mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
cae76ba1b6
* test(volume): assert chunk GC stays wired on in CreateVolume GCEnabled was zero-valued at every viperblock construction site for a long time and no test noticed. It is not part of viperblock.VBState, so it never round-trips through a saved config.json and cannot be observed by reading volume state back. Extract the viperblock.VB assembly out of CreateVolume into buildVBConfig so the GC wiring is assertable directly against the returned config, without a live viperblock or S3 backend. The config is returned by pointer because viperblock.VB carries atomic.Uint64 fields that vet's copylocks check rightly refuses to see copied. * test(e2e): snapshot backend byte accounting before volume purge DeleteVolume purges a volume's entire backend prefix, including any chunks a leak left behind, before anything measures it. That is the same masking that hid the storage-growth leak in production: a passing E2E cannot fail on backend growth when the evidence is deleted first. Snapshot the volume's backend chunk footprint in EnsureVolume's cleanup closure, immediately before DeleteVolume, so every volume the shared teardown path purges is measured rather than silently discarded. The snapshot is always taken and logged; the hard ratio check additionally runs for callers that registered a guest-written-bytes baseline, since most callers never attach or write to the volume they create and so have no baseline to compare against. The tolerance is the RS(2,1) erasure floor widened for per-chunk header and tail-chunk overhead. It is sized to distinguish unbounded growth from a footprint settling at the floor, not to catch bounded residual garbage. The check is non-fatal inside the cleanup callback: t.Fatalf's runtime.Goexit would abort the DeleteVolume call queued behind it and turn a reported leak into a real one. * test(e2e): add memory-constrained concurrent-write durability regression The existing durability tests write one 4MiB sentinel, sequentially, on a comfortably sized guest, which is the exact inverse of the known-open data-loss bug: acked writes read back zero-filled after a cold reread when a guest is memory-starved during concurrent writeback. No happy-path test can reach it, because the fault lives in the intersection of memory pressure, write concurrency and cache-cold reread. Add a suite that encodes those three conditions together: a guest discovered at or below the working set, N parallel large writers launched as background jobs in a single command so they genuinely overlap, swap disabled, then sync and drop_caches before rereading. Assertions are per stream rather than aggregate so a failure names the losing writer instead of leaving whoever reads it to re-derive which of N writers lost data from one combined digest. GuestExec gains a timeout-parameterised variant. Its fixed two-minute default is sized for sub-second payloads, and a multi-gigabyte write to a network-backed volume would exceed it, so the suite would have failed by timeout while looking like it had caught the corruption. The budget scales with the working set, and a deadline is reported distinctly from a data mismatch so the two red states are never confused. The suite is dispatchable but deliberately absent from the default SUITES: the bug it reproduces is still open, so it is expected to fail and must not sit in a merge-gating path. It is registered in the workflow allow-list so it stays discoverable rather than being buried behind a skip. Also record on the live IAM instance-profile test why its assertions were not moved down to the integration tier, so the trace is not repeated. * test(e2e): drop backend byte accounting, assert a node-wide delta instead The accounting helper listed the internal predastore bucket to attribute bytes per volume. That listing is refused unconditionally: predastore authorises bucket access by same-account ownership, and the bucket belongs to the service account, so a test caller gets 403 no matter what it holds. Granting the test a service credential would invert the trust boundary to buy a measurement, which is the wrong trade. Replace it with what the S3 surface actually permits: sample node-wide allocated bytes either side of the write and bound the delta against the bytes the guest wrote. Coarser, but it measures something real rather than depending on a call that cannot succeed. The tolerance moves into the suite that uses it. It encodes RS(2,1)'s 1.5x expansion floor plus headroom; a cluster running the recommended RS(3,2) has a 1.667x floor and only ~12% of margin left, so the constant needs revisiting if the encoding changes. * revert: drop memdurability e2e suite The suite asserted the guest read back what it wrote after a memory-constrained concurrent write, but the assertion could not fail for the reason it claimed: it compared the guest's own read against the guest's own write with the page cache still warm, so it passed whether or not the data reached the backend. A test that is green on a build with a known-open durability bug is worse than no test — it advertises coverage that does not exist. Removes the suite