Commit dc3fda1

render_sysctl_pool() {

out="$1"; shift

helm template kubernetes-nodes-myk8s-md0 packages/apps/kubernetes-nodes \

--namespace tenant-test \

--set cluster=myk8s \

--set _cluster.cluster-domain=cozy.local \

--set version=v1.35 \

--set minReplicas=0 --set maxReplicas=3 \

--set instanceType="" \

--set diskSize=20Gi --set storageClass=replicated \

--set 'roles[0]=ingress-nginx' \

--set resources.cpu=2 --set resources.memory=4Gi \

"$@" > "$out" 2>"$out.err"

[ -s "$out" ] || { cat "$out.err" >&2; return 1; }

}

@test "sysctl names and values survive the actual Job heredoc literally without shell execution" {

TMP=$(mktemp -d)

cat > "$TMP/values.yaml" <<'VALUES'

render_sysctl_pool "$TMP/r.yaml" -f "$TMP/values.yaml"

yq -r 'select(.kind == "Job") | .spec.template.spec.containers[0].command[2]' "$TMP/r.yaml" > "$TMP/job.sh"

# Execute only the real manifest-producing heredoc, never the surrounding

# kubectl/Talos operations. YAML is parsed on both sides of the shell so

# escaping that prevents execution but corrupts the machine config also fails.

awk '/^TCT_MANIFEST=/{emit=1} emit{print} emit && /^\)"$/{exit}' "$TMP/job.sh" > "$TMP/heredoc.sh"

[ -s "$TMP/heredoc.sh" ]

printf '\nprintf "%%s\\n" "$TCT_MANIFEST"\n' >> "$TMP/heredoc.sh"

yq -o=json '.talos.sysctls | sort_keys(.)' "$TMP/values.yaml" > "$TMP/expected.json"

for shell in bash dash; do

SYSCTL_MARKER="$TMP/executed" TALOS_TOKEN=runtime-token "$shell" "$TMP/heredoc.sh" > "$TMP/tct.yaml"

[ ! -e "$TMP/executed" ]

yq -o=json '.spec.template.spec.data | from_yaml | .machine.sysctls | sort_keys(.)' "$TMP/tct.yaml" > "$TMP/actual.json"

diff -u "$TMP/expected.json" "$TMP/actual.json"

[ "$(yq '.spec.template.spec.data | from_yaml | .machine.token' "$TMP/tct.yaml")" = "runtime-token" ]

done

rm -rf "$TMP"

}

@test "sysctl types are rejected by both the schema and the render-time guard" {

TMP=$(mktemp -d)

for value in '11255' 'false' 'null' '["1"]' '{"evil":"$(id)"}'; do

input="talos.sysctls={\"kernel.panic\":$value}"

if render_sysctl_pool "$TMP/r.yaml" --set-json "$input"; then

echo "FAIL: schema accepted a non-string sysctl: $value"

false

fi

grep -q 'values don.t meet the specifications' "$TMP/r.yaml.err"

if render_sysctl_pool "$TMP/r.yaml" --skip-schema-validation --set-json "$input"; then

echo "FAIL: template accepted a non-string sysctl: $value"

false

fi

grep -Fq 'talos.sysctls["kernel.panic"] must be a string' "$TMP/r.yaml.err"

done

for value in '"$(id)"' 'false' '0' '[]' '["1"]'; do

input="talos.sysctls=$value"

if render_sysctl_pool "$TMP/r.yaml" --set-json "$input"; then

echo "FAIL: schema accepted a non-map sysctls: $value"

false

fi

grep -q 'values don.t meet the specifications' "$TMP/r.yaml.err"

if render_sysctl_pool "$TMP/r.yaml" --skip-schema-validation --set-json "$input"; then

echo "FAIL: template accepted a non-map sysctls: $value"

false

fi

grep -Fq 'talos.sysctls must be a map of strings' "$TMP/r.yaml.err"

done

rm -rf "$TMP"

}

@test "sysctl file values reject invalid UTF-8 rather than changing their bytes" {

TMP=$(mktemp -d)

# --set-file reads raw bytes, unlike the YAML/JSON-facing application API.

for bytes in '\377' '\300\257' '\342\202'; do

printf '%b' "$bytes" > "$TMP/value"

if render_sysctl_pool "$TMP/r.yaml" --skip-schema-validation --set-file "talos.sysctls.kernel\\.panic=$TMP/value"; then

echo "FAIL: accepted invalid UTF-8 sysctl bytes: $bytes"

false

fi

grep -Fq 'must be valid UTF-8' "$TMP/r.yaml.err"

done

printf '\357\277\275' > "$TMP/value"

render_sysctl_pool "$TMP/r.yaml" --skip-schema-validation --set-file "talos.sysctls.kernel\\.panic=$TMP/value"

rm -rf "$TMP"

}