Skip to content

Commit 62331dd

Browse files
lexfreilexfrei
committed
test(e2e): fail the isp-hosted no-Cilium check on any cilium.io CRD
The check looked for one CRD by name, so a cluster carrying only part of Cilium's CRDs passed as a cluster without Cilium, and a failed lookup read as an absent CRD and passed too. It now lists the CRD groups once, fails if that list cannot be read, and fails on any CRD in cilium.io. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent cd28e9d commit 62331dd

2 files changed

Lines changed: 56 additions & 2 deletions

File tree

‎hack/e2e-install-cozystack-hosted.bats‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,15 @@
6868
# The variant's promise is that nothing in it needs Cilium or a
6969
# Cozystack-provided StorageClass. A green install proves that only if those
7070
# were really absent while it converged.
71-
if kubectl get crd ciliumnetworkpolicies.cilium.io >/dev/null 2>&1; then
72-
echo "Cilium CRDs are installed; the lane no longer tests a cluster without them" >&2
71+
# Any CRD in the group counts, not only the policy kinds. The premise is a
72+
# cluster with no Cilium at all, and a partial set breaks it even where the
73+
# tenant guard, which needs both policy kinds, would still skip its policies.
74+
# Read before counting, so a failed list fails the test instead of counting
75+
# as zero.
76+
crd_groups="$(kubectl get crd -o jsonpath='{range .items[*]}{.spec.group}{"\n"}{end}')"
77+
cilium_crds="$(printf '%s\n' "$crd_groups" | grep -cx 'cilium\.io' || true)"
78+
if [ "$cilium_crds" -ne 0 ]; then
79+
echo "$cilium_crds cilium.io CRDs are installed; the lane no longer tests a cluster without them" >&2
7380
exit 1
7481
fi
7582
for sc in replicated local; do

‎hack/isp-hosted-lane_test.bats‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,50 @@ TESTING_MAKEFILE="$REPO_ROOT/packages/core/testing/Makefile"
6767
grep -Eq '^[[:space:]]+KIND_NODE_IMAGE: "?kindest/node:v[0-9.]+@sha256:[0-9a-f]{64}"?$' "$WORKFLOW"
6868
grep -Fq 'sha256sum --check' "$WORKFLOW"
6969
}
70+
71+
# Runs the install suite's no-Cilium check against a stubbed kubectl. The copy
72+
# drops the e2e- prefix so hack/cozytest.sh arms no cluster captures, which
73+
# would otherwise run the stub as if it were a cluster.
74+
@test "the suite's no-Cilium check fails on any cilium.io CRD, not only CiliumNetworkPolicy" {
75+
tmp="$(mktemp -d)"
76+
mkdir -p "$tmp/bin"
77+
cp "$INSTALL" "$tmp/hosted.bats"
78+
printf '%s\n' \
79+
'#!/bin/sh' \
80+
'[ "$1 $2" = "get storageclass" ] && exit 1' \
81+
'[ "$1 $2" = "get crd" ] || exit 2' \
82+
'shift 2' \
83+
'[ -n "$FAKE_LIST_FAILS" ] && exit 1' \
84+
'case "$*" in' \
85+
' -o\ jsonpath=*) for n in $FAKE_CRDS; do echo "${n#*.}"; done ;;' \
86+
' -*) exit 2 ;;' \
87+
' *) for n in $FAKE_CRDS; do [ "$n" = "$1" ] && exit 0; done; exit 1 ;;' \
88+
'esac' > "$tmp/bin/kubectl"
89+
chmod +x "$tmp/bin/kubectl"
90+
91+
rc=0
92+
PATH="$tmp/bin:$PATH" FAKE_CRDS="packages.cozystack.io ciliumendpoints.cilium.io" COZY_REPORT_DIR="$tmp/report" COZYTEST_TRACE=0 \
93+
"$REPO_ROOT/hack/cozytest.sh" "$tmp/hosted.bats" "The cluster carries none" > "$tmp/partial.log" 2>&1 || rc=$?
94+
if [ "$rc" -eq 0 ]; then
95+
echo "the check passed with ciliumendpoints.cilium.io installed" >&2
96+
exit 1
97+
fi
98+
99+
rc=0
100+
PATH="$tmp/bin:$PATH" FAKE_CRDS="" FAKE_LIST_FAILS=1 COZY_REPORT_DIR="$tmp/report" COZYTEST_TRACE=0 \
101+
"$REPO_ROOT/hack/cozytest.sh" "$tmp/hosted.bats" "The cluster carries none" > "$tmp/unreadable.log" 2>&1 || rc=$?
102+
if [ "$rc" -eq 0 ]; then
103+
echo "the check passed although the CRD list could not be read" >&2
104+
exit 1
105+
fi
106+
107+
rc=0
108+
PATH="$tmp/bin:$PATH" FAKE_CRDS="packages.cozystack.io" COZY_REPORT_DIR="$tmp/report" COZYTEST_TRACE=0 \
109+
"$REPO_ROOT/hack/cozytest.sh" "$tmp/hosted.bats" "The cluster carries none" > "$tmp/clean.log" 2>&1 || rc=$?
110+
if [ "$rc" -ne 0 ] || ! grep -q "Test OK" "$tmp/clean.log"; then
111+
echo "the check did not pass on a cluster with no cilium.io CRD:" >&2
112+
cat "$tmp/clean.log" >&2
113+
exit 1
114+
fi
115+
rm -rf "$tmp"
116+
}

0 commit comments

Comments
 (0)