mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:04:31 +00:00
0e806a9233
- normalize K3S/CNPG/OpenTofu env keys across installer and configs; - harden CNPG storage validation/provisioning and fail fast in init script; - update DB manifests/recovery template and port/network mapping data; - expand cluster node policy UI coverage and shell/python tests; - add k3s mode version marker files Co-authored-by: Junie <junie@jetbrains.com>
432 lines
12 KiB
Bash
432 lines
12 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# Regression tests for k3s CNPG storage guardrails in etc/init_cloudnative_pg.sh
|
|
# - must fail if Synology storage roots are root-backed
|
|
# - must fail if manifest lacks explicit synology-iscsi + selector labels (prevents local-path fallback)
|
|
# - must fail if a required Synology root is missing
|
|
# - must succeed (with mocks) when mounts + computed paths + manifest + runtime objects are correct
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
REPO_ROOT=$(cd "$SCRIPT_DIR/../.." && pwd)
|
|
SCRIPT_UNDER_TEST="$REPO_ROOT/etc/init_cloudnative_pg.sh"
|
|
|
|
run_case() {
|
|
local name="$1"; shift
|
|
echo "--- CASE: $name ---"
|
|
|
|
# Ensure case-local env doesn't leak across runs.
|
|
unset CNPG_MANIFEST_OVERRIDE || true
|
|
unset PROLE_NAMESPACE PROLE_MODE DEPLOYMENT_MODE CLUSTER_ENV prole_mode \
|
|
LOCAL_REGISTRY LOCAL_REGISTRY_INTERNAL PROLE_K3S_SERVER K3S_SERVER_URL || true
|
|
|
|
local TMP_DIR
|
|
TMP_DIR=$(mktemp -d)
|
|
trap 'rm -rf "$TMP_DIR"' RETURN
|
|
|
|
local BIN_DIR="$TMP_DIR/bin"
|
|
mkdir -p "$BIN_DIR"
|
|
|
|
export PROLE_TEST_LOG_FILE="$TMP_DIR/mock_calls.log"
|
|
: >"$PROLE_TEST_LOG_FILE"
|
|
|
|
# findmnt mock (driven by env vars)
|
|
cat >"$BIN_DIR/findmnt" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
|
|
path=""
|
|
field=""
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-T)
|
|
path="$2"; shift 2; continue ;;
|
|
-o)
|
|
field="$2"; shift 2; continue ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
if [[ "$field" == *","* ]]; then
|
|
field="${field%%,*}"
|
|
fi
|
|
|
|
if [[ "$path" == "/" && "$field" == "SOURCE" ]]; then
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_ROOT_SRC:-/dev/root}"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$field" == "TARGET" ]]; then
|
|
# Return the mount target for the path (for root-backed checks)
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_TARGET:-$path}"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -n "${PROLE_TEST_ROOT_D001:-}" && "$path" == "${PROLE_TEST_ROOT_D001}"* ]]; then
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_D001_SRC:-/dev/iscsi-d001}"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -n "${PROLE_TEST_ROOT_D002:-}" && "$path" == "${PROLE_TEST_ROOT_D002}"* ]]; then
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_D002_SRC:-/dev/iscsi-d002}"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -n "${PROLE_TEST_ROOT_D003:-}" && "$path" == "${PROLE_TEST_ROOT_D003}"* ]]; then
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_D003_SRC:-/dev/iscsi-d003}"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -n "${PROLE_TEST_ROOT_D004:-}" && "$path" == "${PROLE_TEST_ROOT_D004}"* ]]; then
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_D004_SRC:-/dev/iscsi-d004}"
|
|
exit 0
|
|
fi
|
|
|
|
# Default: pretend it's root-backed
|
|
printf '%s\n' "${PROLE_TEST_FINDMNT_ROOT_SRC:-/dev/root}"
|
|
EOF
|
|
chmod +x "$BIN_DIR/findmnt"
|
|
|
|
# kubectl mock
|
|
cat >"$BIN_DIR/kubectl" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
|
|
_log_file="${PROLE_TEST_LOG_FILE:-}"
|
|
if [[ -n "${_log_file}" ]]; then
|
|
echo "Mocked kubectl called with $*" >>"${_log_file}" 2>/dev/null || true
|
|
fi
|
|
|
|
args="$*"
