jakman85andClaude Opus 4.8
bb48f675ee
Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate` runs identically here and in CI: - Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12), yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block; add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance. - versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA; align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args. - ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth). Fix harness seams so the gate can run: - dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the container still runs without it. - conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects both layers in one pass (backward compatible for single layers). NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release (max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3). Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used by any static gate stage. Co-Authored-By: Claude Opus 4.8 <[email protected]>
82 lines
3.5 KiB
Bash
82 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared helpers for the conformance harness. Sourced by run.sh; not executed directly.
|
|
# shellcheck shell=bash
|
|
|
|
# --- Requirement-tagging convention (single source of truth) --------------------------
|
|
# A Chainsaw Test declares the requirement(s) it verifies with a per-requirement label:
|
|
#
|
|
# metadata:
|
|
# labels:
|
|
# conformance.home.k3s/R-NET-01: "true" # one label per verified R-* ID
|
|
# annotations:
|
|
# conformance.home.k3s/requirements: "R-NET-01, R-NET-02" # human summary
|
|
# conformance.home.k3s/layer: "L2"
|
|
# conformance.home.k3s/safety-critical: "false"
|
|
#
|
|
# The LABEL is authoritative and does double duty:
|
|
# * `chainsaw test --selector conformance.home.k3s/R-NET-01=true` runs the subset.
|
|
# * lib/coverage.py reads the same labels to map requirement -> verifying test(s).
|
|
# The annotation is a convenience for humans/reports and MUST agree with the labels
|
|
# (coverage.py flags a mismatch). This is the convention referenced in README.md.
|
|
export CONF_LABEL_PREFIX="conformance.home.k3s"
|
|
|
|
# Absolute path to the conformance root (dir containing run.sh). Set by run.sh.
|
|
: "${CONF_ROOT:?CONF_ROOT must be set before sourcing common.sh}"
|
|
|
|
# --- Test discovery -------------------------------------------------------------------
|
|
# Every leaf test is a directory containing a `chainsaw-test.yaml`.
|
|
conf_all_test_files() {
|
|
find "${CONF_ROOT}/tests" -type f -name 'chainsaw-test.yaml' 2>/dev/null | sort
|
|
}
|
|
|
|
# Directories of tests that carry ANY of the given requirement labels (space-separated
|
|
# R-IDs). Used to translate `--requirements R-NET-01,R-NET-06` into a set of test dirs
|
|
# so we run each matching test exactly once (union, deduplicated).
|
|
conf_dirs_for_requirements() {
|
|
local reqs="$1" f dir rid matched
|
|
while IFS= read -r f; do
|
|
[ -n "$f" ] || continue
|
|
matched=0
|
|
for rid in $reqs; do
|
|
# Match a label line: conformance.home.k3s/R-NET-01: "true"
|
|
if grep -Eq "^[[:space:]]*${CONF_LABEL_PREFIX}/${rid}:[[:space:]]*[\"']?true" "$f"; then
|
|
matched=1; break
|
|
fi
|
|
done
|
|
[ "$matched" = 1 ] && dirname "$f"
|
|
done < <(conf_all_test_files) | sort -u
|
|
}
|
|
|
|
# Directories for a given layer (subtree): l1 | l2 | l3 | meta | all.
|
|
# Accepts a comma/space separated LIST of layers (e.g. "l2,l3") and returns the UNION of
|
|
# their test dirs, deduplicated. A single layer keeps its prior behavior (backward compatible);
|
|
# this is what lets `run.sh --layer l2,l3` (the ci/conformance.sh L2/L3 stage) select both
|
|
# layers in one pass instead of erroring on an unknown "l2,l3" layer.
|
|
conf_dirs_for_layer() {
|
|
local layers="$1" layer
|
|
local -a roots=()
|
|
for layer in ${layers//,/ }; do
|
|
case "$layer" in
|
|
all) roots=("${CONF_ROOT}/tests"); break ;;
|
|
l1) roots+=("${CONF_ROOT}/tests/l1-rendering") ;;
|
|
l2) roots+=("${CONF_ROOT}/tests/l2-behavioral") ;;
|
|
l3) roots+=("${CONF_ROOT}/tests/l3-fault-injection") ;;
|
|
meta) roots+=("${CONF_ROOT}/tests/meta") ;;
|
|
*) echo "unknown layer: $layer" >&2; return 2 ;;
|
|
esac
|
|
done
|
|
[ "${#roots[@]}" -gt 0 ] || return 0
|
|
find "${roots[@]}" -type f -name 'chainsaw-test.yaml' -exec dirname {} \; 2>/dev/null | sort -u
|
|
}
|
|
|
|
# Normalize a comma/space separated requirement list to space-separated, uppercased.
|
|
conf_normalize_reqs() {
|
|
echo "$1" | tr ',' ' ' | tr '[:lower:]' '[:upper:]' | xargs
|
|
}
|
|
|
|
# Is a live cluster reachable? (Preflight for L1/L2/L3 execution.)
|
|
conf_cluster_reachable() {
|
|
command -v kubectl >/dev/null 2>&1 || return 1
|
|
kubectl cluster-info >/dev/null 2>&1
|
|
}
|