adc430e27c
`kubectl wait <kind> <name>` errors immediately with NotFound if the
resource doesn't exist yet — even with --for=condition or --for=jsonpath.
The redis test in CI run 25043350705 failed in 1 second for exactly this
reason: the redis-failover operator hadn't created the PVC by the time
the test waited for it. Previously the 3x retry on `Run E2E tests`
masked this race; with retry dropped, every such call is a flake risk.
Add a small `until kubectl get` existence backstop before each
kubectl wait, matching the pattern already established for HRs in
commit 66888c91.
33 backstops across 12 files:
bucket.bats — bucketclaims, bucketaccesses x2
clickhouse.bats — statefulset 0-0 (0-1 already covered)
harbor.bats — deploy x3, bucketclaims, bucketaccesses
kafka.bats — kafkas
mariadb.bats — statefulset, deployment
mongodb.bats — statefulset
openbao.bats — sts, pvc
postgres.bats — job.batch
qdrant.bats — sts, pvc
redis.bats — pvc, deploy, sts (the trigger)
vminstance.bats — dv, pvc, vm (with 120s for KubeVirt latency)
e2e-install-cozystack.bats — apiservices, sts/etcd, vmalert,
vmalertmanager, vlclusters, vmcluster,
clusters.postgresql.cnpg.io,
deploy/grafana-deployment, namespace
Same pattern, same 60s default timeout for the existence wait (120s for
nested-virt resources). Once the resource exists, the original wait
timeout takes over.
Run-kubernetes.sh has the same race shape on several waits (nfs, kamaji,
machinedeployment, etc.) — out of scope here; flagged for follow-up.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
76 lines
3.5 KiB
Bash
76 lines
3.5 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
@test "Create and Verify Seeweedfs Bucket" {
|
|
# Create the bucket resource with readwrite and readonly users
|
|
name='test'
|
|
kubectl -n tenant-test delete bucket.apps.cozystack.io $name --ignore-not-found --timeout=2m || true
|
|
pkill -f "port-forward.*8333:" 2>/dev/null || true
|
|
kubectl apply -f - <<EOF
|
|
apiVersion: apps.cozystack.io/v1alpha1
|
|
kind: Bucket
|
|
metadata:
|
|
name: ${name}
|
|
namespace: tenant-test
|
|
spec:
|
|
users:
|
|
admin: {}
|
|
viewer:
|
|
readonly: true
|
|
EOF
|
|
|
|
# Wait for the bucket to be ready
|
|
kubectl -n tenant-test wait hr bucket-${name} --timeout=100s --for=condition=ready
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get bucketclaims.objectstorage.k8s.io bucket-${name} >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.bucketReady}'
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get bucketaccesses.objectstorage.k8s.io bucket-${name}-admin >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-admin --timeout=300s --for=jsonpath='{.status.accessGranted}'
|
|
timeout 60 sh -ec "until kubectl -n tenant-test get bucketaccesses.objectstorage.k8s.io bucket-${name}-viewer >/dev/null 2>&1; do sleep 2; done"
|
|
kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-viewer --timeout=300s --for=jsonpath='{.status.accessGranted}'
|
|
|
|
# Get admin (readwrite) credentials
|
|
kubectl -n tenant-test get secret bucket-${name}-admin -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-admin-credentials.json
|
|
ADMIN_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-admin-credentials.json)
|
|
ADMIN_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-admin-credentials.json)
|
|
BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-admin-credentials.json)
|
|
|
|
# Get viewer (readonly) credentials
|
|
kubectl -n tenant-test get secret bucket-${name}-viewer -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-viewer-credentials.json
|
|
VIEWER_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-viewer-credentials.json)
|
|
VIEWER_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-viewer-credentials.json)
|
|
|
|
# Start port-forwarding
|
|
bash -c 'timeout 100s kubectl port-forward service/seaweedfs-s3 -n tenant-root 8333:8333 > /dev/null 2>&1 &'
|
|
|
|
# Wait for port-forward to be ready
|
|
timeout 30 sh -ec 'until nc -z localhost 8333; do sleep 1; done'
|
|
|
|
# --- Test readwrite user (admin) ---
|
|
mc alias set rw-user https://localhost:8333 $ADMIN_ACCESS_KEY $ADMIN_SECRET_KEY --insecure
|
|
|
|
# Admin can upload
|
|
echo "readwrite test" > /tmp/rw-test.txt
|
|
mc cp --insecure /tmp/rw-test.txt rw-user/$BUCKET_NAME/rw-test.txt
|
|
|
|
# Admin can list
|
|
mc ls --insecure rw-user/$BUCKET_NAME/rw-test.txt
|
|
|
|
# Admin can download
|
|
mc cp --insecure rw-user/$BUCKET_NAME/rw-test.txt /tmp/rw-test-download.txt
|
|
|
|
# --- Test readonly user (viewer) ---
|
|
mc alias set ro-user https://localhost:8333 $VIEWER_ACCESS_KEY $VIEWER_SECRET_KEY --insecure
|
|
|
|
# Viewer can list
|
|
mc ls --insecure ro-user/$BUCKET_NAME/rw-test.txt
|
|
|
|
# Viewer can download
|
|
mc cp --insecure ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
|
|
|
|
# Viewer cannot upload (must fail with Access Denied)
|
|
echo "readonly test" > /tmp/ro-test.txt
|
|
! mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
|
|
|
|
# --- Cleanup ---
|
|
mc rm --insecure rw-user/$BUCKET_NAME/rw-test.txt
|
|
kubectl -n tenant-test delete bucket.apps.cozystack.io ${name}
|
|
}
|