261 lines
9.9 KiB
Go
261 lines
9.9 KiB
Go
package updateagent
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"sync/atomic"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo"
|
|
)
|
|
|
|
type roundTripFunc func(*http.Request) (*http.Response, error)
|
|
|
|
func (f roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
|
|
return f(request)
|
|
}
|
|
|
|
func TestValidateUpdateCompatibilityAllowsDirectMajorJump(t *testing.T) {
|
|
t.Parallel()
|
|
current := compatibleImage("v1.4.0", "v1.4.0")
|
|
target := compatibleImage("v2.0.0", "v1.4.0")
|
|
if err := validateUpdateCompatibility("v1.4.0", "v2.0.0", current, target); err != nil {
|
|
t.Fatalf("compatible direct update was rejected: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestWaitForDockerAPIRetriesBootTransient(t *testing.T) {
|
|
t.Parallel()
|
|
var calls atomic.Int32
|
|
err := waitForDockerAPI(context.Background(), 100*time.Millisecond, time.Millisecond, func(context.Context) error {
|
|
if calls.Add(1) < 3 {
|
|
return errors.New("Docker is still starting")
|
|
}
|
|
return nil
|
|
})
|
|
if err != nil || calls.Load() != 3 {
|
|
t.Fatalf("Docker boot transient was not retried: calls=%d err=%v", calls.Load(), err)
|
|
}
|
|
}
|
|
|
|
func TestWaitCurrentHealthyAllowsStartingButRejectsUnhealthy(t *testing.T) {
|
|
t.Parallel()
|
|
var calls atomic.Int32
|
|
client := dockerTestClient(func() string {
|
|
if calls.Add(1) == 1 {
|
|
return "starting"
|
|
}
|
|
return "healthy"
|
|
})
|
|
inspected, err := client.waitCurrentHealthy(context.Background(), "container-id", "sha256:current", 100*time.Millisecond, time.Millisecond)
|
|
if err != nil || inspected.State.Health == nil || inspected.State.Health.Status != "healthy" {
|
|
t.Fatalf("starting container did not become eligible: inspect=%#v err=%v", inspected, err)
|
|
}
|
|
|
|
unhealthy := dockerTestClient(func() string { return "unhealthy" })
|
|
if _, err := unhealthy.waitCurrentHealthy(context.Background(), "container-id", "sha256:current", 100*time.Millisecond, time.Millisecond); err == nil || !strings.Contains(err.Error(), "unhealthy") {
|
|
t.Fatalf("unhealthy container was not rejected immediately: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestResolveCurrentVersionRequiresRuntimeAndImageMetadataToAgree(t *testing.T) {
|
|
t.Parallel()
|
|
config := json.RawMessage(`{"Image":"registry.example/app:v1.4.0","Labels":{"org.opencontainers.image.version":"v1.4.0"}}`)
|
|
version, err := resolveCurrentVersion("", config, "registry.example/app")
|
|
if err != nil || version != "v1.4.0" {
|
|
t.Fatalf("exact image version was not resolved: version=%q err=%v", version, err)
|
|
}
|
|
if _, err := resolveCurrentVersion("v1.5.0", config, "registry.example/app"); err == nil {
|
|
t.Fatal("untrusted reported version overrode the running image metadata")
|
|
}
|
|
mismatch := json.RawMessage(`{"Image":"registry.example/app:v1.4.0","Labels":{"org.opencontainers.image.version":"v1.3.0"}}`)
|
|
if _, err := resolveCurrentVersion("", mismatch, "registry.example/app"); err == nil {
|
|
t.Fatal("mismatching image reference and label were accepted")
|
|
}
|
|
}
|
|
|
|
func TestValidateUpdateCompatibilityRejectsUnsupportedJump(t *testing.T) {
|
|
t.Parallel()
|
|
tests := []struct {
|
|
name string
|
|
mutate func(map[string]any)
|
|
}{
|
|
{name: "minimum version", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelMinimumVersion] = "v1.5.0" }},
|
|
{name: "runtime contract", mutate: func(config map[string]any) {
|
|
