when: ansible_distribution == "Fedora" or
-    ( ansible_distribution_major_version | int > 7 and
-      ansible_distribution in ["CentOS", "RedHat", "Rocky"] )
+    (ansible_distribution_major_version | int > 7 and
+     ansible_distribution in ["CentOS", "RedHat", "Rocky"])
diff --git a/tests/tests_config.yml b/tests/tests_config.yml
index beb33d3..b4c291d 100644
--- a/tests/tests_config.yml
+++ b/tests/tests_config.yml
@@ -45,7 +45,9 @@
         - name: Test - cockpit metapackage is not installed
           fail:
             msg: cockpit is unexpectedly installed
-          when: "'cockpit' in ansible_facts.packages"
+          when:
+            - "'cockpit' in ansible_facts.packages"
+            - ansible_facts.pkg_mgr | d() != "ansible.posix.rhel_rpm_ostree"
 
         - name: Test - write expected configuration file
           copy: