mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-27 07:03:17 +08:00
* feat(kubernetes): add sidecar supervisor topology Add the Kubernetes sidecar supervisor topology, its Helm/Skaffold configuration, topology documentation, and sidecar e2e matrix coverage. Skip root-only sandbox identity rewriting when process enforcement is network-only so the low-permission sidecar process container can start successfully. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): avoid similar proxy id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(kubernetes): clarify sidecar topology limits Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): keep sidecar process leaf capless Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): refresh sidecar provider env snapshots Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(supervisor): align hot-swap identity regression Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): stage sidecar mtls files before proxy chown Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): simplify sidecar supervisor topology Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(helm): reuse sidecar skaffold values Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar iptables helper names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(e2e): harden kube gateway wrapper setup Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid nft batch rollback on OCP Run nftables setup as individual commands so optional conntrack and log expressions can fail without rolling back required table, chain, and reject rules. Signed-off-by: Seth Jennings <sjenning@redhat.com> Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): preserve process identity in sidecar topology Render sidecar pods with a shared process namespace, keep binary-aware network policy enabled, and move Kubernetes sidecar settings under the nested sidecar config table. Also apply unprivileged Landlock/seccomp setup in NetworkOnly supervisor mode so sidecar topology keeps sandbox child hardening without privileged process setup. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): replace sidecar snapshots with control socket Coordinate sidecar policy and provider bootstrap over a local Unix socket so the process leaf no longer reads policy/provider snapshot files. Report entrypoint startup through the control channel and keep gateway credentials confined to the network sidecar. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * feat(kubernetes): support relaxed sidecar network identity Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy sidecar clippy lint Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): standardize topology naming Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy linux clippy timeout import Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): support kata sidecar on ipv4 pods Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): satisfy linux clippy for sidecar fallback Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(kubernetes): remove stale supervisor topology references Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): enable sidecar binary policy inspection Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): harden sidecar control boundary Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): couple sidecar supervisor lifecycles Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Seth Jennings <sjenning@redhat.com> Co-authored-by: Seth Jennings <sjenning@redhat.com>
150 lines
5.7 KiB
TOML
150 lines
5.7 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Test tasks (Rust + Python)
|
|
|
|
[test]
|
|
description = "Run all tests (Rust + Python)"
|
|
depends = ["test:rust", "test:python", "test:sbom", "test:install-sh", "test:packaging-assets", "test:docs-website"]
|
|
|
|
["test:docs-website"]
|
|
description = "Test the docs-website sync script"
|
|
# --no-project skips the workspace (maturin) build; --with supplies pytest and
|
|
# the script's runtime dep (PyYAML), which live outside the project env.
|
|
run = "uv run --no-project --with pytest --with pyyaml pytest tasks/scripts/sync_docs_website_test.py"
|
|
|
|
["test:sbom"]
|
|
description = "Run SBOM tooling tests"
|
|
run = "uv run --no-project --with pytest pytest -o \"python_files=*_test.py\" deploy/sbom/"
|
|
hide = true
|
|
|
|
["test:install-sh"]
|
|
description = "Run focused install.sh shell tests"
|
|
run = "tasks/scripts/test-install-sh.sh"
|
|
hide = true
|
|
|
|
["test:packaging-assets"]
|
|
description = "Run static packaging asset tests"
|
|
run = "tasks/scripts/test-packaging-assets.sh"
|
|
hide = true
|
|
|
|
[e2e]
|
|
description = "Run all end-to-end tests (Rust + Python + MCP)"
|
|
depends = ["e2e:rust", "e2e:python", "e2e:mcp"]
|
|
|
|
["e2e:gpu"]
|
|
description = "Run Docker GPU end-to-end tests"
|
|
depends = ["e2e:docker:gpu"]
|
|
|
|
["e2e:workloads:build"]
|
|
description = "Build local GPU workload test images and manifest"
|
|
run = "bash tasks/scripts/e2e-gpu-build-images.sh"
|
|
|
|
["test:rust"]
|
|
description = "Run Rust tests"