and its Makefile/workflow wiring, plus DiscoverInstanceTypeAtLeastMemory, which had no other caller. GuestExecTimeout stays: GuestExec now delegates to it, and the old two-minute hard cap it replaced was a latent trap for any long guest command. * test(e2e): add partial-block concurrent-write durability suite Replaces the removed memdurability suite, which passed on a build that still carried the bug it claimed to test. The engine reaches its read-modify-write path only for a partial block; a fully covered block takes a full-overwrite branch that reads nothing and can lose nothing. The old workload wrote through ext4 with 1 MiB buffers, which the filesystem coalesced into aligned full-block requests: block-layer tracing recorded zero unaligned and zero sub-4096 requests, so the path under test never ran, and writers 4 MiB apart could not collide on a block even in principle. This suite writes the shape the defect needs. Two writers issue concurrent O_DIRECT writes into disjoint halves of the same 4096-byte blocks on a raw, unformatted device, stamping every half with the round number, then drop the page cache and reread with O_DIRECT asserting every half carries the final round. One half reading back at an earlier round is the signature of the lost update. The old suite also could not fail even had it reached the path: its write phase ended in 'wait; sync; sha256sum' and reported sha256sum's exit status, while bare wait returns 0 unconditionally, so writer errors were invisible and a backend ENOSPC presented as a pass. Here each writer's exit status and exact byte count are asserted before any durability claim is made. Working set is 8 MiB rather than 2048 MiB, and the volume is deleted on teardown; the predecessor left roughly 3 GiB of backend per run and twice drove a node under the nearfull watermark. Dispatchable but not in the default suite list until a green run and a demonstrated fail-first against a pre-fix engine exist. * test(e2e): let the fixture own the working-set volume delete The suite deleted the volume in its own cleanup and the fixture deleted it again on close, so every run ended with an InvalidVolume.NotFound from the second attempt. Detach stays — DeleteVolume against a still attached volume is what leaks volumes on teardown — and the delete is left to the fixture so the volume is released exactly once. * test(e2e): gate merges on the partial-block durability suite Verified on one node with the same test binary and workload, varying only the engine: 1758 of 8192 halves reverted a generation against the pre-fix build, 0 of 8192 against the fixed one. That is the fail-first evidence the suite needed before it could be trusted to gate anything. Adding it to the default suite list rather than leaving it dispatchable is the point. Its predecessor sat outside every path that runs, which is how it survived long enough to be discovered green on a build that still lost data. * test(integration): cover the ECR data plane in the front gate The live ecr/ suite drove docker, crane and skopeo against a real registry, yet none of it boots a guest: it needs a registry, an object store and an HTTP client. The in-process gateway already serves the OCI Distribution v2 surface on an ephemeral port with a memory-backed object store, so these run here in 0.18s instead of behind full provisioning. Covers the three claims the live tests made beyond authorization, which is already down here: a push/pull round trip asserting blobs and manifests read back byte-identical, refusal to auto-create a repository on push, and retagging an existing manifest without disturbing the original tag. Content is compared rather than status codes alone. A registry that stores a blob under the wrong digest, truncates it, or serves a different one answers 200 to every request in the sequence. The capacity/load leg deliberately stays live: it exists to put real parallel pressure on a real predastore, and a memory-backed object store cannot make that claim. * fix(e2e): make volume teardown release the volume before deleting it Fixture cleanups drain LIFO, so a suite that creates its instance before its volume tears the volume down first, while it is still attached. DeleteVolume answered VolumeInUse, nothing retried, and the volume was stranded on the node. Reordering the chain cannot fix this — registration order has no way to express the instance/volume dependency. Instead teardown is now self-sufficient for any creation order: it force-detaches, waits for the volume to reach available, and only then deletes. Instance teardown waits for terminated for the same reason, since TerminateInstances returns as soon as the request is accepted. Two things kept the leak invisible. A failing cleanup was logged and forgotten, so a run stayed green with resources left behind; failures are now reported as leaks, failing the bound test or surfacing through Close() for TestMain to fail the run. And a panic in one cleanup aborted the whole chain, stranding every resource behind it; each callback is now isolated. RegisterVolumeTeardown and the fixture had grown separate teardown paths, only one of which detached. Both now share it.
