mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Myasnikov Daniil
f75153ac0a
The srv1-srv3 nodes of both lanes that gate a merge -- the same-repo one
in pull-requests.yaml and the fork one in e2e-fork.yaml -- run as Talos
containers instead of QEMU guests, so a tenant worker sits at L2 rather
than L3. Measured in CI on commits where both substrates ran the same
tree: whole-job wall clock down 24-49 minutes, essentially all of it in
Chainsaw, while the two tenant-Kubernetes suites go from 1143-2040s to
466-809s and stop depending on the runner's vgif flag.
The node-join soft-red gate goes with the substrate, which is what it
was for. It existed because nested virtualisation on the shared runners
degraded far enough that a worker registering in minutes elsewhere could
miss any deadline this test could afford; #3513 established that the
discriminator was the host's kvm_amd vgif flag, and removing a nesting
level removes what it acted on. So hack/e2e-node-join-soft-red.sh, the
SOFT-RED-node-join.txt marker and the soft_red job outputs are gone from
all four workflows, and a missed deadline is an ordinary red again. The
::warning annotation survives, because the reason a run went red should
be legible without opening the log, and so does the 124-versus-everything
-else test, because "the workers were slow" and "the wait never ran"
send a reader to different places.
Done by swapping the substrate inside the existing e2e jobs rather than
by promoting a separate container job. Those jobs carry more than a
substrate -- the GitHub App token, the report-overrun guard, the images
list, the SSH breakpoint -- and promoting a job that never had them
would have dropped four features without saying so.
Three properties of container mode drive the design, and each fails
quietly rather than loudly. machine.kernel.modules is a silent no-op --
kernel_module_spec.go returns early on ModeContainer with no error and
no event -- so the host loads openvswitch and zfs before the nodes start
and the workflow step asserts both rather than trusting them; a missing
module surfaces an hour later looking like a CNI or a storage
regression. Docker gives a privileged container its own tmpfs /dev
seeded once at creation, so /dev/kvm works but ZFS zvols created later
never appear and linstor-csi fails ControllerPublishVolume; the compose
file binds the host devtmpfs, which is also why talosctl cluster create
docker can never carry LINSTOR. And there is no ARP VIP, so
192.168.123.11 stands in for the QEMU lane's .10.
The QEMU machinery stays in the tree and keeps running: nightly.yaml and
e2e-tag.yaml still call `make prepare-env`, so DRBD, the replicated
StorageClass, its Immediate binding mode, the tenant StorageClass
propagation that only applies to remotely-accessible classes, and the
Cozystack Talos node image with its extensions all keep nightly and
release-candidate coverage. None of them is exercised per pull request
any more. That is the trade.
Nothing on the PR path builds or downloads a nocloud disk now, so
build-talos drops the talos-nocloud step and the talos-image artifact.
build-talos itself stays: finalize consumes its digest fragment.
One property this does not fix, recorded beside the runner class because
it will be read off a red run eventually: a container node reports the
HOST's CPU and memory as capacity, and hack/e2e-container-up.sh counters
that with kubelet systemReserved. That corrects the scheduler and not
what a pod reads from /proc, so a workload sizing itself from
/proc/cpuinfo or /proc/meminfo is configured for the whole runner.
Also carried here because the same files carry them: the ghcr.io
pull-through mirror removal (see #4007 -- whichever lands first makes the
other a no-op), the authoritative HelmRelease readiness gate, the
backup-credential preflight, the prepull guard against an image-less
container fragment, and folding the two standalone OIDC suites into the
latest-version tenant cluster.
Adapted for release-1.6: this branch has no e2e-fork.yaml, no soft-red
gate, no ghcr.io mirror and no backup e2e, so those hunks are dropped
together with the tests for helpers that exist only on main; e2e-tag.yaml
stays on QEMU. The platform Package generator carries the API endpoint
and nothing else, because the linstor drbd.enabled and kubevirt-cdi
importerResources overrides need chart values this branch does not ship;
the container lane gets e2e-side substitutes for them in later commits.
run-kubernetes.sh takes the storage-class helper, the local-lane pool
baseline, the scoped drain and the OIDC fold, while cleanup keeps its
best-effort `|| true`. The OIDC suite references in select-install.sh and
the chainsaw README go with the suites here rather than in a later commit.
