Skip to content

Commit 4990143

Browse files
IvanHuntersIvanHunters
committed
test(e2e): harden ghcr-mirror endpoint resolution, drop dead helper
Address non-blocking review nits on the ghcr-mirror helper: - Only commit the mirror endpoint once its tenant egress allow actually applied; a failed policy apply now falls back to direct pulls instead of pointing workers at a ClusterIP the default-deny egress drops (keeps the 'can only help, never make CI worse' invariant). - Distinguish a genuine NotFound (stable, cached) from a transient apiserver error (not cached, retried) so one blip does not disable the mirror for the whole sandbox run; write the decision file atomically (temp + mv). - Remove talos_image_factory_spec_block from talos-image-cache.sh: it became dead code once run-kubernetes.sh was rewired to the combined talos_spec_block. Refs #3513 Signed-off-by: IvanHunters <[email protected]>
1 parent 020c545 commit 4990143

2 files changed

Lines changed: 30 additions & 22 deletions

File tree

‎hack/e2e-chainsaw/_lib/ghcr-mirror.sh‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,40 @@ resolve_ghcr_mirror_endpoint() {
4848
cat "$_GHCR_MIRROR_DECISION_FILE"
4949
return 0
5050
fi
51-
local endpoint=""
52-
if kubectl -n kube-system get deploy ghcr-mirror >/dev/null 2>&1; then
53-
if kubectl -n kube-system rollout status deploy/ghcr-mirror --timeout=5m >/dev/null 2>&1; then
54-
_apply_ghcr_mirror_egress_policy || true
51+
local endpoint="" cache=1 out rc
52+
# One `get deploy` serves both the existence check and the not-deployed-vs-error
53+
# split: a genuine NotFound is a stable decision worth caching, but any other
54+
# failure (transient apiserver blip) must NOT be cached, or one blip would
55+
# disable the mirror for every later test in the shared sandbox.
56+
out=$(kubectl -n kube-system get deploy ghcr-mirror 2>&1); rc=$?
57+
if [ "$rc" -ne 0 ]; then
58+
case "$out" in
59+
*NotFound*|*"not found"*)
60+
echo "ghcr-mirror not deployed -- tenant workers pull ghcr.io directly" >&2 ;;
61+
*)
62+
echo "WARNING: could not query ghcr-mirror Deployment (transient); not caching, will retry" >&2
63+
cache=0 ;;
64+
esac
65+
elif kubectl -n kube-system rollout status deploy/ghcr-mirror --timeout=5m >/dev/null 2>&1; then
66+
# Only commit the endpoint once the tenant egress allow is actually in place.
67+
# The mirror is a kube-system ClusterIP that the tenant default-deny egress
68+
# drops without this allow; pointing workers at it when the policy did not
69+
# apply just adds dial-timeout latency before Talos falls back. Leaving the
70+
# endpoint empty keeps the "can only help, never make CI worse" invariant.
71+
if _apply_ghcr_mirror_egress_policy; then
5572
endpoint="$GHCR_MIRROR_SVC_URL"
56-
echo "ghcr-mirror pull-through registry ready -- tenant workers mirror ghcr.io via ${endpoint}" >&2
73+
echo "ghcr-mirror ready and egress allow applied -- tenant workers mirror ghcr.io via ${endpoint}" >&2
5774
else
58-
echo "WARNING: ghcr-mirror not Available in time -- tenant workers pull ghcr.io directly" >&2
75+
echo "WARNING: ghcr-mirror ready but its egress allow failed to apply -- tenant workers pull ghcr.io directly" >&2
5976
fi
6077
else
61-
echo "ghcr-mirror not deployed -- tenant workers pull ghcr.io directly" >&2
78+
echo "WARNING: ghcr-mirror not Available in time -- tenant workers pull ghcr.io directly" >&2
79+
fi
80+
# Cache atomically (temp + mv) so a concurrent reader in the shared sandbox never
81+
# sees a half-written decision file.
82+
if [ "$cache" -eq 1 ]; then
83+
printf '%s' "$endpoint" > "${_GHCR_MIRROR_DECISION_FILE}.tmp" \
84+
&& mv "${_GHCR_MIRROR_DECISION_FILE}.tmp" "$_GHCR_MIRROR_DECISION_FILE"
6285
fi
63-
printf '%s' "$endpoint" > "$_GHCR_MIRROR_DECISION_FILE"
6486
printf '%s' "$endpoint"
6587
}

‎hack/e2e-chainsaw/_lib/talos-image-cache.sh‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -210,17 +210,3 @@ talos_image_cache_diagnose() {
210210
-c serve --tail=50 --prefix 2>&1 || true
211211
} >&2
212212
}
213-
214-
# talos_image_factory_spec_block: emit a two-line YAML block
215-
# talos:
216-
# imageFactoryURL: <url>
217-
# indented for insertion directly under a tenant Kubernetes CR `spec:`, or
218-
# nothing when the chart default should apply. Ends with a trailing newline when
219-
# non-empty so it can prefix the next `spec` key in a heredoc.
220-
talos_image_factory_spec_block() {
221-
local url
222-
url=$(resolve_talos_image_factory_url)
223-
if [ -n "$url" ]; then
224-
printf ' talos:\n imageFactoryURL: %s\n' "$url"
225-
fi
226-
}

0 commit comments

Comments
 (0)