174 lines
5.4 KiB
Go
174 lines
5.4 KiB
Go
//go:build e2e
|
|
|
|
package gpu
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"sync"
|
|
"testing"
|
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
|
"github.com/aws/aws-sdk-go/service/ec2"
|
|
"github.com/mulgadc/spinifex/tests/e2e/harness"
|
|
)
|
|
|
|
var (
|
|
pkgFixOnce sync.Once
|
|
pkgFix *Fixture
|
|
pkgFixErr error
|
|
pkgSkipReason string
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
code := m.Run()
|
|
if pkgFix != nil {
|
|
if pkgFix.Harness != nil {
|
|
// A leaked resource fails the run: the suite may have passed, but it
|
|
// left state on the node that the next run will trip over.
|
|
if err := pkgFix.Harness.Close(); err != nil {
|
|
fmt.Fprintf(os.Stderr, "e2e teardown: %v\n", err)
|
|
code = 1
|
|
}
|
|
}
|
|
if pkgFix.TmpDir != "" {
|
|
_ = os.RemoveAll(pkgFix.TmpDir)
|
|
}
|
|
}
|
|
os.Exit(code)
|
|
}
|
|
|
|
// Fixture carries per-process state shared across GPU passthrough tests.
|
|
type Fixture struct {
|
|
Env *harness.Env
|
|
AWS *harness.AWSClient
|
|
Harness *harness.Fixture
|
|
TmpDir string
|
|
GPUInstanceType string // first GPU instance type advertised by the node, e.g. "g5.xlarge"
|
|
AMIID string // AMI ID of the imported ubuntu-26.04-nvidia-gpu-x86_64 image
|
|
}
|
|
|
|
func (f *Fixture) ArtifactDir(t *testing.T) string {
|
|
t.Helper()
|
|
return harness.ArtifactDir(t, f.Env)
|
|
}
|
|
|
|
// requireGPUFixture returns the package-scoped Fixture singleton, building it
|
|
// on first call. Skips the calling test when:
|
|
// - SPINIFEX_E2E is unset
|
|
// - no GPU instance types are advertised (node has no GPU or gpu_passthrough=false)
|
|
//
|
|
// The ubuntu base GPU AMI is resolved best-effort into Fixture.AMIID; tests that
|
|
// launch from it must additionally call requireBaseGPUAMI. The ECS test resolves
|
|
// its own spinifex-ecs-node-gpu AMI and does not need the base image.
|
|
func requireGPUFixture(t *testing.T) *Fixture {
|
|
t.Helper()
|
|
pkgFixOnce.Do(func() {
|
|
if os.Getenv("SPINIFEX_E2E") == "" {
|
|
return
|
|
}
|
|
env := harness.LoadEnv(t)
|
|
if env.Mode != harness.ModeSingle {
|
|
pkgSkipReason = "gpu suite requires SPINIFEX_MODE=single"
|
|
return
|
|
}
|
|
// Guard against harness.NewAWSClient calling t.Fatal (which exits via
|
|
// runtime.Goexit and corrupts the Once state for subsequent tests) when
|
|
// no Spinifex node is running. ResolveCACert uses the same candidate
|
|
// paths, so a failure here gives a clean skip with an actionable message.
