Repository navigation
test: full-path go-inventory e2e in kind (ADR 0010) - #24
Merged
Merged
Conversation
…pool (ADR 0010) Asserts the whole node→controller inventory path against a real cluster: a known Go workload (a Deployment) runs, the node DaemonSet scans it and ships the fact to the controller over HTTP with a projected controller-audience token, the controller validates the token locally against the cluster JWKS, joins the fact against its workload inventory, and writes a go_inventory payload to its spool. The test asserts on the spool contents — the payload the backend would receive, not logs (docs/development.md): the sample's module path, a go1.x version, a sha256 image digest, pgo=false, container and workload resolved. - deploy/controller.yaml: the controller's raw manifest for this path — read RBAC (security.md §4) plus the read-only JWKS-discovery nonResourceURL grant (no TokenReview, no write verb), the node-intake Service, ConfigMap, and an emptyDir spool. Scoped to the inventory path; backend enrollment/identity is a later slice. - test/e2e/inventory_test.go: deploys the sample, the controller (with a shell sidecar sharing the spool volume, since the agent image is distroless), and the node DaemonSet pointed at the controller Service; reads the payload via exec in the sidecar. Cluster-scoped RBAC objects are per-run named and cleaned up. - deployNodeDaemonSet gains a controller-endpoint parameter; clusterClient is refactored to expose the REST config for exec. New `make inventory-e2e` target (loads a busybox sidecar image). go.mod gains the remotecommand transitive deps, used only under the e2e build tag. Ran locally against kind: inventory-e2e, node-e2e, and the non-image e2e suite all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Slice 4 (final): asserts the whole node→controller inventory path against a real kind cluster.
A known Go workload (a Deployment) runs → the node DaemonSet scans it and ships the fact to the controller over HTTP with a projected controller-audience token → the controller validates the token locally against the cluster JWKS → joins the fact against its workload inventory → writes a
go_inventorypayload to its spool. The test asserts on the spool contents — the payload the backend would receive, not logs (perdevelopment.md): the sample's module path, ago1.xversion, asha256:image digest,pgo=false, and the resolved container + workload (Deployment/goworkload).Contents
deploy/controller.yaml— the controller's raw manifest for this path: read RBAC (security.md §4) + the read-only JWKS-discovery nonResourceURL grant (noTokenReview, no write verb), the node-intake Service, ConfigMap, and an emptyDir spool. Scoped to the inventory path; backend enrollment/identity is a later slice.test/e2e/inventory_test.go— deploys sample + controller (with a busybox sidecar sharing the spool volume, since the agent image is distroless — no shell tocatwith) + node DaemonSet pointed at the controller Service; reads the payload viaexecin the sidecar. Cluster-scoped RBAC objects are per-run named and cleaned up.deployNodeDaemonSetgains a controller-endpoint parameter;clusterClientrefactored to expose the REST config forexec. Newmake inventory-e2etarget (loads the busybox sidecar image).go.modgains theremotecommandtransitive deps, used only under thee2ebuild tag.Verified locally against kind
make inventory-e2e→ PASS (67s): full path, correct payload fields.make node-e2e→ PASS (refactor intact).make e2e(pods/nodes/oom/usage/filter) → PASS (container-index change intact).This completes the ADR 0010 feature: ADR (#20) → nodeauth (#21) → transport (#22) → join+payload (#23) → this e2e.
🤖 Generated with Claude Code