titan/metis
3
0
Fork 0
Code Issues 383 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

test: verify recovered image markers cannot skip credentials
All checks were successful
Tests / Declarative: Post Actions passed: 314
Details

Browse Source
This commit is contained in:
codex 2026-10-04 00:29:37 -05:00
parent 1c110c930c
commit 62131596fc
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/plan/node_identity_boot_test.go
View File

@ -72,6 +72,22 @@ func TestIdentityFailureAndRetry(t *testing.T) {
if err := run("1"); err != nil { if err := run("1"); err != nil {
t.Fatal("completed setup should not reset passwords", err) t.Fatal("completed setup should not reset passwords", err)
} }
// Re-injection into a previously booted image must not trust its old marker.
if err := os.WriteFile(filepath.Join(etc, "node-identity.pending"), []byte("pending"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(envPath, []byte(synthetic), 0600); err != nil {
t.Fatal(err)
}
if run("1") == nil {
t.Fatal("old marker suppressed newly injected credentials")
}
if err := run("0"); err != nil {
t.Fatal(err)
}
if _, err := os.Stat(filepath.Join(etc, "node-identity.pending")); !os.IsNotExist(err) {
t.Fatal("successful identity left a pending marker")
}
} }
func TestIdentityEnabledWithoutCloudInit(t *testing.T) { func TestIdentityEnabledWithoutCloudInit(t *testing.T) {