trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-20 06:00:06 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
windows
OpenShell/e2e/rust/Cargo.toml
T
Matthew GrossmanandEvan Lezar 8c67c27e8b test(oci): add a shared Docker and Podman suite for image USER and WORKDIR (#3931) 
* test(oci): share OCI image checks across Docker and Podman

Add an oci-image feature testsuite that runs against installed artifacts.
It covers custom WORKDIR placement, image content and ownership, workspace
writes from the main process and exec, file transfer including
directory-merge upload, OCI user identity, the managed /sandbox fallback,
and rejection of an unwritable WORKDIR.

CI runs the suite on the Docker rootful, Podman rootful, and Podman
rootless tmachine guests.

Replace the Docker-only custom_image e2e with the shared suite.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(oci): require WorkspaceValidationFailed and cover image USER fallback

The unwritable WORKDIR scenario now requires the WorkspaceValidationFailed
reason, so unrelated provisioning failures cannot pass it. The numeric
USER scenario supplies a policy without a process section, so the image
USER is the only source of the sandbox identity.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(podman): leave shared OCI identity checks to the oci-image suite

The oci-image feature suite covers the sandbox identity seen by the main
process and sandbox exec on Docker and Podman. The Podman e2e keeps the
checks only it can make: the pinned image ID and the isolated
workload/supervisor container pair.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(oci): accept existing workspace rejection diagnostics

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(oci): fix cleanup ordering and restore coverage parity

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>

* test(oci): remove migrated legacy workspace helpers and checks

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* fix(drivers): report rejected OCI working directories as WorkspaceValidationFailed

The supervisor exits with the reserved status when the sandbox rejects the
image working directory. Docker maps that exit during readiness and
monitoring and records it before removing the supervisor container, and
Podman maps the supervisor companion's exit instead of the workload's.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): require WorkspaceValidationFailed for unwritable WORKDIR

Unrelated provisioning failures can no longer pass the rejection scenario.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* fix(oci): keep exit 78 reserved and report fixed workspace diagnostics

The supervisor no longer passes on a workload's own exit status 78, so
drivers cannot misreport it as a workspace rejection after a runtime
restart. The rejection is recognized once at agent start and carried as a
typed error. Docker reports the same fixed condition message as Podman and
logs the supervisor output instead, and its monitor removes the supervisor
container when a stop overlaps diagnostics collection. The OCI image suite
registers images for cleanup only after they build.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* refactor(oci): simplify workspace failure handling and OCI image tests

Report a recorded Docker workspace rejection once, where supervisor
readiness fails, and match its fixed message exactly. Read the Podman
supervisor exit status once per inspection. Choose the supervisor exit
status in one function and derive the workspace error type.

The OCI image suite shares step helpers, checks that a custom workspace
does not also create /sandbox, and its playbook waits for a connected
gateway and collects failure diagnostics through the shared role.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): replace podman_oci_identity with shared and driver suite checks

The oci-image feature suite now checks, on Docker and Podman, that the
image user has no capabilities, has no_new_privs set, and cannot read
the sandbox control credentials, and that a custom WORKDIR is not a
mount. The checks that need container inspection (pinned image ID,
network=none, supervisor user and capabilities) move to a small test in
the Podman driver suite. Remove the legacy podman_oci_identity e2e test.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): keep podman_oci_identity for Podman-only isolation checks

Restore the Podman e2e test removed in the previous commit and drop
only the checks the shared oci-image suite now runs on Docker and
Podman: workload capabilities, no_new_privs, credential readability,
and the workspace and /sandbox mount checks. The pinned image ID and
the workload/supervisor isolation checks stay, as does the Podman
driver suite unchanged.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* refactor(oci): simplify workspace failure reporting and OCI image suite

Carry the Docker control supervisor's failure reason in a typed error
instead of matching status text, build the fixed workspace message where
the wait result is classified, and drop the fake Docker server test.