|
|
|
|
# Simulate kubectl local merge patch used for selector injection.
|
|
if [[ "${args}" == patch*" --local "*" -o yaml"* ]]; then
|
|
src=""
|
|
if [[ "$#" -ge 2 ]]; then
|
|
for ((i=1; i<=$#; i++)); do
|
|
if [[ "${!i}" == "-f" ]]; then
|
|
j=$((i+1))
|
|
src="${!j:-}"
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
if [[ -n "${src}" && -f "${src}" ]]; then
|
|
awk '
|
|
{
|
|
print
|
|
if ($0 ~ /^[[:space:]]*synology\.storage\/role:[[:space:]]*data[[:space:]]*$/) {
|
|
match($0, /^[[:space:]]*/)
|
|
indent = substr($0, RSTART, RLENGTH)
|
|
print indent "prole.io/namespace: test-ns"
|
|
print indent "prole.io/cluster: knoe-db"
|
|
}
|
|
if ($0 ~ /^[[:space:]]*synology\.storage\/role:[[:space:]]*wal[[:space:]]*$/) {
|
|
match($0, /^[[:space:]]*/)
|
|
indent = substr($0, RSTART, RLENGTH)
|
|
print indent "prole.io/namespace: test-ns"
|
|
print indent "prole.io/cluster: knoe-db"
|
|
}
|
|
}
|
|
' "${src}"
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$args" == *"get --raw='/readyz'"* || "$args" == *"get --raw=/readyz"* ]]; then
|
|
echo "ok"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$args" == *"version --short"* ]]; then
|
|
echo "Client Version: v0.0.0"
|
|
echo "Server Version: v0.0.0"
|
|
exit 0
|
|
fi
|
|
|
|
# CNPG webhook wait: return an endpoint IP so waits pass quickly.
|
|
if [[ "$args" == *"get endpoints"*"cnpg-webhook-service"* ]]; then
|
|
echo "10.42.0.10"
|
|
exit 0
|
|
fi
|
|
|
|
# Barman TLS readiness probes: return non-empty jsonpath so waits pass.
|
|
if [[ "$args" == *"-n cnpg-system get secret"*"barman-cloud-"*"-o jsonpath="* ]]; then
|
|
echo "dummy"
|
|
exit 0
|
|
fi
|
|
|
|
# Barman plugin service registration readiness (strict gating)
|
|
if [[ "$args" == *"-n cnpg-system get svc"*"-l cnpg.io/pluginName=barman-cloud.cloudnative-pg.io"*"-o jsonpath="*"metadata.name"* ]]; then
|
|
echo "barman-cloud"
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-n cnpg-system get svc barman-cloud"*"-o jsonpath="*"metadata.name"* ]]; then
|
|
echo "barman-cloud"
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-n cnpg-system get svc barman-cloud"*"pluginClientSecret"* ]]; then
|
|
echo "barman-cloud-client-tls"
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-n cnpg-system get svc barman-cloud"*"pluginServerSecret"* ]]; then
|
|
echo "barman-cloud-server-tls"
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-n cnpg-system get svc barman-cloud"*"pluginPort"* ]]; then
|
|
echo "9090"
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-n cnpg-system get endpoints barman-cloud"* ]]; then
|
|
echo "10.42.0.11"
|
|
exit 0
|
|
fi
|
|
|
|
# DB node availability checks (bootstrap safety)
|
|
if [[ "$args" == *"get nodes"*"--no-headers"* ]]; then
|
|
# Name Status Roles Age Version
|
|
echo "mock-node-1 Ready <none> 1d v0.0.0"
