## What this PR does
One unit test was reading from whatever cluster the caller's kubeconfig
selected. The knob test in `hack/run-kubernetes-node-join_test.bats`
runs `cozy_report_node_join_failure` in a fresh `bash -c` and stubs only
`kubectl`, as a shell function. `cozy_diag_read` runs every read through
`timeout`, and `timeout` execs the real `kubectl` from PATH, so the stub
never ran. With a recording `kubectl` first on PATH, one run of that
file logged 170 calls such as `kubectl -n tenant-test describe
virtualmachineinstances.kubevirt.io`. All of them were reads, but a unit
suite should not touch a cluster at all.
The PR has three parts:
1. Both `bash -c` blocks in that file now stub `timeout`, as the
post-source test already did. They also put recording `kubectl` and
`talosctl` executables first on the subshell's PATH and fail if either
one is executed. The declined-path block made no calls in my runs,
because a zero budget declines every read. It gets the same guard
because it has the same shape.
2. The unit and controller targets now run with no cluster to reach. The
root `Makefile` sets `KUBECONFIG=/dev/null` and an empty
`KUBERNETES_SERVICE_HOST` for `unit-tests`, each of its prerequisites,
and `test-controllers`, so the CI command and each target run on its own
are covered. The second variable is needed because client-go falls back
to in-cluster credentials when the kubeconfig is empty and that variable
plus a service-account token are present. The new
`hack/unit-lane-no-cluster.bats` runs every prerequisite of `unit-tests`
as its own goal with a sentinel kubeconfig and service host in the
environment, and fails if any target receives them.
3. One unit file was missing the strict-mode helper.
`hack/bats-strict-setup.bats` requires a `load test_helper` line in
every unit file, and `hack/fork-new-images.bats` is the only one without
it, so the bats lane is red on main and would stay red here. #4805
carries the same one-line fix on its own; if it lands first, this commit
drops out on rebase.
I ran the whole lane (`make unit-tests test-controllers`) with recording
fakes for 20 cluster clients first on PATH. It made no `kubectl` call.
`helm` was called 444 times, all `template` or `unittest`, none with
`--validate`. `flux` was called once, for `push artifact --help`.
Deleting either export line from the Makefile, or removing one target
from the list, turns the new test red. Removing the `timeout` stubs
turns the knob test red, and the failure lists the reads that escaped.
Closes#4793
### Screenshots
Not a UI change.
### Downstream repositories
- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:
### Release note
```release-note
test(tests): unit and controller test targets run with no kubeconfig and no in-cluster service host, so a unit test can no longer reach a cluster.
```
Aleksei Sviridkin
22e0fdbc63