mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Matthew Grossman
1fff8b97b9
* fix(supervisor): report rejected OCI working directories as WorkspaceValidationFailed The RFC 0012 split dropped the supervisor exit status that drivers map to the WorkspaceValidationFailed condition. An image WORKDIR the sandbox identity cannot use then surfaced as ControlSupervisorStartFailed on Docker and as a signal kill on Podman. The supervisor now exits with the reserved status when the sandbox rejects the image working directory. Docker maps that supervisor exit during readiness and monitoring, and Podman maps the supervisor companion's exit instead of the workload's. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * feat(podman): honor OCI image working directories Podman sandboxes now use a custom OCI image WORKDIR as the workspace and as the working directory for agent commands, matching Docker. Empty, /, and /sandbox values keep the managed /sandbox workspace volume. A custom workspace stays in the image's container filesystem: no workspace volume, no archive upload, and no root setup step. Resolve the image ID, user, environment, and working directory from one pinned inspection, validate the workdir with the shared OCI rules, and reject Podman control-path overlaps and image volumes or driver mounts that cover it. The runtime starts from / and passes the resolved path to agent commands with --workdir. Add podman_oci_identity to the Podman CI test list. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(drivers): preserve custom workspace failures across supervisor cleanup Check the Podman custom workspace rather than the absent managed volume in the OCI identity E2E. Classify Bollard wait errors by exit code and record Docker workspace failures before removing the supervisor so readiness retains the specific failure reason. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(docker): use sandbox ID for recorded startup failures Keep the workload container ID for Docker inspection and use the sandbox ID to retrieve the monitor failure. Test with distinct identifiers so the lookup cannot accidentally pass with a container ID. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(podman): keep WORKDIR change focused on workspace behavior Remove the new cross-driver workspace failure classification path and its monitor/readiness workaround. Preserve Podman WORKDIR resolution, mount safety, and workspace rejection without requiring a distinct condition reason. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(podman): simplify inspected image metadata and test fixtures Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * code review Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
106 lines
3.3 KiB
Bash
Executable File
106 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Run the Rust e2e suite against a standalone gateway running the bundled Podman
|
|
# compute driver. Set OPENSHELL_GATEWAY_ENDPOINT=http://host:port to reuse an
|
|
# existing gateway instead of starting an ephemeral one.
|
|
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
E2E_TEST="${OPENSHELL_E2E_PODMAN_TEST:-}"
|
|
E2E_TEST_SET="${OPENSHELL_E2E_PODMAN_TEST_SET:-}"
|
|
E2E_FEATURES="${OPENSHELL_E2E_PODMAN_FEATURES-e2e-podman}"
|
|
DEFAULT_WORKLOAD_MANIFEST="${ROOT}/e2e/gpu/images/.build/workloads.yaml"
|
|
RUN_WITH_GATEWAY_COMMAND="__openshell_run_podman_e2e"
|
|
# shellcheck source=e2e/support/conformance.sh
|
|
source "${ROOT}/e2e/support/conformance.sh"
|
|
|
|
# Keep required branch CI on the Podman targets that are known to pass. The
|
|
# unfiltered e2e:podman task remains available while the omitted targets are
|
|
# stabilized and can be added here.
|
|
PODMAN_CI_TESTS=(
|
|
bypass_detection
|
|
ephemeral_cleanup
|
|
core_dump_hardening
|
|
credential_gating
|
|
default_image
|
|
driver_config_volume
|
|
edge_tunnel_e2e
|
|
forward_proxy_graphql_l7
|
|
forward_proxy_jsonrpc_l7
|
|
forward_proxy_l7_bypass
|
|
host_gateway_alias
|
|
landlock
|
|
live_policy_update
|
|
local_driver_token_restart
|
|
no_proxy
|
|
podman_corporate_proxy
|
|
podman_gateway_start
|
|
podman_host_gateway
|
|
podman_oci_identity
|
|
provider_token_exchange
|
|
)
|
|
|
|
if [ -n "${E2E_TEST}" ] && [ -n "${E2E_TEST_SET}" ]; then
|
|
echo "error: OPENSHELL_E2E_PODMAN_TEST and OPENSHELL_E2E_PODMAN_TEST_SET cannot both be set" >&2
|
|
exit 2
|
|
fi
|
|
|
|
case "${E2E_TEST_SET}" in
|
|
"")
|
|
SELECTED_TESTS=()
|
|
;;
|
|
ci)
|
|
SELECTED_TESTS=("${PODMAN_CI_TESTS[@]}")
|
|
;;
|
|
*)
|
|
echo "error: unknown Podman E2E test set '${E2E_TEST_SET}' (expected 'ci')" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
if [ -n "${E2E_TEST}" ]; then
|
|
SELECTED_TESTS=("${E2E_TEST}")
|
|
fi
|
|
|
|
if [ "${E2E_TEST}" = "gpu" ] && [ -z "${OPENSHELL_E2E_WORKLOAD_MANIFEST:-}" ] && [ ! -f "${DEFAULT_WORKLOAD_MANIFEST}" ]; then
|
|
echo "note: running Podman GPU e2e without a workload manifest; workload validation will log an explicit skip. Build one with 'CONTAINER_ENGINE=podman mise run e2e:workloads:build' or set OPENSHELL_E2E_WORKLOAD_MANIFEST."
|
|
fi
|
|
|
|
if [ "${1:-}" = "${RUN_WITH_GATEWAY_COMMAND}" ]; then
|
|
e2e_run_openshell_conformance "Podman"
|
|
if [ -z "${E2E_FEATURES}" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
TEST_ARGS=(
|
|
cargo test --manifest-path "${ROOT}/e2e/rust/Cargo.toml"
|
|
--features "${E2E_FEATURES}"
|
|
)
|
|
for test_target in "${SELECTED_TESTS[@]}"; do
|
|
TEST_ARGS+=(--test "${test_target}")
|
|
done
|
|
TEST_ARGS+=(-- --nocapture)
|
|
"${TEST_ARGS[@]}"
|
|
exit 0
|
|
fi
|
|
|
|
# An empty selector runs the full Podman suite, including provider_token_exchange.
|
|
if [ "${#SELECTED_TESTS[@]}" -eq 0 ] || [[ " ${SELECTED_TESTS[*]} " == *" provider_token_exchange "* ]]; then
|
|
export OPENSHELL_E2E_SPIFFE_FIXTURE="${OPENSHELL_E2E_SPIFFE_FIXTURE:-1}"
|
|
fi
|
|
|
|
if [ -n "${OPENSHELL_GATEWAY_ENDPOINT:-}" ] && [ -z "${OPENSHELL_BIN:-}" ]; then
|
|
cargo build -p openshell-cli
|
|
export OPENSHELL_BIN="${ROOT}/target/debug/openshell"
|
|
fi
|
|
|
|
if [ -n "${E2E_FEATURES}" ]; then
|
|
CONTAINER_ENGINE=podman bash "${ROOT}/tasks/scripts/e2e-build-workload.sh"
|
|
fi
|
|
|
|
exec "${ROOT}/e2e/with-podman-gateway.sh" \
|
|
bash "${BASH_SOURCE[0]}" "${RUN_WITH_GATEWAY_COMMAND}"
|