test(soteria): lift b2 and job helper coverage
This commit is contained in:
codex
parent
2ec2edae4c
commit
0cda32777f
213
internal/k8s/jobs_test.go
Normal file
213
internal/k8s/jobs_test.go
Normal file
@ -0,0 +1,213 @@
|
||||
package k8s
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"scm.bstein.dev/bstein/soteria/internal/api"
|
||||
"scm.bstein.dev/bstein/soteria/internal/config"
|
||||
|
||||
batchv1 "k8s.io/api/batch/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func TestJobNameSanitizesAndTruncates(t *testing.T) {
|
||||
name := jobName("backup", "PVC.With Spaces_and_symbols________________________________")
|
||||
if len(name) > 63 {
|
||||
t.Fatalf("expected kubernetes-safe name length, got %d for %q", len(name), name)
|
||||
}
|
||||
if strings.ContainsAny(name, " _.") {
|
||||
t.Fatalf("expected sanitized name, got %q", name)
|
||||
}
|
||||
if !strings.HasPrefix(name, "soteria-backup-") {
|
||||
t.Fatalf("expected soteria backup prefix, got %q", name)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHelperDefaultsAndParsers(t *testing.T) {
|
||||
if !dedupeEnabled(nil) {
|
||||
t.Fatalf("expected nil dedupe to default true")
|
||||
}
|
||||
falseValue := false
|
||||
if dedupeEnabled(&falseValue) {
|
||||
t.Fatalf("expected explicit false dedupe to remain false")
|
||||
}
|
||||
if keepLastWithDefault(nil) != 0 {
|
||||
t.Fatalf("expected nil keep_last to default to zero")
|
||||
}
|
||||
negative := -5
|
||||
if keepLastWithDefault(&negative) != 0 {
|
||||
t.Fatalf("expected negative keep_last to clamp to zero")
|
||||
}
|
||||
if !parseBoolWithDefault("yes", false) || parseBoolWithDefault("off", true) {
|
||||
t.Fatalf("unexpected bool parsing")
|
||||
}
|
||||
if parseIntWithDefault("12", 0) != 12 || parseIntWithDefault("-1", 7) != 7 || parseIntWithDefault("bad", 9) != 9 {
|
||||
t.Fatalf("unexpected int parsing")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRepositoryHelpers(t *testing.T) {
|
||||
base := "s3:https://b2.example.invalid/atlas"
|
||||
if repo := resticRepositoryForBackup(base, "apps", "data", true); repo != base {
|
||||
t.Fatalf("expected dedupe-enabled repository to stay shared, got %q", repo)
|
||||
}
|
||||
isolated := resticRepositoryForBackup(base, "Apps", "Data.Volume", false)
|
||||
if !strings.Contains(isolated, "/isolated/apps/data-volume") {
|
||||
t.Fatalf("expected isolated repository suffix, got %q", isolated)
|
||||
}
|
||||
if sanitizeRepositorySegment(" ") != "unknown" {
|
||||
t.Fatalf("expected blank repository segment to default to unknown")
|
||||
}
|
||||
if appended := appendRepositoryPath("https://b2.example.invalid/root/", "/child/"); appended != "https://b2.example.invalid/root/child" {
|
||||
t.Fatalf("unexpected appended repository path %q", appended)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildBackupJobIncludesResticMetadata(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
ResticImage: "restic/restic:test",
|
||||
ResticRepository: "s3:https://b2.example.invalid/atlas",
|
||||
ResticBackupArgs: []string{"--exclude", "/tmp"},
|
||||
ResticForgetArgs: []string{"--keep-last", "7"},
|
||||
S3Endpoint: "https://b2.example.invalid",
|
||||
S3Region: "us-west-000",
|
||||
JobTTLSeconds: 900,
|
||||
JobNodeSelector: map[string]string{"hardware": "rpi5"},
|
||||
WorkerServiceAccount: "soteria-worker",
|
||||
}
|
||||
req := api.BackupRequest{
|
||||
Namespace: "apps",
|
||||
PVC: "data",
|
||||
Tags: []string{"manual", "drill"},
|
||||
}
|
||||
|
||||
job := buildBackupJob(cfg, req, "backup-job", "restic-secret", cfg.ResticRepository, true, 3)
|
||||
|
||||
if job.Name != "backup-job" || job.Namespace != "apps" {
|
||||
t.Fatalf("unexpected job metadata: %#v", job.ObjectMeta)
|
||||
}
|
||||
if job.Labels[labelPVC] != "data" || job.Annotations[annotationKeepLast] != "3" {
|
||||
t.Fatalf("unexpected backup annotations/labels: %#v %#v", job.Labels, job.Annotations)