(cherry picked from commit 186547d835)
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-by: LLM
195 lines
8.7 KiB
Makefile
195 lines
8.7 KiB
Makefile
.PHONY: manifests assets prepare-env prepare-env-container unit-tests helm-unit-tests bats-unit-tests rd-presets-check migrations-target-check test-controllers preflight
|
|
|
|
include hack/common-envs.mk
|
|
|
|
build-deps:
|
|
@command -V find docker skopeo jq gh helm > /dev/null
|
|
@yq --version | grep -q "mikefarah" || (echo "mikefarah/yq is required" && exit 1)
|
|
@tar --version | grep -q GNU || (echo "GNU tar is required" && exit 1)
|
|
@sed --version | grep -q GNU || (echo "GNU sed is required" && exit 1)
|
|
@awk --version | grep -q GNU || (echo "GNU awk is required" && exit 1)
|
|
|
|
build: build-deps
|
|
make -C packages/apps/http-cache image
|
|
make -C packages/apps/mariadb image
|
|
make -C packages/apps/clickhouse image
|
|
make -C packages/apps/kubernetes image
|
|
make -C packages/system/monitoring image
|
|
make -C packages/system/cozystack-api image
|
|
make -C packages/system/cozystack-controller image
|
|
make -C packages/system/backup-controller image
|
|
make -C packages/system/backupstrategy-controller image
|
|
make -C packages/system/lineage-controller-webhook image
|
|
make -C packages/system/flux-shard-operator image
|
|
make -C packages/system/cilium image
|
|
make -C packages/system/linstor image
|
|
make -C packages/system/linstor-gui image
|
|
make -C packages/system/kubeovn-webhook image
|
|
make -C packages/system/kubeovn-plunger image
|
|
make -C packages/system/dashboard image
|
|
make -C packages/system/metallb image
|
|
make -C packages/system/kamaji image
|
|
make -C packages/system/capi-providers-cpprovider image
|
|
make -C packages/system/multus image
|
|
make -C packages/system/bucket image
|
|
make -C packages/system/objectstorage-controller image
|
|
make -C packages/system/securitygroup-controller image
|
|
make -C packages/system/grafana-operator image
|
|
make -C packages/core/testing image
|
|
make -C packages/core/talos image
|
|
make -C packages/core/platform image
|
|
make -C packages/core/installer image
|
|
make manifests
|
|
|
|
manifests:
|
|
mkdir -p _out/assets
|
|
cat internal/crdinstall/manifests/*.yaml > _out/assets/cozystack-crds.yaml
|
|
# kubectl-apply install path: render the bare Namespace resource alongside
|
|
# the operator. bareNamespace=true gates a Namespace cozy-system with PSA +
|
|
# identity labels (see packages/core/installer/templates/cozy-system-namespace.yaml).
|
|
# helm install/upgrade users keep the default (false) and use --create-namespace
|
|
# + the pre-install labeler hook.
|
|
# platformVersion is rendered into the COZYSTACK_VERSION env on the operator so
|
|
# the install artifacts carry the version as deploy-time data (not baked into
|
|
# the image). Promotion re-renders these with the stable version, no rebuild.
|
|
# Talos variant (default)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--set cozystackOperator.platformVersion=$(if $(COZYSTACK_VERSION),v$(COZYSTACK_VERSION),) \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-talos.yaml
|
|
# Generic Kubernetes variant (k3s, kubeadm, RKE2)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--set cozystackOperator.variant=generic \
|
|
--set cozystackOperator.platformVersion=$(if $(COZYSTACK_VERSION),v$(COZYSTACK_VERSION),) \
|
|
--set cozystack.apiServerHost=REPLACE_ME \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-generic.yaml
|
|
# Hosted variant (managed Kubernetes)
|
|
helm template installer packages/core/installer -n cozy-system \
|
|
--set bareNamespace=true \
|
|
--set cozystackOperator.variant=hosted \
|
|
--set cozystackOperator.platformVersion=$(if $(COZYSTACK_VERSION),v$(COZYSTACK_VERSION),) \
|
|
--show-only templates/cozy-system-namespace.yaml \
|
|
--show-only templates/cozystack-operator.yaml \
|
|
> _out/assets/cozystack-operator-hosted.yaml
|
|
|
|
cozypkg:
|
|
go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg
|
|
|
|
# Operator diagnostic: reports non-ready cozystack / Flux / Kubernetes resources.
|
|
check-readiness:
|
|
go build -ldflags "-X main.Version=v$(COZYSTACK_VERSION)" -o _out/bin/check-readiness ./cmd/check-readiness
|
|
|
|
assets: assets-talos assets-cozypkg openapi-json
|
|
|
|
openapi-json:
|
|
mkdir -p _out/assets
|
|
VERSION=$(if $(COZYSTACK_VERSION),v$(COZYSTACK_VERSION),$(shell git describe --tags --always 2>/dev/null || echo dev)) go run ./tools/openapi-gen/ 2>/dev/null > _out/assets/openapi.json
|
|
|
|
assets-talos:
|
|
make -C packages/core/talos assets
|
|
|
|
assets-cozypkg: assets-cozypkg-linux-amd64 assets-cozypkg-linux-arm64 assets-cozypkg-darwin-amd64 assets-cozypkg-darwin-arm64 assets-cozypkg-windows-amd64 assets-cozypkg-windows-arm64
|
|
(cd _out/assets/ && sha256sum cozypkg-*.tar.gz) > _out/assets/cozypkg-checksums.txt
|
|
|
|
assets-cozypkg-%:
|
|
$(eval EXT := $(if $(filter windows,$(firstword $(subst -, ,$*))),.exe,))
|
|
mkdir -p _out/assets
|
|
GOOS=$(firstword $(subst -, ,$*)) GOARCH=$(lastword $(subst -, ,$*)) go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg-$*/cozypkg$(EXT) ./cmd/cozypkg
|
|
cp LICENSE _out/bin/cozypkg-$*/LICENSE
|
|
tar -C _out/bin/cozypkg-$* -czf _out/assets/cozypkg-$*.tar.gz LICENSE cozypkg$(EXT)
|
|
|
|
test:
|
|
make -C packages/core/testing apply
|
|
make -C packages/core/testing e2e
|
|
|
|
unit-tests: helm-unit-tests bats-unit-tests go-unit-tests rd-presets-check test-check-readiness migrations-target-check
|
|
|
|
helm-unit-tests:
