jakman85andClaude Opus 4.8
bb48f675ee
Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate` runs identically here and in CI: - Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12), yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block; add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance. - versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA; align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args. - ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth). Fix harness seams so the gate can run: - dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the container still runs without it. - conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects both layers in one pass (backward compatible for single layers). NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release (max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3). Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used by any static gate stage. Co-Authored-By: Claude Opus 4.8 <[email protected]>
62 lines
2.7 KiB
Bash
Executable File
62 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ci/conformance.sh — Stage 5: L2 behavioral + L3 fault-injection.
|
|
#
|
|
# Per docs/14 + ADR-0011, L2/L3 run as an IN-CLUSTER Chainsaw Job on the dev/test
|
|
# cluster; CI only *triggers* the Job and *collects* its JUnit + coverage. CI holds
|
|
# no broad kubeconfig — the Job's own scoped ServiceAccount holds cluster access.
|
|
#
|
|
# PHASE 0: no cluster exists. This stage therefore SKIPS (exit 3) — clearly
|
|
# reported, never faked green (HARD RULE 4). It goes live in Phase 1+ once a
|
|
# cluster is declared via CLUSTER_AVAILABLE=true.
|
|
set -euo pipefail
|
|
CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck disable=SC1091
|
|
source "${CI_DIR}/lib.sh"
|
|
|
|
log "Stage: L2/L3 conformance (in-cluster Chainsaw Job)"
|
|
mkartifacts
|
|
|
|
if ! cluster_available; then
|
|
skip "no cluster configured (CLUSTER_AVAILABLE!=true) — L2/L3 NOT RUN. Phase 0: expected."
|
|
skip "these requirements remain UNVERIFIED until a dev/test cluster exists (Phase 1)."
|
|
summary "- conformance-l2-l3: **SKIPPED — cluster required** (Phase 0; not a pass)"
|
|
exit 3
|
|
fi
|
|
|
|
if ! entrypoint_ready "$CONFORMANCE_CMD"; then
|
|
die "CLUSTER_AVAILABLE=true but conformance runner '${CONFORMANCE_CMD}' is missing (T-0.4)"
|
|
fi
|
|
|
|
# Touched-requirement subset (R-TEST-03) — the merge gate runs only the tagged
|
|
# subset the change touches, not the whole suite.
|
|
mapfile -t reqs < <("${CI_DIR}/touched-requirements.sh" || true)
|
|
req_args=()
|
|
if [ "${#reqs[@]}" -gt 0 ]; then
|
|
log "touched requirements: ${reqs[*]}"
|
|
req_args=(--requirements "$(IFS=,; echo "${reqs[*]}")")
|
|
else
|
|
log "no touched requirements detected — running full L2/L3 subset as a safety net"
|
|
fi
|
|
|
|
# RECONCILED (PM 2026-08-16): run.sh writes artifacts to conformance/_artifacts/ and does
|
|
# NOT accept --junit/--coverage. This stage is CLUSTER-GATED (only runs when
|
|
# CLUSTER_AVAILABLE=true, Phase 1+), so its trigger path is confirmed against a real
|
|
# cluster in Phase 1 — TODO(Phase 1): drive the in-cluster Chainsaw Job
|
|
# (conformance/incluster/chainsaw-job.yaml) under the narrow CONFORMANCE_TRIGGER_KUBECONFIG.
|
|
# Multi-layer selection: `--layer l2,l3` selects BOTH layers in one run — conf_dirs_for_layer
|
|
# (conformance/lib/common.sh) now unions a comma/space list of layers, so this is a single
|
|
# invocation with one aggregated report (no per-layer looping needed). Artifacts are then
|
|
# COLLECTED from the fixed location below.
|
|
"$CONFORMANCE_CMD" --layer l2,l3 "${req_args[@]}"
|
|
|
|
CONF_ART="$(dirname "$CONFORMANCE_CMD")/_artifacts"
|
|
if [ -f "${CONF_ART}/report.junit.xml" ]; then
|
|
cp "${CONF_ART}/report.junit.xml" "${JUNIT_DIR}/l2l3.junit.xml"
|
|
fi
|
|
if [ -d "${CONF_ART}/coverage" ]; then
|
|
cp -r "${CONF_ART}/coverage/." "${COVERAGE_DIR}/"
|
|
fi
|
|
|
|
ok "L2/L3 conformance passed for touched subset"
|
|
summary "- conformance-l2-l3: **passed**"
|