mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-07 08:55:37 +08:00
Drew Newberry
e5adf6f484
* feat(supervisor): recover shared instances with hash-based HA Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): keep HA coordination out of compute drivers Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): fence pool admission and reconciliation races Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(supervisor): keep pool mode stable across replica scaling Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): default shared deployments to pool mode Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): fence refused launches and remove legacy mode Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): confirm live owners and fence stale observations Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): preserve takeover cause log formatting Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): add memory-based supervisor autoscaling Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(supervisor): retain acknowledgements and fence streamed input Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(supervisor): consolidate experimental multi-tenant guidance Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(supervisor): simplify multi-tenant supervisor guide Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(supervisor): simplify pool member identity Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): make supervisor affinity configurable Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(helm): make supervisor disruption budget optional Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(supervisor): align HA fixtures with suspend support Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
824 lines
27 KiB
YAML
824 lines
27 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
suite: supervisor deployment
|
|
templates:
|
|
- templates/supervisor.yaml
|
|
- templates/supervisor-service.yaml
|
|
- templates/supervisor-networkpolicy.yaml
|
|
- templates/supervisor-token-secret.yaml
|
|
- templates/supervisor-pdb.yaml
|
|
- templates/gateway-config.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: gateway
|
|
tests:
|
|
- it: adds no supervisor by default
|
|
template: templates/supervisor.yaml
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-pdb.yaml
|
|
- it: deploys the supervisor pool without Kubernetes identity in the gateway namespace
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
supervisor_image: example.com/supervisor:shared
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
- equal:
|
|
path: kind
|
|
value: Deployment
|
|
documentIndex: 0
|
|
- equal:
|
|
path: metadata.namespace
|
|
value: gateway
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 1
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.metadata.labels["app.kubernetes.io/name"]
|
|
value: openshell-supervisor
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.containers[0].image
|
|
value: example.com/supervisor:shared
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.containers[0].args
|
|
value:
|
|
- --mode=shared
|
|
- --gateway-endpoint
|
|
- https://openshell.gateway.svc.cluster.local:8080
|
|
- --address
|
|
- 0.0.0.0:5501
|
|
- --token-file
|
|
- /etc/openshell/supervisor-token/token
|
|
- --runtime-listen
|
|
- 0.0.0.0:5500
|
|
- --session-root
|
|
- /run/openshell/sessions
|
|
documentIndex: 0
|
|
- lengthEqual:
|
|
path: spec.template.spec.containers[0].ports
|
|
count: 2
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.containers[0].readinessProbe
|
|
value:
|
|
tcpSocket:
|
|
port: health
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.containers[0].livenessProbe
|
|
value:
|
|
tcpSocket:
|
|
port: health
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: run
|
|
mountPath: /run/openshell
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.ports
|
|
value:
|
|
- name: runtime
|
|
port: 5500
|
|
targetPort: runtime
|
|
protocol: TCP
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: false
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_ENDPOINT
|
|
value: https://openshell.gateway.svc.cluster.local:8080
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_GATEWAY_TLS_SERVER_NAME
|
|
value: openshell.gateway.svc.cluster.local
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: supervisor-token
|
|
secret:
|
|
secretName: openshell-supervisor-token
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: supervisor-token
|
|
mountPath: /etc/openshell/supervisor-token
|
|
readOnly: true
|
|
documentIndex: 0
|
|
- equal:
|
|
path: kind
|
|
value: Secret
|
|
template: templates/supervisor-token-secret.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-supervisor-token
|
|
template: templates/supervisor-token-secret.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: type
|
|
value: Opaque
|
|
template: templates/supervisor-token-secret.yaml
|
|
documentIndex: 0
|
|
- notExists:
|
|
path: data
|
|
template: templates/supervisor-token-secret.yaml
|
|
documentIndex: 0
|
|
- notExists:
|
|
path: stringData
|
|
template: templates/supervisor-token-secret.yaml
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: gateway-ca
|
|
secret:
|
|
secretName: openshell-client-tls
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
documentIndex: 0
|
|
- equal:
|
|
path: kind
|
|
value: Service
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.selector
|
|
value:
|
|
app.kubernetes.io/name: openshell-supervisor
|
|
app.kubernetes.io/instance: openshell
|
|
app.kubernetes.io/component: supervisor
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: kind
|
|
value: NetworkPolicy
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- lengthEqual:
|
|
path: spec.ingress
|
|
count: 1
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.ingress[0]
|
|
value:
|
|
from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: gateway
|
|
podSelector:
|
|
matchLabels:
|
|
openshell.ai/boundary-role: workload
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5500
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- it: admits runtimes only from this gateway's managed namespaces
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
workspace_mode: managed
|
|
gateway_id: gw-a
|
|
asserts:
|
|
- equal:
|
|
path: spec.ingress[0].from[0].namespaceSelector
|
|
value:
|
|
matchLabels:
|
|
