jklein
f202fdc3fc
Validate Helm Charts / Detect changed charts (pull_request) Successful in 5s
Validate Helm Charts / Resource quantities (pull_request) Successful in 15s
Validate Helm Charts / Selector match (pull_request) Successful in 14s
Validate Helm Charts / HTTPRoute match (pull_request) Successful in 14s
Validate Helm Charts / Build freesailarr (pull_request) Successful in 8s
Validate Helm Charts / Trivy config freesailarr (pull_request) Successful in 22s
Install-test / Install-test freesailarr (pull_request) Successful in 4m19s
Validate Helm Charts / Install-test (pull_request) Successful in 4m19s
Publish Helm Chart with patched Application Version / publish-helm-chart (push) Successful in 12s
Publish Freesailarr Helm Chart / Publish Freesailarr Helm Chart (push) Successful in 12s
SonarQube Analysis / SonarQube Analysis (push) Successful in 48s
qBittorrent has no base-path setting, so the chart serves it under a prefix and strips that prefix before the request reaches it. For the slashed form that is correct. For the BARE form - /qbittorrent, no trailing slash - the request is rewritten to "/" and qBittorrent answers 200 with its login page, while the browser's document URL keeps the prefixless form. Every relative link in that page therefore resolves against the host root, and on the shared host the root is seerr: the login form comes up unstyled and does nothing while a different application answers its assets and XHRs. Nothing reports an error at any level. The shared-domain HTTPRoute now carries a second rule for qBittorrent: an Exact match on qbittorrent.ingress.path with a RequestRedirect filter that replaces the full path with the slashed form, statusCode 301. The Gateway API ranks an Exact path match above every prefix match, so it wins over both qBittorrent's own PathPrefix rule and seerr's "/" wherever it is emitted - the rules' length-descending order stays a rendering convention. 301 rather than 308 because only 301 and 302 are Core in that API; an Extended value an implementation declines makes it set Accepted=False on the WHOLE route, which would take the four neighbouring apps' routing down with it, and that would also contradict decision 1 of Gitea #114. statusCode is written out because it defaults to 302. The rule is guarded on the app being qbittorrent and its path not being "/", and it reads the path from the value, never a literal. The INGRESS BRANCH IS UNCHANGED, deliberately. The remedy there is an nginx configuration-snippet annotation, and the chart cannot ship it: snippets are ignored unless the controller runs with allow-snippet-annotations=true, off by default since ingress-nginx 1.9 and only switched on by accepting annotation risk level "Critical". A shipped annotation would be a silent no-op on every cluster keeping the default. The working snippet, that price, and why a third Ingress object with pathType: Exact is not a substitute - buildLocation in ingress-nginx controller-v1.14.5 returns a regex location in its enforceRegex branch before reaching the PathTypeExact branch, and enforceRegex is computed once per nginx server over every location of the hostname, one of which carries rewrite-target - are all written out in values.yaml instead. ci/run-httproute-match-test.sh gains a third assertion, per HTTPRoute object: a rule stripping a prefix with ReplacePrefixMatch requires a rule in the same route matching that path Exactly and carrying a RequestRedirect filter. This is what stops the gap reappearing; bulwark is the second rewrite-target chart and meets the same check when group 3 of Gitea #114 lands. 37 assertions over 15 charts, up from 36. Both fail paths were exercised: the rule deleted, and the redirect pointed at a path other than the one stripped. Minor and not major: with the Ingress branch untouched and httpRoute.enabled defaulting to false, no existing release's render changes by a byte and no value becomes required. Shown by an empty helm template diff against origin/main in both Ingress shapes, shared-domain and per-app hosts. Fixes #118
579 lines
29 KiB
Bash
Executable File
579 lines
29 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# HTTPRoute render test: every HTTPRoute a chart renders is held against the