|
|
exit 0
|
|
fi
|
|
|
|
# Runtime validation calls
|
|
if [[ "$args" == *" get cluster knoe-db -o jsonpath="* ]]; then
|
|
# Return empty imageName so _cnpg_current_image_name sees no prior image.
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *" get cluster knoe-db -o json"* ]]; then
|
|
cat <<JSON
|
|
{"apiVersion":"postgresql.cnpg.io/v1","kind":"Cluster","metadata":{"name":"knoe-db"},"spec":{"storage":{"pvcTemplate":{"storageClassName":"synology-iscsi","selector":{"matchLabels":{"synology.storage/role":"data","prole.io/namespace":"test-ns","prole.io/cluster":"knoe-db"}}}},"walStorage":{"pvcTemplate":{"storageClassName":"synology-iscsi","selector":{"matchLabels":{"synology.storage/role":"wal","prole.io/namespace":"test-ns","prole.io/cluster":"knoe-db"}}}}}}
|
|
JSON
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$args" == *" get pvc"*"cnpg.io/cluster=knoe-db"*"-o json"* ]]; then
|
|
cat <<JSON
|
|
{"items":[
|
|
{"metadata":{"name":"knoe-db-1"},"spec":{"storageClassName":"synology-iscsi","volumeName":"pv-data"}},
|
|
{"metadata":{"name":"knoe-db-wal"},"spec":{"storageClassName":"synology-iscsi","volumeName":"pv-wal"}}
|
|
]}
|
|
JSON
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$args" == "get pv pv-data -o json"* ]]; then
|
|
echo '{"spec":{"storageClassName":"synology-iscsi","local":{"path":"/synology/d001/data"}}}'
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == "get pv pv-wal -o json"* ]]; then
|
|
echo '{"spec":{"storageClassName":"synology-iscsi","local":{"path":"/synology/d001/wal"}}}'
|
|
exit 0
|
|
fi
|
|
|
|
# jsonpath calls: keep them simple/empty
|
|
if [[ "$args" == *"-o jsonpath="* ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
exit 0
|
|
EOF
|
|
chmod +x "$BIN_DIR/kubectl"
|
|
|
|
# Light mocks for external tools we don't want to run.
|
|
for t in curl docker skopeo openssl base64; do
|
|
if [[ "$t" == "openssl" ]]; then
|
|
# Use real openssl.
|
|
continue
|
|
fi
|
|
cat >"$BIN_DIR/$t" <<EOF
|
|
#!/usr/bin/env bash
|
|
echo "Mocked $t called with \$*" >>"$TMP_DIR/mock_calls.log"
|
|
exit 0
|
|
EOF
|
|
chmod +x "$BIN_DIR/$t"
|
|
done
|
|
|
|
export PATH="$BIN_DIR:$PATH"
|
|
|
|
# Minimal conf layout (service env) so prole_cfg.sh loads k3s mode.
|
|
local CONF_DIR="$TMP_DIR/conf"
|
|
mkdir -p "$CONF_DIR/service"
|
|
cat >"$CONF_DIR/service/prole.cfg" <<EOF
|
|
[Global]
|
|
DEPLOYMENT_MODE = k3s
|
|
NAMESPACE = test-ns
|
|
SERVICE_NAMESPACE = test-sys
|
|
PROLE_HOME = $TMP_DIR/prolehome
|
|
PROLE_SERVICE = $TMP_DIR/service
|
|
PROLE_K3S_SERVER = https://example.invalid:6443
|
|
EOF
|
|
ln -snf "service/prole.cfg" "$CONF_DIR/prole.cfg"
|
|
|
|
export PROLE_CONF="$CONF_DIR"
|
|
export PROLE_HOME="$TMP_DIR/prolehome"
|
|
export PROLE_SERVICE="$TMP_DIR/service"
|
|
|
|
# Create a manifest directory under PROLE_HOME so init_cloudnative_pg.sh prefers it.
|
|
local MANIFEST_DIR="$PROLE_HOME/deploy/opentofu/k3s/manifests/prole"
|
|
mkdir -p "$MANIFEST_DIR"
|
|
|
|
# Synology roots + computed host paths (override to tmp)
|
|
export PROLE_TEST_ROOT_D001="$TMP_DIR/synology/d001"
|
|
export PROLE_TEST_ROOT_D002="$TMP_DIR/synology/d002"
|
|
export PROLE_TEST_ROOT_D003="$TMP_DIR/synology/d003"
|
|
export PROLE_TEST_ROOT_D004="$TMP_DIR/synology/d004"
|
|
mkdir -p "$PROLE_TEST_ROOT_D001" "$PROLE_TEST_ROOT_D002" "$PROLE_TEST_ROOT_D003" "$PROLE_TEST_ROOT_D004"
|
|
|
|
export SYNOLOGY_ROOTS="$PROLE_TEST_ROOT_D001,$PROLE_TEST_ROOT_D002,$PROLE_TEST_ROOT_D003,$PROLE_TEST_ROOT_D004"
|
|
export CNPG_DATA_HOST_PATH="$PROLE_TEST_ROOT_D001/knoe/knoe-db/test-ns/knoe-db/data"
|
|
export CNPG_WAL_HOST_PATH="$PROLE_TEST_ROOT_D002/knoe/knoe-db/test-ns/knoe-db/wal"
|
|
mkdir -p "$CNPG_DATA_HOST_PATH" "$CNPG_WAL_HOST_PATH"
|
|
export CNPG_STAGE1_NODE="$(hostname -f 2>/dev/null || hostname)"
|
|
|
|
# Defaults: non-root-backed mounts
|
|
export PROLE_TEST_FINDMNT_ROOT_SRC="/dev/root"
|
|
export PROLE_TEST_FINDMNT_D001_SRC="/dev/iscsi0"
|
|
export PROLE_TEST_FINDMNT_D002_SRC="/dev/iscsi1"
|
|
export PROLE_TEST_FINDMNT_D003_SRC="/dev/iscsi2"
|
|
export PROLE_TEST_FINDMNT_D004_SRC="/dev/iscsi3"
|
|
|
|
# Run the case-provided setup (writes manifest + adjusts mocks)
|
|
"$@" "$MANIFEST_DIR" "$TMP_DIR"