Inline image cleanup ordering in the suite, read the container engine
once, share sandbox naming, and stop granting a literal /sandbox in the
image identity policy. Add e2e:oci-image mise tasks and use them from the
ARM64 Docker workflow and TESTING.md.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): move shared container checks into the OCI image suite

Inspect the containers the driver created through the gateway's engine in
the shared suite: the workload runs the inspected image ID as the OCI
identity without a network or supervisor credential mounts, and the
supervisor is a separate non-root container. Keep only the Podman-specific
supervisor identity and capability checks in podman_oci_identity.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): check the workspace rejection reason from sandbox JSON

Read the WorkspaceValidationFailed condition reason from sandbox get
--output json instead of matching CLI output, and restore the Docker
driver's original workspace failure helpers.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* test(oci): capture fixture image identity before sandbox creation

Signed-off-by: Evan Lezar <elezar@nvidia.com>

---------

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Co-authored-by: Evan Lezar <elezar@nvidia.com>
2026-10-13 13:00:59 +00:00

284 lines
7.4 KiB
TOML
Raw Permalink Blame History

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
# Standalone crate — the empty [workspace] table prevents Cargo from
# treating this as part of the root workspace, avoiding Dockerfile
# and Cargo.lock coupling.
[workspace]
[package]
name = "openshell-e2e"
description = "End-to-end tests for the OpenShell CLI"
version = "0.1.0"
edition = "2024"
rust-version = "1.90"
license = "Apache-2.0"
publish = false
[features]
# Selects the common E2E suite.
e2e = []
# Selects tests that rely on `host.openshell.internal` (the sandbox's stable
# alias to the host running test fixtures). docker, podman, and vm wire the
# alias unconditionally; the kube driver only does so when
# `gatewayConfig.openshell.drivers.kubernetes.host_gateway_ip` is set, so
# `e2e-kubernetes` does NOT imply this and the Helm wrapper opts in explicitly
# when it has resolved an IP.
e2e-host-gateway = ["e2e"]
e2e-local-container-driver = ["e2e"]
e2e-docker = ["e2e", "e2e-host-gateway", "e2e-local-container-driver"]
e2e-gpu = ["e2e"]
e2e-docker-gpu = ["e2e-docker", "e2e-gpu"]
e2e-kubernetes = ["e2e"]
e2e-kubernetes-ha = ["e2e-kubernetes"]
e2e-kubernetes-credential-drivers = ["e2e-kubernetes"]
e2e-kubernetes-workspace-managed = ["e2e-kubernetes"]
e2e-kubernetes-workspace-operator = ["e2e-kubernetes"]
e2e-podman = ["e2e", "e2e-host-gateway", "e2e-local-container-driver"]
e2e-podman-gpu = ["e2e-podman", "e2e-gpu"]
e2e-oidc-pkce = []
e2e-vm = ["e2e", "e2e-host-gateway"]
[[test]]
name = "policy_activation"
path = "tests/policy_activation.rs"
required-features = ["e2e-docker"]
[[test]]
name = "provider_files"
path = "tests/provider_files.rs"
required-features = ["e2e-docker"]
[[test]]
name = "oidc_pkce"
path = "tests/oidc_pkce.rs"
required-features = ["e2e-oidc-pkce"]
[[test]]
name = "vm_overlay"
path = "tests/vm_overlay.rs"
required-features = ["e2e-vm"]
[[test]]
name = "service_bearer_passthrough"
path = "tests/service_bearer_passthrough.rs"
required-features = ["e2e-docker"]
[[test]]
name = "rootfs_tar"
path = "tests/rootfs_tar.rs"
required-features = ["e2e-vm"]
[[test]]
name = "docker_preflight"
path = "tests/docker_preflight.rs"
required-features = ["e2e-docker"]
[[test]]
name = "docker_corporate_proxy"
path = "tests/docker_corporate_proxy.rs"
required-features = ["e2e-docker"]
[[test]]
name = "driver_config_volume"
path = "tests/driver_config_volume.rs"
required-features = ["e2e-local-container-driver"]
[[test]]
name = "gateway_start"
path = "tests/gateway_start.rs"
required-features = ["e2e-docker"]
[[test]]
name = "local_driver_token_restart"
path = "tests/local_driver_token_restart.rs"
required-features = ["e2e"]
[[test]]
name = "ephemeral_cleanup"
path = "tests/ephemeral_cleanup.rs"
required-features = ["e2e"]
[[test]]
name = "podman_gateway_start"
path = "tests/podman_gateway_start.rs"
required-features = ["e2e-podman"]
[[test]]
name = "podman_host_gateway"
path = "tests/podman_host_gateway.rs"
required-features = ["e2e-podman"]
[[test]]
