ms2k/remora
SHA256
Watch
0
Code Releases Activity

Add complete system qualification evidence

Browse source
This commit is contained in:
ms2k 2026-07-18 14:09:04 +09:00
commit 6952767503
1 changed files with 1256 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

168
tests/kind/run-deployment.sh
View file

@ -17,7 +17,8 @@ cleanup() {
rm -f \
"$RUNTIME/deployment-values.yaml" \
"$RUNTIME/deployment-rendered.yaml" \
"$RUNTIME/deployment-policy-rendered.yaml"
"$RUNTIME/deployment-policy-rendered.yaml" \
"$RUNTIME/qualification-ingress.yaml"
if [[ "${REMORA_TESTBED_RETAIN:-0}" = 1 ]] && [[ "$SUCCEEDED" != true ]]; then
printf 'retained kubeconfig: %s\n' "$KUBECONFIG_PATH"
printf 'retained context: %s\n' "$CONTEXT"
@ -159,6 +160,7 @@ write_helm_values() {
local target_prefix
local target_region
local vault_path
local public_origin=http://remora.test
coordination_namespace="$(profile_value "$PROFILE" REMORA_COORDINATION_NAMESPACE)"
oidc_issuer="$(profile_value "$PROFILE" REMORA_OIDC_ISSUER)"
oidc_client_id="$(profile_value "$PROFILE" REMORA_OIDC_CLIENT_ID)"
@ -168,6 +170,9 @@ write_helm_values() {
target_prefix="$(profile_value "$PROFILE" REMORA_TARGET_PREFIX)"
target_region="$(profile_value "$PROFILE" REMORA_TARGET_REGION)"
vault_path="$(profile_value "$PROFILE" REMORA_VAULT_PATH)"
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
public_origin=http://127.0.0.1:4174
fi
cat > "$RUNTIME/deployment-values.yaml" <<EOF
api:
image: {repository: remora-api, tag: wp25, digest: "", pullPolicy: Never}
@ -175,7 +180,7 @@ worker:
image: {repository: remora-worker, tag: wp25, digest: "", pullPolicy: Never}
web:
image: {repository: remora-web, tag: wp25, digest: "", pullPolicy: Never}
publicOrigin: http://remora.test
publicOrigin: $public_origin
apiUrl: /v1/
oidcClientId: remora-web
cspConnectSrc: "'self' $oidc_issuer"
@ -204,7 +209,7 @@ vault:
path: "$vault_path"
kubernetesAuthMount: auth/remora-kubernetes
runtime:
eventAllowedOrigins: http://remora.test
eventAllowedOrigins: $public_origin
recoveryIntervalSeconds: 1
networkPolicy:
enabled: true
@ -226,6 +231,14 @@ observability:
serviceMonitor: {enabled: false, interval: 30s}
prometheusRule: {enabled: false}
EOF
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
cat >> "$RUNTIME/deployment-values.yaml" <<'EOF'
ingress:
enabled: true
className: qualification-nginx
host: qualification-ingress
EOF
fi
}
wait_for_queue_length() {
@ -243,6 +256,117 @@ wait_for_queue_length() {
return 1
}
wait_for_available_replicas() {
local deployment="$1"
local expected="$2"
local deadline=$((SECONDS + 120))
local available
while ((SECONDS < deadline)); do
available="$(kube --namespace "$FIXTURE_NAMESPACE" get "deployment/$deployment" \
--output 'jsonpath={.status.availableReplicas}')"
if [[ "${available:-0}" = "$expected" ]]; then
return
fi
sleep 1
done
printf '%s did not reach %s available replicas\n' "$deployment" "$expected" >&2
return 1
}
run_deployment_test() {
local job="$1"
local expected_job_id="${2:-}"
local manifest="$RUNTIME/$job.yaml"
render_lane_job \
"$TESTBED/deployment-job.yaml.in" \
"$manifest" \
"$job" \
"$PROFILE" \
remora-kind-deployment:local
sed -i "s|@@EXPECTED_JOB_ID@@|$expected_job_id|g" "$manifest"
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
sed -i 's|@@INGRESS_URL@@|http://qualification-ingress|g' "$manifest"
else
sed -i 's|@@INGRESS_URL@@||g' "$manifest"
fi
run_job_manifest "$FIXTURE_NAMESPACE" "$job" "$manifest"
}
run_system_browser_test() {
local job=system-browser
local manifest="$RUNTIME/$job.yaml"
render_lane_job \
"$TESTBED/system-browser-job.yaml.in" \
"$manifest" \
"$job" \
"$PROFILE" \
remora-kind-web-system:local
run_job_manifest "$FIXTURE_NAMESPACE" "$job" "$manifest"
}
install_qualification_ingress() {
local image
image="$(load_external_image ingress-nginx "$INGRESS_NGINX_IMAGE")"
sed "s|@@INGRESS_IMAGE@@|$image|g" \
"$TESTBED/qualification-ingress.yaml.in" \
> "$RUNTIME/qualification-ingress.yaml"
kube apply --filename "$RUNTIME/qualification-ingress.yaml"