config["Labels"].(map[string]string)[labelRuntimeContract] = strconv.Itoa(buildinfo.RuntimeContractVersion + 1)
|
|
}},
|
|
{name: "database contract", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelDatabaseContract] = "2" }},
|
|
{name: "agent protocol", mutate: func(config map[string]any) {
|
|
config["Labels"].(map[string]string)[labelMinimumAgent] = strconv.Itoa(buildinfo.UpdateProtocolVersion + 1)
|
|
}},
|
|
{name: "wrong image version", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelImageVersion] = "v1.9.9" }},
|
|
{name: "missing healthcheck", mutate: func(config map[string]any) { delete(config, "Healthcheck") }},
|
|
}
|
|
for _, test := range tests {
|
|
test := test
|
|
t.Run(test.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
image := compatibleImage("v2.0.0", "v1.4.0")
|
|
var config map[string]any
|
|
if err := json.Unmarshal(image.Config, &config); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
labels := make(map[string]string)
|
|
for key, value := range config["Labels"].(map[string]any) {
|
|
labels[key] = value.(string)
|
|
}
|
|
config["Labels"] = labels
|
|
test.mutate(config)
|
|
image.Config, _ = json.Marshal(config)
|
|
if err := validateUpdateCompatibility("v1.4.0", "v2.0.0", compatibleImage("v1.4.0", "v1.4.0"), image); err == nil {
|
|
t.Fatal("incompatible image was accepted")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateUpdateCompatibilityRejectsSchemaRegressionAfterEarlierSkip(t *testing.T) {
|
|
t.Parallel()
|
|
current := compatibleImage("v2.0.0", "v1.4.0")
|
|
target := compatibleImage("v2.1.0", "v1.4.0")
|
|
current.Config = withImageLabel(t, current.Config, labelSchemaVersion, "20")
|
|
target.Config = withImageLabel(t, target.Config, labelSchemaVersion, "19")
|
|
if err := validateUpdateCompatibility("v2.0.0", "v2.1.0", current, target); err == nil {
|
|
t.Fatal("target with an older schema contract was accepted")
|
|
}
|
|
}
|
|
|
|
func TestBuildReplacementConfigUsesNewImageDefaultsAndKeepsDeploymentOverrides(t *testing.T) {
|
|
t.Parallel()
|
|
oldImage := json.RawMessage(`{
|
|
"User":"dyndns:dyndns",
|
|
"Entrypoint":["/old-entrypoint"],
|
|
"WorkingDir":"/data",
|
|
"Env":["PATH=/old","OLD_DEFAULT=1"],
|
|
"Labels":{"org.opencontainers.image.version":"v1.3.0","image-owned":"old"},
|
|
"ExposedPorts":{"8080/tcp":{}},
|
|
"Volumes":{"/data":{}}
|
|
}`)
|
|
targetImage := json.RawMessage(`{
|
|
"User":"dyndns:dyndns",
|
|
"Entrypoint":["/new-entrypoint"],
|
|
"WorkingDir":"/data",
|
|
"Env":["PATH=/new","NEW_DEFAULT=1"],
|
|
"Labels":{"org.opencontainers.image.version":"v2.0.0","image-owned":"new"},
|
|
"ExposedPorts":{"8080/tcp":{}},
|
|
"Volumes":{"/data":{}}
|
|
}`)
|
|
container := containerInspect{
|
|
ID: "0123456789abcdef",
|
|
Config: json.RawMessage(`{
|
|
"Hostname":"0123456789ab",
|
|
"User":"dyndns:dyndns",
|
|
"Entrypoint":["/old-entrypoint"],
|
|
"WorkingDir":"/data",
|
|
"Env":["PATH=/old","OLD_DEFAULT=1","CUSTOM=yes"],
|
|
"Labels":{"org.opencontainers.image.version":"v0.0.0","image-owned":"old","com.docker.compose.project":"domain-control","de.j-mahler.domain-control.role":"app"},
|
|
"ExposedPorts":{"8080/tcp":{},"9091/tcp":{}},
|
|
"Volumes":{"/data":{},"/custom":{}}
|
|
}`),
|
|
}
|
|
config, err := buildReplacementConfig(container, oldImage, targetImage, "registry.example/app:v2.0.0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, exists := config["Hostname"]; exists {
|
|
t.Fatal("generated container hostname was copied")
|
|
}
|
|
var image, user string
|
|
