mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
Taylor Mutch
59475aabf4
* test(helm): Add kube gateway e2e tests Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * ci(helm): add Branch Helm E2E workflow gated on test:e2e-helm Adds a label-gated GitHub Actions workflow that exercises the Helm chart end-to-end against the Rust e2e suite via `mise run e2e:helm`. Pipeline: - pr_metadata gates on the `test:e2e-helm` label via the pr-gate action. - build-gateway / build-supervisor build and push Docker images using the reusable docker-build.yml workflow. - helm-e2e (bare runner): apt-installs z3 build deps so cargo can compile the openshell-policy crate's z3-sys backend, creates a kind cluster via helm/kind-action, materializes the kind kubeconfig at the path mise's [env] block expects, side-loads the freshly built gateway/supervisor images, applies deploy/kube/manifests/agent-sandbox.yaml so the sandboxes.agents.x-k8s.io CRD and reconciling StatefulSet are in place, and finally runs `mise run e2e:helm`. Also expands the `e2e:helm` task to run the full Rust e2e suite (matching `e2e:podman`) instead of only the smoke test, with OPENSHELL_E2E_KUBE_TEST as an opt-in single-test override for local debugging. Extends the e2e-label-help workflow so applying `test:e2e-helm` posts the next-step hint pointing at this workflow. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(helm-e2e): run host-gateway tests on the kube driver Six tests previously skipped on the kubernetes driver — three in host_gateway_alias.rs plus the forward_proxy_l7 + graphql_l7 cases — relied on `host.openshell.internal` reaching either a host process or a sibling docker container. The Helm chart already supports this via `server.hostGatewayIP`, but the e2e wrapper never set it. - with-kube-gateway.sh: auto-detect the host-routable IP (CoreDNS `host.k3d.internal` first to handle Docker Desktop, docker network gateway as a fallback for kind on Linux CI) and pass it to helm install. Also import locally-built images into existing k3d clusters and wait for namespace deletion to complete before exit. - e2e/rust/Cargo.toml + e2e-helm.sh: add an `e2e-host-gateway` feature that gates the three test files; docker and podman runs imply it, helm runs opt in by default (overridable via OPENSHELL_E2E_HELM_FEATURES for remote clusters where the test host is unreachable from pods). - Drop the `skip_if_kube` helper and its callers — feature gating now decides whether the tests compile in. Verified against a local k3d cluster: all six previously-skipped tests pass, smoke regression intact. * refactor(e2e): rename e2e:helm to e2e:kubernetes The runner exercises the gateway on Kubernetes; helm is just the deployment mechanism. Names now describe the target environment. - mise task: `e2e:helm` -> `e2e:kubernetes` - script: e2e/rust/e2e-helm.sh -> e2e/rust/e2e-kubernetes.sh - env var: OPENSHELL_E2E_HELM_FEATURES -> OPENSHELL_E2E_KUBERNETES_FEATURES - workflow: branch-helm-e2e.yml -> branch-kubernetes-e2e.yml (display name "Branch Kubernetes E2E", job "kubernetes-e2e") - PR gate label: test:e2e-helm -> test:e2e-kubernetes (e2e-label-help hint workflow updated to match) PR #1251 needs the new label applied; the old label can be removed. * fix(e2e): prefer IPv4 host-gateway IP from dual-stack docker networks kind dual-stacks its network; the wrapper's awk picked the first non-empty gateway, which was the IPv6 entry (fc00:...). Sandbox pods can't reach the test host's IPv4 listener through that, so the L7 and host-gateway-alias tests failed in CI even though they passed locally against k3d (where host.k3d.internal in CoreDNS short-circuits the docker-network fallback). Restrict the awk filter to IPv4 octets. --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
92 lines
2.4 KiB
TOML
92 lines
2.4 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Standalone crate — the empty [workspace] table prevents Cargo from
|
|
# treating this as part of the root workspace, avoiding Dockerfile
|
|
# and Cargo.lock coupling.
|
|
[workspace]
|
|
|
|
[package]
|
|
name = "openshell-e2e"
|
|
description = "End-to-end tests for the OpenShell CLI"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
rust-version = "1.88"
|
|
license = "Apache-2.0"
|
|
publish = false
|
|
|
|
[features]
|
|
e2e = []
|
|
# Selects tests that rely on `host.openshell.internal` (the sandbox's stable
|
|
# alias to the host running test fixtures). docker and podman wire the alias
|
|
# unconditionally; the kube driver only does so when the chart's
|
|
# `server.hostGatewayIP` is set, so `e2e-kubernetes` does NOT imply this and
|
|
# the helm wrapper opts in explicitly when it has resolved an IP.
|
|
e2e-host-gateway = ["e2e"]
|
|
e2e-docker = ["e2e", "e2e-host-gateway"]
|
|
e2e-gpu = ["e2e"]
|
|
e2e-docker-gpu = ["e2e-docker", "e2e-gpu"]
|
|
e2e-kubernetes = ["e2e"]
|
|
e2e-podman = ["e2e", "e2e-host-gateway"]
|
|
e2e-podman-gpu = ["e2e-podman", "e2e-gpu"]
|
|
|
|
[[test]]
|
|
name = "custom_image"
|
|
path = "tests/custom_image.rs"
|
|
required-features = ["e2e-docker"]
|
|
|
|
[[test]]
|
|
name = "docker_preflight"
|
|
path = "tests/docker_preflight.rs"
|
|
required-features = ["e2e-docker"]
|
|
|
|
[[test]]
|
|
name = "gateway_resume"
|
|
path = "tests/gateway_resume.rs"
|
|
required-features = ["e2e-docker"]
|
|
|
|
[[test]]
|
|
name = "user_namespaces"
|
|
path = "tests/user_namespaces.rs"
|
|
required-features = ["e2e-kubernetes"]
|
|
|
|
[[test]]
|
|
name = "host_gateway_alias"
|
|
path = "tests/host_gateway_alias.rs"
|
|
required-features = ["e2e-host-gateway"]
|
|
|
|
[[test]]
|
|
name = "forward_proxy_l7_bypass"
|
|
path = "tests/forward_proxy_l7_bypass.rs"
|
|
required-features = ["e2e-host-gateway"]
|
|
|
|
[[test]]
|
|
name = "forward_proxy_graphql_l7"
|
|
path = "tests/forward_proxy_graphql_l7.rs"
|
|
required-features = ["e2e-host-gateway"]
|
|
|
|
[[test]]
|
|
name = "gpu_device_selection"
|
|
path = "tests/gpu_device_selection.rs"
|
|
required-features = ["e2e-gpu"]
|
|
|
|
[dependencies]
|
|
tokio = { version = "1.43", features = ["full"] }
|
|
tempfile = "3"
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
rand = "0.9"
|
|
serde_json = "1"
|
|
|
|
[lints.rust]
|
|
unsafe_code = "warn"
|
|
rust_2018_idioms = { level = "warn", priority = -1 }
|
|
|
|
[lints.clippy]
|
|
all = { level = "warn", priority = -1 }
|
|
pedantic = { level = "warn", priority = -1 }
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|