wait_for_deployment qualification-ingress
}
operational_restore() {
local database="remora_lane_$LANE"
local backup="/tmp/remora-qualification.dump"
local expected_job_id
expected_job_id="$(kube --namespace "$FIXTURE_NAMESPACE" exec deployment/postgres -- \
env PGPASSWORD=synthetic-postgres psql \
--username remora \
--dbname "$database" \
--tuples-only \
--no-align \
--command "SELECT job_id FROM jobs WHERE label = 'deployment-coordination-rebuild'")"
[[ -n "$expected_job_id" ]]
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/remora-remora-api --replicas=0
kube --namespace "$FIXTURE_NAMESPACE" rollout status deployment/remora-remora-api --timeout=300s
kube --namespace "$FIXTURE_NAMESPACE" exec deployment/postgres -- \
env PGPASSWORD=synthetic-postgres pg_dump \
--username remora \
--dbname "$database" \
--format custom \
--file "$backup"
kube --namespace "$FIXTURE_NAMESPACE" exec deployment/postgres -- \
env PGPASSWORD=synthetic-postgres psql \
--username remora \
--dbname postgres \
--set ON_ERROR_STOP=1 \
--command "DROP DATABASE $database" \
--command "CREATE DATABASE $database"
kube --namespace "$FIXTURE_NAMESPACE" exec deployment/postgres -- \
env PGPASSWORD=synthetic-postgres pg_restore \
--username remora \
--dbname "$database" \
--exit-on-error \
"$backup"
kube --namespace "$FIXTURE_NAMESPACE" delete pod \
--selector app=dragonfly \
--wait=true
wait_for_deployment dragonfly
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/remora-remora-api --replicas=2
kube --namespace "$FIXTURE_NAMESPACE" rollout status deployment/remora-remora-api --timeout=600s
wait_for_queue_length 1
run_deployment_test deployment-restore "$expected_job_id"
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/versitygw --replicas=0
kube --namespace "$FIXTURE_NAMESPACE" rollout status deployment/versitygw --timeout=300s
wait_for_available_replicas remora-remora-api 0
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/versitygw --replicas=1
wait_for_deployment versitygw
reset_lane_target_store versitygw "remora-lane-$LANE"
wait_for_available_replicas remora-remora-api 2
}
rollout_remora() {
local component
for component in api worker web; do
@ -306,13 +430,26 @@ validate_deployment_assets
--target kind-deployment-runner \
--tag remora-kind-deployment:local \
"$ROOT"
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
"$REMORA_REAL_NERDCTL" --namespace default build \
--file "$ROOT/Dockerfile.test" \
--target kind-web-system-runner \
--tag remora-kind-web-system:local \
"$ROOT"
fi
OWNS_FIXTURE=true
setup_fixture durable coordination oidc target secret
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
install_qualification_ingress
fi
load_local_image remora-api:wp25
load_local_image remora-worker:wp25
load_local_image remora-web:wp25
load_local_image remora-kind-deployment:local
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
load_local_image remora-kind-web-system:local
fi
PROFILE="$(write_lane_profile "$LANE" dragonfly zitadel versitygw)"
configure_vault_kubernetes_auth
@ -329,22 +466,19 @@ rollout_remora
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/remora-remora-worker --replicas=0
kube --namespace "$FIXTURE_NAMESPACE" rollout status deployment/remora-remora-worker --timeout=300s
JOB=deployment-smoke
MANIFEST="$RUNTIME/$JOB.yaml"
render_lane_job \
"$TESTBED/deployment-job.yaml.in" \
"$MANIFEST" \
"$JOB" \
"$PROFILE" \
remora-kind-deployment:local
run_job_manifest "$FIXTURE_NAMESPACE" "$JOB" "$MANIFEST"
run_deployment_test deployment-smoke
wait_for_queue_length 1
kube --namespace "$FIXTURE_NAMESPACE" delete pod \
--selector app=dragonfly \
--wait=true
wait_for_deployment dragonfly
wait_for_queue_length 1
if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
operational_restore
run_system_browser_test
else
kube --namespace "$FIXTURE_NAMESPACE" delete pod \
--selector app=dragonfly \
--wait=true
wait_for_deployment dragonfly
wait_for_queue_length 1
fi
kube --namespace "$FIXTURE_NAMESPACE" scale deployment/remora-remora-worker --replicas=2
rollout_remora