test: RSA key-size + QMP socket-wait seams to speed up test suites (#497)

spinifex/admin/admin.go

@@ -500,9 +500,14 @@ func GenerateNATSToken() (string, error) {
 	return "nats_" + base64.URLEncoding.EncodeToString(bytes)[:32], nil
 }
 
+// certKeyBits is the RSA key size used when generating certificate keys.
+// It is a seam so tests can lower it for faster key generation; production
+// keeps the 4096-bit default.
+var certKeyBits = 4096
+
 // GenerateCACert generates a Certificate Authority certificate and key.
 func GenerateCACert(caCertPath, caKeyPath string) error {
-	caPrivateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	caPrivateKey, err := rsa.GenerateKey(rand.Reader, certKeyBits)
 	if err != nil {
 		return fmt.Errorf("failed to generate CA private key: %w", err)
 	}
@@ -653,7 +658,7 @@ func GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath string, extraIP
 		return fmt.Errorf("CA key is not RSA")
 	}
 
-	serverPrivateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	serverPrivateKey, err := rsa.GenerateKey(rand.Reader, certKeyBits)
 	if err != nil {
 		return fmt.Errorf("failed to generate server private key: %w", err)
 	}

spinifex/admin/ipsec.go

@@ -60,7 +60,7 @@ func GenerateIPSecPeerCert(configDir, caCertPath, caKeyPath, hostname, nodeIP st
 		return err
 	}
 
-	peerKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	peerKey, err := rsa.GenerateKey(rand.Reader, certKeyBits)
 	if err != nil {
 		return fmt.Errorf("ipsec peer cert: generate key: %w", err)
 	}

spinifex/admin/main_test.go

@@ -0,0 +1,14 @@
+package admin
+
+import (
+	"os"
+	"testing"
+)
+
+// TestMain lowers the RSA key size for the whole admin test package. 2048-bit
+// keys are still valid and generate several times faster than the 4096-bit
+// production default, which dominates the admin suite runtime.
+func TestMain(m *testing.M) {
+	certKeyBits = 2048
+	os.Exit(m.Run())
+}

spinifex/utils/utils_test.go

@@ -134,7 +134,7 @@ func TestExecProcessAndKill(t *testing.T) {
 	err = WaitForPidFileRemoval("utilsunittest", 100*time.Millisecond)
 	assert.Error(t, err) // Should timeout since file should still exist
 
-	time.Sleep(500 * time.Millisecond)
+	time.Sleep(20 * time.Millisecond)
 
 	// Kill the process
 	err = StopProcess("utilsunittest")

spinifex/vm/lifecycle.go

@@ -656,6 +656,11 @@ const (
 	qmpDialRetryInterval = 50 * time.Millisecond
 )
 
+// qmpSocketWaitTimeout bounds how long newQMPClientWithHandshake waits for the
+// QMP socket inode to appear before dialling. Mirrors qmpDialTimeout; a test
+// seam overrides it to keep dial-failure tests off the wall clock.
+var qmpSocketWaitTimeout = 3 * time.Second
+
 // removeStaleQMPSocket unlinks a leftover QMP socket inode from a prior QEMU so
 // the startup probe and QMP dial cannot race a dead listener. A missing file is
 // not an error.
@@ -698,7 +703,7 @@ func isTransientDialError(err error) bool {
 func newQMPClientWithHandshake(ctx context.Context, v *VM) (*qmp.QMPClient, error) {
 	// QMP socket bind lags the pidfile under recovery load; wait for the
 	// socket inode to exist before dialling to avoid an ENOENT race.
-	if err := utils.WaitForUnixSocket(v.Config.QMPSocket, 3*time.Second); err != nil {
+	if err := utils.WaitForUnixSocket(v.Config.QMPSocket, qmpSocketWaitTimeout); err != nil {
 		return nil, fmt.Errorf("connect QMP socket %s: %w", v.Config.QMPSocket, err)
 	}
 	client, err := dialQMPWithRetry(v.Config.QMPSocket)

spinifex/vm/lifecycle_test.go

@@ -465,6 +465,10 @@ func startBrokenQMPListener(t *testing.T) (string, func()) {
 func TestAttachQMP_DialFailure_NoHeartbeatLeak(t *testing.T) {
 	defer goleak.VerifyNone(t)
 
+	orig := qmpSocketWaitTimeout
+	qmpSocketWaitTimeout = 50 * time.Millisecond
+	t.Cleanup(func() { qmpSocketWaitTimeout = orig })
+
 	m := NewManager()
 	instance := &VM{
 		ID:     "i-dial-fail",
@@ -893,6 +897,8 @@ var _ NetworkPlumber = (*scriptedNetworkPlumber)(nil)
 func TestStartupTimeouts(t *testing.T) {
 	assert.Equal(t, 5*time.Second, qemuStartupTimeout)
 	assert.Equal(t, 5*time.Second, nbdReadyTimeout)
+	assert.Equal(t, 3*time.Second, qmpSocketWaitTimeout,
+		"production QMP socket wait default must stay 3s outside tests")
 }
 
 // TestRG4_GuestOOMTier asserts the RG-4 OOM ladder: a customer guest QEMU