|
|
hack/helm-unit-tests.sh
|
|
|
|
# Pin the resourcesPreset enum in every ApplicationDefinition openAPISchema
|
|
# to the canonical 47-value set (40 instance-type names + 7 legacy aliases).
|
|
# Catches the regression where one chart's Makefile forgets to invoke
|
|
# hack/update-crd.sh and that RD's schema drifts from values.schema.json.
|
|
rd-presets-check:
|
|
hack/check-rd-presets.sh
|
|
|
|
# Catch the off-by-one where migrations/<N> is added but
|
|
# migrations.targetVersion in packages/core/platform/values.yaml is not
|
|
# bumped to >= N+1. run-migrations.sh loops `seq $$CURRENT $$((TARGET-1))`,
|
|
# so the new migration is silently skipped on every cluster upgrade.
|
|
migrations-target-check:
|
|
hack/check-migrations-target.sh
|
|
|
|
# Scoped go test over the cozystack-api surface that this repo owns. Kept
|
|
# narrow intentionally - running `go test ./...` pulls in generated code
|
|
# round-trip suites whose behavior depends on tool versions outside this
|
|
# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised
|
|
# from their generator workflows.
|
|
go-unit-tests:
|
|
go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/...
|
|
|
|
# Go tests for the controllers and supporting packages under ./internal.
|
|
# Excludes ./pkg/... and ./cmd/... — those are run separately by
|
|
# go-unit-tests above (pkg subset) and skipped (cmd) until their tests
|
|
# stabilise. Run as its own step in CI alongside helm/bats unit tests;
|
|
# locally invoke directly (`make test-controllers`) or chain
|
|
# (`make unit-tests test-controllers`).
|
|
test-controllers:
|
|
go test ./internal/... -count=1
|
|
|
|
# Black-box golden test for cmd/check-readiness. Builds the binary and runs it
|
|
# against a mock kubectl (fixtures under test/check-readiness/testdata),
|
|
# diffing stdout/stderr/exit against golden files. Regenerate goldens with:
|
|
# go test ./test/check-readiness/ -update
|
|
test-check-readiness:
|
|
go test ./test/check-readiness/ -count=1
|
|
|
|
# Discover every hack/*.bats file that is NOT an e2e test and run it
|
|
# through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
|
|
# up automatically on the next `make unit-tests` run.
|
|
#
|
|
# Caveat: $(wildcard ...) returns space-separated names, so a filename
|
|
# containing a literal space would split into multiple tokens here. All
|
|
# current bats files use hyphen-separated names; if the project ever
|
|
# introduces whitespace-bearing filenames this recipe must be rewritten
|
|
# (e.g. to use `find ... -print0 | xargs -0`).
|
|
BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
|
|
|
|
bats-unit-tests:
|
|
@if [ -z "$(BATS_UNIT_FILES)" ]; then \
|
|
echo "ERROR: no hack/*.bats unit test files found"; \
|
|
exit 1; \
|
|
fi
|
|
@for f in $(BATS_UNIT_FILES); do \
|
|
echo "--- running $$f ---"; \
|
|
hack/cozytest.sh "$$f" || exit 1; \
|
|
done
|
|
|
|
# Operator-facing host preflight check. Warns about a standalone
|
|
# containerd.service or docker.service running alongside the embedded
|
|
# k3s runtime. Safe to run at any time; always exits 0.
|
|
preflight:
|
|
@hack/check-host-runtime.sh
|
|
|
|
prepare-env:
|
|
make -C packages/core/testing apply
|
|
make -C packages/core/testing prepare-cluster
|
|
|
|
# Container-lane sibling of prepare-env. Same sandbox, Talos nodes as containers
|
|
# instead of QEMU guests, so no nocloud asset is copied in.
|
|
prepare-env-container:
|
|
make -C packages/core/testing apply
|
|
make -C packages/core/testing prepare-cluster-container
|
|
|
|
generate:
|
|
hack/update-codegen.sh
|
|
|
|
upload_assets: manifests
|
|
hack/upload-assets.sh
|