Jean-Gabriel Gill-Couture
99bdc0cb38
AuthMode::Callout now deploys the production auth fabric from the same Scores fleet_staging_install uses: Zitadel (stable namespace, groups-claim Action, roles-as-groups) + FleetNatsScore::callout + NatsAuthCalloutScore + OpenBao with JWT auth bound to the live issuer. VM devices enroll as Zitadel machine users (username = device id) and authenticate everywhere with that one identity. Issuer plumbing: http://sso.fleet-e2e.local:30424 resolves from the host (k3d port mapping + Host header), in-cluster (CoreDNS rewrite to a zitadel-e2e NodePort Service whose port equals the nodePort), and VMs (/etc/hosts → libvirt gateway). 8080 was rejected — dev hosts commonly occupy it. Also: Stack::connect_admin for per-test NATS connections (the shared client's driver dies with the bring-up test's runtime), callout image joins the generic image builder, harness pins HARMONY_SECRET_STORE=file + a namespace so credential-persisting Scores work unconfigured, port-mapping preflight with an actionable delete-and-recreate error.
79 lines
2.2 KiB
TOML
79 lines
2.2 KiB
TOML
[package]
|
|
name = "harmony-fleet-e2e"
|
|
edition = "2024"
|
|
version.workspace = true
|
|
license.workspace = true
|
|
description = "In-cluster e2e harness for the fleet stack: brings up NATS + agent (and later: callout + operator + mock-OIDC) in a fresh k3d namespace per test run."
|
|
|
|
# Library + integration tests. No bin. Consumers are the integration
|
|
# tests in `tests/` plus future callers (the slimmed-down fleet_e2e_demo).
|
|
[lib]
|
|
path = "src/lib.rs"
|
|
|
|
[[test]]
|
|
name = "ping"
|
|
path = "tests/ping.rs"
|
|
|
|
[[test]]
|
|
name = "operator"
|
|
path = "tests/operator.rs"
|
|
|
|
[[test]]
|
|
name = "openbao_policy"
|
|
path = "tests/openbao_policy.rs"
|
|
|
|
[[test]]
|
|
name = "openbao_groups"
|
|
path = "tests/openbao_groups.rs"
|
|
|
|
[[test]]
|
|
name = "vm_ping"
|
|
path = "tests/vm_ping.rs"
|
|
|
|
[[test]]
|
|
name = "vm_isolation"
|
|
path = "tests/vm_isolation.rs"
|
|
|
|
[[test]]
|
|
name = "vm_deploy_lifecycle"
|
|
path = "tests/vm_deploy_lifecycle.rs"
|
|
|
|
[[test]]
|
|
name = "vm_secret_access"
|
|
path = "tests/vm_secret_access.rs"
|
|
|
|
[dependencies]
|
|
# `kvm` for the VM-side harness (ProvisionVmScore + KvmVirtualMachineHost),
|
|
# `podman` for `ReconcileScore`/`PodmanV0Score` the kv_admin helpers
|
|
# serialize into the desired-state bucket.
|
|
harmony = { path = "../../harmony", features = ["kvm", "podman"] }
|
|
harmony-fleet-auth = { path = "../harmony-fleet-auth" }
|
|
harmony-fleet-deploy = { path = "../harmony-fleet-deploy" }
|
|
harmony-fleet-operator = { path = "../harmony-fleet-operator" }
|
|
harmony-reconciler-contracts = { path = "../../harmony-reconciler-contracts" }
|
|
harmony-k8s = { path = "../../harmony-k8s" }
|
|
harmony_types = { path = "../../harmony_types" }
|
|
k3d-rs = { path = "../../k3d" }
|
|
|
|
anyhow = { workspace = true }
|
|
async-nats = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
futures-util = { workspace = true }
|
|
k8s-openapi = { workspace = true }
|
|
kube = { workspace = true, features = ["runtime", "derive"] }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tempfile = "3"
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["full"] }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
directories = "6.0.0"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
jsonwebtoken = "9"
|
|
nkeys = "0.4"
|
|
reqwest = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["full"] }
|