|
||
# Services of the SAME render, and against the one condition without which the
|
||
# route attaches to nothing.
|
||
#
|
||
# Usage: ci/run-httproute-match-test.sh [chart ...] (no argument = all charts)
|
||
#
|
||
# WHAT IT GUARDS AGAINST, AND WHY NEITHER A RENDER NOR AN INSTALL DOES (#114)
|
||
#
|
||
# An HTTPRoute is the Gateway-API alternative to the Ingress (README, "Ingress
|
||
# and Gateway API"), and it has two silent failure modes that look exactly like
|
||
# a working route from the outside:
|
||
#
|
||
# parentRefs EMPTY - a route without a parent attaches to no Gateway. The
|
||
# object is created, it is schema-valid, no controller rejects it, and it
|
||
# routes nothing. There is no event and no condition; the only symptom is a
|
||
# hostname that does not answer. The charts abort the render over this, and
|
||
# this test is the half that catches a chart which forgot to.
|
||
# backendRefs pointing at NOTHING - the reference is by name, in the release
|
||
# namespace, and nothing validates that the name exists. A typo, a renamed
|
||
# Service, or a port number that no longer matches the Service's port
|
||
# yields a route that resolves to no endpoint. ResolvedRefs goes False in
|
||
# the route's STATUS, which only exists once a controller has looked at it
|
||
# - so in CI, where no Gateway controller runs, nothing reports it at all.
|
||
# A PREFIX STRIPPED WITHOUT THE BARE PREFIX REDIRECTED (#118) - the third
|
||
# finding, and the one that is not about an object pointing nowhere but
|
||
# about an object pointing somewhere WRONG. A rule that matches
|
||
# PathPrefix "<path>" (anything but "/") and carries a URLRewrite filter
|
||
# with ReplacePrefixMatch strips the prefix before the app sees the
|
||
# request. For the slashed form that is correct. For the BARE form -
|
||
# "<path>", no trailing slash - the request becomes "/" and the app
|
||
# answers 200, while the browser's document URL keeps the prefixless form:
|
||
# every relative link in that page then resolves against the PARENT of
|
||
# that path, which is the host root. On a shared host the root belongs to
|
||
# a different application, so the app's own assets and XHRs are answered
|
||
# by its neighbour. Nothing in the chart, the render, the schema or the
|
||
# install reports any of it; the symptom is a half-working UI and a
|
||
# neighbour in the access log, which points nowhere useful.
|
||
#
|
||
# So: wherever a route strips a prefix, the SAME route must also carry a
|
||
# rule matching that path with type Exact and a RequestRedirect filter.
|
||
# Per HTTPRoute object, because Gateway-API matching precedence is a
|
||
# property of one route - a different route is a different hostname and
|
||
# says nothing about this one. Exact outranks every prefix match in that
|
||
# precedence, so the pairing is about existence and not about order.
|
||
# freesailarr is the first chart this applies to; bulwark is the second
|
||
# rewrite-target chart and meets the same check when group 3 of #114
|
||
# lands, which is the point of checking it here rather than in one chart.
|
||
#
|
||
# And the install-test cannot close either gap, even with the real CRDs in the
|
||
# cluster: schema validation accepts an empty parentRefs list and accepts a
|
||
# backendRef to a Service that does not exist. The CRDs prove the object is
|
||
# WELL-FORMED; this test is what proves it POINTS SOMEWHERE.
|
||
#
|
||
# Over ALL charts and not the changed ones, for the same reason as
|
||
# ci/run-quantity-render-test.sh and ci/run-selector-match-test.sh: the mistake
|
||
# arrives by copy into a chart whose own diff nobody reads for it - and this
|
||
# convention is going to be copied 20 more times when the sweep of #114 runs.
|
||
# Running over everything also means there is no list to maintain: adding a
|
||
# chart enrols it.
|
||
#
|
||
# HOW THE YAML IS PARSED
|
||
#
|
||
# By Helm, through ci/yaml2json, exactly as ci/run-selector-match-test.sh does
|
||
# it - the runners have neither pyyaml nor yq, and a parser written in awk
|
||
# would be able to read nothing, find no route and report no finding, leaving
|
||
# this test green for a chart it never looked at. The only textual step is the
|
||
# document split on a line that is exactly "---" in column one, and getting
|
||
# that wrong is not a false pass: the fragment stops being valid YAML and helm
|
||
# exits 1. See that script's header for the long form.
|
||
#
|
||
