From d46d25727848089550f2a82bd2c2abeb833f3103 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 15 Jul 2026 15:17:13 +1000 Subject: [PATCH] fix(e2e): don't require CA cert when SPINIFEX_AWS_INSECURE=1 The storagegrowth gate called ResolveCACert unconditionally before building the AWS client, even though newAWSClient itself skips CA resolution entirely when SPINIFEX_AWS_INSECURE=1. That blocked the documented runner-resident remote path (env12 and similar clusters with no local CA cert on disk) and the skip message falsely claimed no node was running when the real cause was a missing CA. Skip the CA check under SPINIFEX_AWS_INSECURE=1 and state the actual cause plus the escape hatch in the skip message. --- tests/e2e/storagegrowth/main_test.go | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/tests/e2e/storagegrowth/main_test.go b/tests/e2e/storagegrowth/main_test.go index 56c66f1c2..3fe3054f2 100644 --- a/tests/e2e/storagegrowth/main_test.go +++ b/tests/e2e/storagegrowth/main_test.go @@ -117,11 +117,20 @@ func requireStorageGrowthFixture(t *testing.T) *Fixture { } // Guard against harness.NewAWSClient calling t.Fatal (which exits via // runtime.Goexit and corrupts the Once state for subsequent tests) when - // no Spinifex node is running. ResolveCACert uses the same candidate - // paths, so a failure here gives a clean skip with an actionable message. - if _, err := harness.ResolveCACert(env); err != nil { - pkgSkipReason = "no Spinifex node running — provision first: ansible-playbook ansible/playbooks/dev-reset.yml" - return + // no CA cert is resolvable. ResolveCACert uses the same candidate + // paths NewAWSClient falls back to, so a failure here gives a clean + // skip with an actionable message — but only when NewAWSClient would + // actually take that path: SPINIFEX_AWS_INSECURE=1 makes it skip CA + // resolution entirely (see harness/aws.go), which is how a + // runner-resident scenario reaches a remote cluster that doesn't + // have the spinifex cert on disk. + if os.Getenv("SPINIFEX_AWS_INSECURE") != "1" { + if _, err := harness.ResolveCACert(env); err != nil { + pkgSkipReason = "no Spinifex CA cert found: " + err.Error() + + " — provision a local node first (ansible-playbook ansible/playbooks/dev-reset.yml), " + + "or target a remote cluster with SPINIFEX_AWS_INSECURE=1 (skips CA verification; see harness/aws.go)" + return + } } awsCli := harness.NewAWSClient(t, env)