var entrypoint, environment []string
|
|
var labels map[string]string
|
|
var ports, volumes map[string]any
|
|
_ = json.Unmarshal(config["Image"], &image)
|
|
_ = json.Unmarshal(config["User"], &user)
|
|
_ = json.Unmarshal(config["Entrypoint"], &entrypoint)
|
|
_ = json.Unmarshal(config["Env"], &environment)
|
|
_ = json.Unmarshal(config["Labels"], &labels)
|
|
_ = json.Unmarshal(config["ExposedPorts"], &ports)
|
|
_ = json.Unmarshal(config["Volumes"], &volumes)
|
|
if image != "registry.example/app:v2.0.0" || user != runtimeUser || len(entrypoint) != 1 || entrypoint[0] != "/new-entrypoint" {
|
|
t.Fatalf("new image defaults were not retained: image=%q user=%q entrypoint=%v", image, user, entrypoint)
|
|
}
|
|
if !contains(environment, "PATH=/new") || !contains(environment, "NEW_DEFAULT=1") || !contains(environment, "CUSTOM=yes") || contains(environment, "OLD_DEFAULT=1") {
|
|
t.Fatalf("environment was merged incorrectly: %v", environment)
|
|
}
|
|
if labels[labelImageVersion] != "v2.0.0" || labels["image-owned"] != "new" || labels["com.docker.compose.project"] != "domain-control" || labels["de.j-mahler.domain-control.role"] != "app" {
|
|
t.Fatalf("labels were merged incorrectly: %#v", labels)
|
|
}
|
|
if _, exists := ports["9091/tcp"]; !exists {
|
|
t.Fatalf("custom exposed port was lost: %#v", ports)
|
|
}
|
|
if _, exists := volumes["/custom"]; !exists {
|
|
t.Fatalf("custom volume was lost: %#v", volumes)
|
|
}
|
|
}
|
|
|
|
func compatibleImage(version, minimum string) imageInspect {
|
|
config := map[string]any{
|
|
"User": runtimeUser,
|
|
"Entrypoint": []string{runtimeEntrypoint},
|
|
"Cmd": []string{runtimeCommand},
|
|
"WorkingDir": runtimeWorkingDirectory,
|
|
"ExposedPorts": map[string]any{
|
|
"8080/tcp": map[string]any{},
|
|
},
|
|
"Healthcheck": map[string]any{
|
|
"Test": []string{"CMD", runtimeEntrypoint, "healthcheck"},
|
|
},
|
|
"Labels": map[string]string{
|
|
labelImageVersion: version,
|
|
labelMinimumVersion: minimum,
|
|
labelMinimumAgent: strconv.Itoa(buildinfo.MinimumAgentProtocol),
|
|
labelRuntimeContract: strconv.Itoa(buildinfo.RuntimeContractVersion),
|
|
labelDatabaseContract: strconv.Itoa(buildinfo.DatabaseContractVersion),
|
|
labelSchemaVersion: strconv.Itoa(buildinfo.CurrentSchemaVersion),
|
|
},
|
|
}
|
|
encoded, _ := json.Marshal(config)
|
|
return imageInspect{ID: "sha256:target", Config: encoded}
|
|
}
|
|
|
|
func withImageLabel(t *testing.T, raw json.RawMessage, key, value string) json.RawMessage {
|
|
t.Helper()
|
|
var config map[string]any
|
|
if err := json.Unmarshal(raw, &config); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
labels, ok := config["Labels"].(map[string]any)
|
|
if !ok {
|
|
t.Fatal("image labels are missing")
|
|
}
|
|
labels[key] = value
|
|
encoded, err := json.Marshal(config)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return encoded
|
|
}
|
|
|
|
func contains(values []string, expected string) bool {
|
|
for _, value := range values {
|
|
if value == expected {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func dockerTestClient(health func() string) *dockerClient {
|
|
transport := roundTripFunc(func(*http.Request) (*http.Response, error) {
|
|
body := `{"Id":"container-id","Image":"sha256:current","Config":{"Labels":{}},"State":{"Running":true,"ExitCode":0,"Health":{"Status":"` + health() + `"}}}`
|
|
return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body))}, nil
|
|
})
|
|
return &dockerClient{client: &http.Client{Transport: transport}, apiPrefix: "/v1.0"}
|
|
}
|