|
|
if _, err := harness.ResolveCACert(env); err != nil {
|
|
pkgSkipReason = "no Spinifex node running — provision first: ansible-playbook ansible/playbooks/dev-reset.yml"
|
|
return
|
|
}
|
|
awsCli := harness.NewAWSClient(t, env)
|
|
|
|
gpuType, reason := discoverGPUInstanceType(awsCli)
|
|
if reason != "" {
|
|
pkgSkipReason = reason
|
|
return
|
|
}
|
|
amiID := discoverBaseGPUAMI(awsCli) // empty if not imported; gated per-test
|
|
|
|
h, err := harness.NewProcessFixture(awsCli)
|
|
if err != nil {
|
|
pkgFixErr = err
|
|
return
|
|
}
|
|
tmpDir, err := os.MkdirTemp("", "gpu-pkgfix-*")
|
|
if err != nil {
|
|
pkgFixErr = err
|
|
return
|
|
}
|
|
harness.EnsureDefaultSGOpen(t, awsCli)
|
|
pkgFix = &Fixture{
|
|
Env: env,
|
|
AWS: awsCli,
|
|
Harness: h,
|
|
TmpDir: tmpDir,
|
|
GPUInstanceType: gpuType,
|
|
AMIID: amiID,
|
|
}
|
|
})
|
|
if pkgFixErr != nil {
|
|
t.Fatalf("gpu fixture init: %v", pkgFixErr)
|
|
}
|
|
if pkgFix == nil {
|
|
if pkgSkipReason != "" {
|
|
t.Skip(pkgSkipReason)
|
|
}
|
|
t.Skip("SPINIFEX_E2E unset")
|
|
}
|
|
return pkgFix
|
|
}
|
|
|
|
// discoverGPUInstanceType returns the SMALLEST GPU instance type advertised by
|
|
// the node (fewest vCPUs, then least memory) so it fits on a single dev host —
|
|
// picking an arbitrary/large type (e.g. g5.8xlarge) fails with
|
|
// InsufficientInstanceCapacity. A non-empty reason means none are advertised.
|
|
func discoverGPUInstanceType(c *harness.AWSClient) (gpuType, reason string) {
|
|
typesOut, err := c.EC2.DescribeInstanceTypes(&ec2.DescribeInstanceTypesInput{})
|
|
if err != nil {
|
|
return "", "DescribeInstanceTypes: " + err.Error()
|
|
}
|
|
var bestVCPU, bestMem int64
|
|
for _, it := range typesOut.InstanceTypes {
|
|
if it.GpuInfo == nil || len(it.GpuInfo.Gpus) == 0 {
|
|
continue
|
|
}
|
|
vcpu := aws.Int64Value(it.VCpuInfo.DefaultVCpus)
|
|
mem := aws.Int64Value(it.MemoryInfo.SizeInMiB)
|
|
if gpuType == "" || vcpu < bestVCPU || (vcpu == bestVCPU && mem < bestMem) {
|
|
gpuType, bestVCPU, bestMem = aws.StringValue(it.InstanceType), vcpu, mem
|
|
}
|
|
}
|
|
if gpuType == "" {
|
|
return "", "no GPU instance types advertised — node has no GPU or gpu_passthrough is disabled"
|
|
}
|
|
return gpuType, ""
|
|
}
|
|
|
|
// discoverBaseGPUAMI returns the ubuntu-26.04-nvidia-gpu-x86_64 image ID, or ""
|
|
// if it has not been imported. Only the raw-EC2 GPU tests launch from it.
|
|
func discoverBaseGPUAMI(c *harness.AWSClient) string {
|
|
imgsOut, err := c.EC2.DescribeImages(&ec2.DescribeImagesInput{
|
|
Filters: []*ec2.Filter{
|
|
{Name: aws.String("name"), Values: []*string{aws.String("ubuntu-26.04-nvidia-gpu-x86_64")}},
|
|
{Name: aws.String("state"), Values: []*string{aws.String("available")}},
|
|
},
|
|
})
|
|
if err != nil || len(imgsOut.Images) == 0 {
|
|
return ""
|
|
}
|
|
return aws.StringValue(imgsOut.Images[0].ImageId)
|
|
}
|
|
|
|
// requireBaseGPUAMI skips the calling test unless the ubuntu base GPU image is
|
|
// imported. Tests that launch a VM directly from the base AMI call this after
|
|
// requireGPUFixture; the ECS test uses its own node AMI and does not.
|
|
func requireBaseGPUAMI(t *testing.T, fix *Fixture) {
|
|
t.Helper()
|
|
if fix.AMIID == "" {
|
|
t.Skip("ubuntu-26.04-nvidia-gpu-x86_64 AMI not imported — run: spx admin images import --name ubuntu-26.04-nvidia-gpu-x86_64")
|
|
}
|
|
}
|