# WHAT IS DELIBERATELY NOT CHECKED, so the gaps are not mistaken for coverage
|
||
#
|
||
# - THAT TRAFFIC FLOWS. No Gateway controller runs in CI and none will; a
|
||
# route's status is written by the implementation, so "Accepted: True" is
|
||
# not obtainable here. What is obtainable: the object is schema-valid
|
||
# (install-test, against the real CRDs) and it names a Service and a port
|
||
# that exist (this test). Routing itself is unproven, by construction.
|
||
# - MUTUAL EXCLUSION with the Ingress. Every chart aborts its own render when
|
||
# ingress.enabled and httpRoute.enabled are both true, which is where that
|
||
# check belongs: this test renders ONE configuration per chart, and a
|
||
# render-level rule here would have to assume the switch is chart-global.
|
||
# That holds for the pilot and may not hold for the multi-app charts of the
|
||
# sweep (matrix-synapse renders in a loop, keycloak and bulwark have two
|
||
# Ingresses each), so the rule is not written down here where it would have
|
||
# to be undone.
|
||
# - CROSS-NAMESPACE backendRefs and non-Service backends. A backendRef into
|
||
# another namespace needs a ReferenceGrant on the other side and its target
|
||
# is by definition not in this render; a backend that is not a Service is
|
||
# some implementation's own kind. Both are REPORTED as "not checked" and
|
||
# are never counted as passing, because a green tick for a code path nobody
|
||
# entered is worse than an honest gap (README, "Two rules for every check
|
||
# added here").
|
||
# - A RULE WITHOUT backendRefs. Legal - a rule carrying only a
|
||
# RequestRedirect filter needs no backend - so it is reported, not failed.
|
||
# The redirect rule the prefix check below demands is exactly such a rule,
|
||
# so a chart that satisfies that check also earns one "not checked" line
|
||
# here. Both are correct: the pairing is an assertion, the missing backend
|
||
# is an honest gap.
|
||
# - THAT ANY REDIRECT IS EVER SERVED. The prefix/redirect pairing proves the
|
||
# rendered OBJECT carries a RequestRedirect rule on the bare prefix. It
|
||
# does not prove that a 301 ever reaches a client, and it cannot: no
|
||
# Gateway controller runs in CI, nothing evaluates matching precedence,
|
||
# and no route reaches "Accepted: True" - so whether the implementation
|
||
# honours the statusCode, or declines it and fails the whole route, is
|
||
# outside what this test can see. What is proven is that the rule exists,
|
||
# that it matches the right path, and that the chart did not silently stop
|
||
# rendering it.
|
||
#
|
||
# AND THE ANTI-VACUUM GUARDS, because this test can be green over nothing. The
|
||
# convention ships with httpRoute.enabled: false, so a chart renders no route
|
||
# at all unless its CI values or an overlay switch the mode on. Two rules:
|
||
#
|
||
# 1. ci/httproute/<chart>.yaml is an overlay applied last, whose only job is
|
||
# to put a chart into Gateway mode for this test. A chart that HAS one and
|
||
# still renders no HTTPRoute FAILS - the overlay exists for exactly that.
|
||
# 2. If no HTTPRoute at all was checked across the whole run, the run fails.
|
||
set -euo pipefail
|
||
|
||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
CI_DIR="$ROOT/ci"
|
||
YAML2JSON="$CI_DIR/yaml2json"
|
||
OVERLAY_DIR="$CI_DIR/httproute"
|
||
RELEASE="httproute"
|
||
|
||
WORK="$(mktemp -d)"
|
||
trap 'rm -rf "$WORK"' EXIT
|
||
|
||
# --- Which charts -----------------------------------------------------------
|
||
CHARTS=()
|
||
if [ "$#" -gt 0 ]; then
|
||
CHARTS=("$@")
|
||
else
|
||
for DIR in "$ROOT"/*/; do
|
||
[ -f "$DIR/Chart.yaml" ] || continue
|
||
CHARTS+=("$(basename "$DIR")")
|
||
done
|
||
fi
|
||
if [ "${#CHARTS[@]}" -eq 0 ]; then
|
||
echo "ERROR: no chart directories found under $ROOT" >&2
|
||
exit 1
|
||
fi
|
||
|
||
FAILED=""
|
||
CHECKED=""
|
||
NOT_EXERCISED=""
|
||
WITH_GAPS=""
|
||
TOTAL_ASSERTIONS=0
|
||
SUMMARY_ROWS=""
|
||
|
||
for CHART in "${CHARTS[@]}"; do
|
||
if [ ! -f "$ROOT/$CHART/Chart.yaml" ]; then
|
||
echo "ERROR: '$CHART' is not a chart directory" >&2
|
||
exit 1
|
||
fi
|
||
|
||
# Same reason as in the other two render tests: a chart with a declared
|
||
# dependency cannot be rendered at all while charts/ is empty, and this job
|
||
# runs over EVERY chart on EVERY pull request - so without this line a PR
|
||
# touching nothing but a README would go red on the charts that have one.
|
||
"$ROOT/ci/helm-dependencies.sh" "$ROOT/$CHART"
