verifiers

package
v0.0.0-...-a9ec591 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2026 License: Apache-2.0 Imports: 56 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// DefaultPollInterval is the standard interval between verifier poll attempts in E2E tests.
	DefaultPollInterval = 15 * time.Second
	// DefaultDiagnoseTimeout is the timeout for collecting failure diagnostics after a poll times out.
	DefaultDiagnoseTimeout = 30 * time.Second
)

Variables

This section is empty.

Functions

func IsRetryable 

func IsRetryable(err error) bool

IsRetryable reports whether err is a retryable error.

func VerifyHCPCluster 

func VerifyHCPCluster(ctx context.Context, adminRESTConfig *rest.Config, additionalVerifiers ...HostedClusterVerifier) error

func VerifyMustGatherCLI 

func VerifyMustGatherCLI(subscriptionID, resourceGroup string) mustGatherCLIVerifier

VerifyMustGatherCLI creates a verifier that tests the hcpctl must-gather CLI

func VerifyMustGatherLogs 

func VerifyMustGatherLogs(subscriptionID, rgName string) verifyMustGatherLogsImpl

VerifyMustGatherLogs creates a new must-gather logs verifier with default configuration

func VerifyShoeboxEventHub 

func VerifyShoeboxEventHub(connectionString, eventHubName string) verifyShoeboxEventHubImpl

VerifyShoeboxEventHub creates a verifier that consumes messages from an Azure Event Hub and checks that at least one message contains valid shoebox diagnostic log records.

func VerifyShoeboxLogs 

func VerifyShoeboxLogs(client *armstorage.BlobContainersClient, resourceGroupName, storageAccountName string) verifyShoeboxLogsImpl

VerifyShoeboxLogs creates a verifier that checks for the presence of insights-logs-* blob containers in the given storage account, which indicates that Azure Monitor diagnostic logs are being forwarded.

Types

type HostedClusterVerifier 

type HostedClusterVerifier interface {
	Name() string
	Verify(ctx context.Context, restConfig *rest.Config) error
}

func ExpectForbidden 

func ExpectForbidden(inner HostedClusterVerifier) HostedClusterVerifier

ExpectForbidden returns a verifier that runs inner and succeeds only when inner.Verify returns a forbidden (403) error. Use it to assert that an identity must not be able to perform the action implemented by inner, without defining separate "Cannot" verifiers.

func VerifyAllClusterOperatorsAvailable 

func VerifyAllClusterOperatorsAvailable() HostedClusterVerifier

func VerifyCatalogSourceReady 

func VerifyCatalogSourceReady(namespace, catalogSource string, timeout time.Duration) HostedClusterVerifier

VerifyCatalogSourceReady verifies that a catalog source is healthy and ready to serve operators.

func VerifyCiliumConnectivityChecks 

func VerifyCiliumConnectivityChecks(ciliumVersion string) HostedClusterVerifier

Deploy and run Cilium Connectivity Checks, set of deployments that will perform a series of connectivity checks via liveness and readiness checks. An unhealthy/unready pod indicates a problem.

func VerifyCiliumOperational 

func VerifyCiliumOperational(ciliumNamespace string, ciliumLabelSelector string) HostedClusterVerifier

Verifies that all Cilium pods are running in given namespace.

func VerifyDaemonSetReady 

func VerifyDaemonSetReady(namespace, name string, timeout time.Duration) HostedClusterVerifier

VerifyDaemonSetReady verifies that a DaemonSet exists, has at least one desired pod, and NumberReady equals DesiredNumberScheduled. Polls until ready or timeout expires.

func VerifyFIPSEnabled 

func VerifyFIPSEnabled() HostedClusterVerifier

func VerifyGetDeploymentLogs 

func VerifyGetDeploymentLogs(namespace, deploymentName, containerName string) HostedClusterVerifier

VerifyGetDeploymentLogs returns a verifier that checks the identity can read logs from a pod of the given deployment. It discovers one pod via the deployment's label selector and fetches logs from it. containerName is optional; leave empty for the pod's default container.