name = "podman_corporate_proxy"
path = "tests/podman_corporate_proxy.rs"
required-features = ["e2e-podman"]
[[test]]
name = "podman_oci_identity"
path = "tests/podman_oci_identity.rs"
required-features = ["e2e-podman"]
[[test]]
name = "podman_resource_limits"
path = "tests/podman_resource_limits.rs"
required-features = ["e2e-podman"]
[[test]]
name = "provider_refresh_handles"
path = "tests/provider_refresh_handles.rs"
required-features = ["e2e-podman"]
[[test]]
name = "provider_readiness"
path = "tests/provider_readiness.rs"
required-features = ["e2e-docker"]
[[test]]
name = "vm_gateway_start"
path = "tests/vm_gateway_start.rs"
required-features = ["e2e-vm"]
[[test]]
name = "vm_corporate_proxy"
path = "tests/vm_corporate_proxy.rs"
required-features = ["e2e-vm"]
[[test]]
name = "provider_token_exchange"
path = "tests/provider_token_exchange.rs"
required-features = ["e2e-podman"]
[[test]]
name = "kubernetes_ha_rebalancing"
path = "tests/kubernetes_ha_rebalancing.rs"
required-features = ["e2e-kubernetes-ha"]
[[test]]
name = "kubernetes_corporate_proxy"
path = "tests/kubernetes_corporate_proxy.rs"
required-features = ["e2e-kubernetes"]
[[test]]
name = "kubernetes_runtime_reconcile"
path = "tests/kubernetes_runtime_reconcile.rs"
required-features = ["e2e-kubernetes"]
[[test]]
name = "credential_drivers"
path = "tests/credential_drivers.rs"
required-features = ["e2e-kubernetes-credential-drivers"]
[[test]]
name = "websocket_conformance"
path = "tests/websocket_conformance.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "credential_gating"
path = "tests/credential_gating.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "user_namespaces"
path = "tests/user_namespaces.rs"
required-features = ["e2e-kubernetes"]
[[test]]
name = "host_gateway_alias"
path = "tests/host_gateway_alias.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "forward_proxy_l7_bypass"
path = "tests/forward_proxy_l7_bypass.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "forward_proxy_graphql_l7"
path = "tests/forward_proxy_graphql_l7.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "forward_proxy_jsonrpc_l7"
path = "tests/forward_proxy_jsonrpc_l7.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "workspace_lifecycle"
path = "tests/workspace_lifecycle.rs"
required-features = ["e2e"]
[[test]]
name = "sandbox_templates"
path = "tests/sandbox_templates.rs"
required-features = ["e2e"]
[[test]]
name = "proxy_egress_pipeline"
path = "tests/proxy_egress_pipeline.rs"
required-features = ["e2e-host-gateway"]
[[test]]
name = "workspace_namespace_managed"
path = "tests/workspace_namespace_managed.rs"
required-features = ["e2e-kubernetes-workspace-managed"]
[[test]]
name = "workspace_namespace_operator"
path = "tests/workspace_namespace_operator.rs"
required-features = ["e2e-kubernetes-workspace-operator"]
[[test]]
name = "gpu"
path = "tests/gpu.rs"
required-features = ["e2e-gpu"]
[dependencies]
base64 = "0.22"
bollard = "0.20"
bytes = "1"
futures-util = "0.3"
http-body-util = "0.1"
hyper = { version = "1", features = ["client", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }
jsonwebtoken = { version = "10", features = ["aws_lc_rs"] }
prost = "0.14"
tokio = { version = "1.43", features = ["full"] }
tokio-stream = { version = "0.1", features = ["net"] }
tempfile = "3"
sha1 = "0.10"
sha2 = "0.10"
hex = "0.4"
rand = "0.9"
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "aws_lc_rs"] }
rustls-pemfile = "2"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yml = { package = "noyalib", version = "0.0.53", default-features = false, features = ["std", "compat-serde-yaml"] }
tonic = { version = "0.14", features = ["transport"] }
tonic-prost = "0.14"
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "aws_lc_rs"] }
tower = "0.5"
url = "2"
nix = { version = "0.29", features = ["process", "signal", "term", "user"] }
[dev-dependencies]
serial_test = "3"
[lints.rust]
unsafe_code = "warn"
rust_2018_idioms = { level = "warn", priority = -1 }
[lints.clippy]
all = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
module_name_repetitions = "allow"
must_use_candidate = "allow"
missing_errors_doc = "allow"
missing_panics_doc = "allow"
[[test]]
name = "live_internet_traffic_perf"
path = "tests/live_internet_traffic_perf.rs"
required-features = ["e2e-host-gateway"]
Reference in New Issue View Git Blame Copy Permalink