|
||
|
||
# Values: the same precedence the other render tests use, so a chart's CI
|
||
# values are maintained in one place and satisfy its required() values.
|
||
VALUES_ARGS=()
|
||
VALUES_LABEL="chart defaults"
|
||
if [ -f "$CI_DIR/$CHART/test-values.yaml" ]; then
|
||
VALUES_ARGS=(-f "$CI_DIR/$CHART/test-values.yaml")
|
||
VALUES_LABEL="ci/$CHART/test-values.yaml"
|
||
elif [ -f "$CI_DIR/trivy/values/$CHART.yaml" ]; then
|
||
VALUES_ARGS=(-f "$CI_DIR/trivy/values/$CHART.yaml")
|
||
VALUES_LABEL="ci/trivy/values/$CHART.yaml"
|
||
fi
|
||
HAS_OVERLAY=""
|
||
if [ -f "$OVERLAY_DIR/$CHART.yaml" ]; then
|
||
# Last, so it wins over the install-test values.
|
||
VALUES_ARGS+=(-f "$OVERLAY_DIR/$CHART.yaml")
|
||
VALUES_LABEL="$VALUES_LABEL + ci/httproute/$CHART.yaml"
|
||
HAS_OVERLAY=1
|
||
fi
|
||
|
||
echo "::group::$CHART ($VALUES_LABEL)"
|
||
|
||
RENDER="$WORK/$CHART.manifest.yaml"
|
||
if ! helm template "$RELEASE" "$ROOT/$CHART" \
|
||
${VALUES_ARGS[@]+"${VALUES_ARGS[@]}"} >"$RENDER" 2>"$WORK/err"; then
|
||
sed 's/^/ /' "$WORK/err"
|
||
echo "::endgroup::"
|
||
echo "::error title=httproute $CHART::$CHART does not render with its CI values, so no HTTPRoute could be checked. Reproduce: helm template $RELEASE $CHART $(printf '%s ' "${VALUES_ARGS[@]+${VALUES_ARGS[@]}}")"
|
||
FAILED="$FAILED $CHART"
|
||
continue
|
||
fi
|
||
|
||
# --- The document split, and the only textual step in this script ----------
|
||
# One YAML sequence item per rendered document, content indented by four and
|
||
# the item marker on a line of its own - so a document whose first line is a
|
||
# comment ("# Source: ...") needs no special case. A wrong split does not
|
||
# produce a false pass: the result stops being parsable and helm exits 1.
|
||
DOCS="$WORK/$CHART.docs.yaml"
|
||
awk '
|
||
BEGIN { print "docs:"; started = 0 }
|
||
/^---[ \t]*$/ { print " -"; started = 1; next }
|
||
{
|
||
if (!started) { print " -"; started = 1 }
|
||
if (length($0) == 0) print ""; else print " " $0
|
||
}
|
||
' "$RENDER" >"$DOCS"
|
||
|
||
JSON="$WORK/$CHART.json"
|
||
if ! helm template y2j "$YAML2JSON" -f "$DOCS" 2>"$WORK/err" \
|
||
| awk '/^\{/ { print; exit }' >"$JSON"; then
|
||
sed 's/^/ /' "$WORK/err"
|
||
echo "::endgroup::"
|
||
echo "::error title=httproute $CHART::the rendered manifests of $CHART could not be re-read as YAML by ci/yaml2json. That is a parse failure, not an HTTPRoute finding: either the render contains a document this script's '---' split cut in the wrong place, or the manifest is not valid YAML. Helm's own message is in the job log."
|
||
FAILED="$FAILED $CHART"
|
||
continue
|
||
fi
|
||
if [ ! -s "$JSON" ]; then
|
||
echo "::endgroup::"
|
||
echo "::error title=httproute $CHART::ci/yaml2json produced no JSON for $CHART - the manifests were not re-read, so nothing was checked."
|
||
FAILED="$FAILED $CHART"
|
||
continue
|
||
fi
|
||
|
||
# --- The comparison --------------------------------------------------------
|
||
# Inline and on the standard library only, as in the two sibling tests. It
|
||
# writes one "VERDICT|detail" line per assertion and never decides the exit
|
||
# code itself: the loop below does, so a verdict can never be lost to a
|
||
# swallowed status.
|
||
set +e
|
||
python3 - "$CHART" "$JSON" >"$WORK/$CHART.out" 2>"$WORK/$CHART.pyerr" <<'PY'
|
||
import json, sys
|
||
|
||
chart, path = sys.argv[1], sys.argv[2]
|
||
docs = json.load(open(path)).get("docs") or []
|
||
docs = [d for d in docs if isinstance(d, dict)]
|
||
|
||
|
||
def name_of(doc):
|
||
meta = doc.get("metadata")
|
||
if isinstance(meta, dict) and meta.get("name"):
|
||
return str(meta["name"])
|
||
return "<unnamed %s>" % doc.get("kind", "object")
