Add a released-image dependency compatibility testbed

tests/kind/probe.yaml.in

@@ -0,0 +1,283 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: probe-payload
+  namespace: remora-testbed
+data:
+  payload: remora-wp02-published-image-transfer
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: state-probe
+  namespace: remora-testbed
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      initContainers:
+        - name: postgres
+          image: @@POSTGRES_IMAGE@@
+          imagePullPolicy: Never
+          command: [psql]
+          args:
+            - -h
+            - postgres
+            - -U
+            - remora
+            - -d
+            - remora
+            - -v
+            - ON_ERROR_STOP=1
+            - -c
+            - "CREATE TABLE wp02_probe (value text NOT NULL)"
+            - -c
+            - "INSERT INTO wp02_probe VALUES ('passed')"
+            - -c
+            - "SELECT value = 'passed' FROM wp02_probe"
+          env:
+            - {name: PGPASSWORD, value: synthetic-postgres}
+        - name: redis
+          image: @@REDIS_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args: ["redis-cli -h redis SET wp02 passed && test \"$(redis-cli -h redis GET wp02)\" = passed"]
+        - name: dragonfly
+          image: @@REDIS_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args: ["redis-cli -h dragonfly SET wp02 passed && test \"$(redis-cli -h dragonfly GET wp02)\" = passed"]
+        - name: vault-write
+          image: @@VAULT_IMAGE@@
+          imagePullPolicy: Never
+          command: [vault]
+          args: [kv, put, secret/wp02, value=passed]
+          env:
+            - {name: VAULT_ADDR, value: "http://vault:8200"}
+            - {name: VAULT_TOKEN, value: synthetic-vault-token}
+      containers:
+        - name: vault-read
+          image: @@VAULT_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args: ["test \"$(vault kv get -field=value secret/wp02)\" = passed && printf 'Vault write/read passed\\n'"]
+          env:
+            - {name: VAULT_ADDR, value: "http://vault:8200"}
+            - {name: VAULT_TOKEN, value: synthetic-vault-token}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: "1", memory: 128Mi}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: oidc-probe
+  namespace: remora-testbed
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      dnsPolicy: None
+      dnsConfig:
+        nameservers: [10.96.0.53]
+      containers:
+        - name: curl
+          image: @@CURL_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              probe() {
+                url="$1"
+                pattern="$2"
+                attempt=0
+                until curl --fail --silent --show-error "$url" | grep -q "$pattern"; do
+                  attempt=$((attempt + 1))
+                  test "$attempt" -lt 30
+                  sleep 1
+                done
+              }
+              probe http://keycloak.remora.test:8080/realms/master/.well-known/openid-configuration '"issuer"'
+              probe http://keycloak.remora.test:8080/realms/master/protocol/openid-connect/certs '"keys"'
+              probe http://zitadel.remora.test:8080/.well-known/openid-configuration '"issuer"'
+              probe http://zitadel.remora.test:8080/oauth/v2/keys '"keys"'
+              printf 'Keycloak and ZITADEL discovery passed through controlled DNS\n'
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: "1", memory: 128Mi}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: garage-probe
+  namespace: remora-testbed
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      initContainers:
+        - name: bucket
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://garage:3900 s3api head-bucket --bucket remora-fixture; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
+            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
+            - {name: AWS_DEFAULT_REGION, value: garage}
+        - name: upload
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://garage:3900 s3api put-object --bucket remora-fixture --key smoke/payload --body /fixture/payload; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
+            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
+            - {name: AWS_DEFAULT_REGION, value: garage}
+          volumeMounts:
+            - {name: fixture, mountPath: /fixture}
+        - name: download
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://garage:3900 s3api get-object --bucket remora-fixture --key smoke/payload /work/result; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
+            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
+            - {name: AWS_DEFAULT_REGION, value: garage}
+          volumeMounts:
+            - {name: work, mountPath: /work}
+      containers:
+        - name: compare
+          image: @@CURL_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args: ["cmp /fixture/payload /work/result && printf 'Garage transfer passed\\n'"]
+          volumeMounts:
+            - {name: fixture, mountPath: /fixture}
+            - {name: work, mountPath: /work}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: "1", memory: 128Mi}
+      volumes:
+        - name: fixture
+          configMap: {name: probe-payload}
+        - name: work
+          emptyDir: {}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: versitygw-probe
+  namespace: remora-testbed
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      initContainers:
+        - name: bucket
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://versitygw:10000 s3api create-bucket --bucket remora-fixture || aws --endpoint-url http://versitygw:10000 s3api head-bucket --bucket remora-fixture; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
+            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
+            - {name: AWS_DEFAULT_REGION, value: us-east-1}
+        - name: upload
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://versitygw:10000 s3api put-object --bucket remora-fixture --key smoke/payload --body /fixture/payload; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
+            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
+            - {name: AWS_DEFAULT_REGION, value: us-east-1}
+          volumeMounts:
+            - {name: fixture, mountPath: /fixture}
+        - name: download
+          image: @@AWS_CLI_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              attempt=0
+              until aws --endpoint-url http://versitygw:10000 s3api get-object --bucket remora-fixture --key smoke/payload /work/result; do
+                attempt=$((attempt + 1))
+                test "$attempt" -lt 30
+                sleep 1
+              done
+          env:
+            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
+            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
+            - {name: AWS_DEFAULT_REGION, value: us-east-1}
+          volumeMounts:
+            - {name: work, mountPath: /work}
+      containers:
+        - name: compare
+          image: @@CURL_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args: ["cmp /fixture/payload /work/result && printf 'VersityGW transfer passed\\n'"]
+          volumeMounts:
+            - {name: fixture, mountPath: /fixture}
+            - {name: work, mountPath: /work}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: "1", memory: 128Mi}
+      volumes:
+        - name: fixture
+          configMap: {name: probe-payload}
+        - name: work
+          emptyDir: {}