|
|
run = [
|
|
# Run the workspace once without openshell-server so we can run that crate
|
|
# with test-only helpers enabled.
|
|
"cargo test --workspace --exclude openshell-server",
|
|
"cargo test -p openshell-server --features test-support",
|
|
]
|
|
hide = true
|
|
|
|
["test:python"]
|
|
description = "Run Python tests"
|
|
depends = ["python:proto"]
|
|
env = { UV_NO_SYNC = "1" }
|
|
run = "uv run pytest python/"
|
|
hide = true
|
|
|
|
["e2e:rust"]
|
|
description = "Run Rust CLI e2e tests against a Docker-backed gateway"
|
|
run = [
|
|
"cargo build -p openshell-cli",
|
|
"e2e/with-docker-gateway.sh cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker",
|
|
]
|
|
|
|
["e2e:websocket-conformance"]
|
|
description = "Run focused WebSocket conformance e2e tests against a Docker-backed gateway"
|
|
run = [
|
|
"cargo build -p openshell-cli",
|
|
"e2e/with-docker-gateway.sh cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test websocket_conformance",
|
|
]
|
|
|
|
["e2e:mcp"]
|
|
description = "Run MCP conformance e2e scenarios against one Docker-backed gateway (static defaults for spec 2025-11-25; set OPENSHELL_MCP_CONFORMANCE_SCENARIOS for a focused subset)"
|
|
run = "bash e2e/mcp-conformance.sh"
|
|
|
|
["e2e:nodejs"]
|
|
description = "Alias for e2e:mcp"
|
|
depends = ["e2e:mcp"]
|
|
|
|
["e2e:python"]
|
|
description = "Run Python e2e tests against a Docker-backed gateway (E2E_PARALLEL=N or 'auto'; default 5)"
|
|
depends = ["python:proto"]
|
|
env = { UV_NO_SYNC = "1", PYTHONPATH = "python" }
|
|
run = "e2e/with-docker-gateway.sh uv run pytest -o python_files='test_*.py' -m 'not gpu' -n ${E2E_PARALLEL:-5} e2e/python"
|
|
|
|
["e2e:podman"]
|
|
description = "Run Rust CLI e2e tests against a Podman-backed gateway"
|
|
run = "e2e/rust/e2e-podman.sh"
|
|
|
|
["e2e:podman:rootless"]
|
|
description = "Run Rust CLI e2e tests against a rootless Podman-backed gateway"
|
|
run = "e2e/rust/e2e-podman-rootless.sh"
|
|
|
|
["e2e:podman:gpu"]
|
|
description = "Run GPU e2e against a standalone gateway with the Podman compute driver"
|
|
env = { OPENSHELL_E2E_PODMAN_GPU = "1", OPENSHELL_E2E_PODMAN_TEST = "gpu", OPENSHELL_E2E_PODMAN_FEATURES = "e2e-podman-gpu" }
|
|
run = "e2e/rust/e2e-podman.sh"
|
|
|
|
["e2e:kubernetes"]
|
|
description = "Run Rust CLI e2e tests against an OpenShell gateway deployed on Kubernetes via Helm (set OPENSHELL_E2E_KUBE_CONTEXT to reuse a cluster; otherwise creates a local k3d cluster when k3d is installed; set OPENSHELL_E2E_KUBE_TEST=<name> to scope to one test)"
|
|
run = "e2e/rust/e2e-kubernetes.sh"
|
|
|
|
["e2e:kubernetes:v1alpha1"]
|
|
description = "Run Kubernetes e2e against Agent Sandbox v1alpha1"
|
|
env = { AGENT_SANDBOX_VERSION = "v0.4.6" }
|
|
run = "e2e/rust/e2e-kubernetes.sh"
|
|
|
|
["e2e:kubernetes:agent-sandbox-versions"]
|
|
description = "Run Kubernetes e2e against Agent Sandbox v1beta1 and v1alpha1"
|
|
run = [
|
|
"e2e/rust/e2e-kubernetes.sh",
|
|
"AGENT_SANDBOX_VERSION=v0.4.6 e2e/rust/e2e-kubernetes.sh",
|
|
]
|
|
|
|
["e2e:kubernetes:sidecar"]
|
|
description = "Run Kubernetes e2e with the supervisor sidecar topology overlay"
|
|
env = { OPENSHELL_E2E_KUBE_EXTRA_VALUES = "deploy/helm/openshell/ci/values-sidecar.yaml" }
|
|
run = "e2e/rust/e2e-kubernetes.sh"
|
|
|
|
["e2e:kubernetes:db"]
|
|
description = "Run Kubernetes e2e with all database backend scenarios (SQLite and external PostgreSQL with existingSecret)"
|
|
env = { OPENSHELL_E2E_KUBE_DB_SCENARIOS = "1" }
|
|
run = "e2e/rust/e2e-kubernetes.sh"
|
|
|
|
["e2e:vm"]
|
|
description = "Start openshell-gateway with the VM compute driver and run the cluster-agnostic smoke e2e"
|
|
run = "e2e/rust/e2e-vm.sh"
|
|
|
|
["e2e:docker"]
|
|
description = "Run smoke e2e against a standalone gateway with the Docker compute driver"
|
|
run = "e2e/rust/e2e-docker.sh"
|
|
|
|
["e2e:mechanistic-smoke"]
|
|
description = "Run mechanistic L4 smoke against a Docker-backed gateway"
|
|
run = [
|
|
"cargo build -p openshell-cli",
|
|
"e2e/with-docker-gateway.sh bash -lc 'target/debug/openshell settings set --global --key agent_policy_proposals_enabled --value true --yes && OPENSHELL_BIN=$PWD/target/debug/openshell bash e2e/policy-advisor/mechanistic-smoke.sh'",
|
|
]
|
|
|
|
["e2e:docker:gpu"]
|
|
description = "Run GPU e2e against a standalone gateway with the Docker compute driver"
|
|
env = { OPENSHELL_E2E_DOCKER_GPU = "1", OPENSHELL_E2E_DOCKER_TEST = "gpu", OPENSHELL_E2E_DOCKER_FEATURES = "e2e-docker-gpu" }
|
|
run = "e2e/rust/e2e-docker.sh"
|
|
|
|
["e2e:openshift"]
|
|
description = "Run OpenShift database-backend integration scenarios against a live cluster (requires oc CLI authenticated to an OpenShift cluster)"
|
|
run = "e2e/rust/e2e-openshift.sh"
|