test: add ShellSpec coverage for init-aks-custom-cloud*.sh#8692
Open
Devinwong wants to merge 2 commits into
Open
test: add ShellSpec coverage for init-aks-custom-cloud*.sh#8692Devinwong wants to merge 2 commits into
Devinwong wants to merge 2 commits into
Conversation
Anchored on IcM 725845756 (Bleu, Dec 2025–Jan 2026): an unreachable repo
URL baked into the VHD caused tdnf to hang during AzSecPack install, which
exhausted CRP's extension budget and stuck cluster upgrades in "Creating".
The fix landed in VHD 202601.07, but no test exercises the
init-aks-custom-cloud*.sh scripts that rewrite repo URLs at boot — so a
similar misconfiguration would slip through public-cloud e2e again.
Refactor all 4 init-aks-custom-cloud*.sh scripts to be testable:
- Lift hardcoded paths (apt sources, yum.repos.d, ssl certs, chrony,
wireserver) into `: "\"` env-overridable constants.
- Add `\` guard so ShellSpec can `Include` them
without running `main` at source time.
- Wrap the existing inline logic into named functions (detect_distro,
fetch_and_install_ca_certs, init_*_repo_depot, write_chrony_config, etc.)
so individual flows can be exercised in isolation.
Behavior is preserved — main() invokes the same functions in the same
order with the same arguments as the originals.
Add ShellSpec tests asserting, for both the `operation-requests` variants
(used in Bleu / public custom clouds) and the originals (USSecCloud /
USNatCloud):
- All rewritten repo files point at a mocked REPO_DEPOT_ENDPOINT.
- No leftover packages.microsoft.com URLs remain.
- No third-party (e.g. developer.download.nvidia.com) URLs leak in.
- Existing /etc/apt/sources.list[.d] entries are backed up, not left in
place.
- `init_repo_depot` correctly strips the trailing `/ubuntu` suffix and
dispatches Mariner vs AzureLinux vs Ubuntu/Flatcar/ACL flows.
20 new ShellSpec examples across 4 spec files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Devinwong
requested review from
AbelHu,
SriHarsha001,
awesomenix,
calvin197,
cameronmeissner,
djsly,
ganeshkumarashok,
lilypan26,
mxj220,
pdamianov-dev,
phealy,
r2k1,
runzhen,
sulixu,
surajssd,
timmy-wright and
zachary-bailey
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens custom-cloud bootstrap reliability by refactoring the init-aks-custom-cloud*.sh repo-depot rewrite scripts to be sourceable/testable and adding ShellSpec coverage to prevent regressions like the IcM 725845756 “stale repo URL → package manager hang” incident.
Changes:
- Refactors the 4
init-aks-custom-cloud*.shscripts into function-oriented, env-overridable implementations and adds a${__SOURCED__:+return}guard to support ShellSpecInclude. - Adds 4 new ShellSpec files (≈20 examples) asserting repo rewrite invariants (no upstream PMC/Ubuntu/NVIDIA URLs leaking; backup behavior; correct repo-depot dispatch).
- Adds focused dispatch tests for Mariner vs AzureLinux handling (including stripping trailing
/ubuntufromREPO_DEPOT_ENDPOINT).
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh | Adds Ubuntu/Flatcar/ACL coverage for init-aks-custom-cloud.sh repo rewrite + backups + URL checks. |
| spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_operation_requests_spec.sh | Adds Ubuntu/Flatcar/ACL coverage for operation-requests variant used by Bleu-like clouds. |
| spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_mariner_spec.sh | Adds Mariner/AzureLinux coverage for depot rewrite + dispatch behavior. |
| spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_operation_requests_mariner_spec.sh | Adds Mariner/AzureLinux coverage for operation-requests variant + dispatch behavior. |
| parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh | Refactors into testable functions; introduces env-overridable paths; preserves main execution via main(). |
| parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests.sh | Same refactor pattern for operation-requests Ubuntu/Flatcar/ACL variant. |
| parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh | Same refactor pattern for Mariner/AzureLinux variant; keeps repo rewrite + chrony config behavior. |
| parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests-mariner.sh | Same refactor pattern for operation-requests Mariner/AzureLinux variant. |
…ustom-cloud scripts
- Guard top-level 'set -x' with ${__SOURCED__} so ShellSpec Include does not
emit trace to stderr (was causing the shellspec CI job to abort with exit 102).
- Drop the misleading 'echo "distribution is $distribution"' line ($distribution
was never set); 'Running on $NAME' already logs the detected distro. Addresses
the 4 Copilot review comments.
- Capture the functions' progress output in the 17 affected examples via
'The output should be present', clearing the unhandled-stdout warnings.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🕵️ AgentBaker Linux Gate Detective — PR gate failure analysis
RCA (3-level)
Classification
Recommendation / owner
Posted by Clawpilot AgentBaker Linux Gate Detective Watcher. No raw private logs are included. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The
init-aks-custom-cloud*.shscripts run at node boot in custom-cloud environments and rewrite the system package repository URLs to point at the internal RepoDepot mirror (since those nodes cannot reach the public internet). A misconfiguration here — e.g. a leftover public URL that does not get rewritten — can cause package operations to hang during provisioning. There was previously no automated test exercising these scripts, so a regression in the repo-URL rewrite could slip through.This PR adds that missing test coverage.
What this PR does
1. Makes all 4
init-aks-custom-cloud*.shscripts testable (no behavior change)init-aks-custom-cloud.sh(Ubuntu/Flatcar/ACL)init-aks-custom-cloud-mariner.sh(Mariner/AzureLinux)init-aks-custom-cloud-operation-requests.sh(Ubuntu/Flatcar/ACL)init-aks-custom-cloud-operation-requests-mariner.sh(Mariner/AzureLinux)Refactor pattern (matches existing repo convention, e.g.
mariner-package-update.sh):: "${VAR:=default}"env-overridable constants. Defaults are identical to the previous hardcoded values, so production behavior is unchanged.${__SOURCED__:+return}guard so ShellSpec'sIncludecan source the script without runningmainat source time.detect_distro,fetch_and_install_ca_certs,init_*_repo_depot,write_chrony_config, etc.) — the same commands, just grouped into callable units.2. Adds ShellSpec tests (20 examples across 4 spec files)
Drives each script with a mocked
REPO_DEPOT_ENDPOINTand asserts:packages.microsoft.comURLs remain.developer.download.nvidia.com) URLs leak in./etc/apt/sources.list[.d]entries are backed up, not left in place.init_repo_depotstrips the trailing/ubuntuand dispatches the Mariner / AzureLinux / Ubuntu paths correctly.Verification
make validate-shell(shellcheck gate) passes.