|
||||
}
|
||||
container := job.Spec.Template.Spec.Containers[0]
|
||||
if container.Image != "restic/restic:test" || container.Args[0] == "" {
|
||||
t.Fatalf("unexpected restic container: %#v", container)
|
||||
}
|
||||
if !strings.Contains(container.Args[0], "--tag pvc=data") || !strings.Contains(container.Args[0], "--exclude /tmp") {
|
||||
t.Fatalf("expected generated backup command to include request metadata, got %q", container.Args[0])
|
||||
}
|
||||
if job.Spec.Template.Spec.ServiceAccountName != "soteria-worker" {
|
||||
t.Fatalf("expected worker service account, got %#v", job.Spec.Template.Spec.ServiceAccountName)
|
||||
}
|
||||
if job.Spec.Template.Spec.NodeSelector["hardware"] != "rpi5" {
|
||||
t.Fatalf("expected node selector to be copied, got %#v", job.Spec.Template.Spec.NodeSelector)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildRestoreJobUsesTargetPVC(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
ResticImage: "restic/restic:test",
|
||||
ResticRepository: "s3:https://b2.example.invalid/atlas",
|
||||
JobTTLSeconds: 600,
|
||||
}
|
||||
req := api.RestoreTestRequest{
|
||||
Namespace: "apps",
|
||||
TargetPVC: "restore-data",
|
||||
}
|
||||
|
||||
job := buildRestoreJob(cfg, req, "restore-job", "restore-secret", "latest", cfg.ResticRepository)
|
||||
|
||||
if job.Labels[labelPVC] != "restore-data" {
|
||||
t.Fatalf("expected target pvc label, got %#v", job.Labels)
|
||||
}
|
||||
if claim := job.Spec.Template.Spec.Volumes[0].PersistentVolumeClaim; claim == nil || claim.ClaimName != "restore-data" {
|
||||
t.Fatalf("expected restore volume pvc claim, got %#v", job.Spec.Template.Spec.Volumes[0])
|
||||
}
|
||||
}
|
||||
|
||||
func TestGeneratedResticCommandsAndEnv(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
ResticRepository: "s3:https://b2.example.invalid/atlas",
|
||||
ResticBackupArgs: []string{"--exclude", "/cache"},
|
||||
S3Endpoint: "https://b2.example.invalid",
|
||||
S3Region: "us-west-000",
|
||||
}
|
||||
keepLast := 2
|
||||
command := backupCommand(cfg, api.BackupRequest{
|
||||
PVC: "data",
|
||||
Dedupe: boolPtr(false),
|
||||
KeepLast: &keepLast,
|
||||
Tags: []string{"nightly"},
|
||||
})
|
||||
if !strings.Contains(command, "restic init") || !strings.Contains(command, "--keep-last 2") || !strings.Contains(command, "dedupe=off") {
|
||||
t.Fatalf("unexpected backup command %q", command)
|
||||
}
|
||||
|
||||
restore := restoreCommand("latest")
|
||||
if !strings.Contains(restore, "restic restore latest") || !strings.Contains(restore, "/restore/") {
|
||||
t.Fatalf("unexpected restore command %q", restore)
|
||||
}
|
||||
|
||||
env := resticEnv(cfg, "restic-secret", "")
|
||||
values := map[string]string{}
|
||||
for _, item := range env {
|
||||
values[item.Name] = item.Value
|
||||
}
|
||||
if values["RESTIC_REPOSITORY"] != cfg.ResticRepository || values["AWS_REGION"] != "us-west-000" {
|
||||
t.Fatalf("unexpected env values %#v", values)
|
||||
}
|
||||
if int32Ptr(7) == nil || *int32Ptr(7) != 7 {
|
||||
t.Fatalf("expected int32 pointer helper to round-trip")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSummarizeAndSortBackupJobs(t *testing.T) {
|
||||
now := time.Now().UTC()
|
||||
completed := batchv1.Job{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "job-complete",
|
||||
Namespace: "apps",
|
||||
CreationTimestamp: metav1.NewTime(now.Add(-2 * time.Hour)),
|
||||
Annotations: map[string]string{
|
||||
annotationResticRepository: "s3:https://b2.example.invalid/atlas",
|
||||
annotationDedupeEnabled: "false",
|
||||
annotationKeepLast: "5",
|
||||
},
|
||||
},
|
||||
Status: batchv1.JobStatus{
|
||||
Succeeded: 1,
|
||||
CompletionTime: &metav1.Time{Time: now.Add(-time.Hour)},
|
||||
},
|
||||
}
|
||||
running := batchv1.Job{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "job-running",
|
||||
Namespace: "apps",
|
||||