func VerifyGlobalPullSecretSyncer 

func VerifyGlobalPullSecretSyncer(timeout time.Duration) HostedClusterVerifier

VerifyGlobalPullSecretSyncer verifies the global-pull-secret-syncer DaemonSet in kube-system. It delegates to VerifyDaemonSetReady.

func VerifyHostedControlPlaneYStreamUpgrade 

func VerifyHostedControlPlaneYStreamUpgrade(previousMinor, targetMinor string) HostedClusterVerifier

VerifyHostedControlPlaneYStreamUpgrade returns a verifier that clusterversion status.history contains at least one parseable version in previousMinor and at least one in targetMinor.

func VerifyHostedControlPlaneZStreamUpgradeOnly 

func VerifyHostedControlPlaneZStreamUpgradeOnly(initialVersion string) HostedClusterVerifier

VerifyHostedControlPlaneZStreamUpgradeOnly returns a verifier that the HCP control plane has performed only a z-stream upgrade from the initial version: at least one entry in ClusterVersion status.history is greater than initialVersion, and every entry has the same major.minor as initialVersion.

func VerifyImageDigestMirrorSets 

func VerifyImageDigestMirrorSets(expectedMirrors []ImageDigestMirrorExpectation) HostedClusterVerifier

VerifyImageDigestMirrorSets returns a HostedClusterVerifier that checks whether the cluster contains ImageDigestMirrorSet objects matching the expected source→mirrors mappings.

func VerifyImagePulled 

func VerifyImagePulled(namespace, imageRepository, imageName string, timeout time.Duration) HostedClusterVerifier

VerifyImagePulled creates a verifier that checks if an image has been successfully pulled. Polls until the image appears or timeout expires. This verifier returns stable, sorted error text so repeated polls with unchanged state do not produce duplicate log lines.

Parameters:

  • namespace: the namespace to check for pods
  • imageRepository: the repository to match (e.g., "registry.redhat.io")
  • imageName: optional specific image name to match (empty string matches any image from repository)

func VerifyImageRegistryDisabled 

func VerifyImageRegistryDisabled() HostedClusterVerifier

func VerifyIngressControllerScope 

func VerifyIngressControllerScope(expectedScope operatorv1.LoadBalancerScope) HostedClusterVerifier

VerifyIngressControllerScope returns a verifier that checks the default IngressController's load balancer scope matches the expected value. Use operatorv1.InternalLoadBalancer for private ingress clusters or operatorv1.ExternalLoadBalancer for public ingress clusters.

func VerifyKubeAPIServerServerVersionUpgraded 

func VerifyKubeAPIServerServerVersionUpgraded(preUpgrade *version.Info) HostedClusterVerifier

VerifyKubeAPIServerServerVersionUpgraded fails if the kube-apiserver version is the same as before the upgrade. preUpgrade is the kubernetes discovery ServerVersion (/version) read from the cluster before upgrading.

func VerifyList 

func VerifyList(resources ...string) HostedClusterVerifier

func VerifyListNamespaced 

func VerifyListNamespaced(namespace string, resources ...string) HostedClusterVerifier

func VerifyNodeCount 

func VerifyNodeCount(clusterName string, expected int) HostedClusterVerifier

func VerifyNodePoolReadyAndSchedulableNodeCount 

func VerifyNodePoolReadyAndSchedulableNodeCount(nodePoolName string, expected int) HostedClusterVerifier

VerifyNodePoolReadyAndSchedulableNodeCount verifies that the specified node pool has exactly the expected number of ready and schedulable nodes. This excludes cordoned nodes (Unschedulable=true), which is useful during rolling upgrades when old nodes are being replaced and the total node count may temporarily exceed the target replica count.

func VerifyNodePoolUpgrade 

func VerifyNodePoolUpgrade(expectedVersion string, nodePoolName string, previousReleaseImages set.Set[string]) HostedClusterVerifier

