Add unified-snapshots e2e: SDK write-path and delete-protection - #55
Closed
kneumoin wants to merge 1 commit into
Closed
Add unified-snapshots e2e: SDK write-path and delete-protection#55kneumoin wants to merge 1 commit into
kneumoin wants to merge 1 commit into
Conversation
New self-contained suite (tests/unified-snapshots) that validates the unified snapshot SDK write-path and the delete-protection guard against a live cluster, using the reference demo domain controllers (DemoVirtualDisk / DemoVirtualMachine). What it verifies: - Readiness: a leaf VirtualDisk snapshot and a VirtualMachine tree snapshot both reach Ready, exercising the SDK capture phases (Planning -> Planned -> Finished) and the SnapshotContent -> Snapshot Ready mirror. - Marker write-path: the delete-protected marker (state-snapshotter.deckhouse.io/delete-protected=true) is stamped on every system-created child domain snapshot and on every SnapshotContent, but never on the user-created root snapshots. - Break-glass: with deckhouse.io/allow-delete=true a protected SnapshotContent can be deleted while the marker itself stays in place. - Delete guard (enforcement=Deny, gated by E2E_DELETE_GUARD=true): a direct DELETE of a protected object is denied, and removing/mutating the marker via UPDATE is denied. Under the default Audit,Warn this spec is skipped. - Cascade: deleting the unmarked user roots tears down the whole tree with no finalizer hang. Runner notes: - Connects either through the storage-e2e SSH framework or, when SNAP_KUBECONFIG is set, directly to an already-reachable cluster (e.g. a persistent local tunnel) with no SSH. - API coordinates and storage class are overridable (SNAP_DEMO_GROUP, SNAP_STORAGE_CLASS, ...) so the suite can target either demo controller group. - The deny assertion is pinned to the delete-guard policy by name and accepts both Forbidden and Invalid, since a VAP validation without an explicit reason surfaces the denial as HTTP 422 Invalid.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New self-contained suite (tests/unified-snapshots) that validates the unified snapshot SDK write-path and the delete-protection guard against a live cluster, using the reference demo domain controllers (DemoVirtualDisk / DemoVirtualMachine).
What it verifies:
Runner notes: