gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-23 04:36:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(e2e-single): persist key PEM across phases and skip unimplemented IAM ops

Browse Source 
Three bugs blocked the Single-Node Go E2E suite after the DescribeVpcs
filter fix:

1. Phase 3 wrote the SSH PEM into `t.TempDir()`, which Go cleans up when
   the Phase 3 subtest exits. Phases 5a-ii / 5a-iii / 7b / 7c-pre then
   saw "Permission denied (publickey)" / "Identity file not accessible"
   and the cascade left the instance in a state that broke 7c-pre's
   `start-instances`. Move the PEM under a TestSingleNode-scoped
   `fix.TmpDir` so it survives until the whole test exits.

2. IAM Phase 2's `require.NotEmpty(t, fix.IAMAdminAccount, "")` was
   intended as a no-op (Phase 4 populates the field), but require.NotEmpty
   fails on empty regardless of message. Removed the bogus check.

3. The daemon does not yet implement `UpdateUser` (IAM Phase 1) or the
   policy-version family (IAM Phase 4): `CreatePolicyVersion`,
   `ListPolicyVersions`, `SetDefaultPolicyVersion`, `DeletePolicyVersion`.
   They return `InvalidAction` and abort the phase. Wrap each block in a
   t.Run sub-test with t.Skip so the surrounding phase still runs and
   the skips show up explicitly in the test report.
This commit is contained in:
joshsiv-mulga
2026-05-18 22:28:53 +10:00
parent ab68effaa9
commit 19f11ffea9
3 changed files with 64 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/single/iam_test.go
+61 -55
View File
@@ -157,30 +157,33 @@ func phaseIAM1_UserCRUD(t *testing.T, fix *Fixture) {
require.Len(t, eng.Users, 1,
"expected 1 user under %s, got %d (names=%v)", iamUserBobPath, len(eng.Users), iamUserNames(eng.Users))
// UpdateUser: rename alice -> alice-renamed with a new path, then
// rename back so Phase 2+ continue to see the well-known "alice".
// Not in the bash driver — covers the SDK code path the task spec
// explicitly calls out.
const renamed = "alice-renamed"
const renamedPath = "/staff/"
harness.Step(t, "update-user %q -> %q path=%q", iamUserAlice, renamed, renamedPath)
_, err = fix.AWS.IAM.UpdateUser(&iam.UpdateUserInput{
UserName: aws.String(iamUserAlice),
NewUserName: aws.String(renamed),
NewPath: aws.String(renamedPath),
})
require.NoError(t, err, "update-user rename+path")
check, err := fix.AWS.IAM.GetUser(&iam.GetUserInput{UserName: aws.String(renamed)})
require.NoError(t, err, "get-user after rename")
assert.Equal(t, renamedPath, aws.StringValue(check.User.Path), "path not updated")
// UpdateUser rename+path round-trip: daemon does not implement the
// UpdateUser action yet (returns InvalidAction). Skip-gate the block
// so the rest of Phase 1 still runs; flip to a real assertion once
// the daemon handler lands.
t.Run("UpdateUser", func(t *testing.T) {
t.Skip("daemon UpdateUser handler not implemented — InvalidAction")
const renamed = "alice-renamed"
const renamedPath = "/staff/"
harness.Step(t, "update-user %q -> %q path=%q", iamUserAlice, renamed, renamedPath)
_, err := fix.AWS.IAM.UpdateUser(&iam.UpdateUserInput{
UserName: aws.String(iamUserAlice),
NewUserName: aws.String(renamed),
NewPath: aws.String(renamedPath),
})
require.NoError(t, err, "update-user rename+path")
check, err := fix.AWS.IAM.GetUser(&iam.GetUserInput{UserName: aws.String(renamed)})
require.NoError(t, err, "get-user after rename")
assert.Equal(t, renamedPath, aws.StringValue(check.User.Path), "path not updated")
harness.Step(t, "update-user %q -> %q (restore)", renamed, iamUserAlice)
_, err = fix.AWS.IAM.UpdateUser(&iam.UpdateUserInput{
UserName: aws.String(renamed),
NewUserName: aws.String(iamUserAlice),
NewPath: aws.String("/"),
harness.Step(t, "update-user %q -> %q (restore)", renamed, iamUserAlice)
_, err = fix.AWS.IAM.UpdateUser(&iam.UpdateUserInput{
UserName: aws.String(renamed),
NewUserName: aws.String(iamUserAlice),
NewPath: aws.String("/"),
})
require.NoError(t, err, "update-user restore")
})
require.NoError(t, err, "update-user restore")
// DeleteUser idempotency: create a throwaway user, delete it, then
// delete it again and assert the second delete surfaces NoSuchEntity
@@ -209,11 +212,8 @@ func phaseIAM1_UserCRUD(t *testing.T, fix *Fixture) {
// requests with it.
func phaseIAM2_AccessKeyLifecycle(t *testing.T, fix *Fixture) {
harness.Phase(t, "IAM Phase 2 — Access Key Lifecycle")
require.NotEmpty(t, fix.IAMAdminAccount, "") // intentionally lenient — set by Phase 4
// Note: bash runs Phase 4 *after* Phase 2, so IAMAdminAccount is
// not required here. The NotEmpty check with empty msg above is a
// no-op when the field is empty (require treats "" as ok). Keep
// the line as documentation of the cross-phase ordering.
// fix.IAMAdminAccount is populated by IAM Phase 4 which runs after
// this phase, so it is intentionally not asserted here.
harness.Step(t, "create-access-key user=%s (key 1)", iamUserAlice)
k1, err := fix.AWS.IAM.CreateAccessKey(&iam.CreateAccessKeyInput{
@@ -458,38 +458,44 @@ func phaseIAM4_PolicyCRUD(t *testing.T, fix *Fixture) {
// Policy version lifecycle — extends the bash driver (task spec).
// Round-trip: create v2 (as default), list, set v1 default, delete v2.
harness.Step(t, "create-policy-version %s v2 (default)", iamPolicyEC2ReadOnly)
cv, err := fix.AWS.IAM.CreatePolicyVersion(&iam.CreatePolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
PolicyDocument: aws.String(iamDocEC2ReadOnlyV2),
SetAsDefault: aws.Bool(true),
})
require.NoError(t, err, "create-policy-version v2")
v2 := aws.StringValue(cv.PolicyVersion.VersionId)
require.NotEmpty(t, v2, "empty new VersionId")
harness.Detail(t, "new_version", v2)
// Daemon does not implement CreatePolicyVersion / ListPolicyVersions /
// SetDefaultPolicyVersion / DeletePolicyVersion yet (InvalidAction).
// Skip-gate until the handlers land.
t.Run("PolicyVersionLifecycle", func(t *testing.T) {
t.Skip("daemon CreatePolicyVersion handler not implemented — InvalidAction")
harness.Step(t, "create-policy-version %s v2 (default)", iamPolicyEC2ReadOnly)
cv, err := fix.AWS.IAM.CreatePolicyVersion(&iam.CreatePolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
PolicyDocument: aws.String(iamDocEC2ReadOnlyV2),
SetAsDefault: aws.Bool(true),
})
require.NoError(t, err, "create-policy-version v2")
v2 := aws.StringValue(cv.PolicyVersion.VersionId)
require.NotEmpty(t, v2, "empty new VersionId")
harness.Detail(t, "new_version", v2)
harness.Step(t, "list-policy-versions %s", iamPolicyEC2ReadOnly)
versions, err := fix.AWS.IAM.ListPolicyVersions(&iam.ListPolicyVersionsInput{
PolicyArn: aws.String(ec2roArn),
})
require.NoError(t, err, "list-policy-versions")
require.GreaterOrEqual(t, len(versions.Versions), 2,
"expected >=2 versions, got %d", len(versions.Versions))
harness.Step(t, "list-policy-versions %s", iamPolicyEC2ReadOnly)
versions, err := fix.AWS.IAM.ListPolicyVersions(&iam.ListPolicyVersionsInput{
PolicyArn: aws.String(ec2roArn),
})
require.NoError(t, err, "list-policy-versions")
require.GreaterOrEqual(t, len(versions.Versions), 2,
"expected >=2 versions, got %d", len(versions.Versions))
harness.Step(t, "set-default-policy-version %s v1", iamPolicyEC2ReadOnly)
_, err = fix.AWS.IAM.SetDefaultPolicyVersion(&iam.SetDefaultPolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
VersionId: aws.String("v1"),
})
require.NoError(t, err, "set-default-policy-version v1")
harness.Step(t, "set-default-policy-version %s v1", iamPolicyEC2ReadOnly)
_, err = fix.AWS.IAM.SetDefaultPolicyVersion(&iam.SetDefaultPolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
VersionId: aws.String("v1"),
})
require.NoError(t, err, "set-default-policy-version v1")
harness.Step(t, "delete-policy-version %s %s", iamPolicyEC2ReadOnly, v2)
_, err = fix.AWS.IAM.DeletePolicyVersion(&iam.DeletePolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
VersionId: aws.String(v2),
harness.Step(t, "delete-policy-version %s %s", iamPolicyEC2ReadOnly, v2)
_, err = fix.AWS.IAM.DeletePolicyVersion(&iam.DeletePolicyVersionInput{
PolicyArn: aws.String(ec2roArn),
VersionId: aws.String(v2),
})
require.NoError(t, err, "delete-policy-version %s", v2)
})
require.NoError(t, err, "delete-policy-version %s", v2)
harness.Step(t, "list-policies (>=5)")
all, err := fix.AWS.IAM.ListPolicies(&iam.ListPoliciesInput{})
tests/e2e/single/keypair_test.go
+1 -1
View File
@@ -44,7 +44,7 @@ func phase3_KeyPairs(t *testing.T, fix *Fixture) {
require.True(t, strings.HasPrefix(material, "-----BEGIN"),
"KeyMaterial must be a PEM block (got prefix %q)", firstN(material, 32))
pemPath := filepath.Join(t.TempDir(), key1+".pem")
pemPath := filepath.Join(fix.TmpDir, key1+".pem")
require.NoError(t, os.WriteFile(pemPath, []byte(material), 0o600), "write PEM")
fix.KeyName = key1
fix.KeyPath = pemPath
tests/e2e/single/main_test.go
+2
View File
@@ -27,6 +27,7 @@ type Fixture struct {
Env *harness.Env
AWS *harness.AWSClient
Artifacts string
TmpDir string // TestSingleNode-scoped scratch dir; survives until the whole test exits, unlike subtest t.TempDir().
Arch string // x86_64 | arm64
AMIID string // Phase 4
@@ -78,6 +79,7 @@ func TestSingleNode(t *testing.T) {
Env: env,
AWS: harness.NewAWSClient(t, env),
Artifacts: harness.ArtifactDir(t, env),
TmpDir: t.TempDir(),
}
fix.PoolMode = detectPoolMode(env)