VerifyNodePoolUpgrade verifies after a node pool upgrade (y-stream or z-stream) for nodes in the given node pool only: (1) all those nodes are ready, (2) they report a version in the same major.minor as expectedVersion, and (3) each node's release images differ from previousReleaseImages. nodePoolName must be non-empty. Nodes are selected with framework.SelectNodesBelongingToNodePool (hypershift nodePool label ends with -<nodePoolName>; shortest label wins).

func VerifyNodesReady 

func VerifyNodesReady() HostedClusterVerifier

func VerifyOperatorCSV 

func VerifyOperatorCSV(namespace, csvName string) HostedClusterVerifier

func VerifyOperatorInstalled 

func VerifyOperatorInstalled(namespace, subscriptionName string, timeout time.Duration) HostedClusterVerifier

func VerifyPullSecretAuthData 

func VerifyPullSecretAuthData(secretName, namespace, expectedHost, expectedAuth, expectedEmail string) HostedClusterVerifier

func VerifyPullSecretMergedIntoGlobal 

func VerifyPullSecretMergedIntoGlobal(expectedHost string, timeout time.Duration) HostedClusterVerifier

func VerifyRBACAllowed 

func VerifyRBACAllowed(checks ...PermissionCheck) HostedClusterVerifier

VerifyRBACAllowed returns a verifier that asserts all given permission checks are allowed according to the cluster's RBAC rules, using SelfSubjectAccessReview.

func VerifyRBACDenied 

func VerifyRBACDenied(checks ...PermissionCheck) HostedClusterVerifier

VerifyRBACDenied returns a verifier that asserts all given permission checks are denied according to the cluster's RBAC rules, using SelfSubjectAccessReview.

func VerifySimpleWebApp 

func VerifySimpleWebApp(nodeSelector ...map[string]string) HostedClusterVerifier

func VerifyWhoAmI 

func VerifyWhoAmI(expectedGroups ...string) HostedClusterVerifier

type ImageDigestMirrorExpectation 

type ImageDigestMirrorExpectation struct {
	Source             string
	Mirrors            []configv1.ImageMirror
	MirrorSourcePolicy configv1.MirrorSourcePolicy
	// AbsentSources lists sources that must NOT exist in any IDMS object on the cluster.
	AbsentSources []string
}

ImageDigestMirrorExpectation describes an expected source-to-mirrors mapping that should exist in the cluster's ImageDigestMirrorSet objects.

type PermissionCheck 

type PermissionCheck struct {
	Group       string
	Resource    string
	Verb        string
	Namespace   string // empty for cluster-scoped
	SubResource string // empty if not a subresource
}

PermissionCheck describes a single RBAC permission to verify via SelfSubjectAccessReview.

func CanCreate 

func CanCreate(group, resource string) PermissionCheck

CanCreate returns a PermissionCheck for the create verb on a cluster-scoped resource.

func CanDelete 

func CanDelete(group, resource string) PermissionCheck

CanDelete returns a PermissionCheck for the delete verb on a cluster-scoped resource.

func CanGet 

func CanGet(group, resource string) PermissionCheck

CanGet returns a PermissionCheck for the get verb on a cluster-scoped resource.

func CanGetSubresource 

func CanGetSubresource(group, resource, subresource string) PermissionCheck

CanGetSubresource returns a PermissionCheck for reading a subresource (e.g. pods/log).

func CanList 

func CanList(group, resource string) PermissionCheck

CanList returns a PermissionCheck for the list verb on a cluster-scoped resource.

func CanUpdate 

func CanUpdate(group, resource string) PermissionCheck

CanUpdate returns a PermissionCheck for the update verb on a cluster-scoped resource.

func CanWatch 

func CanWatch(group, resource string) PermissionCheck

CanWatch returns a PermissionCheck for the watch verb on a cluster-scoped resource.

func (PermissionCheck) String 

func (p PermissionCheck) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.