|
|
|
|
# Execute deploy with a non-latest version to avoid GitHub lookups.
|
|
set +e
|
|
bash "$SCRIPT_UNDER_TEST" --mode k3s deploy 0.0.0 >"$TMP_DIR/stdout" 2>"$TMP_DIR/stderr"
|
|
rc=$?
|
|
set -e
|
|
|
|
echo "[DEBUG_LOG] rc=$rc"
|
|
sed -n '1,120p' "$TMP_DIR/stderr" || true
|
|
sed -n '1,120p' "$TMP_DIR/stdout" || true
|
|
return $rc
|
|
}
|
|
|
|
case_root_backed() {
|
|
local manifest_dir="$1"
|
|
# Any manifest is fine; we should fail before apply.
|
|
cat >"$manifest_dir/knoe-db.yaml" <<'EOF'
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: knoe-db
|
|
spec:
|
|
storage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: data
|
|
walStorage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: wal
|
|
EOF
|
|
|
|
export PROLE_TEST_FINDMNT_D001_SRC="/dev/root"
|
|
}
|
|
|
|
case_missing_root() {
|
|
local manifest_dir="$1"
|
|
cat >"$manifest_dir/knoe-db.yaml" <<'EOF'
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: knoe-db
|
|
spec:
|
|
storage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: data
|
|
walStorage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: wal
|
|
EOF
|
|
|
|
rm -rf "$PROLE_TEST_ROOT_D004"
|
|
}
|
|
|
|
case_invalid_manifest_missing_sc() {
|
|
local manifest_dir="$1"
|
|
local tmp_dir="$2"
|
|
cat >"$manifest_dir/knoe-db.yaml" <<'EOF'
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: knoe-db
|
|
spec:
|
|
storage:
|
|
pvcTemplate:
|
|
resources:
|
|
requests:
|
|
storage: 29Gi
|
|
walStorage:
|
|
pvcTemplate:
|
|
resources:
|
|
requests:
|
|
storage: 29Gi
|
|
EOF
|
|
|
|
# Use override so deploy_cluster applies our invalid manifest even if sync modifies the default.
|
|
export CNPG_MANIFEST_OVERRIDE="$manifest_dir/knoe-db.yaml"
|
|
}
|
|
|
|
case_success() {
|
|
local manifest_dir="$1"
|
|
cat >"$manifest_dir/knoe-db.yaml" <<'EOF'
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: knoe-db
|
|
spec:
|
|
instances: 1
|
|
storage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: data
|
|
resources:
|
|
requests:
|
|
storage: 29Gi
|
|
walStorage:
|
|
pvcTemplate:
|
|
storageClassName: synology-iscsi
|
|
selector:
|
|
matchLabels:
|
|
synology.storage/role: wal
|
|
resources:
|
|
requests:
|
|
storage: 29Gi
|
|
EOF
|
|
}
|
|
|
|
# 1) Root-backed storage roots must hard-fail.
|
|
if run_case "root-backed mounts" case_root_backed; then
|
|
echo "FAILURE: expected root-backed mounts to fail" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 2) Missing storage roots must hard-fail.
|
|
if run_case "missing Synology root" case_missing_root; then
|
|
echo "FAILURE: expected missing Synology root to fail" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 3) Missing explicit storageClassName/selector must hard-fail.
|
|
if run_case "invalid manifest (missing storageClassName/selector)" case_invalid_manifest_missing_sc; then
|
|
echo "FAILURE: expected invalid manifest to fail" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 4) Happy path should succeed with mocks.
|
|
run_case "success" case_success
|
|
|
|
echo "SUCCESS"
|