mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Myasnikov Daniil
7b9f286faa
Flux helm-controller v1.5.0 (shipped in Flux v2.8) replaced the legacy
Helm readiness logic with kstatus-based health checking, which polls
Deployment/StatefulSet/Service status and waits for kstatus to assess
rollout-ready. This typically adds 10-30s of latency between resource
apply and HR condition Ready=True compared to v2.7.
Our per-app bats tests had `kubectl wait hr/... --for=condition=ready
--timeout=` budgets of 20s, 30s, 60s, 100s — sized for v2.7's faster
readiness flip and previously masked by the 3x retry on Run E2E tests
(dropped in #2558). Under v2.8 with no retry, every app that runs after
the first few hit its HR wait timeout exactly, surfacing as 13 of 16
test failures on PR #2619.
Standardise on 5m for HR Ready across all app tests. Tight enough to
catch genuine bring-up failures within the per-app job budget, loose
enough to absorb kstatus dispatch jitter on a management cluster that
is concurrently reconciling multiple tenant-test HRs.
Post-HR-Ready checks for app-specific resources (StatefulSet/Service/
PVC/operator CRs) remain — for CR-based apps kstatus only observes
that the chart applied, not that the operator finished. Audit of
which of those are actually redundant under v2.8 kstatus is queued
as a follow-up.
Also bumps the 10s "kamajicontrolplane appears" wait in
run-kubernetes.sh to 2m, and the kubernetes-addon HR Ready loop from
1m to 5m for the same reason.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
(cherry picked from commit 5ef02ee7b3)
65 lines
3.1 KiB
Bash
65 lines
3.1 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
@test "Create OpenBAO (standalone)" {
|
|
name='test'
|
|
kubectl -n tenant-test delete openbao.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
|
|
kubectl apply -f- <<EOF
|
|
apiVersion: apps.cozystack.io/v1alpha1
|
|
kind: OpenBAO
|
|
metadata:
|
|
name: $name
|
|
namespace: tenant-test
|
|
spec:
|
|
replicas: 1
|
|
size: 10Gi
|
|
storageClass: ""
|
|
resourcesPreset: "small"
|
|
resources: {}
|
|
external: false
|
|
ui: true
|
|
EOF
|
|
# Wait for the operator to materialise the HelmRelease before kubectl wait
|
|
# kicks in (kubectl wait errors immediately if the object does not exist yet).
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get hr openbao-$name >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait hr openbao-$name --timeout=5m --for=condition=ready
|
|
kubectl -n tenant-test wait hr openbao-$name-system --timeout=5m --for=condition=ready
|
|
|
|
# Wait for container to be started (pod Running does not guarantee container is ready for exec on slow CI)
|
|
if ! timeout 120 sh -ec "until kubectl -n tenant-test get pod openbao-$name-0 --output jsonpath='{.status.containerStatuses[0].started}' 2>/dev/null | grep -q true; do sleep 5; done"; then
|
|
echo "=== DEBUG: Container did not start in time ===" >&2
|
|
kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
|
|
kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
|
|
kubectl -n tenant-test logs openbao-$name-0 >&2 || true
|
|
return 1
|
|
fi
|
|
|
|
# Wait for OpenBAO API to accept connections
|
|
# bao status exit codes: 0 = unsealed, 1 = error/not ready, 2 = sealed but responsive
|
|
if ! timeout 60 sh -ec "until kubectl -n tenant-test exec openbao-$name-0 -- bao status >/dev/null 2>&1; rc=\$?; test \$rc -eq 0 -o \$rc -eq 2; do sleep 3; done"; then
|
|
echo "=== DEBUG: OpenBAO API did not become responsive ===" >&2
|
|
kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
|
|
kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
|
|
kubectl -n tenant-test logs openbao-$name-0 >&2 || true
|
|
return 1
|
|
fi
|
|
|
|
# Initialize OpenBAO (single key share for testing simplicity)
|
|
init_output=$(kubectl -n tenant-test exec openbao-$name-0 -- bao operator init -key-shares=1 -key-threshold=1 -format=json)
|
|
unseal_key=$(echo "$init_output" | jq -r '.unseal_keys_b64[0]')
|
|
if [ -z "$unseal_key" ] || [ "$unseal_key" = "null" ]; then
|
|
echo "Failed to extract unseal key. Init output: $init_output" >&2
|
|
return 1
|
|
fi
|
|
|
|
# Unseal OpenBAO
|
|
kubectl -n tenant-test exec openbao-$name-0 -- bao operator unseal "$unseal_key"
|
|
|
|
# Now wait for pod to become ready (readiness probe checks seal status)
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get sts openbao-$name >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait sts openbao-$name --timeout=90s --for=jsonpath='{.status.readyReplicas}'=1
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get pvc data-openbao-$name-0 >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait pvc data-openbao-$name-0 --timeout=50s --for=jsonpath='{.status.phase}'=Bound
|
|
kubectl -n tenant-test delete openbao.apps.cozystack.io $name
|
|
kubectl -n tenant-test delete pvc data-openbao-$name-0 --ignore-not-found
|
|
}
|