|
||
|
||
|
||
# Every Service of the render, as name -> the set of port NUMBERS it exposes.
|
||
# Port numbers and not names on purpose: an HTTPRoute backendRef carries a
|
||
# PortNumber and cannot reference a port by name, which is exactly where it
|
||
# differs from the Ingress backend this convention replaces - and exactly why
|
||
# a chart has to keep the number in the route in step with its Service by
|
||
# hand.
|
||
services = {}
|
||
for doc in docs:
|
||
if doc.get("kind") != "Service":
|
||
continue
|
||
ports = set()
|
||
spec = doc.get("spec") if isinstance(doc.get("spec"), dict) else {}
|
||
for port in (spec.get("ports") or []):
|
||
if isinstance(port, dict) and port.get("port") is not None:
|
||
ports.add(str(port["port"]))
|
||
services[name_of(doc)] = ports
|
||
|
||
routes = [d for d in docs if d.get("kind") == "HTTPRoute"]
|
||
lines = []
|
||
|
||
for doc in routes:
|
||
route = "HTTPRoute %s" % name_of(doc)
|
||
spec = doc.get("spec") if isinstance(doc.get("spec"), dict) else {}
|
||
|
||
# 1. parentRefs must be a non-empty list. The whole point: a route without
|
||
# a parent is valid, created, and inert.
|
||
parents = spec.get("parentRefs")
|
||
if not isinstance(parents, list) or not parents:
|
||
lines.append("FAIL|%s: %s has %s parentRefs. A route without a parent "
|
||
"attaches to NO Gateway: the object is created, it is "
|
||
"schema-valid, no controller rejects it and it routes "
|
||
"nothing - no event, no condition, the only symptom is a "
|
||
"hostname that does not answer. The chart must abort its "
|
||
"own render on an empty httpRoute.parentRefs"
|
||
% (chart, route,
|
||
"no" if parents is None else "an empty list of"))
|
||
else:
|
||
bad = [p for p in parents
|
||
if not isinstance(p, dict) or not str(p.get("name") or "").strip()]
|
||
if bad:
|
||
lines.append("FAIL|%s: %s has %d parentRef(s) without a usable "
|
||
"'name' (%r). ParentReference.name is required by the "
|
||
"API; a reference without it attaches to nothing"
|
||
% (chart, route, len(bad), bad))
|
||
else:
|
||
lines.append("OK|%s: %s has %d parentRef(s): %s"
|
||
% (chart, route, len(parents),
|
||
", ".join("%s%s" % (p["name"],
|
||
"/%s" % p["namespace"] if p.get("namespace") else "")
|
||
for p in parents)))
|
||
|
||
# 2. Every backendRefs entry, against the Services of the SAME render.
|
||
rules = spec.get("rules")
|
||
if not isinstance(rules, list) or not rules:
|
||
lines.append("FAIL|%s: %s renders no rules at all, so it matches no "
|
||
"request and forwards nothing" % (chart, route))
|
||
continue
|
||
|
||
for i, rule in enumerate(rules):
|
||
tag = "%s rules[%d]" % (route, i)
|
||
if not isinstance(rule, dict):
|
||
lines.append("FAIL|%s: %s is not a mapping (%r)" % (chart, tag, rule))
|
||
continue
|
||
backends = rule.get("backendRefs")
|
||
if not backends:
|
||
# Legal: a rule carrying only a RequestRedirect or a
|
||
# RequestMirror filter needs no backend. Reported, never counted.
|
||
lines.append("SKIP|%s: %s has no backendRefs. That is legal for a "
|
||
"filter-only rule (a redirect, for instance) and is "
|
||
"not evaluated here - but a rule meant to forward "
|
||
"traffic and carrying no backend answers 500 by "
|
||
"specification" % (chart, tag))
|
||
continue
|
||
if not isinstance(backends, list):
|
||
lines.append("FAIL|%s: %s backendRefs is not a list (%r)"
|
||
% (chart, tag, backends))
|
||
continue
|
||
for j, backend in enumerate(backends):
|
||
where = "%s.backendRefs[%d]" % (tag, j)
|
||
if not isinstance(backend, dict):
|
||
lines.append("FAIL|%s: %s is not a mapping (%r)"
|
||
% (chart, where, backend))
