mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-28 15:47:33 +09:00
Aleksei Sviridkin
b1085782c7
The check looked for one CRD by name, so a cluster carrying only part of Cilium's CRDs passed as a cluster without Cilium, and a failed lookup read as an absent CRD and passed too. It now lists the CRD groups once, fails if that list cannot be read, and fails on any CRD in cilium.io. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
89 lines
4.5 KiB
Bash
89 lines
4.5 KiB
Bash
#!/usr/bin/env bats
|
|
# Install suite for the isp-hosted lane (.github/workflows/e2e-isp-hosted.yaml).
|
|
#
|
|
# The cluster is kind: its CNI, kube-proxy and default StorageClass belong to
|
|
# the host, which is what the hosted installer variant and the isp-hosted
|
|
# platform variant assume. The pass condition is the one the variant has never
|
|
# had checked on a live cluster: every HelmRelease the platform creates goes
|
|
# Ready, cozystack-platform and tenant-root included, with no Cilium CRDs, no
|
|
# LINSTOR and no `replicated` StorageClass anywhere.
|
|
#
|
|
# What this does not cover, by design: tenant applications, ingress (kind has
|
|
# no LoadBalancer implementation, so an ingress Service never gets an address),
|
|
# and anything in the iaas bundle, which this variant refuses to render.
|
|
|
|
@test "Install Cozystack with the hosted installer variant" {
|
|
helm upgrade installer packages/core/installer \
|
|
--install \
|
|
--namespace cozy-system \
|
|
--create-namespace \
|
|
--set cozystackOperator.variant=hosted \
|
|
--set cozystackOperator.helmReleaseInterval=30s \
|
|
--timeout 2m
|
|
|
|
# On hosted the labeler hook runs as an ordinary pod on the host CNI rather
|
|
# than on hostNetwork, so it is the path this lane exercises and no other does.
|
|
kubectl get ns cozy-system -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}' | grep -qx privileged
|
|
kubectl get ns cozy-system -o jsonpath='{.metadata.labels.cozystack\.io/system}' | grep -qx true
|
|
|
|
# Rollout rather than condition=Available, for the reason given at the same
|
|
# step in hack/e2e-install-cozystack.bats.
|
|
kubectl rollout status deployment/cozystack-operator -n cozy-system --timeout=5m || {
|
|
kubectl describe pod -n cozy-system -l app=cozystack-operator 2>&1 || true
|
|
kubectl logs -n cozy-system -l app=cozystack-operator --all-containers --tail=50 2>&1 || true
|
|
kubectl logs -n cozy-system -l app=cozystack-operator --all-containers --previous --tail=50 2>&1 || true
|
|
false
|
|
}
|
|
|
|
timeout 120 sh -ec 'until kubectl wait crd/packages.cozystack.io --for=condition=Established --timeout=10s 2>/dev/null; do sleep 2; done'
|
|
timeout 120 sh -ec 'until kubectl wait crd/packagesources.cozystack.io --for=condition=Established --timeout=10s 2>/dev/null; do sleep 2; done'
|
|
timeout 120 sh -ec 'until kubectl get packagesource cozystack.cozystack-platform >/dev/null 2>&1; do sleep 2; done'
|
|
|
|
kubectl apply -f hack/e2e-isp-hosted-package.yaml
|
|
|
|
# 1800s against the 900s the isp-full lane allows: nothing is pre-pulled here,
|
|
# so one node pulls every platform image cold before its release can go Ready.
|
|
. hack/e2e-wait-helmreleases.sh
|
|
cozy_wait_all_helmreleases_ready 1800 11 5 2
|
|
}
|
|
|
|
@test "The platform and the root tenant are Ready" {
|
|
kubectl wait hr/cozystack-platform -n cozy-system --for=condition=ready --timeout=1m
|
|
kubectl wait hr/tenant-root -n tenant-root --for=condition=ready --timeout=1m
|
|
}
|
|
|
|
@test "The isp-hosted variant took effect" {
|
|
# The install gate above is equally green for any variant that converges, so
|
|
# this reads what the platform actually emitted, not what the lane asked for.
|
|
kubectl get package cozystack.networking -o jsonpath='{.spec.variant}' | grep -qx noop
|
|
for pkg in cozystack.linstor cozystack.metallb cozystack.multus cozystack.kubevirt; do
|
|
if kubectl get package "$pkg" >/dev/null 2>&1; then
|
|
echo "Package $pkg exists, but isp-hosted must not emit it" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
@test "The cluster carries none of what isp-hosted leaves to the host" {
|
|
# The variant's promise is that nothing in it needs Cilium or a
|
|
# Cozystack-provided StorageClass. A green install proves that only if those
|
|
# were really absent while it converged.
|
|
# Any CRD in the group counts, not only the policy kinds. The premise is a
|
|
# cluster with no Cilium at all, and a partial set breaks it even where the
|
|
# tenant guard, which needs both policy kinds, would still skip its policies.
|
|
# Read before counting, so a failed list fails the test instead of counting
|
|
# as zero.
|
|
crd_groups="$(kubectl get crd -o jsonpath='{range .items[*]}{.spec.group}{"\n"}{end}')"
|
|
cilium_crds="$(printf '%s\n' "$crd_groups" | grep -cx 'cilium\.io' || true)"
|
|
if [ "$cilium_crds" -ne 0 ]; then
|
|
echo "$cilium_crds cilium.io CRDs are installed; the lane no longer tests a cluster without them" >&2
|
|
exit 1
|
|
fi
|
|
for sc in replicated local; do
|
|
if kubectl get storageclass "$sc" >/dev/null 2>&1; then
|
|
echo "StorageClass $sc exists; the lane no longer tests a host-provided class alone" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|