jakman85andClaude Opus 4.8
948c390272
TASK 1 — reliably single-pass green L2/L3: Split run_chainsaw into a LIGHT pass (concurrent, config parallelism) and a HEAVY pass (serial, parallel=1). The KubeVirt-CDI/Longhorn/DR tests (vm-lifecycle, vm-data-survival, vm-default-deny, data-survival, dr-restore) spike embedded-etcd on the small dev VMs; running them serially in their own pass keeps their etcd spikes from ever coinciding with another test's setup — the coincidence that let one heavy test's apiserver blip fail-close Kyverno admission and abort every in-flight test at 0.01s. Heavy set is keyed by test dir basename and overridable via CONF_HEAVY_TESTS. Each pass writes its own JUnit; lib/merge_junit.py stitches them into the one stable report.junit.xml CI collects, so the split is invisible downstream. Overall rc is the union of both passes (no masking — real failures still surface). Proof: full --layer l2,l3 run now completes single-pass green: 24/24 passed, 0 failures/errors/skipped. vpn-killswitch, which previously failed with an apiserver EOF (etcd blip), passed; no mass environmental setup-aborts. TASK 2 (T-4.1) — author conformance/tests/l3-fault-injection/alerting/ fixtures/smtp-sink.yaml: a hermetic Mailpit SMTP capture sink (Service smtp-sink, SMTP 1025, HTTP API 8025) the alerting test applies as its mail sink. restricted-PodSecurity compliant, in-memory (no PVC). Unblocks the previously-aborting alerting scaffold; it now passes. Touches conformance/ + ci-read content only — no apps/ or platform/ workload. Co-Authored-By: Claude Opus 4.8 <[email protected]>
122 lines
4.0 KiB
YAML
122 lines
4.0 KiB
YAML
# =============================================================================
|
|
# T-4.1 — Hermetic SMTP capture sink for the L3 "alerting" conformance test
|
|
# (R-OBS-02, R-OBS-04).
|
|
#
|
|
# The alerting test injects a fault, Alertmanager fires and routes an email, and
|
|
# the test asserts the email arrived. To keep the test hermetic (no real inbox,
|
|
# ADR-0011 reproducibility), Alertmanager's email route is pointed at THIS
|
|
# in-namespace sink instead of a real MTA. The sink is Mailpit: it speaks SMTP
|
|
# for delivery and exposes an HTTP API the test polls for the captured message.
|
|
#
|
|
# Contract the alerting test relies on (chainsaw injects the ephemeral namespace,
|
|
# so these are intentionally namespace-less):
|
|
# * Service name .............. smtp-sink (stable DNS the test/AM target)
|
|
# * SMTP port (delivery) ...... 1025 (Alertmanager `smarthost`)
|
|
# * HTTP port (query/API) ..... 8025 (test polls for the message)
|
|
# * Query endpoint ............ GET http://smtp-sink:8025/api/v1/messages
|
|
# -> JSON: .messages[].Subject / .To / .From
|
|
# (health: GET /api/v1/messages returns 200 once the sink is up; a delivered
|
|
# alert appears as a message whose Subject matches the fired alertname.)
|
|
#
|
|
# Mailpit stores messages in memory (no PVC, no persistence) — a leaked namespace
|
|
# leaves nothing behind, and chainsaw's per-test namespace teardown removes it.
|
|
# =============================================================================
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: smtp-sink
|
|
labels:
|
|
app.kubernetes.io/name: smtp-sink
|
|
app.kubernetes.io/part-of: conformance-alerting
|
|
conformance.home.k3s/fixture: smtp-sink
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: smtp-sink
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: smtp-sink
|
|
app.kubernetes.io/part-of: conformance-alerting
|
|
spec:
|
|
# Hermetic, disposable capture sink — no state worth protecting.
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: mailpit
|
|
image: axllent/mailpit:v1.21.8
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
# Bind SMTP + HTTP UI/API on the well-known conformance ports.
|
|
- name: MP_SMTP_BIND_ADDR
|
|
value: "0.0.0.0:1025"
|
|
- name: MP_UI_BIND_ADDR
|
|
value: "0.0.0.0:8025"
|
|
# In-memory store: no disk, cleared on pod restart (hermetic per-run).
|
|
- name: MP_MAX_MESSAGES
|
|
value: "500"
|
|
ports:
|
|
- name: smtp
|
|
containerPort: 1025
|
|
protocol: TCP
|
|
- name: http
|
|
containerPort: 8025
|
|
protocol: TCP
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: http
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 3
|
|
timeoutSeconds: 2
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /livez
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
volumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: smtp-sink
|
|
labels:
|
|
app.kubernetes.io/name: smtp-sink
|
|
app.kubernetes.io/part-of: conformance-alerting
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: smtp-sink
|
|
ports:
|
|
- name: smtp
|
|
port: 1025
|
|
targetPort: smtp
|
|
protocol: TCP
|
|
- name: http
|
|
port: 8025
|
|
targetPort: http
|
|
protocol: TCP
|