openshell.ai/managed-by: openshell
|
|
openshell.ai/gateway-id: gw-a
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- it: admits runtimes only from operator-labeled namespaces
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
workspace_mode: operator
|
|
operator_namespace_label: example.com/openshell-workspace=true
|
|
asserts:
|
|
- equal:
|
|
path: spec.ingress[0].from[0].namespaceSelector
|
|
value:
|
|
matchLabels:
|
|
example.com/openshell-workspace: "true"
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- it: rejects operator namespace selectors it cannot scope
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
workspace_mode: operator
|
|
operator_namespace_file: /etc/openshell/namespaces
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology=gateway in operator workspace mode requires operator_namespace_label of the form key=value
|
|
- it: keeps a distinct name when the release fullname leaves no room for the suffix
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
fullnameOverride: openshell-gateway-release-with-a-very-very-long-name-0057
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: metadata.name
|
|
pattern: ^openshell-gateway-release-with-a-very-very-[0-9a-f]{8}-supervisor$
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- notEqual:
|
|
path: metadata.name
|
|
value: openshell-gateway-release-with-a-very-very-long-name-0057
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- it: requires gateway TLS for the supervisor token
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
server:
|
|
disableTls: true
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology=gateway requires gateway TLS; the supervisor token travels only over TLS
|
|
- it: renders the chart-owned shared supervisor connection into gateway TOML
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_topology = "gateway"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'shared_supervisor = \{ runtime_port = 5500, service_name = "openshell-supervisor", service_namespace = "gateway", token_secret_name = "openshell-supervisor-token" \}'
|
|
- it: runs one replica as a high-availability pool by default
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 1
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.strategy
|
|
value:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.terminationGracePeriodSeconds
|
|
value: 60
|
|
documentIndex: 0
|
|
- notExists:
|
|
path: spec.template.spec.affinity
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_SUPERVISOR_POOL_MEMBER_ID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_SUPERVISOR_POOL_ADVERTISE_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.maxUnavailable
|
|
value: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
documentSelector:
|
|
path: kind
|
|
value: PodDisruptionBudget
|
|
- it: runs two or more replicas as a high-availability pool
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 3
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 3
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.strategy
|
|
value:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.template.spec.terminationGracePeriodSeconds
|
|
value: 60
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_SUPERVISOR_POOL_MEMBER_ID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
documentIndex: 0
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_SUPERVISOR_POOL_ADVERTISE_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.selector
|
|
value:
|
|
app.kubernetes.io/name: openshell-supervisor
|
|
app.kubernetes.io/instance: openshell
|
|
app.kubernetes.io/component: supervisor
|
|
template: templates/supervisor-service.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: spec.ingress[0].ports
|
|
value:
|
|
- protocol: TCP
|
|
port: 5500
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
documentIndex: 0
|
|
- equal:
|
|
path: apiVersion
|
|
value: policy/v1
|
|
template: templates/supervisor-pdb.yaml
|
|
documentSelector:
|
|
path: kind
|
|
value: PodDisruptionBudget
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-supervisor
|
|
template: templates/supervisor-pdb.yaml
|
|
documentSelector:
|
|
path: kind
|
|
value: PodDisruptionBudget
|
|
- equal:
|
|
path: spec
|
|
value:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openshell-supervisor
|
|
app.kubernetes.io/instance: openshell
|
|
app.kubernetes.io/component: supervisor
|
|
template: templates/supervisor-pdb.yaml
|
|
documentSelector:
|
|
path: kind
|
|
value: PodDisruptionBudget
|
|
- it: protects the pool from voluntary disruption without a NetworkPolicy
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
networkPolicy:
|
|
enabled: false
|
|
supervisor:
|
|
replicas: 2
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
- equal:
|
|
path: spec.maxUnavailable
|
|
value: 1
|
|
template: templates/supervisor-pdb.yaml
|
|
documentSelector:
|
|
path: kind
|
|
value: PodDisruptionBudget
|
|
- it: enables the supervisor PodDisruptionBudget by default
|
|
template: templates/supervisor-pdb.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
- isKind:
|
|
of: PodDisruptionBudget
|
|
- equal:
|
|
path: spec.maxUnavailable
|
|
value: 1
|
|
- it: keeps the PodDisruptionBudget enabled when older reused values lack the setting
|
|
template: templates/supervisor-pdb.yaml
|
|
set:
|
|
supervisor:
|
|
podDisruptionBudget: null
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
- equal:
|
|
path: spec.maxUnavailable
|
|
value: 1
|
|
- it: renders only the PodDisruptionBudget away when it is disabled
|
|
set:
|
|
supervisor:
|
|
replicas: 3
|
|
podDisruptionBudget:
|
|
enabled: false
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-pdb.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 1
|
|
template: templates/supervisor-token-secret.yaml
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 3
|
|
template: templates/supervisor.yaml
|
|
- notExists:
|
|
path: spec.template.metadata.annotations
|
|
template: templates/supervisor.yaml
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'shared_supervisor = \{ runtime_port = 5500, service_name = "openshell-supervisor", service_namespace = "gateway", token_secret_name = "openshell-supervisor-token" \}'
|
|
template: templates/gateway-config.yaml
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: (?i)disruption
|
|
template: templates/gateway-config.yaml