|
||
continue
|
||
# kind and group default to Service and the core group.
|
||
kind = str(backend.get("kind") or "Service")
|
||
group = str(backend.get("group") or "")
|
||
if kind != "Service" or group not in ("", "core"):
|
||
lines.append("SKIP|%s: %s references %s.%s, which is not a core "
|
||
"Service - some implementation's own backend kind. "
|
||
"This test cannot resolve it and does not count it "
|
||
"as passing" % (chart, where, group or "core", kind))
|
||
continue
|
||
namespace = backend.get("namespace")
|
||
if namespace:
|
||
lines.append("SKIP|%s: %s references Service %s in namespace %s. A "
|
||
"cross-namespace backend needs a ReferenceGrant on "
|
||
"the other side and its target is by definition not "
|
||
"in this render, so it is reported rather than "
|
||
"checked" % (chart, where, backend.get("name"), namespace))
|
||
continue
|
||
target = str(backend.get("name") or "")
|
||
if not target:
|
||
lines.append("FAIL|%s: %s has no 'name' - it references no "
|
||
"backend at all" % (chart, where))
|
||
continue
|
||
if target not in services:
|
||
lines.append("FAIL|%s: %s references Service %r, which the SAME "
|
||
"render does not create. A backendRef is resolved "
|
||
"by name at runtime and validated by nothing: the "
|
||
"route is accepted, ResolvedRefs goes False in a "
|
||
"status no controller writes in CI, and the "
|
||
"hostname answers with the Gateway's error instead "
|
||
"of the app. Services this render does create: %s"
|
||
% (chart, where, target,
|
||
", ".join(sorted(services)) or "none at all"))
|
||
continue
|
||
port = backend.get("port")
|
||
if port is None:
|
||
lines.append("FAIL|%s: %s references Service %r without a port. "
|
||
"A backendRef to a Service must carry one - the "
|
||
"CRD schema cannot require it conditionally, so an "
|
||
"omitted port is accepted at apply time and "
|
||
"resolves to nothing. The Service exposes: %s"
|
||
% (chart, where, target,
|
||
", ".join(sorted(services[target])) or "no ports"))
|
||
continue
|
||
if str(port) not in services[target]:
|
||
lines.append("FAIL|%s: %s references Service %r on port %s, which "
|
||
"that Service does not expose (it serves %s). "
|
||
"backendRefs takes a port NUMBER and cannot name a "
|
||
"port, so this pair is kept in step by hand and "
|
||
"drifts the moment one side is edited alone"
|
||
% (chart, where, target, port,
|
||
", ".join(sorted(services[target])) or "no ports"))
|
||
continue
|
||
lines.append("OK|%s: %s resolves to Service %s:%s, created by the same "
|
||
"render" % (chart, where, target, port))
|
||
|
||
# 3. A stripped prefix needs the BARE prefix redirected, in THIS route
|
||
# (#118). Collected over all rules of this one object first, because the
|
||
# pairing is a property of the route and not of a rule: the Gateway API
|
||
# ranks an Exact path match above every prefix match, so the redirect
|
||
# rule may sit anywhere in the list and still win.
|
||
stripped = {} # prefix -> index of the rule that strips it
|
||
redirected = {} # path -> index of the rule that redirects it exactly
|
||
for i, rule in enumerate(rules):
|
||
if not isinstance(rule, dict):
|
||
continue
|
||
filter_types = set()
|
||
strips_prefix = False
|
||
filters = rule.get("filters")
|
||
for f in (filters if isinstance(filters, list) else []):
|
||
if not isinstance(f, dict):
|
||
continue
|
||
ftype = str(f.get("type") or "")
|
||
filter_types.add(ftype)
|
||
if ftype != "URLRewrite":
|
||
continue
|
||
rewrite = f.get("urlRewrite")
|
||
rewrite = rewrite if isinstance(rewrite, dict) else {}
|
||
rpath = rewrite.get("path")
|
||
rpath = rpath if isinstance(rpath, dict) else {}
|
||
if str(rpath.get("type") or "") == "ReplacePrefixMatch":
|
||
strips_prefix = True
|
||
matches = rule.get("matches")
|
||
for m in (matches if isinstance(matches, list) else []):
|
||
if not isinstance(m, dict):
|
||
continue
|
||
mpath = m.get("path")
