Cluster-member workloads (OVN raft, LINSTOR, cert-manager) fail when
replicas start at different times due to per-node image-pull stagger.
This test pre-pulls the images that those charts reference onto every
node before the platform HelmReleases install, so all replicas can
start with images already cached.
Mechanics:
- Source images directly from the rendered charts (kubeovn, linstor,
cert-manager) via `helm template` + a `yq` filter that walks every
PodSpec-shaped object and emits each container's image. Scopes the
output to images the kubelet actually pulls — skips configmap fields
and CRD examples that happen to contain an `image:` key. Each render
is staged through a tmp file so a helm-template failure trips `set -e`
cleanly without needing `pipefail` (cozytest.sh runs @test bodies
under /bin/sh, which is dash on Ubuntu CI), and without capturing
rendered YAML into a shell variable that `set -x` would expand and
balloon the CI trace.
- The pre-pull DaemonSet is the hard part: distroless images
(cert-manager and friends) ship no shell and no /bin/sleep, so the
obvious `command: ["sleep", "infinity"]` fails with exec ENOENT.
Stage a statically-linked busybox:musl into a shared emptyDir from
an initContainer; every prepull container then execs /shared/sleep
regardless of what the image itself ships. The glibc busybox tag is
unusable here — it needs /lib64/ld-linux-x86-64.so.2 which distroless
lacks. Loop is written in POSIX shell (no bash arrays) for the same
/bin/sh-is-dash reason.
Verified locally on kind v1.33.1 single-node: every chart-referenced
image is held Ready under the DaemonSet before the platform HelmRelease
applies.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Some workloads (kube-ovn raft, LINSTOR controller / piraeus-server)
fail when replicas start at materially different times due to
image-pull stagger across nodes. Add a DaemonSet-based pre-pull step
that runs before `helm install`, ensuring every node has the images
cached so replicas start within milliseconds of each other.
The script accepts image refs on stdin and creates one container per
image so pulls run in parallel — total time = max(any single image)
rather than sum. The bats test sources image refs directly from the
rendered platform charts via `yq`, walking only PodSpec-shaped
objects, so version bumps stay in sync without a hardcoded list.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