|
|
- it: renders no PodDisruptionBudget without the gateway topology
|
|
template: templates/supervisor-pdb.yaml
|
|
set:
|
|
supervisor:
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
- it: rejects a non-boolean PodDisruptionBudget toggle
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
podDisruptionBudget:
|
|
enabled: "false"
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.podDisruptionBudget.enabled must be a boolean
|
|
- it: renders the pool's recovery deadline in the gateway table by default
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'shared_supervisor = \{ runtime_port = 5500, service_name = "openshell-supervisor", service_namespace = "gateway", token_secret_name = "openshell-supervisor-token" \}'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.supervisor_pool\]\nrecovery_timeout_secs = 60\n'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_pool\]\n[^\[]*(enabled|high_availability)'
|
|
- it: renders no pool tuning when the recovery timeout is null, leaving the gateway's defaults
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
supervisor:
|
|
recoveryTimeoutSeconds: null
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_topology = "gateway"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: supervisor_pool|recovery_timeout_secs
|
|
- it: renders a configured recovery timeout into the supervisor pool table
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 2
|
|
recoveryTimeoutSeconds: 45
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.supervisor_pool\]\nrecovery_timeout_secs = 45\n'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'shared_supervisor = \{ runtime_port = 5500, service_name = "openshell-supervisor", service_namespace = "gateway", token_secret_name = "openshell-supervisor-token" \}'
|
|
- it: renders no supervisor pool without the gateway topology
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 2
|
|
recoveryTimeoutSeconds: 120
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: supervisor_pool|recovery_timeout_secs|shared_supervisor
|
|
- it: rejects a hand-written supervisor pool table
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 2
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
openshell.gateway.supervisor_pool:
|
|
enabled: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_pool is rendered by the chart; set supervisor.replicas and supervisor.recoveryTimeoutSeconds
|
|
- it: rejects a hand-written supervisor pool inside the gateway table
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
openshell.gateway:
|
|
supervisor_pool:
|
|
enabled: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_pool is rendered by the chart; set supervisor.replicas and supervisor.recoveryTimeoutSeconds
|
|
- it: rejects a hand-written supervisor pool without the gateway topology
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.gateway.supervisor_pool:
|
|
enabled: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_pool is rendered by the chart; set supervisor.replicas and supervisor.recoveryTimeoutSeconds
|
|
- it: rejects zero supervisor replicas
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 0
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.replicas must be an integer of at least 1
|
|
- it: rejects fractional supervisor replicas
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 1.5
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.replicas must be an integer of at least 1
|
|
- it: rejects supervisor replicas given as a string
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: "2"
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.replicas must be an integer of at least 1
|
|
- it: rejects a recovery timeout below 10 seconds
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
recoveryTimeoutSeconds: 9
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.recoveryTimeoutSeconds must be an integer between 10 and 300, or null for the default
|
|
- it: rejects a recovery timeout above 300 seconds
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 2
|
|
recoveryTimeoutSeconds: 301
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.recoveryTimeoutSeconds must be an integer between 10 and 300, or null for the default
|
|
- it: rejects a fractional recovery timeout
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
recoveryTimeoutSeconds: 30.5
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor.recoveryTimeoutSeconds must be an integer between 10 and 300, or null for the default
|
|
- it: ignores supervisor pool values without the gateway topology
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
supervisor:
|
|
replicas: 0
|
|
recoveryTimeoutSeconds: 5
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-service.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-networkpolicy.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-token-secret.yaml
|
|
- hasDocuments:
|
|
count: 0
|
|
template: templates/supervisor-pdb.yaml
|
|
- it: rejects a hand-written shared supervisor connection
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
shared_supervisor:
|
|
service_name: elsewhere
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: shared_supervisor is rendered by the chart; set only supervisor_topology
|
|
- it: rejects settings the shared supervisor cannot isolate
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
upstreamProxy:
|
|
url: http://proxy.example:3128
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology=gateway does not support upstream proxy settings or provider SPIFFE identity
|
|
- it: rejects workspace until implemented
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: workspace
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology=workspace is not implemented
|
|
- it: rejects invalid topology
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: invalid
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology must be gateway or workspace; omit it to disable the shared supervisor
|
|
- it: rejects enabled topology for another compute driver
|
|
template: templates/supervisor.yaml
|
|
set:
|
|
gatewayConfig:
|
|
openshell.gateway:
|
|
compute_driver: docker
|
|
openshell.drivers.kubernetes:
|
|
supervisor_topology: gateway
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: supervisor_topology requires the kubernetes compute driver
|