CreationTimestamp: metav1.NewTime(now.Add(-30 * time.Minute)),
|
||||
},
|
||||
Status: batchv1.JobStatus{
|
||||
Active: 1,
|
||||
},
|
||||
}
|
||||
|
||||
completedSummary := summarizeBackupJob(completed, "data")
|
||||
if completedSummary.State != "Completed" || completedSummary.DedupeEnabled || completedSummary.KeepLast != 5 {
|
||||
t.Fatalf("unexpected completed summary %#v", completedSummary)
|
||||
}
|
||||
runningSummary := summarizeBackupJob(running, "data")
|
||||
if runningSummary.State != "Running" {
|
||||
t.Fatalf("unexpected running summary %#v", runningSummary)
|
||||
}
|
||||
|
||||
items := []BackupJobSummary{completedSummary, runningSummary}
|
||||
sortBackupJobSummaries(items)
|
||||
if items[0].Name != "job-running" {
|
||||
t.Fatalf("expected newer running job first, got %#v", items)
|
||||
}
|
||||
}
|
||||
|
||||
func boolPtr(value bool) *bool {
|
||||
return &value
|
||||
}
|
||||
@ -321,6 +321,179 @@ func TestStartSeedsInitialBackgroundState(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestQueryBoolParsesTruthyValues(t *testing.T) {
|
||||
if !queryBool("true") || !queryBool(" yes ") || !queryBool("1") || !queryBool("ON") {
|
||||
t.Fatalf("expected truthy values to parse as true")
|
||||
}
|
||||
if queryBool("false") || queryBool("") || queryBool("0") {
|
||||
t.Fatalf("expected falsey values to parse as false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandleB2UsageRejectsUnsupportedMethod(t *testing.T) {
|
||||
srv := &Server{cfg: &config.Config{}, metrics: newTelemetry()}
|
||||
srv.handler = http.HandlerFunc(srv.route)
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/v1/b2", nil)
|
||||
res := httptest.NewRecorder()
|
||||
srv.Handler().ServeHTTP(res, req)
|
||||
|
||||
if res.Code != http.StatusMethodNotAllowed {
|
||||
t.Fatalf("expected 405, got %d: %s", res.Code, res.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestHandleB2UsageReturnsCachedSnapshot(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{B2Enabled: false},
|
||||
metrics: newTelemetry(),
|
||||
b2Usage: api.B2UsageResponse{Enabled: false, Endpoint: "cached-endpoint"},
|
||||
}
|
||||
srv.handler = http.HandlerFunc(srv.route)
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "/v1/b2", nil)
|
||||
res := httptest.NewRecorder()
|
||||
srv.Handler().ServeHTTP(res, req)
|
||||
|
||||
if res.Code != http.StatusOK {
|
||||
t.Fatalf("expected 200, got %d: %s", res.Code, res.Body.String())
|
||||
}
|
||||
|
||||
var payload api.B2UsageResponse
|
||||
if err := json.Unmarshal(res.Body.Bytes(), &payload); err != nil {
|
||||
t.Fatalf("decode b2 response: %v", err)
|
||||
}
|
||||
if payload.Endpoint != "cached-endpoint" {
|
||||
t.Fatalf("expected cached snapshot, got %#v", payload)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRefreshB2UsageDisabledStoresDisabledSnapshot(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{B2Enabled: false},
|
||||
metrics: newTelemetry(),
|
||||
}
|
||||
|
||||
srv.refreshB2Usage(context.Background())
|
||||
|
||||
if usage := srv.getB2Usage(); usage.Enabled {
|
||||
t.Fatalf("expected disabled usage snapshot, got %#v", usage)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveB2CredentialsFromConfigValues(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{
|
||||
B2Endpoint: "https://s3.us-west-000.backblazeb2.com",
|
||||
B2Region: "us-west-000",
|
||||
B2AccessKeyID: "abc",
|
||||
B2SecretAccessKey: "def",
|
||||
},
|
||||
client: &fakeKubeClient{},
|
||||
}
|
||||
|
||||
creds, err := srv.resolveB2Credentials(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("resolve b2 credentials: %v", err)
|
||||
}
|
||||
if creds.Endpoint != "https://s3.us-west-000.backblazeb2.com" || creds.Region != "us-west-000" {
|
||||
t.Fatalf("unexpected endpoint/region: %#v", creds)
|
||||
}
|
||||
if creds.AccessKeyID != "abc" || creds.SecretAccessKey != "def" {
|
||||
t.Fatalf("unexpected keys: %#v", creds)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveB2CredentialsLoadsSecretValues(t *testing.T) {
|
||||
kube := &fakeKubeClient{
|
||||
secretData: map[string][]byte{
|
||||
"AWS_ACCESS_KEY_ID": []byte("abc"),
|
||||
"AWS_SECRET_ACCESS_KEY": []byte("def"),
|
||||
"AWS_ENDPOINT": []byte("https://s3.us-west-123.backblazeb2.com"),
|
||||
},
|
||||
}
|
||||
srv := &Server{
|
||||
cfg: &config.Config{
|
||||
Namespace: "atlas",
|
||||
B2SecretNamespace: "atlas",
|
||||
B2SecretName: "b2-creds",
|
||||
B2AccessKeyField: "AWS_ACCESS_KEY_ID",
|
||||
B2SecretKeyField: "AWS_SECRET_ACCESS_KEY",
|
||||
B2EndpointField: "AWS_ENDPOINT",
|
||||
},
|
||||
client: kube,
|
||||
}
|
||||
|
||||
creds, err := srv.resolveB2Credentials(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("resolve b2 credentials from secret: %v", err)
|
||||
}
|
||||
if creds.Region != "us-west-123" {
|
||||
t.Fatalf("expected inferred region, got %#v", creds)
|
||||
}
|
||||
if creds.AccessKeyID != "abc" || creds.SecretAccessKey != "def" {
|
||||
t.Fatalf("unexpected secret credentials: %#v", creds)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveB2CredentialsRejectsMissingValues(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{},
|
||||
client: &fakeKubeClient{},
|
||||
}
|
||||
|
||||
if _, err := srv.resolveB2Credentials(context.Background()); err == nil || !strings.Contains(err.Error(), "B2 endpoint is not configured") {
|
||||
t.Fatalf("expected missing endpoint error, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadB2SecretValueValidatesInputs(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{
|
||||
B2SecretNamespace: "atlas",
|
||||
B2SecretName: "b2-creds",
|
||||
},
|
||||
client: &fakeKubeClient{},
|
||||
}
|
||||
|
||||
if _, err := srv.loadB2SecretValue(context.Background(), " "); err == nil || !strings.Contains(err.Error(), "empty") {
|
||||
t.Fatalf("expected empty key error, got %v", err)
|
||||
}
|
||||
if _, err := srv.loadB2SecretValue(context.Background(), "AWS_ACCESS_KEY_ID"); err == nil || !strings.Contains(err.Error(), "is empty") {
|
||||
t.Fatalf("expected empty secret value error, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeS3Endpoint(t *testing.T) {
|
||||
host, secure, err := normalizeS3Endpoint("https://s3.us-west-000.backblazeb2.com")
|
||||
if err != nil || host != "s3.us-west-000.backblazeb2.com" || !secure {
|
||||
t.Fatalf("unexpected https endpoint parse: %q %v %v", host, secure, err)
|
||||
}
|
||||
host, secure, err = normalizeS3Endpoint("http://minio.internal:9000")
|
||||
if err != nil || host != "minio.internal:9000" || secure {
|
||||
t.Fatalf("unexpected http endpoint parse: %q %v %v", host, secure, err)
|
||||
}
|
||||
host, secure, err = normalizeS3Endpoint("minio.internal:9000/")
|
||||
if err != nil || host != "minio.internal:9000" || !secure {
|
||||
t.Fatalf("unexpected bare endpoint parse: %q %v %v", host, secure, err)
|
||||
}
|
||||
if _, _, err := normalizeS3Endpoint(""); err == nil {
|
||||
t.Fatalf("expected empty endpoint error")
|
||||
}
|
||||
if _, _, err := normalizeS3Endpoint("https://"); err == nil {
|
||||
t.Fatalf("expected missing host error")
|
||||
}
|
||||
}
|
||||
|
||||
func TestInferB2RegionFallsBackWhenNeeded(t *testing.T) {
|
||||
if region := inferB2Region("https://s3.us-west-009.backblazeb2.com", "fallback"); region != "us-west-009" {
|
||||
t.Fatalf("expected inferred region, got %q", region)
|
||||
}
|
||||
if region := inferB2Region("http://minio.internal:9000", "fallback"); region != "fallback" {
|
||||
t.Fatalf("expected fallback region, got %q", region)
|
||||
}
|
||||
}
|
||||
|
||||
func TestProtectedInventoryRequiresAuth(t *testing.T) {
|
||||
srv := &Server{
|
||||
cfg: &config.Config{AuthRequired: true, AllowedGroups: []string{"admin", "maintenance"}, BackupDriver: "longhorn"},
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user