|
| 1 | +#!/usr/bin/env bats |
| 2 | +# EXIT-TRAP DEBT: 3 -- see hack/bats-no-exit-trap.bats. |
| 3 | +# None of the three is debt: each trap sits inside an explicit subshell and |
| 4 | +# removes that test's own temp dir, so it does not displace the handler the |
| 5 | +# bats binary installs and a failure still prints its `not ok`. The count is |
| 6 | +# declared because the ratchet is exact in both directions: it fails if a |
| 7 | +# test-level trap is added here, and it fails if one of these is removed. |
| 8 | + |
| 9 | +_capk_fixture() { |
| 10 | + mkdir -p "$1/packages/system" "$1/hack" "$1/bin" "$1/oci" |
| 11 | + cp -R packages/system/capi-providers-infraprovider "$1/packages/system/" |
| 12 | + cp hack/common-envs.mk hack/package.mk "$1/hack/" |
| 13 | + cat > "$1/bin/docker" <<'EOF' |
| 14 | +#!/bin/sh |
| 15 | +set -eu |
| 16 | +printf '%s\n' "$@" > "$CAPK_BUILD_ARGS" |
| 17 | +[ "${CAPK_BUILD_FAIL:-0}" = 0 ] || exit 77 |
| 18 | +while [ "$#" -gt 0 ]; do |
| 19 | + if [ "$1" = --metadata-file ]; then |
| 20 | + shift |
| 21 | + printf '{"containerimage.digest":"%s"}\n' "${CAPK_TEST_DIGEST:-sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}" > "$1" |
| 22 | + exit 0 |
| 23 | + fi |
| 24 | + shift |
| 25 | +done |
| 26 | +exit 2 |
| 27 | +EOF |
| 28 | + chmod +x "$1/bin/docker" |
| 29 | +} |
| 30 | + |
| 31 | +@test "CAPK compressed provider ships the migration create permission" { |
| 32 | + pkg=packages/system/capi-providers-infraprovider |
| 33 | + gzip -dc "$pkg/files/components.gz" | cmp - "$pkg/files/infrastructure-components.yaml" |
| 34 | + rules=$(gzip -dc "$pkg/files/components.gz" | yq -o=json -I=0 'select(.kind == "ClusterRole" and .metadata.name == "capk-manager-role") | .rules') |
| 35 | + printf '%s\n' "$rules" | jq -e '[.[] | select(.apiGroups == ["kubevirt.io"] and .resources == ["virtualmachineinstancemigrations"])] == [{"apiGroups":["kubevirt.io"],"resources":["virtualmachineinstancemigrations"],"verbs":["create"]}]' |
| 36 | +} |
| 37 | + |
| 38 | +@test "CAPK rendered provider reads the digest pin outside the gzip" { |
| 39 | + ( |
| 40 | + work=$(mktemp -d) |
| 41 | + trap 'rm -rf "$work"' EXIT |
| 42 | + pkg=packages/system/capi-providers-infraprovider |
| 43 | + helm template capk "$pkg" --namespace cozy-cluster-api > "$work/rendered.yaml" |
| 44 | + image=$(yq -r 'select(.kind == "InfrastructureProvider") | .spec.deployment.containers[] | select(.name == "manager") | .imageUrl' "$work/rendered.yaml") |
| 45 | + [ "$image" = "$(cat "$pkg/images/cluster-api-provider-kubevirt.tag")" ] |
| 46 | + [ "$(yq -r 'select(.kind == "InfrastructureProvider") | .spec.version' "$work/rendered.yaml")" = v0.1.10-infraprovider ] |
| 47 | + yq -r 'select(.kind == "ConfigMap") | .binaryData.components' "$work/rendered.yaml" \ |
| 48 | + | python3 -c 'import base64,gzip,sys; sys.stdout.buffer.write(gzip.decompress(base64.b64decode(sys.stdin.read())))' \ |
| 49 | + | cmp - "$pkg/files/infrastructure-components.yaml" |
| 50 | + ) |
| 51 | +} |
| 52 | + |
| 53 | +@test "CAPK OCI build stamps a discoverable ref without rewriting components" { |
| 54 | + ( |
| 55 | + work=$(mktemp -d) |
| 56 | + trap 'rm -rf "$work"' EXIT |
| 57 | + _capk_fixture "$work" |
| 58 | + pkg="$work/packages/system/capi-providers-infraprovider" |
| 59 | + PATH="$work/bin:$PATH" CAPK_BUILD_ARGS="$work/args" \ |
| 60 | + make -C "$pkg" image COZYSTACK_VERSION=0 REGISTRY=registry.example.test/cozy \ |
| 61 | + IMAGE_TAG=pr-test OCI_EXPORT_DIR="$work/oci" PLATFORM=linux/amd64 |
| 62 | + ref=registry.example.test/cozy/cluster-api-provider-kubevirt:pr-test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa |
| 63 | + [ "$(cat "$pkg/images/cluster-api-provider-kubevirt.tag")" = "$ref" ] |
| 64 | + grep -Fx -- --push=0 "$work/args" |
| 65 | + grep -Fx -- --load=0 "$work/args" |
| 66 | + grep -Fx -- "type=oci,dest=$work/oci/cluster-api-provider-kubevirt.oci.tar" "$work/args" |
| 67 | + cmp "$pkg/files/components.gz" packages/system/capi-providers-infraprovider/files/components.gz |
| 68 | + . hack/lib/image-refs.sh |
| 69 | + collect_image_refs "$work/packages" | grep -Fx "$ref" |
| 70 | + ) |
| 71 | +} |
| 72 | + |
| 73 | +@test "CAPK failed builds and missing digests cannot replace the prior pin" { |
| 74 | + ( |
| 75 | + work=$(mktemp -d) |
| 76 | + trap 'rm -rf "$work"' EXIT |
| 77 | + _capk_fixture "$work" |
| 78 | + pkg="$work/packages/system/capi-providers-infraprovider" |
| 79 | + pin=$(cat "$pkg/images/cluster-api-provider-kubevirt.tag") |
| 80 | + for failure in build digest; do |
| 81 | + fail=0 |
| 82 | + digest=invalid |
| 83 | + [ "$failure" != build ] || fail=1 |
| 84 | + rc=0 |
| 85 | + PATH="$work/bin:$PATH" CAPK_BUILD_ARGS="$work/args" CAPK_BUILD_FAIL="$fail" CAPK_TEST_DIGEST="$digest" \ |
| 86 | + make -C "$pkg" image COZYSTACK_VERSION=0 REGISTRY=registry.example.test/cozy \ |
| 87 | + IMAGE_TAG=pr-test OCI_EXPORT_DIR="$work/oci" > "$work/build.log" 2>&1 || rc=$? |
| 88 | + [ "$rc" -ne 0 ] |
| 89 | + [ "$(cat "$pkg/images/cluster-api-provider-kubevirt.tag")" = "$pin" ] |
| 90 | + done |
| 91 | + ) |
| 92 | +} |
0 commit comments