|
||
mpath = mpath if isinstance(mpath, dict) else {}
|
||
# The API's own defaults for HTTPPathMatch.
|
||
ptype = str(mpath.get("type") or "PathPrefix")
|
||
value = str(mpath.get("value") or "/")
|
||
if strips_prefix and ptype == "PathPrefix" and value != "/":
|
||
stripped.setdefault(value, i)
|
||
if ptype == "Exact" and "RequestRedirect" in filter_types:
|
||
redirected.setdefault(value, i)
|
||
|
||
for prefix in sorted(stripped):
|
||
if prefix in redirected:
|
||
lines.append("OK|%s: %s strips the prefix %r (rules[%d]) and "
|
||
"redirects the bare, slashless %r to the slashed form "
|
||
"(rules[%d]) - so the prefixless entry point cannot be "
|
||
"answered under a URL whose relative links leave the app"
|
||
% (chart, route, prefix, stripped[prefix], prefix,
|
||
redirected[prefix]))
|
||
else:
|
||
lines.append("FAIL|%s: %s rules[%d] strips the prefix %r with a "
|
||
"ReplacePrefixMatch rewrite, but NO rule of this route "
|
||
"redirects the bare prefix: there is no match of type "
|
||
"Exact on %r carrying a RequestRedirect filter. A "
|
||
"request for %r WITHOUT the trailing slash is then "
|
||
"rewritten to \"/\" and the app answers it 200, so "
|
||
"nothing anywhere reports a problem - but the browser's "
|
||
"document URL stays prefixless, every relative link in "
|
||
"that page resolves against the host ROOT, and on a "
|
||
"shared host the root is a DIFFERENT application, which "
|
||
"then answers the app's own assets and XHRs. The fix is "
|
||
"a rule matching %r exactly with a RequestRedirect to "
|
||
"'%s/' and statusCode 301 written out (302 is the API's "
|
||
"default, and 308 is Extended - an implementation that "
|
||
"declines it sets Accepted=False on the WHOLE route, "
|
||
"taking every other app on it down). Exact outranks "
|
||
"every prefix match, so where the rule sits in the list "
|
||
"does not matter. Gitea #118"
|
||
% (chart, route, stripped[prefix], prefix, prefix,
|
||
prefix, prefix, prefix))
|
||
|
||
for line in lines:
|
||
print(line)
|
||
PY
|
||
RC=$?
|
||
set -e
|
||
if [ "$RC" -gt 1 ]; then
|
||
sed 's/^/ /' "$WORK/$CHART.pyerr"
|
||
echo "::endgroup::"
|
||
echo "::error title=httproute $CHART::the HTTPRoute comparison itself failed for $CHART (python exit $RC). Treated as a failure, never as a pass."
|
||
FAILED="$FAILED $CHART"
|
||
continue
|
||
fi
|
||
|
||
CHART_FAIL=""
|
||
CHART_OK=0
|
||
CHART_SKIP=0
|
||
while IFS='|' read -r VERDICT DETAIL; do
|
||
case "$VERDICT" in
|
||
OK)
|
||
CHART_OK=$((CHART_OK + 1))
|
||
echo " ok $DETAIL"
|
||
;;
|
||
SKIP)
|
||
CHART_SKIP=$((CHART_SKIP + 1))
|
||
echo " gap $DETAIL"
|
||
;;
|
||
FAIL)
|
||
CHART_FAIL=1
|
||
echo " FAIL $DETAIL"
|
||
echo "::error title=httproute $CHART::$DETAIL"
|
||
;;
|
||
*)
|
||
[ -n "$VERDICT" ] && echo " $VERDICT $DETAIL"
|
||
;;
|
||
esac
|
||
done <"$WORK/$CHART.out"
|
||
echo "::endgroup::"
|
||
|
||
TOTAL_ASSERTIONS=$((TOTAL_ASSERTIONS + CHART_OK))
|
||
|
||
if [ -n "$CHART_FAIL" ]; then
|
||
FAILED="$FAILED $CHART"
|
||
SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | $CHART_OK | $CHART_SKIP |"$'\n'
|
||
echo "$CHART: FAILED"
|
||
elif [ "$CHART_OK" -gt 0 ]; then
|
||
CHECKED="$CHECKED $CHART"
|
||
[ "$CHART_SKIP" -gt 0 ] && WITH_GAPS="$WITH_GAPS $CHART"
|
||
SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | ok | $CHART_OK | $CHART_SKIP |"$'\n'
|
||
echo "$CHART: ok ($CHART_OK assertion(s) held, $CHART_SKIP not checked)"
|
||
elif [ -n "$HAS_OVERLAY" ]; then
|
||
# The overlay's ONE job is to put this chart into Gateway mode. If no
|
||
# HTTPRoute came out, this test is vacuum-green for the chart the overlay
|
||
# was written for, which is the failure the overlay prevents.
|
||
FAILED="$FAILED $CHART"
|
||
SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | 0 | $CHART_SKIP |"$'\n'
|
||
echo "::error title=httproute $CHART::$CHART has an overlay at ci/httproute/$CHART.yaml but rendered no HTTPRoute, so nothing was checked. That overlay exists only to switch the chart into Gateway mode - either it no longer does (a renamed value, a changed gate) or the chart stopped rendering a route. A green tick here would be a tick for a check that ran over nothing."
|
||
echo "$CHART: FAILED (overlay present, no HTTPRoute rendered)"
|
||
else
|
||
NOT_EXERCISED="$NOT_EXERCISED $CHART"
|
||
[ "$CHART_SKIP" -gt 0 ] && WITH_GAPS="$WITH_GAPS $CHART"
|
||
echo "$CHART: no HTTPRoute rendered - nothing to check."
|
||
fi
|
||
done
|
||
|
||
# --- Report ------------------------------------------------------------------
|
||
count() { set -- $1; echo "$#"; }
|
||
listing() { set -- $1; [ "$#" -eq 0 ] && { echo "–"; return; }; printf '`%s`' "$1"; shift; for C in "$@"; do printf ', `%s`' "$C"; done; echo; }
|
||
SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/null}"
|
||
{
|
||
echo "### HTTPRoute render test (Gitea #114)"
|
||
echo
|
||
echo "Every \`HTTPRoute\` a chart renders, held against the \`Service\` objects of the"
|
||
echo "**same** render. An empty \`parentRefs\` attaches the route to no Gateway, and a"
|
||
echo "\`backendRefs\` entry naming a Service or a port that does not exist resolves to"
|
||
echo "nothing — both are schema-valid, so neither the real CRDs in the install-test nor"
|
||
echo "any render error catches them, and the only report would be a route status that no"
|
||
echo "controller writes in CI. A third finding is not about pointing nowhere but about"
|
||
echo "pointing somewhere wrong: a rule that strips a prefix with \`ReplacePrefixMatch\`"
|
||
echo "while the same route carries no \`Exact\` match on that prefix with a"
|
||
echo "\`RequestRedirect\` filter leaves the slashless form answered 200 under a URL whose"
|
||
echo "relative links resolve to the host root — a neighbouring app (Gitea #118)."
|
||
echo
|
||
echo "| Result | Count | Charts |"
|
||
echo "|---|---|---|"
|
||
echo "| HTTPRoutes checked | $(count "$CHECKED") | $(listing "$CHECKED") |"
|
||
echo "| No HTTPRoute rendered | $(count "$NOT_EXERCISED") | $(listing "$NOT_EXERCISED") |"
|
||
echo "| Failed | $(count "$FAILED") | $(listing "$FAILED") |"
|
||
echo
|
||
echo "$TOTAL_ASSERTIONS assertion(s) held in total."
|
||
echo
|
||
echo "**Not provable here, by construction:** that traffic flows. No Gateway controller"
|
||
echo "runs in CI, so no route ever reaches \`Accepted: True\`."
|
||
if [ -n "$WITH_GAPS" ]; then
|
||
echo
|
||
echo "Charts with references this test does **not** resolve (cross-namespace or non-Service backends, filter-only rules — reported, never counted as passing): $(listing "$WITH_GAPS")."
|
||
fi
|
||
if [ -n "$SUMMARY_ROWS" ]; then
|
||
echo
|
||
echo "| Chart | Result | Checked | Not checked |"
|
||
echo "| --- | --- | --- | --- |"
|
||
printf '%s' "$SUMMARY_ROWS"
|
||
fi
|
||
} >>"$SUMMARY"
|
||
|
||
echo "====================== httproute render test ======================"
|
||
echo "checked: $(count "$CHECKED")${CHECKED:+ -$CHECKED}"
|
||
echo "not exercised: $(count "$NOT_EXERCISED")${NOT_EXERCISED:+ -$NOT_EXERCISED}"
|
||
echo "failed: $(count "$FAILED")${FAILED:+ -$FAILED}"
|
||
echo "assertions held: $TOTAL_ASSERTIONS"
|
||
echo "=================================================================="
|
||
|
||
if [ -n "$FAILED" ]; then
|
||
echo "ERROR: HTTPRoute findings in:$FAILED" >&2
|
||
exit 1
|
||
fi
|
||
|
||
# The second anti-vacuum guard. Reaching zero means every chart fell into "no
|
||
# HTTPRoute rendered", which is indistinguishable from a broken harness - and
|
||
# it is the state this test would silently decay into if the overlays were ever
|
||
# dropped, or if the convention were reverted in the charts without anyone
|
||
# removing this job.
|
||
if [ "$TOTAL_ASSERTIONS" -eq 0 ]; then
|
||
echo "ERROR: not a single HTTPRoute assertion was checked in this run. Either no chart renders an HTTPRoute any more, or the overlays under ci/httproute/ no longer switch one into Gateway mode. A pass over zero assertions is not a pass." >&2
|
||
exit 1
|
||
fi
|